PART OF THE JONES & BARTLETT LEARNING INFORMATION SYSTEMS SECURITY & ASSURANCE SERIES Revised and updated with the latest data in the field, the Second Edition of Managing Risk in Information Systems provides a comprehensive overview of the SSCP(r) Risk, Response, and Recovery Domain in addition to providing a thorough overview of risk management and its implications on IT infrastructures and compliance. Written by industry experts, and using a wealth of examples and exercises, this book incorporates hands-on activities to walk the reader through the fundamentals of risk management, strategies and approaches for mitigating risk, and the anatomy of how to create a plan that reduces risk. Instructor's Material for Managing Risk in Information Systems include: PowerPoint Lecture Slides Instructor's Guide Course Syllabus Quiz & Exam Questions Case Scenarios/Handouts
Written by two INFOSEC experts, this book provides a systematic and practical approach for establishing, managing and operating a comprehensive Information Assurance program. It is designed to provide ISSO managers, security managers, and INFOSEC professionals with an understanding of the essential issues required to develop and apply a targeted information security posture to both public and private corporations and government run agencies. There is a growing concern among all corporations and within the security industry to come up with new approaches to measure an organization's information security risks and posture. Information Assurance explains and defines the theories and processes that will help a company protect its proprietary information including: * The need to assess the current level of risk. * The need to determine what can impact the risk. * The need to determine how risk can be reduced. The authors lay out a detailed strategy for defining information security, establishing IA goals, providing training for security awareness, and conducting airtight incident response to system compromise. Such topics as defense in depth, configuration management, IA legal issues, and the importance of establishing an IT baseline are covered in-depth from an organizational and managerial decision-making perspective. Experience-based theory provided in a logical and comprehensive manner. Management focused coverage includes establishing an IT security posture, implementing organizational awareness and training, and understanding the dynamics of new technologies. Numerous real-world examples provide a baseline for assessment and comparison.
Author: Stephen D. Gantz
Release Date: 2012-12-31
FISMA and the Risk Management Framework: The New Practice of Federal Cyber Security deals with the Federal Information Security Management Act (FISMA), a law that provides the framework for securing information systems and managing risk associated with information resources in federal government agencies. Comprised of 17 chapters, the book explains the FISMA legislation and its provisions, strengths and limitations, as well as the expectations and obligations of federal agencies subject to FISMA. It also discusses the processes and activities necessary to implement effective information security management following the passage of FISMA, and it describes the National Institute of Standards and Technology's Risk Management Framework. The book looks at how information assurance, risk management, and information systems security is practiced in federal government agencies; the three primary documents that make up the security authorization package: system security plan, security assessment report, and plan of action and milestones; and federal information security-management requirements and initiatives not explicitly covered by FISMA. This book will be helpful to security officers, risk managers, system owners, IT managers, contractors, consultants, service providers, and others involved in securing, managing, or overseeing federal information systems, as well as the mission functions and business processes supported by those systems. Learn how to build a robust, near real-time risk management system and comply with FISMA Discover the changes to FISMA compliance and beyond Gain your systems the authorization they need
Author: David Kim
Publisher: Jones & Bartlett Learning
Release Date: 2010-11-17
Fundamentals of Information Systems Security provides a comprehensive overview of the essential concepts readers must know as they pursue careers in information systems security. The text opens with discussion of the new risks, threats, and vulnerabilities associated with the transformation to a digital world, including a look at how business, government, and individuals operate today. Part 2 is adapted from the Official (ISC)¦ SSCP« Certified Body of Knowledge and presents a high-level overview of each of the seven domains within the Systems Security Certified Practitioner certification. The book closes with a resource for readers who desire additional material on information security standards, education, professional certifications, and compliance laws. Key Features Focuses on new risks, threats, and vulnerabilities associated with the transformation to a digital world. Presents a high-level overview of each of the seven domains within the Systems Security Certified Practitioner certification. Provides a resource for readers and students desiring more information on information security standards, education, professional certifications, and recent compliance laws. Features an SSCP practice exam as well as a coupon offer for an SSCP Review Seminar.
