Principles of Information Security

This is the textbook that trains security professionals across the United States and many English-speaking countries. If you want a structured, defensible way to think about protecting information — not just tools but frameworks, laws, and math — this is the foundation. Students, IT managers, and anyone preparing for security certifications will use these models for years.

1. 1Chapter 1

   The Triangle That Rules Security

   Out of the 1970s came three letters — C, I, A — standing for confidentiality, integrity, and availability. Whitman and Mattord present this C.I.A. triangle as the industry standard for computer security since the 1970s. Three sides, one shape: keep secrets secret, keep data accurate, keep systems running. The authors then push further, expanding the triangle in the text to include authentication, authorization, and accountability.

   The idea

   The triangle endures because it forces a choice: every control you buy serves at least one of its sides, and every failure breaks at least one. Adding authentication, authorization, and accountability answers a question the original three leave open — who did it, and were they allowed? The shape is simple enough for a whiteboard and demanding enough to audit an entire enterprise against.

   Try this: Pick one system you manage and label every existing control with the C.I.A. property it protects — anything left unlabeled is a gap.

2. 2Chapter 1

   Twenty-Seven Cells of the Cube

   The triangle has a problem: it describes what to protect but not when or how. So the authors introduce the NSTISSC model — from the National Security Telecommunications and Information Systems Security Committee — drawn as a 3x3x3 cube. Twenty-seven cells, each representing the intersection of one information characteristic, one information state, and one security measure. Every cell is a question the organization must answer.

   The idea

   The cube's power is exhaustiveness. A team that thinks only in terms of the triangle might encrypt data in transit and forget it at rest; the cube makes that omission visible as an empty cell. It turns security from a checklist of tools into a grid of coverage, where gaps are geometrically obvious.

   Try this: Sketch the 3x3x3 grid for your own data and mark which cells your current controls actually cover.

3. 3Chapter 2

   Twelve Ways Everything Goes Wrong

   Chapter 2 lays out the threat taxonomy: twelve categories of threats to information security. Acts of human error or failure. Acts of nature. Deviations in quality of service by service providers. Espionage or trespass. Hardware or software technical failures. Ideological, political, or religious extremism. Ignorance or improper usage. Information extortion. Sabotage or vandalism. Software attacks. Technical hardware failures or errors. Theft.

   The idea

   The taxonomy's value is breadth. Defenders instinctively fixate on hackers — software attacks — while the list quietly insists that weather, incompetence, and a failing vendor's service can do equal damage. Naming twelve categories keeps a security program honest about how many directions trouble comes from.

   Try this: List your top five threats by name from these categories and check whether your current budget addresses all five.

4. 4Chapter 2

   The Con Artist at the Front Desk

   A caller with a confident voice, a plausible story, and one question: what's your password? The text describes social engineering as 'the process of using social skills to convince people to reveal access credentials or other valuable information.' Kevin Mitnick appears as a famous example of a social engineer — a man who breached systems not by cracking code but by cracking people.

   The idea

   Social engineering matters because it routes around every technical control. The strongest encryption is useless if an employee hands over the key. The book's framing makes clear that the vulnerability is not in the software but in the conversation — which means awareness training is as much a security technology as any firewall.

   Try this: Run a five-minute drill: ask a colleague to verify a caller's identity before sharing anything, and see how often the check gets skipped.

5. 5Chapter 2

   How Much Risk Can You Stomach?

   Senior management decides — not in so many words, but in budgets and signatures — how much danger the organization will carry. The chapter calls this risk appetite: the quantity and nature of risk that organizations are willing to accept, and it is determined by senior management. Beneath it sits risk tolerance, the variation from that level the organization can tolerate.

   The idea

   Risk appetite makes security a management decision, not a technical one. Technicians can measure threats, but only executives can decide how much of them to live with. The distinction between appetite and tolerance gives organizations a two-level dial: the broad stance from the top, and the wiggle room beneath it.

   Try this: Ask your leadership to state in one sentence how much risk they're willing to accept — then compare it to what current controls imply.

6. 6Chapter 3

   The Law Comes Knocking

   A security professional's map of American law: the Computer Fraud and Abuse Act of 1986, which criminalizes unauthorized access to protected computers and was amended by the USA PATRIOT Act of 2001. The Electronic Communications Privacy Act. The Health Insurance Portability and Accountability Act of 1996 — HIPAA — governing health data. The Sarbanes-Oxley Act of 2002, reaching into how corporations handle their records. Each statute turns a technical failure into a legal one.

   The idea

   The legal chapter reframes security as compliance. A breach is no longer just an outage; it can be a federal offense, a healthcare violation, or a securities problem. Knowing which law covers which data tells an organization which controls are optional and which are mandatory — and what a subpoena will look for.

   Try this: Match one dataset you handle to the specific law that governs it, and note one control that law requires.

