Assessing and Managing Security Risk in IT Systems

FOREWORD

In 1988, a young graduate student at Cornell University released the first destructive Internet worm. Late one night in November of that year, it crashed thousands of connected computer systems and startled computer administrators and government officials alike. Shortly after that incident, I learned about it from my supervisor who was also this young man’s father.

As I sat with Bob Morris in his office that early morning, he motioned me to shut the door so he could try to get away with smoking in the government office building. He always got caught, but he fought the rules anyway. After I returned to the side chair, he spoke for a few minutes about his mixed feelings of filial pride and parental frustration. But after only a few comments, ...