Security has become an important topic of higher education. The National Security Agency has established centers of excellence in information assurance at many universities throughout the country. This book is intended to provide the fundamental concepts of information security to students in this field. In writing this book, I attempted to pick out the issues that have confronted me on a day-to-day basis when working as a security officer and a consultant. Most of these issues caused me much consternation over the years, and it would have been very helpful for me to have had all of this information at my fingertips.

Security continues to be an issue for organizations. Not only are we hearing about the successful penetration of Web sites and organizations, but we also have new laws and regulations that affect the protection of information. In response to these issues, more and more vendors are appearing with tools that offer some protection. From looking at all of this information, it would appear that the big issues in security can be solved with technology. Unfortunately, security issues are much more complex than that. At the very bottom, security is a people issue. No matter how much technology we throw at this problem, the best we can do is to make the job of the security practitioner a little easier. We will not solve the basic problem with technology, but we can manage the security problem through the dedicated application of well-thought-out security processes and procedures.

Students of information security need to understand the basic concepts so that they can be applied in real-world environments. Hopefully, this book will provide that basic understanding.