PART OF THE JONES & BARTLETT LEARNING INFORMATION SYSTEMS SECURITY & ASSURANCE SERIES Revised and updated with the latest data in the field, the Second Edition of Managing Risk in Information Systems provides a comprehensive overview of the SSCP(r) Risk, Response, and Recovery Domain in addition to providing a thorough overview of risk management and its implications on IT infrastructures and compliance. Written by industry experts, and using a wealth of examples and exercises, this book incorporates hands-on activities to walk the reader through the fundamentals of risk management, strategies and approaches for mitigating risk, and the anatomy of how to create a plan that reduces risk. Instructor's Material for Managing Risk in Information Systems include: PowerPoint Lecture Slides Instructor's Guide Course Syllabus Quiz & Exam Questions Case Scenarios/Handouts
Author: Stephen D. Gantz
Release Date: 2012-12-31
FISMA and the Risk Management Framework: The New Practice of Federal Cyber Security deals with the Federal Information Security Management Act (FISMA), a law that provides the framework for securing information systems and managing risk associated with information resources in federal government agencies. Comprised of 17 chapters, the book explains the FISMA legislation and its provisions, strengths and limitations, as well as the expectations and obligations of federal agencies subject to FISMA. It also discusses the processes and activities necessary to implement effective information security management following the passage of FISMA, and it describes the National Institute of Standards and Technology's Risk Management Framework. The book looks at how information assurance, risk management, and information systems security is practiced in federal government agencies; the three primary documents that make up the security authorization package: system security plan, security assessment report, and plan of action and milestones; and federal information security-management requirements and initiatives not explicitly covered by FISMA. This book will be helpful to security officers, risk managers, system owners, IT managers, contractors, consultants, service providers, and others involved in securing, managing, or overseeing federal information systems, as well as the mission functions and business processes supported by those systems. Learn how to build a robust, near real-time risk management system and comply with FISMA Discover the changes to FISMA compliance and beyond Gain your systems the authorization they need
Written by two INFOSEC experts, this book provides a systematic and practical approach for establishing, managing and operating a comprehensive Information Assurance program. It is designed to provide ISSO managers, security managers, and INFOSEC professionals with an understanding of the essential issues required to develop and apply a targeted information security posture to both public and private corporations and government run agencies. There is a growing concern among all corporations and within the security industry to come up with new approaches to measure an organization's information security risks and posture. Information Assurance explains and defines the theories and processes that will help a company protect its proprietary information including: * The need to assess the current level of risk. * The need to determine what can impact the risk. * The need to determine how risk can be reduced. The authors lay out a detailed strategy for defining information security, establishing IA goals, providing training for security awareness, and conducting airtight incident response to system compromise. Such topics as defense in depth, configuration management, IA legal issues, and the importance of establishing an IT baseline are covered in-depth from an organizational and managerial decision-making perspective. Experience-based theory provided in a logical and comprehensive manner. Management focused coverage includes establishing an IT security posture, implementing organizational awareness and training, and understanding the dynamics of new technologies. Numerous real-world examples provide a baseline for assessment and comparison.
Publisher: Jones & Bartlett Publishers
Release Date: 2016-10-15
Revised and updated with the latest data in the field, Fundamentals of Information Systems Security, Third Edition provides a comprehensive overview of the essential concepts readers must know as they pursue careers in information systems security. The text opens with a discussion of the new risks, threats, and vulnerabilities associated with the transition to a digital world. Part 2 presents a high level overview of the Security+ Exam and provides students with information as they move toward this certification.
