Information Technology Security Handbook

by George Sadowsky, James X. Dempsey, Alan Greenberg, Barbara J. Mack, Alan Schwartz

Informational and Communications Technologies (ICT) are crucial for social and economic development. However, there cannot be an effective use of ICT in the absence of a safe and trusted ICT environment. Thus, IT security plays a prime role in creating the environment needed for e-government or e-commerce activities, including sectoral projects, such as, for example, in the areas of education, health, or finance.

IT security is a complex topic and evolves almost as fast as technology does. This Handbook, funded by a grant from the infoDev Program of the World Bank Group, provides technology-independent best practices as well as recommendations for particular IT environments. The book is composed of five parts, each of which can be read independently. After an introduction to general issues of IT security, the book addresses issues relevant specifically to individuals, small and medium organizations, government, and technical administrators. Although most research and publications on IT security come from developed countries, the authors have attempted to provide practical guidance applicable anywhere and to include examples from developing countries.

The Handbook is currently available in HTML and Adobe Acrobat format.

• Front Cover, Acronyms [PDF 5 pages] Copyright Acronyms
   
• Table of Contents [PDF 1 page] [HTML]
   
• Forward, Review Committee Members [PDF 2 pages] [HTML]
   
• Preface [PDF 5 pages] [HTML]
   
• Executive Summary [PDF 5 pages] [HTML]
   
• Part 1: Introduction [PDF 16 pages] [HTML]
  Part 1 describes the digital revolution, starting with the emergence and growth of the Internet,outlines the scope of IT security issues, and explains some types of malicious behavior with respect to computers and networks. It explores the need for IT security to realize the benefits of participation in the information society and addresses two threshold questions: What is security and why is cybersecurity unique? The importance of security for developing countries is clear: organizations and nations that do not have the required level of security in their digital infrastructure and thus do not protect stored information and digital transmissions will not be trusted and might be left behind in the new global economy.
   
• Part 2: Security for Individuals [PDF 52 pages] [HTML]
  This Part is aimed at the individual computer user, in the home or business context. It is intended to help individual users understand and address computer security. Topics include: keeping your computer and data secure; keeping your operating system and application software secure; malicious software; securing services over networks; tools to enhance security; and the role of encoding and encryption.
   
• Part 3: Security for Organizations [PDF 81 pages] [HTML]
  Organizations, whether governmental, corporate or academic, have responsibilities for protecting their computer and communications networks. This Part provides practical recommendations in such areas as risk evaluation and mitigation; planning; organizational security policy and; personnel security; security outsourcing; mobile risk management; and best practices. This part makes suggestions on how solid security policies may be developed and deployed in a range of organizational environments. Among other topics, Part 2 discusses authentication practices. It also provides overview of global dialogues on security.
   
• Part 4: Information Security and Government Policies [PDF 25 pages] [HTML]
  Government policy has an important role to play in the promotion of IT security. There is a paradox, however: a sound public policy framework can enhance security, but ill-considered government regulation can do more harm than good. It is important therefore to achieve the right balance of regulatory and non-regulatory measures. This Part describes various arrangements for protecting government systems and the role of law and government policy in promoting better security in the private sector.
   
• Part 5: IT Security for Technical Administrators [PDF 161 pages] [HTML]
  Part 5 is aimed at helping system and network administrators perform their duties efficiently. Part 5 differs from the other four Parts of this Handbook in that it assumes a certain level of technical knowledge on behalf of the reader. Topics include physical security; information security; identification and authentication; server security; network security; attacks and defenses; and detecting and managing a break-in.
   
• Annexes [PDF 39 pages] [HTML]
  The Annexes which point to many respected references in the field of computer and network maintenance.