Internet Site Security by Erik Schetina, Ken Green, Jacob Carlson is a “security 101” book. The book is so solid I adopted its “assess -> protect -> detect -> respond” security process model to replace the “plan -> prevent -> detect” version in my own book. If you’re looking to get your feet wet in security, or if you’re a manager who needs to learn the fundamentals, the book is a fine starting point. It also correct state the risk equation as “risk = threat X vulnerability X asset value””]
Source: https://taosecurity.blogspot.com/2003/12/security-101-book-today-i-was-asked.html