Author: Andy Jones
Release Date: 2005
Genre: Business & Economics
The information systems security (InfoSec) profession remains one of the fastest growing professions in the world today. With the advent of the Internet and its use as a method of conducting business, even more emphasis is being placed on InfoSec. However, there is an expanded field of threats that must be addressed by today's InfoSec and information assurance (IA) professionals. Operating within a global business environment with elements of a virtual workforce can create problems not experienced in the past. How do you assess the risk to the organization when information can be accessed, remotely, by employees in the field or while they are traveling internationally? How do you assess the risk to employees who are not working on company premises and are often thousands of miles from the office? How do you assess the risk to your organization and its assets when you have offices or facilities in a nation whose government may be supporting the theft of the corporate "crown jewels" in order to assist their own nationally owned or supported corporations? If your risk assessment and management program is to be effective, then these issues must be assessed. Personnel involved in the risk assessment and management process face a much more complex environment today than they have ever encountered before. This book covers more than just the fundamental elements that make up a good risk program. It provides an integrated "how to" approach to implementing a corporate program, complete with tested methods and processes; flowcharts; and checklists that can be used by the reader and immediately implemented into a computer and overall corporate security program. The challenges are many and this book will help professionals in meeting their challenges as we progress through the 21st Century. *Presents material in an engaging, easy-to-follow manner that will appeal to both advanced INFOSEC career professionals and network administrators entering the information security profession *Addresses the needs of both the individuals who are new to the subject as well as of experienced professionals *Provides insight into the factors that need to be considered & fully explains the numerous methods, processes & procedures of risk management
Attacks on information systems and applications have become more prevalent with new advances in technology. Management of security and quick threat identification have become imperative aspects of technological applications. Information Technology Risk Management and Compliance in Modern Organizations is a pivotal reference source featuring the latest scholarly research on the need for an effective chain of information management and clear principles of information technology governance. Including extensive coverage on a broad range of topics such as compliance programs, data leak prevention, and security architecture, this book is ideally designed for IT professionals, scholars, researchers, and academicians seeking current research on risk management and compliance.
Author: Michael E. Whitman
Publisher: Cengage Learning
Release Date: 2016-03-22
Readers discover a managerially-focused overview of information security with a thorough treatment of how to most effectively administer it with MANAGEMENT OF INFORMATION SECURITY, 5E. Information throughout helps readers become information security management practitioners able to secure systems and networks in a world where continuously emerging threats, ever-present attacks, and the success of criminals illustrate the weaknesses in current information technologies. Current and future professional managers complete this book with the exceptional blend of skills and experiences to develop and manage the more secure computing environments that today’s organizations need. This edition offers a tightened focus on key executive and managerial aspects of information security while still emphasizing the important foundational material to reinforce key concepts. Updated content reflects the most recent developments in the field, including NIST, ISO, and security governance. Important Notice: Media content referenced within the product description or the product text may not be available in the ebook version.
"This book provides high-quality research papers and industrial practice articles about information security in the financial service industry. It provides insight into current information security measures, including: technology, processes, and compliance from some of the leading researchers and practitioners in the field"--Provided by publisher.
The RMF allows an organization to develop an organization-wide risk framework that reduces the resources required to authorize a systems operation. Use of the RMF will help organizations maintain compliance with not only FISMA and OMB requirements but can also be tailored to meet other compliance requirements such as Payment Card Industry (PCI) or Sarbanes Oxley (SOX). With the publishing of NIST SP 800-37 in 2010 and the move of the Intelligence Community and Department of Defense to modified versions of this process, clear implementation guidance is needed to help individuals correctly implement this process. No other publication covers this topic in the detail provided in this book or provides hands-on exercises that will enforce the topics. Examples in the book follow a fictitious organization through the RMF, allowing the reader to follow the development of proper compliance measures. Templates provided in the book allow readers to quickly implement the RMF in their organization. The need for this book continues to expand as government and non-governmental organizations build their security programs around the RMF. The companion website provides access to all of the documents, templates and examples needed to not only understand the RMF but also implement this process in the reader’s own organization. A comprehensive case study from initiation to decommission and disposal Detailed explanations of the complete RMF process and its linkage to the SDLC Hands on exercises to reinforce topics Complete linkage of the RMF to all applicable laws, regulations and publications as never seen before
Author: Michael E. Whitman
Publisher: Cengage Learning
Release Date: 2017-05-24
Master the latest technology and developments from the field with the book specifically oriented to the needs of those learning information systems -- PRINCIPLES OF INFORMATION SECURITY, 6E. Taking a managerial approach, this bestseller emphasizes all aspects of information security, rather than just the technical control perspective. Readers gain a broad overview of the entire field of information security and related elements with the detail to ensure understanding. The book highlights terms used in the field and a history of the discipline as readers learn how to manage an information security program. This edition highlights the latest practices with fresh examples that explore the impact of emerging technologies, such as the Internet of Things, Cloud Computing, and DevOps. Updates address technical security controls, emerging legislative issues, digital forensics, and ethical issues in IS security, making this the ideal IS resource for business decision makers. Important Notice: Media content referenced within the product description or the product text may not be available in the ebook version.
