A nice survey on information security by Ernest and Young – Moving Beyond Compliance.