Calder and Watkins considers, in an approachable way, the vulnerabilities that will be faced in for- and not-for-profit organisations at a level that is transferable: neither are they too specific in being technology biased, nor are they too generic at the level of vulnerability monitoring.
Moreover, Calder and Watkins has four other benefits:
* it neatly parallels the structure of the standard;
* each vulerability comes with detailed advice on how to implement a control to cover it;
* there is useful detail on vulnerabilities uncovered because of the use of the control; and, last bu not least,
* there are the trade-offs that arise between covering a vulnerability and leaving it uncovered.
These are very good reasons for studying the book and they're why we chose it as the basis for the Open University's new Information Security Management Course
Dr Jon G Hall, Lecturer in Information Security, Open University, UK