Auto boutiques-francophones Simple and secure cloud storage SmartSaver Countdown to Black Friday in Home & Kitchen All-New Kindle Paperwhite Deal of the Day - The Beatles in Mono 14LP Vinyl Box Set SGG Countdown to Black Friday in Lawn & Garden
Enterprise Security for the Executive: Setting the Tone f... and over one million other books are available for Amazon Kindle. Learn more
  • List Price: CDN$ 50.37
  • You Save: CDN$ 0.64 (1%)
Only 1 left in stock (more on the way).
Ships from and sold by Gift-wrap available.
Enterprise Security for t... has been added to your Cart
+ CDN$ 6.49 shipping
Used: Good | Details
Condition: Used: Good
Comment: Moderate wear on cover and edges. Minimal highlighting and/or other markings can be present. May be ex-library copy and may not include CD, Accessories and/or Dust Cover. Good readable copy.
Have one to sell?
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See all 3 images

Enterprise Security for the Executive: Setting the Tone from the Top Hardcover – Nov 25 2009

See all 2 formats and editions Hide other formats and editions
Amazon Price
New from Used from
Kindle Edition
"Please retry"
"Please retry"
CDN$ 49.73
CDN$ 14.19 CDN$ 14.30

Black Friday Deals Week in Books

No Kindle device required. Download one of the Free Kindle apps to start reading Kindle books on your smartphone, tablet, and computer.

  • Apple
  • Android
  • Windows Phone
  • Android

To get the free app, enter your e-mail address or mobile phone number.

Product Details

  • Hardcover: 163 pages
  • Publisher: Praeger (Nov. 25 2009)
  • Language: English
  • ISBN-10: 0313376603
  • ISBN-13: 978-0313376603
  • Product Dimensions: 2.5 x 16.5 x 24.1 cm
  • Shipping Weight: 431 g
  • Amazon Bestsellers Rank: #2,221,086 in Books (See Top 100 in Books)
  •  Would you like to update product info, give feedback on images, or tell us about a lower price?

Product Description


• Fills a gap in security literature for executives and academics that are concerned about the security of the both their organizations and the nation at a whole, but currently feel at a loss to do anything about it

• Educates the layperson on security management without expecting them to be technical experts

• Draws on real-life events and experiences, plus analogies and understandable terminology to help readers navigate the a complex topic of security management

• Details 30 "security horror stories," giving executives an insider's look at real criminal and malicious breaches and how to prepare for them

• Includes a case study that allows a readers to test their comprehension of the material


"This book is an excellent read of the practical aspects of building, marketing and maintaining an effective security program, within a business enterprise. It tells it like it is, including how to deal with corporate culture.'" (Dan Schutzer, Executive Director, Financial Services Technology Consortium)

See all Product Description

Inside This Book

(Learn More)
Browse Sample Pages
Front Cover | Copyright | Table of Contents | Excerpt | Index
Search inside this book:

Customer Reviews

There are no customer reviews yet on
5 star
4 star
3 star
2 star
1 star

Most Helpful Customer Reviews on (beta) 2 reviews
4 of 4 people found the following review helpful
Excellent book that helps business executives become familiar with security concepts and techniques Jan. 6 2010
By Ben Rothke - Published on
Format: Hardcover
If Shakespeare were to write an information security tragedy, it would not be titled Hamlet, rather Bayuk. The story of Jennifer Bayuk is tragic in that she spent a decade as CISO at Bear, Stearns, building up its security group to be one of the best in the business; only to find it vaporized when the firm collapsed and was acquired by J.P. Morgan Clearing Corp. After all that toil and sweat, Bayuk was out of a job. (Full disclosure: Bayuk and I have given a presentation together in the past, and I did get a copy of this book for free.)

