Interview with Scott Barman, author of "Writing Information Security Policies"
by Mirko Zorz - Thursday, 10 April 2003.
Who is Scott Barman? Introduce yourself to our readers.

I am the author of "Writing Information Security Policies," a book about the basis of any information security program. I am currently an information security and systems architecture analyst for The MITRE Corporation working to help the United States Internal Revenue Service modernize their IT infrastructure.

I have been involved with systems architecture information security for more than 20 years, nurturing the evolution of systems and their security requirements for commercial organizations and government agencies. Since the explosion of the Internet, and prior to joining MITRE, my focus has been on various areas of security and policy development for many organizations in the Washington, D.C. area. I have a Bachelor of Science degree from the University of Georgia and a Master of Information Systems Management with a concentration in Information Security Management from Carnegie Mellon University.

How did you get interested in computer security?

After the Internet Worm in 1988, where Robert Morris Jr. unleashed a worm that affected Sun and Digital systems running sendmail, I found myself curious as to why something like that could happen. I then started to study the writings of those who figured out how and why it worked and it intrigued me further. The more I read, the more I became interested in various areas of security. It was after reading the paper from Dr. Robert Morris Sr about the insecurity if TCP/IP was when I decided to shift my career.

What operating system(s) do you use and why?

At work, I have a company issued laptop running Windows 2000 Professional. At home I have a Macintosh PowerBook G3 running Mac OS X. It is a great little machine. In fact, I am writing this now on the Mac. I bought this machine from my company's surplus auction to see if I would like it. I love it! Now I want the new 17-inch Titanium PowerBook. And the fact that it is UNIX under the hood helps--I am an unapologetic UNIX bigot!

I also have a Dell that runs Windows 2000 and SuSE Linux. I keep the Windows partition for some legacy applications.

How long did it take you to write "Writing Information Security Policies " and what was it like? Any major difficulties?

That is a harder question than it would appear. I started writing the book in the Summer of 2000 while finishing graduate school at Carnegie Mellon. My wife, Elisa, and I moved back to the Washington, DC area only to have disaster strike. In November, Elisa was diagnosed with cancer. She died the following April.

After taking a month off to recover, I restarted writing and spent the next four months finishing the last 75 percent of the book. Finishing the book was one of my last promises to Elisa. I never broke a promise to her and I was not going to start at that time. She would have been proud of me.

Since Elisa died, I am committed to finding a cure for cancer. I have teamed up with the National Foundation for Cancer Research (NFCR) to look for that cure. All the money earned from buying my book is donated to NFCR. I am also a member of the Associates Program. All commissions earned from any sales through my website is also donated to NFCR. If you buy from, please do so by clicking through my site first. That way we can raise more money for cancer research!

If you could start writing the book all over again, would you change anything?

Other than my personal situation, I would add a chapter on mobile code policies and one on how to write policies for portable devices like PDAs, notebooks, cell phones, etc.


What's the real cost of a security breach?

The majority of business decision makers admit that their organisation will suffer an information security breach and that the cost of recovery could start from around $1 million.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th