Fighting Computer Crime: A New Framework for Protecting Information (edition 1998)

Obsoleting the common three elements of security, confidentiality, integrity, and availability, the fundamentals of his new framework of information security are availability, utility, integrity, authenticity, confidentiality, and possession.
He debunks a number of the tenets of computer security claiming early on that there are “no valid statistics on computer crime,” stressing that information security “can never be a science,” and warning that “starting with vulnerabilities is starting in the middle.” He’s quite harsh in his indictment of numeric and financial threat analysis, claiming that “adopting baseline controls is a simpler, less expensive, and more effective way to select security safeguards than risk assessment.” Parker has a very business-oriented and pragmatic approach to security, and tries to suggest ways that security can help meet business goals instead of conflicting with them.

This is a great book, and I highly recommend it. Readers should not be put off by its date, because it is not about technology, it is about people and making optimal decisions about managing IT and information security-related risks. Many of the counter-productive practices that Parker warns about, gained thru over 3 decades of his experience, continue to plague today's practitioner. ( )