Das Buch fasst alle Sachverhalte zum Risikomanagement zusammen, verbindet sie mit anderen Informationsquellen und umrahmt sie mit vielen Praxistipps, 38 Abbildungen und Tabellen und 14 Fallbeispielen. Wer mit ISO/IEC 27005 arbeiten möchte, für den reicht der unkommentierte Blick in den Standard nicht aus. Die Normenreihe ISO/IEC 27000 ist in den letzten Jahren stark gewachsen und es ist schwer den Überblick zu behalten. Dieses Buch zielt auf den Einsatz in der Praxis und richtet sich an jeden, der seine Entscheidungen auf Grundlage einer fundierten Risikoanalyse treffen will. Zusätzliche Funktionen für Smartphones: 40 QR-Codes mit redaktionell gepflegten Links führen Sie mit Ihrem Smartphone direkt aus dem Buch ins Internet. So gelangen Sie ohne Tippen von der Buchseite aus auf die passende Webseite. Auf diese Weise sind die Vorzüge von Buch und Internet jederzeit für Sie verfügbar. Darüber hinaus steht Ihnen der Autor auf seiner Facebook-Seite und in seinem Blog „Klipper on Security“ als Ansprechpartner zur Verfügung.
Author: Harold F. Tipton
Publisher: CRC Press
Release Date: 2010-06-22
Genre: Business & Economics
Every year, in response to advancements in technology and new laws in different countries and regions, there are many changes and updates to the body of knowledge required of IT security professionals. Updated annually to keep up with the increasingly fast pace of change in the field, the Information Security Management Handbook is the single most comprehensive and up-to-date resource on information security and assurance. Providing an up-to-date compilation of the fundamental skills, techniques, tools, and understanding required of IT security professionals, the Information Security Management Handbook, Sixth Edition, Volume 4 reflects the latest changes to information security and the CISSP® Common Body of Knowledge (CBK®). This edition updates the benchmark Volume 1 with a wealth of new information on mobile device security, adaptive threat defense, Web 2.0, virtualization, data leakage, and governance. New material also addresses risk management, business continuity planning, disaster recovery planning, and cryptography. As the risks that threaten the security of our systems continue to evolve, it is imperative that those charged with protecting that information stay ahead of the curve. Also available in a fully searchable CD-ROM format, this comprehensive resource provides the up-to-date understanding required to keep you abreast of the latest developments, new vulnerabilities, and possible threats.
Author: Jonathan Armstrong
Publisher: Taylor & Francis
Release Date: 2004
Genre: Business & Economics
Managing Risk: Technology and Communications is a practical guide to the effective management of technology and communications risks. Frequent high profile scares, like the Sasser worm and WiFi vulnerabilities, make a proactive approach essential and this book shows you how to put in place expedient checks, balances and countermeasures. Business networks are threatened by a host of factors, from employee abuse to non-compliance with data protection and libel laws, from hacker attacks to viruses and from extortion and terrorism to natural disaster. The costs of failing to manage systems risks can be immense and go beyond simple loss of productivity or even fraudulent losses to brand damage, theft of business secrets, expensive litigation, diminished customer confidence and adverse impacts on personnel and share value. This practical handbook includes examples, checklists and case studies to help you manage such hazards. The book covers: * accessibility of information; * acceptable use of information; * directors' legal duties; * general legal compliance; * protecting networks from external and internal threats; * encouraging security awareness at management and employee level; * reputational risk management; and * national and international risk and security standards. Managing Risk: Technology and Communications is the indispensable work of reference for IT and technology managers, HR managers, IT legal advisors, company secretaries and anyone seeking practical guidance on technology risks and their management.