I came across The Frugal CISO purely by accident over Christmas as it popped up as a new addition to Safari and as I'm always on the look out for security books that are a little bit different and non-technical, I figured it would be worth a read.
I'm really happy that I did because the Frugal CISO is a really solid book on both information security management and management in general. This is definitely a book I'd recommend to anyone either taking up a leadership position in an info sec team or setting up a new security team in an organisation. For me personally there were a lot of points that resonated me with as I've spent the last year putting in place a new regional security team from scratch for a large multinational and there's definitely some good lessons that I learned along the way that are included in this book!
I do feel that the title of the book doesn't do it justify however, as while the title seems to indicate that this book will be very focused on cost saving, it's really much more than that. This book is more about being a realistic CISO.. and if there wasn't already a book called the Pragmatic CSO, I'd have called it that!
The book starts off on some very interesting points on the stages of maturity for an info sec team. The approach used differs from the usual maturity levels that we often see in info sec books and focuses more on the organisational aspects of maturity covering things like funding and resource allocation, planning intervals, alignment with business strategy and stability of the team.
The next few chapters of the book focus on giving solid management advice in light of the challenges faced in info sec such as reduced budgets, increasing threats, and competition for staff, with particularly good chapters on team management and hiring that any hiring manager should read.
The book then moves onto a few chapters focusing on alternative views of policy definition and security awareness and a good chapter on taking stock of your info sec program and always considered why you're doing what you do and whether it's still necessary.
The final few chapters have some great advice on budgeting, appreciating that what works in one company, may not work in all companies and on being flexible and aiming to engage rather than block the business.
Overall, this book is full of good insights and ideas for info sec managers and while some of the material will be more general management focused, it's definitely a very highly recommended read for anyone in information security management and one that I'll definitely be recommending. I'd also love to see a follow up book that deep dives a bit more into some of the areas around maturity and engaging with the business as while these are oft discussed topics, they rarely get the level of detail that I think a lot of people would benefit from.
Links:
CRC http://www.crcpress.com/product/isbn/9781482220070
Amazon http://www.amazon.com/The-Frugal-CISO-Innovation-Approaches/dp/1482220075
Safari http://techbus.safaribooksonline.com/book/networking/security/9781482220070
I'm really happy that I did because the Frugal CISO is a really solid book on both information security management and management in general. This is definitely a book I'd recommend to anyone either taking up a leadership position in an info sec team or setting up a new security team in an organisation. For me personally there were a lot of points that resonated me with as I've spent the last year putting in place a new regional security team from scratch for a large multinational and there's definitely some good lessons that I learned along the way that are included in this book!
I do feel that the title of the book doesn't do it justify however, as while the title seems to indicate that this book will be very focused on cost saving, it's really much more than that. This book is more about being a realistic CISO.. and if there wasn't already a book called the Pragmatic CSO, I'd have called it that!
The book starts off on some very interesting points on the stages of maturity for an info sec team. The approach used differs from the usual maturity levels that we often see in info sec books and focuses more on the organisational aspects of maturity covering things like funding and resource allocation, planning intervals, alignment with business strategy and stability of the team.
The next few chapters of the book focus on giving solid management advice in light of the challenges faced in info sec such as reduced budgets, increasing threats, and competition for staff, with particularly good chapters on team management and hiring that any hiring manager should read.
The book then moves onto a few chapters focusing on alternative views of policy definition and security awareness and a good chapter on taking stock of your info sec program and always considered why you're doing what you do and whether it's still necessary.
The final few chapters have some great advice on budgeting, appreciating that what works in one company, may not work in all companies and on being flexible and aiming to engage rather than block the business.
Overall, this book is full of good insights and ideas for info sec managers and while some of the material will be more general management focused, it's definitely a very highly recommended read for anyone in information security management and one that I'll definitely be recommending. I'd also love to see a follow up book that deep dives a bit more into some of the areas around maturity and engaging with the business as while these are oft discussed topics, they rarely get the level of detail that I think a lot of people would benefit from.
Links:
CRC http://www.crcpress.com/product/isbn/9781482220070
Amazon http://www.amazon.com/The-Frugal-CISO-Innovation-Approaches/dp/1482220075
Safari http://techbus.safaribooksonline.com/book/networking/security/9781482220070
No comments:
Post a Comment