This book provides insight as to why and how current security management practices fail at their basic foundation, resulting in overall dissatisfaction by practitioners and lack of success in the corporate environment. The author examines the reasons and how to fix them. The resulting improvement is highly beneficial to any corporation that chooses to pursue this approach or strategy and from a bottom-line and business operations perspective, not just in technical operations. This book transforms the understanding of the role of the CISO, the selection process for a CISO, and the financial impact that security plays in any organization.
Author: Gene Kim
Publisher: IT Revolution
Release Date: 2014-10-14
Genre: Business & Economics
Bill is an IT manager at Parts Unlimited. It's Tuesday morning and on his drive into the office, Bill gets a call from the CEO. The company's new IT initiative, code named Phoenix Project, is critical to the future of Parts Unlimited, but the project is massively over budget and very late. The CEO wants Bill to report directly to him and fix the mess in ninety days or else Bill's entire department will be outsourced. With the help of a prospective board member and his mysterious philosophy of The Three Ways, Bill starts to see that IT work has more in common with manufacturing plant work than he ever imagined. With the clock ticking, Bill must organize work flow, streamline interdepartmental communications, and effectively serve the other business functions at Parts Unlimited. In a fast-paced and entertaining style, three luminaries of the DevOps movement deliver a story that anyone who works in IT will recognize. Readers will not only learn how to improve their own IT organizations, they'll never view IT the same way again.
Author: Chris Davis
Publisher: McGraw Hill Professional
Release Date: 2011-02-05
Secure Your Systems Using the Latest IT Auditing Techniques Fully updated to cover leading-edge tools and technologies, IT Auditing: Using Controls to Protect Information Assets, Second Edition, explains, step by step, how to implement a successful, enterprise-wide IT audit program. New chapters on auditing cloud computing, outsourced operations, virtualization, and storage are included. This comprehensive guide describes how to assemble an effective IT audit team and maximize the value of the IT audit function. In-depth details on performing specific audits are accompanied by real-world examples, ready-to-use checklists, and valuable templates. Standards, frameworks, regulations, and risk management techniques are also covered in this definitive resource. Build and maintain an internal IT audit function with maximum effectiveness and value Audit entity-level controls, data centers, and disaster recovery Examine switches, routers, and firewalls Evaluate Windows, UNIX, and Linux operating systems Audit Web servers and applications Analyze databases and storage solutions Assess WLAN and mobile devices Audit virtualized environments Evaluate risks associated with cloud computing and outsourced operations Drill down into applications to find potential control weaknesses Use standards and frameworks, such as COBIT, ITIL, and ISO Understand regulations, including Sarbanes-Oxley, HIPAA, and PCI Implement proven risk management practices
Implementing Cisco IOS Network Security (IINS) Foundation Learning Guide Second Edition Foundation learning for the CCNA Security IINS 640-554 exam Implementing Cisco IOS Network Security (IINS) Foundation Learning Guide, Second Edition, is a Cisco-authorized, self-paced learning tool for CCNA® Security 640-554 foundation learning. This book provides you with the knowledge needed to secure Cisco® networks. By reading this book, you will gain a thorough understanding of how to develop a security infrastructure, recognize threats and vulnerabilities to networks, and mitigate security threats. This book focuses on using Cisco IOS routers to protect the network by capitalizing on their advanced features as a perimeter router, firewall, intrusion prevention system, and site-to-site VPN device. The book also covers the use of Cisco Catalyst switches for basic network security, the Cisco Secure Access Control System (ACS), and the Cisco Adaptive Security Appliance (ASA). You learn how to perform basic tasks to secure a small branch office network using Cisco IOS security features available through web-based GUIs (Cisco Configuration Professional) and the CLI on Cisco routers, switches, and ASAs. Whether you are preparing for CCNA Security certification or simply want to gain a better understanding of Cisco IOS security fundamentals, you will benefit from the information provided in this book. Implementing Cisco IOS Network Security (IINS) Foundation Learning Guide, Second Edition, is part of a recommended learning path from Cisco that includes simulation and hands-on training from authorized Cisco Learning Partners and self-study products from Cisco Press. To find out more about instructor-led training, e-learning, and hands-on instruction offered by authorized Cisco Learning Partners worldwide, please visit www.cisco.com/go/authorizedtraining. -- Develop a comprehensive network security policy to counter threats