Self-improvement is essential in all areas of life, and if your job is in the field of technology, it’s critical to your ongoing success. Staying abreast of the latest cybersecurity trends affecting the enterprise and tools is important, but so is making sure that you understand all the basics. Technical books are a good way of covering both of these goals because they allow an expert who has accumulated and assimilated useful information to pay it forward to readers in bite-sized chunks. At least this is true when the book is well-written!
“Secrets of a Cyber Security Architect” is a new title from CRC Press that takes the bull by the horns and explains how to approach the difficult task of planning, building, and maintaining an effective cybersecurity architecture for medium to large enterprises. The book is well-written and informative, and it starts at the beginning by defining what exactly is a security architecture. Any IT pro who has struggled in this area knows that building infrastructure with security in mind requires careful and detailed planning from the beginning. The author knows this and spends a good portion of the book explaining such things as kinds of architectures, types of cyberattacks, tools used for defense, the hacking culture, and security training.
Real-world examples such as the Heartbleed attack are analyzed in detail as a way of helping the reader understand the issues involved and how to deter or mitigate threats. The goal here is not to analyze the latest cyberthreat but to build out a basic approach to architecting enterprise IT to avoid such attacks from being successful. The chapter I found most illuminating was the one outlining various problem areas one will encounter when architecting a cybersecurity program for your enterprise. Difficulties such as late engagement, assessments taking overly long to complete, and skill churn are important areas we should be aware of when developing and trying to implement a cybersecurity program. The book ends with several useful appendices targeting architects and developers.
“Enterprise Level Security: Securing Information Systems in an Uncertain World” is one of several enterprise cybersecurity titles on my bookshelf that I’ve had for a couple of years and frequently refer to as various challenges come up in my work as an IT professional. The goal of the book is to present a comprehensive and modern approach to information security that differs somewhat from the usual fortress approach of building heavily layered defenses and instead develops a framework that combines security definitions, aspects, and designs for all the active entities within the cyber-infrastructure of an enterprise.
The first section of the book covers the basic entities and the author’s underlying philosophy of cybersecurity. Topics explained in this section include such fundamental things as identity, attributes, access, privilege, cryptography, networking, and cloud computing. The writing is concise, and many of the topics are probably familiar to most of our readers, but as you read, you will find new insights that challenge you to rethink how secure your environment is and how you should approach improving security. An example is the short section on least privilege in Chapter 4, which drew my attention to a major issue with the role-based model of assigning user privilege. Namely, what happens when a user is assigned multiple roles with different sets of privileges within the organization? Role-based access control, a well-known way of assigning privilege, can quickly grow to become overly complex when restrictions are not put in place to limit the ways and number of roles that users can be assigned. After this first part of the book comes a much longer second section that focuses in greater technical detail on a wide variety of different security capabilities ranging from federation to delegation to database access and enterprise software development. At this point, the book becomes more a reference than a learning vehicle, and readers are likely, like me, to consult and read only the relevant chapters or portions of chapters depending on their needs and the environment they work in. Medium to large enterprises will want to have this book handy and available for their IT staff to refer to as they build, grow, and expand their IT infrastructure and services.
“Enterprise Level Security 2: Advanced Techniques for Information Technology in an Uncertain World” is a new addendum to the previous enterprise cybersecurity title reviewed above. This second book builds upon the Enterprise Level 
Security (ELS) framework promulgated in the first book by examining a number of advanced topics and solutions based on many years of practical experience with implementing the framework. Some of the key concepts and solutions covered include multifactor authentication, enterprise change management, Big Data, ad hoc mobile networks, key management in cloud environments, and so on. Security is at the forefront everywhere throughout this book, which has been endorsed by the U.S. Air Force as a candidate for securing DoD systems. This second book’s key theme is the growing complexity of cyber environments and how to secure them. Identity and access remains a critical area of security and is covered in detail with respect to key and credential management. As Big Data continues to grow bigger and more important for enterprises, securing data aggregation and content management are also increasingly important, and the book looks into those in detail as well. Zero Trust architecture, a model increasingly used by enterprises, is also covered in the concluding remarks. For readers who have read the first section of the earlier book and assimilated an understanding of the ELS security model and how to implement it properly, this new book will be a welcome addition.
Featured image: Shutterstock
