Risk Management Solutions for Sarbanes-Oxley Section 404 IT Compliance Paperback – Jan 11 2006
No Kindle device required. Download one of the Free Kindle apps to start reading Kindle books on your smartphone, tablet, and computer.
Getting the download link through email is temporarily not available. Please check back later.
To get the free app, enter your mobile phone number.
From the Back Cover
If your company does business on the Internet, your risks are growing exponentially. Worms, viruses, cracker attacks, mechanical failures, and natural disasters create a climate that compromises performance as well as security. Traditional solutions are too limited to address these risks. You need a strategy designed for today, and this book will help you build one.
- Understand the risks faced by your particular business
- Learn to assess the extent, origins, complications, growth, and potential severity of your risk factors
- Examine and analyze strategies already in place
- Explore new strategies and their application in various market contexts
- Devise and implement a solution that is tailored to your enterprise and meets the requirements of Sarbanes-Oxley Section 404
About the Author
John S. Quarterman has previously coauthored The 4.2BSD Berkeley Unix Operating System1 and its successor edition, as well as The Matrix: Computer Networks and Conferencing Systems Worldwide2 and other books. Mr. Quarterman is CEO of InternetPerils, Inc., an Internet business risk management company that is extending risk management strategies available to business into new areas such as insurance, catastrophe bonds, and performance bonds.
He has 26 years of experience in internetworking, beginning with work on ARPANET software at BBN. In 1990, he incorporated MIDS, which published the first maps of the whole Internet and conducted the first Internet Demographic Survey. In 1993, he started the first series of performance data about the entire Internet, visible on the web since 1995 as the Internet Weather Report, which together with the Internet Average and ISP Ratings, were some of the most cited analyses available.
Most Helpful Customer Reviews on Amazon.com (beta)
Chapter 1 looks at three power laws for scaling networks - Sarnoff, Metcalfe and Reed. Valuing assets is a precursor to any risk management activity. Chapter 2 looks at the differences between traditional risk and Internet-style risks. There is an important distinction in perils and anomalies. Perils are defined as bugs and vulnerabilities. Anomalies are defined as the problems that arise once a vulnerability is exercised. There is also a section on monoculture which compares computing monoculture to bollweevils and other physical world monoculture risks.
Chapter 3 describes high level strategies like redundancy and backups for dealing with risks. These are high level not detailed operational planning, but they are useful for directors to plan what actions manage what risks. Federation is mentioned as having a positive impact on higher assurance integration between service providers and consumers. Another theme is the positive and negative aspects of decentralization, Quarterman concludes it is largely a positive development, and a decade and half into the web, that looks like a safe assumption.
For a book with Sarbanes in its title, there is not a ton of information on compliance. This is not a big a problem for me, since I, like this book, view compliance as a subset of risk management. Chapters 4-8 look at the implications of risk in various business sizes and verticals.
Chapter 6 examines some physical world controls that work fine in the real world but are insufficient in the digital world such as 4 digit PINs for ATMs. This chapter also covers various types of insurance schemes such as Cat Bonds.
Chapter 7 compares Frederick Winslow Taylor (command and control) to John Boyd (smart nodes) and concludes - Taylor Wrong. Boyd Right. Speed and autonomy are more valuable in a networked world. It is often said the important stuff is not exciting, risk management may not be a thrill a minute for everyone, but this book shows why risk management is important to businesses.
Chapter 8 contains an history of technologies, but does not address SOA, Web Services, Web 2.0 et. al in the context of the 5th Wave. Chapter 9 deals with a recurring theme on differentiating between risk inside the perimeter and outside the perimeter and the disparate strategies available. Chapter 10 describes some key differences between SOX (looking for black list items) and Basel II (culture change). Boyd's OODA loop is revisited in the context of self-healing networks. There is a section on the modern military's reliance on the web, which reminded me of a story by Thomas Barnett about how soldiers in Iraq were going into chat rooms to teach other about counterinsurgency. The officers instructed them to stop because Al Qaeda would listen in, the soldier's response:"Al Qaeda already knows this. We are the ones with the knowledge gap." Now the training manuals are being updated.
My favorite part of the book is Cliff Forts versus Coordinated Mesas which detailes the ancient Anasazis Protect-Detect-Respond strategy.
Chapter 11 discerns between first party loss and third party loss. Chapter 12 contains a set of actionable items for companies wanting to improve their risk management.
Overall, a useful window into the current risks and risk management opportunities in the early 21st century.
Look for similar items by category
- Books > Business & Investing
- Books > Computers & Technology > History & Culture > Manager's Guides to Computing
- Books > Computers & Technology > History & Culture > Privacy
- Books > Computers & Technology > Networking & Cloud Computing > Networks, Protocols & APIs
- Books > Computers & Technology > Programming
- Books > Computers & Technology > Web Development > Security & Encryption > Encryption
- Books > Qualifying Textbooks - Fall 2007 > Business & Investing
- Books > Qualifying Textbooks - Fall 2007 > Computers & Internet
- Books > Textbooks > Computer Science & Information Systems > Networking