This reflective essay examines the foundational concepts of information security management as encountered in an undergraduate course. Drawing on two primary textbooks — Information Security Fundamentals and Information Security: Design, Implementation, Measurement, and Compliance — the paper explores risk assessment models, access control methods, IT and management collaboration, and the balance between security and organizational productivity. The author, an aspiring information security officer, synthesizes course material to demonstrate how theoretical frameworks translate into practical professional skills. The essay also addresses the human element of information security, emphasizing that technical controls alone are insufficient without organizational awareness, policy enforcement, and cross-departmental cooperation.
During a college career, a select number of courses become something more than a simple requirement for graduation — these are the moments in a student's educational experience that make the most lasting impacts. The lessons encountered through a dedicated study of information security are among those that will likely be remembered in precisely those terms, as the foundational knowledge gained applies directly to daily professional practice in the field. As an aspiring information security officer, the skills imparted through this course of study will prove essential throughout a professional career, and this class stands out as particularly significant within the broader college experience.
Two textbooks have provided detailed instruction on the field: Information Security Fundamentals and Information Security: Design, Implementation, Measurement, and Compliance. Both have become essential resources in and out of the classroom, as the wealth of experiential data they contain has enabled a deeper comprehension of the requirements of a career in information security — and the great responsibility that the duties of an information security officer entail. From the theoretical underpinnings of data protection and access control methods, to the moral and ethical ramifications of protecting a firm's invaluable data by every available means, the course material covered ranks among the most influential of a college career.
Throughout the entire course, new sources of knowledge have continuously emerged, drawn from textbook material, instructors, and fellow students alike. Reading individual chapters covering such diverse topics as risk assessment models, risk analysis and management, and access control methods — and writing detailed essays on the relevant material — proved to be a highly informative process. By approaching the various methodologies and procedures used by information security analysts and contemplating how they might be applied in practice, confidence grew alongside an expanding base of knowledge. As the authors of Information Security Fundamentals state in their introduction, the book "was designed to give the information security professional a solid understanding of the fundamentals of security and the entire range of issues the practitioner must address" (Peltier, Peltier & Blackley, 2005).
It was through this course that exposure to the broader network of organizations serving information security professionals first occurred, including the Computer Security Institute (CSI), described as "the original and leading educational membership organization for information security professionals" whose mission is "to provide high quality products that focus on practical, cost-effective strategies, solutions and methodologies that will help you to protect your organization's greatest asset: Information" (Computer Security Institute, 2012). Having completed this course of study, there is a firm belief that the theoretical foundations of the industry's fundamental tenets — combined with the ability to discern when, where, and how to deploy those skills — provide strong preparation for work as a professional information security analyst.
One of the core concepts within the field of information security and data protection is risk assessment. As Timothy P. Layton states in the preface to Information Security: Design, Implementation, Measurement, and Compliance, "the heart of every information security program is always risk assessment" (2007). Any discussion of information security must therefore begin with this critical component.
While the idea of assessing the full range of risk factors — from external threats to internal misconduct — may appear to be an obvious step in securing an organization's data delivery networks, a true information security professional must be capable of seeing beneath the surface of every security issue encountered. After becoming familiar with the Information Security Risk Assessment Model (ISRAM), as well as other assessment frameworks such as the Global Information Security Assessment Methodology (GISAM), the path toward identifying threats through anticipatory means becomes much clearer. Whether risks are generated by the malicious intrusion of anonymous hackers, the prying eyes of competing organizations, or simply the negligence or incompetence of office workers during the daily exchange of data, effective and efficient risk assessment processes must be conducted on a routine and regular basis.
As the scope and reach of modern computing technology continues to expand at a seemingly exponential pace, an aspiring information security officer must develop a level of proficiency with the tools of the trade. From the complexities of massive server farms used by major corporations to store the endless stream of data produced by global business operations, to the "initial sign-on screen that is the first indication there are controls in place" (Peltier, Peltier & Blackley, 2005), the lessons covered in this course provide preparation to utilize the full spectrum of data protection tools currently available.
One of the most interesting concepts encountered is the observation that, even within a world increasingly dominated by computing technology and digitized data, "to be an effective program, information security must move beyond the narrow scope of IT and address the issues of enterprisewide information protection because the bulk of all of the information available to employees and others is still found in the printed form" (Peltier, Peltier & Blackley, 2005). While the primary objective of a professional information security analyst will always concentrate on securing the storage of, and restricting access to, digital data, this reminder of the importance that paper-based files and memoranda still play serves as a valuable recalibration of priorities.
"Boardroom leadership and organizational security policy"
"Passwords, authentication, cryptography, and productivity tradeoffs"
"Educating colleagues and explaining security policy rationale"
You’re 50% through this paper. Sign up to read the remaining 3 sections.
Sign Up Now — Instant Access Already a member? Log inAlways verify citation format against your institution’s current style guide requirements.