While the information security engineering group that was at Bear, Stearns is no more, Bayuk has taken her vast expertise and put it in a great new book: Enterprise Security for the Executive: Setting the Tone from the Top. While many other books equate security with technology, and are written for technologists; Bayuk writes that information security is all about management control. And to the extent which a CxO controls assets, is the extent to which others can't use them in unexpected ways.

The book is written to help CxO's and business executives become familiar with information security concepts and techniques to make sure they are able to manage and support the efforts of their security team. This is an issue, as a big problem for the poor state of information security is that CxO's are far too often disconnected from their information security groups. No story is more manifest than that of when Heartland Payment Systems CEO Robert Carr blamed his PCI auditors for his firm's security problems. Carr is a perfect example of the type of person that needs to read this book. As an aside, for an excellent reply to Carr's kvetching, read what Rich Mogull wrote in An Open Letter to Robert Carr, CEO of Heartland Payment Systems.

While many CxO's think that security is about firewalls and other cool security products, it is truly a top-down management approach, and not a technology one. The book notes that the only way for information security to succeed in an organization is when management understands what their role is.

What is unique about the book is that Bayuk uses what she calls SHS (security horror stories). Rather than typical FUD stories, the horror stories detail systematic security problems and how they could have been obviated. By seeing how these companies have done it wrong, it makes it easier for pragmatic organizations to accomplish effective security by setting a strong tone from the top down.

Bayuk details the overall problem in the introduction and notes that many CxO's have wrongly spent significant amounts of money on security to avert security incidents; but have done that without any context of a greater information security methodology. The leads to executives thinking that security as nothing more than one long spending pattern.

Chapter 1 - Tone at The Top, notes that tone exists at the top, whether it is set or not. The tone is reflected in how an organization thinks about the things it really cares about. Employees can tell how a CxO cares about security by their level of personal involvement. Not that a CxO needs to be, or should be involved with minutia of firewall configuration or system administration; the key is rather that they are for example, championing the effective and consistent use of firewalls and how systems are securely administered.

In chapter 5 - Security through Matrix Management - Bayuk does a good job of detailing the various places that the security group can be placed in an organization. The chapter notes that there are as many ways to organize security as there are organization structures. Bayuk writes for example that if CxO's in a given organization are a tight-knit group, accustomed to close coordination, then it should not matter to which CxO the person managing information security reports to. If that is not the case, there may be multiple security programs that end up far too below the required C-levels that are needed for effective security. The chapter provides a number of different organizational scenarios, with requisite roles and responsibilities.

Chapter 5 closes with an important observation that a CxO should task the human resources department to put a line in all performance reviews whereby managers attest (or not) that the person being reviewed follows security policy. A CxO should fire people who willfully avoid compliance with security policy. Whatever tone at the top exists should be employed to make sure that everyone knows that the CxO is serious about the corporate security program. Such a tone clearly demonstrates an organization that is resolute about information security.

One thing that Bayuk does very well repeatedly throughout the book is to succinctly identify an issue and its cause. In chapter 6 - Navigating the Regulatory Landscape - she writes that if a CxO does not have management control over an organization, then the organization will fail the audit. It will fail because even if the organization is secure today, there is no assurance that it will be going forward. In addition, control means that the CxO will ensure that the organization is attempting to do the right thing. And in such cases, passing an audit is much easier.

Overall, Enterprise Security for the Executive is a fantastic book. It provides a no-nonsense approach to attaining effective information security. For those executives that are serious about security, the book will be their guiding light down the dark information security tunnel. In its 8 chapters (and a case study), the book focuses on a straightforward and plain-speaking approach to enable CxO's to get a handle on information security. As such, it is hoped that Enterprise Security for the Executive will soon find its way onto every executive's required reading list.
Today's corporations must do everything possible to protect and secure ... Dec 23 2014
By Twin - Published on
Format: Hardcover Verified Purchase
Today's corporations must do everything possible to protect and secure our customer's information. Start with "buy-in" from the top or it will be a losing battle and utimately you'll lose customer confidence. Must read for information security professionals.