Author: Andy Jones
Release Date: 2005-04-28
Risk Management for Computer Security provides IT professionals with an integrated plan to establish and implement a corporate risk assessment and management program. The book covers more than just the fundamental elements that make up a good risk program for computer security. It presents an integrated how-to approach to implementing a corporate program, complete with tested methods and processes, flowcharts, and checklists that can be used by the reader and immediately implemented into a computer and overall corporate security program. The challenges are many and this book will help professionals in meeting their challenges as we progress through the twenty-first century. This book is organized into five sections. Section I introduces the reader to the theories of risk management and describes the field's changing environment as well as the art of managing risks. Section II deals with threat assessment and its input to risk assessment; topics covered include the threat assessment method and an example of threat assessment. Section III focuses on operating system vulnerabilities and discusses application vulnerabilities; public domain vs. COTS; and connectivity and dependence. Section IV explains what risk assessment is and Section V explores qualitative vs. quantitative tools and types of risk assessment and concludes with an assessment of the future of risk management. Corporate security professionals around the world will find this book a highly valuable source of information. Presents material in an engaging, easy-to-follow manner that will appeal to both advanced INFOSEC career professionals and network administrators entering the information security profession Addresses the needs of both the individuals who are new to the subject as well as of experienced professionals Provides insight into the factors that need to be considered and fully explains the numerous methods, processes and procedures of risk management
Management of Information Security, Third Edition focuses on the managerial aspects of information security and assurance. Topics covered include access control models, information security governance, and information security program assessment and metrics. Coverage on the foundational and technical components of information security is included to reinforce key concepts. This new edition includes up-to-date information on changes in the field such as revised sections on national and international laws and international standards like the ISO 27000 series. With these updates, Management of Information Security continues to offer a unique overview of information security from a management perspective while maintaining a finger on the pulse of industry changes and academic relevance. Important Notice: Media content referenced within the product description or the product text may not be available in the ebook version.
"This book provides high-quality research papers and industrial practice articles about information security in the financial service industry. It provides insight into current information security measures, including: technology, processes, and compliance from some of the leading researchers and practitioners in the field"--Provided by publisher.
The RMF allows an organization to develop an organization-wide risk framework that reduces the resources required to authorize a systems operation. Use of the RMF will help organizations maintain compliance with not only FISMA and OMB requirements but can also be tailored to meet other compliance requirements such as Payment Card Industry (PCI) or Sarbanes Oxley (SOX). With the publishing of NIST SP 800-37 in 2010 and the move of the Intelligence Community and Department of Defense to modified versions of this process, clear implementation guidance is needed to help individuals correctly implement this process. No other publication covers this topic in the detail provided in this book or provides hands-on exercises that will enforce the topics. Examples in the book follow a fictitious organization through the RMF, allowing the reader to follow the development of proper compliance measures. Templates provided in the book allow readers to quickly implement the RMF in their organization. The need for this book continues to expand as government and non-governmental organizations build their security programs around the RMF. The companion website provides access to all of the documents, templates and examples needed to not only understand the RMF but also implement this process in the reader’s own organization. A comprehensive case study from initiation to decommission and disposal Detailed explanations of the complete RMF process and its linkage to the SDLC Hands on exercises to reinforce topics Complete linkage of the RMF to all applicable laws, regulations and publications as never seen before
Author: Michael E. Whitman
Publisher: Cengage Learning
Release Date: 2011-01-01
The fourth edition of Principles of Information Security explores the field of information security and assurance with updated content including new innovations in technology and methodologies. Students will revel in the comprehensive coverage that includes a historical overview of information security, discussions on risk management and security technology, current certification information, and more. The text builds on internationally-recognized standards and bodies of knowledge to provide the knowledge and skills students need for their future roles as business decision-makers. Information security in the modern organization is a management issue which technology alone cannot answer; it is a problem that has important economic consequences for which management will be held accountable. Students can feel confident that they are using a standards-based, content-driven resource to prepare for their work in the field. Important Notice: Media content referenced within the product description or the product text may not be available in the ebook version.
