The Cybersecurity Manager's Guide

Why I Wrote this Book

In January 2000, I started my first corporate information security (InfoSec) position after serving in the military. I had no appreciation for the cultural differences between the military and corporate life—in particular, the views and attitudes toward InfoSec. My assumption was that cybersecurity (I use this term interchangeably with information security) anywhere was still cybersecurity, and naturally valued by all. Boy, was I in for a shock. I had more sleepless nights in my first year of corporate life than I had sailing the Persian Gulf during a time of armed conflict.

While writing this book, I’ve made the assumption that you are very well versed in the eight domains of InfoSec. Many will ask why I mention the eight domains when we have so many industry frameworks that enumerate the various facets of our profession. The difference between the industry frameworks and the eight domains is that the former is a set of security controls by topic area, whereas the eight domains provide descriptions of those topics. The two are fundamentally different.

What you’re holding in your hands is a culmination of my learning over the past 25 years. I’ve learned that InfoSec is vastly different from one company to the next. And, although there is a science aspect to our field, as outlined in the eight domains, the art of our profession is far less understood by us in the industry. Yet this nuanced art side, seldom (if ever) discussed within our profession, is just ...