Information Security Myths and Reality Revisited

This guide seeks to build upon, and provide an update to the original Information Security Myths and Reality text that was published for IT Faculty members in 1999. Like its predecessor it is informal in nature, attempting to dispel common security-related myths and provide practical information. Sorting out myth from practical reality Information security has become a major business risk issue. And yet...for all the earnest advice available, there is little down to earth, practical guidance on what information security really nvolves. Myth: Information security is a black art, practiced by Technical gurus with a private vocabulary. Reality: Information security is a blend of common sense, business risk management and basic technical skills tempered by good management and sensible use of specialist products, options and expertise. This guide provides some insights into the realities of information security. It tries to sort out myth from practical reality. It provides views on how you can be affected in your everyday business life. It helps answer some of the basic, simple questions security professionals take for granted - and assume you know.

Table of Contents:
1. Introduction 4; Sorting out myth from practical reality; So what is Information Security? 2. Perceptions And Reality 7; 'Spend spend spend?' 'Computer security is so important that I will deal with it separately'; Don't believe all that you read; Legal pitfalls; 3. Snake Oil Salesmen 14; Be prepared; Product pitfalls; Consultant pitfalls; Cryptography; 4. Information On Security Weaknesses 20; 5. Good Management Beats Technology 22; 6. Internet Security 25; Firewalls; Accessing Internet web servers; Email security; Electronic commerce; 7. Conclusion 34;

About the Author :
Tom Parker has specialised in computer security since 1978, having originally joined ICL as an operating system designer in 1971. In 1991 he was elected an ICL Fellow. He is now an ICL Fellow Emeritus, and an independent consultant focusing on crypto PKI issues and their impact on society, particularly the real world of electronic commerce. Tom has a special interest in cryptography and the security of distributed systems, and was the Security Architect responsible for the Cryptographic Infrastructure of the Horizon project, successfully deployed in Post Offices across the whole of the UK. He is also an active member of tScheme, the independent industry body responsible for the certification of trusted service providers under the Government's e-communications legislation. Chris Sundt has over 35 years experience in the IT industry with ICL and its predecessor companies. He now works as an independent consultant on information security with specific interest in security policy/architecture, e-crime legislation, secure electronic commerce, and cryptography policy. In this role he has worked for major commercial organisations and government departments on a variety of tasks, including advice on security architectures, and e-commerce security policy. Chris represents industry interests on a number of national and international bodies. He currently acts as rapporteur for the EURIM Working Groups one-crime issues and represents industry views on the National HTCU Strategic Stakeholders Group. He also contributes to OECD, G8, European Union and national working groups. He is a member of the BCS Security Experts Panel and chairs the ISEB Board developing qualifications in Security Management.