Jason Andress - Foundations of Information Security: A Straightforward Introduction

When I was in school, I was faced with a choice between pursuing a concentration in either information security or software engineering. The software engineering courses had terribly boring-sounding titles, so information security it was. Little did I know what a twisted and winding path Id embarked on.

Information security as a career can take you many different places. Over the years, Ive dealt with large-scale malware outbreaks, collected forensic information for court cases, hunted for foreign hackers in computer systems, hacked into systems and applications (with permission!), pored over an astonishing amount of log data, implemented and maintained all manner of security tooling, authored many thousands of lines of code to fit square pegs into round holes, worked on open source projects, spoken at security conferences, taught classes, and written somewhere into the upper regions of hundreds of thousands of words on the topic of security.

This book surveys the information security field as a whole. Its well-suited to anyone wondering what people mean when they use the term information securityor anyone interested in the field and wondering where to start. The chapters offer clear, nontechnical explanations of how information security works and how to apply these principles to your own career. It should help you learn about information security without making you consult a massive textbook. Ill first cover the fundamental ideas, such as authentication and authorization, needed to understand the fields key concepts, such as the principle of least privilege and various security models. Ill then dive into a survey of real-world applications of these ideas in the areas of operations, human, physical, network, operating system, mobile, embedded, Internet of Things (IoT), and application security. Ill finish up by looking at how to assess security.

This book will be a valuable resource to beginning security professionals, as well as to network and system administrators. You should use the information provided to develop a better understanding of how you protect your information assets and defend against attacks, as well as how to apply these concepts systematically to make your environment more secure.

Those in management positions will find this information useful as well, because it should help you develop better overall security practices for your organizations. The concepts discussed in this book can be used to drive security projects and policies and to mitigate some of the issues discussed.

This book is designed to take you through a foundational understanding of information security from the ground up, so its best read from start to finish. Throughout the book you will see numbered references to the Notes section at the end of the book, where you can find more information on some of these topics. Heres what youll find in each chapter:

Introduces some of the most basic concepts of information security, such as the confidentiality, integrity, and availability triad; basic concepts of risk; and controls to mitigate it.

Covers the security principles of identification and authentication.

Discusses the use of authorization and access controls, which are means of determining who or what can access your resources.

Explains the use of auditing and accountability for making sure youre aware of what people are doing in your environment.

Covers the use of cryptography for protecting the confidentiality of your data.

Outlines the laws and regulations relevant to information security and what it means to comply with them.

Covers operations security, which is the process you use to protect your information.

Explores issues pertaining to the human element of information security, such as the tools and techniques that attackers use to con us and how to defend against them.

Discusses the physical aspects of information security.

Examines how you might protect your networks from a variety of different angles, such as network design, security devices, and security tooling.

Explores the strategies you can use for securing the operating system, such as hardening and patching, and the steps that you can take to do so.