7. 7Chapter 5

   The Arithmetic of Loss

   Chapter 5 hands the reader a formula. ALE — Annualized Loss Expectancy — is calculated as ARO times SLE: the Annualized Rate of Occurrence multiplied by the Single Loss Expectancy. And SLE itself equals asset value times EF, the Exposure Factor. Multiply what an incident costs by how often it happens per year, and you have the number that justifies — or kills — a security budget request.

   The idea

   This arithmetic converts fear into finance. The formula gives security professionals a language executives already speak: dollars per year.

   Try this: Take one threat, estimate its asset value, exposure factor, and annual rate, and compute the ALE before your next budget meeting.

8. 8Chapter 6

   Sensors on the Wire and the Host

   Chapter 6 deploys the watchers: intrusion detection systems and intrusion prevention systems. The text distinguishes network-based systems — NIDS — from host-based ones — HIDS, one watching the traffic, the other watching a single machine. It then splits detection itself into two philosophies: signature-based, which recognizes known attack patterns, and statistical anomaly-based, which flags behavior that deviates from the norm.

   The idea

   The two detection philosophies expose a permanent trade-off. Signatures are precise but blind to anything new; anomaly detection catches the unknown but cries wolf on legitimate change. Placing sensors on the network and on hosts covers different blind spots. No single configuration sees everything, which is why the book treats these as complementary layers.

   Try this: Check whether your environment has both network-based and host-based monitoring, and note which detection method each uses.

9. 9Chapter 6

   Two Keys, One Lock

   In the same chapter, the cryptographic toolkit appears. Symmetric encryption — the same key locks and unlocks — with AES and DES as the named examples. Asymmetric encryption, exemplified by RSA, works differently: a public and a private key pair, where one encrypts and only the other decrypts. The concept of public and private keys is explained plainly: publish one, guard the other, and strangers can send you secrets.

   The idea

   The two families solve different problems. Understanding why both exist explains most of modern secure communication.

   Try this: Identify one encrypted connection you use daily and determine whether it relies on symmetric, asymmetric, or both methods.

10. 10Chapter 9

    When the Fire Suppression Drowns the Servers

    A fire breaks out in the server room. The suppression system activates — and the water that saves the building destroys the machines. Chapter 9 walks through fire suppression systems: wet pipe, dry pipe, pre-action, and gas-based. The text notes plainly that water-based systems can damage electronic equipment. The gas-based option stands apart precisely because it leaves no water behind.

    The idea

    Physical security forces choices that pure IT never faces: the fix for one threat can be the cause of another. The chapter's point is that protecting information means protecting the room it lives in — with the right agent, not just any agent.

    Try this: Find out which type of fire suppression protects your server room and whether it poses a water risk to the equipment.

11. 11Chapter 9

    The Room With Two Doors

    Someone sprints toward the secure door behind an authorized employee, badge or no badge — tailgating, the oldest trick in physical intrusion. The countermeasure is a mantrap, also called an access control vestibule: a small room with two sets of interlocking doors. The first door closes and locks before the second opens. There is no moment when an unauthorized person can slip through alongside a legitimate one.

    The idea

    The mantrap works by controlling time, not identity. It doesn't verify who you are better than a badge reader does; it removes the window in which social pressure and speed defeat the lock. Interlocking doors turn a moment of courtesy into a contained, observable pause — one person, one cycle, every time.

    Try this: Observe your building's most sensitive entrance for a day and count how many people tailgate through it.

12. 12Chapter 11

    The Door Swings Both Ways

    An employee resigns. Chapter 11 describes the process of exit procedures for departing employees: the revocation of access rights and the return of equipment. Done well, the departure is clean; done poorly, a former employee retains a live path into the network indefinitely.

    The idea

    Exit procedures exist because access outlives trust. The moment someone stops working for you, every credential they hold becomes a liability, and only a deliberate process closes each one. The pairing of revocation with equipment return covers both the digital and the physical residue of employment — and skipping either half leaves a door open.

    Try this: Review your organization's offboarding checklist and confirm that access revocation happens on the last day, not the following week.

13. 13Chapter 12

    Hunt Your Own Weaknesses

    The final chapter turns the defense inward. Chapter 12 describes vulnerability management as a process with three moving parts: vulnerability scanning, penetration testing, and patch management. Then comes the sharpest tool — penetration testing, in which authorized testers attempt to exploit vulnerabilities in a system to identify weaknesses. The organization pays professionals to attack it, under permission, before someone else does it for free.

    The idea

    Vulnerability management replaces hope with evidence. The discipline is cyclical — new software, new flaws, new scans — which is why the book places it in the maintenance chapter rather than the build one. Security is never finished, only currently verified.

    Try this: Schedule a vulnerability scan of one system this week and commit to patching its highest-severity finding within seven days.

Students in information security courses and professionals preparing for certifications will find the canonical frameworks here. IT managers who need to justify budgets in dollars and defend decisions with structured models will get the most immediate value.

FAQ