Author: Harold F. Tipton
Publisher: CRC Press
Release Date: 2009-06-24
Every year, in response to new technologies and new laws in different countries and regions, there are changes to the fundamental knowledge, skills, techniques, and tools required by all IT security professionals. In step with the lightning-quick, increasingly fast pace of change in the technology field, the Information Security Management Handbook, updated yearly, has become the standard on which all IT security programs and certifications are based. It reflects new updates to the Common Body of Knowledge (CBK) that IT security professionals all over the globe need to know. Captures the crucial elements of the CBK Exploring the ten domains of the CBK, the book explores access control, telecommunications and network security, information security and risk management, application security, and cryptography. In addition, the expert contributors address security architecture and design, operations security, business continuity planning and disaster recovery planning. The book also covers legal regulations, compliance, investigation, and physical security. In this anthology of treatises dealing with the management and technical facets of information security, the contributors examine varied topics such as anywhere computing, virtualization, podslurping, quantum computing, mashups, blue snarfing, mobile device theft, social computing, voting machine insecurity, and format string vulnerabilities. Also available on CD-ROM Safeguarding information continues to be a crucial concern of all IT professionals. As new risks threaten the security of our systems, it is imperative that those charged with protecting that information continually update their armor of knowledge to guard against tomorrow’s hackers and software vulnerabilities. This comprehensive Handbook, also available in fully searchable CD-ROM format keeps IT professionals abreast of new developments on the security horizon and reinforces timeless concepts, providing them with the best information, guidance, and counsel they can obtain.
Author: Jonathan Armstrong
Publisher: Taylor & Francis
Release Date: 2004
Genre: Business & Economics
Managing Risk: Technology and Communications is a practical guide to the effective management of technology and communications risks. Frequent high profile scares, like the Sasser worm and WiFi vulnerabilities, make a proactive approach essential and this book shows you how to put in place expedient checks, balances and countermeasures. Business networks are threatened by a host of factors, from employee abuse to non-compliance with data protection and libel laws, from hacker attacks to viruses and from extortion and terrorism to natural disaster. The costs of failing to manage systems risks can be immense and go beyond simple loss of productivity or even fraudulent losses to brand damage, theft of business secrets, expensive litigation, diminished customer confidence and adverse impacts on personnel and share value. This practical handbook includes examples, checklists and case studies to help you manage such hazards. The book covers: * accessibility of information; * acceptable use of information; * directors' legal duties; * general legal compliance; * protecting networks from external and internal threats; * encouraging security awareness at management and employee level; * reputational risk management; and * national and international risk and security standards. Managing Risk: Technology and Communications is the indispensable work of reference for IT and technology managers, HR managers, IT legal advisors, company secretaries and anyone seeking practical guidance on technology risks and their management.
Author: D. P. Dube
Publisher: Tata McGraw-Hill Education
Release Date: 2005-01-01
Genre: Computer networks
Information Technology is no more an enabler it has become a part and parcel of business processes. Consequently, the asset composition of organizations has, with the concomitant vulnerabilities and risks, undergone significant changes. In the new scenario, stakeholders are apprehensive about the security of Information Systems. Regulators all over the world have therefore realized the need for a strong Information System Assurance Framework, and have issued guidelines for periodic Information System Security Assessment.
Author: Michael E. Whitman
Publisher: Cengage Learning
Release Date: 2012-08-01
ROADMAP TO INFORMATION SECURITY: FOR IT AND INFOSEC MANAGERS provides a solid overview of information security and its relationship to the information needs of an organization. Content is tailored to the unique needs of information systems professionals who find themselves brought in to the intricacies of information security responsibilities. The book is written for a wide variety of audiences looking to step up to emerging security challenges, ranging from students to experienced professionals. This book is designed to guide the information technology manager in dealing with the challenges associated with the security aspects of their role, providing concise guidance on assessing and improving an organization's security. The content helps IT managers to handle an assignment to an information security role in ways that conform to expectations and requirements, while supporting the goals of the manager in building and maintaining a solid information security program. Important Notice: Media content referenced within the product description or the product text may not be available in the ebook version.