against information security -- Secure borderless networks -- Learn how to use Cisco IOS Network Foundation Protection (NFP) and Cisco Configuration Professional (CCP) -- Securely implement the management and reporting features of Cisco IOS devices -- Deploy Cisco Catalyst Switch security features -- Understand IPv6 security features -- Plan threat control strategies -- Filter traffic with access control lists -- Configure ASA and Cisco IOS zone-based firewalls -- Implement intrusion prevention systems (IPS) and network address translation (NAT) -- Secure connectivity with site-to-site IPsec VPNs and remote access VPNs This volume is in the Foundation Learning Guide Series offered by Cisco Press®. These guides are developed together with Cisco as the only authorized, self-paced learning tools that help networking professionals build their understanding of networking concepts and prepare for Cisco certification exams. Category: Cisco Certification Covers: CCNA Security IINS exam 640-554
IBM® InfoSphere® Guardium® provides the simplest, most robust solution for data security and data privacy by assuring the integrity of trusted information in your data center. InfoSphere Guardium helps you reduce support costs by automating the entire compliance auditing process across heterogeneous environments. InfoSphere Guardium offers a flexible and scalable solution to support varying customer architecture requirements. This IBM Redbooks® publication provides a guide for deploying the Guardium solutions. This book also provides a roadmap process for implementing an InfoSphere Guardium solution that is based on years of experience and best practices that were collected from various Guardium experts. We describe planning, installation, configuration, monitoring, and administrating an InfoSphere Guardium environment. We also describe use cases and how InfoSphere Guardium integrates with other IBM products. The guidance can help you successfully deploy and manage an IBM InfoSphere Guardium system. This book is intended for the system administrators and support staff who are responsible for deploying or supporting an InfoSphere Guardium environment.
Author: Gary Ford
Publisher: Pearson Education
Release Date: 2011-06-27
Cisco Unified Contact Center Enterprise (UCCE) The complete guide to managing UCCE environments: tips, tricks, best practices, and lessons learned Cisco Unified Contact Center Enterprise (UCCE) integrates multiple components and can serve a wide spectrum of business requirements. In this book, Gary Ford, an experienced Cisco UCCE consultant brings together all the guidance you need to optimally configure and manage UCCE in any environment. The author shares in-depth insights covering both the enterprise and hosted versions of UCCE. He presents an administrator’s view of how to perform key UCCE tasks and why they work as they do. He thoroughly addresses application configuration, agents, scripting, IVR, dial plans, UCM, error handling, reporting, metrics, and many other key topics. You’ll find proven, standardized configuration examples that help eliminate errors and reduce downtime, step-by-step walkthroughs of several actual configurations, and thorough coverage of monitoring and troubleshooting UCCE systems. Cisco Unified Contact Center Enterprise (UCCE) is an indispensable resource to help you deploy and operate UCCE systems reliably and efficiently. · Understand the Cisco Unified Contact Center product portfolio and platform architecture · Choose the right single-site, multi-site, or clustered deployment model for your environment · Take a lifecycle services approach to UCCE deployment and application configuration-–including preparation, planning, design, and implementation · Implement traditional, current-generation, and next-generation call routing · Master the latest best practices for call flow scripting · Understand UCCE’s nodes and distributed processes and build a clean system startup sequence · Design, implement, and deliver unified CM/IP IVR solutions · Set up and efficiently manage UCCE databases · Make the most of UCCE’s reporting tools · Create advanced applications with Data-Driven Routing · Effectively maintain any UCCE deployment, including older versions · Use a best-practice methodology for troubleshooting, and master valuable, little-known Cisco diagnostic tools This IP communications book is part of the Cisco Press® Networking Technology Series. IP communications titles from Cisco Press help networking professionals understand voice and IP telephony technologies, plan and design converged networks, and implement network solutions for increased productivity.
Author: Michael Gentile
Publisher: CRC Press
Release Date: 2016-04-19
Genre: Business & Economics
The CISO Handbook: A Practical Guide to Securing Your Company provides unique insights and guidance into designing and implementing an information security program, delivering true value to the stakeholders of a company. The authors present several essential high-level concepts before building a robust framework that will enable you to map the concepts to your company’s environment. The book is presented in chapters that follow a consistent methodology – Assess, Plan, Design, Execute, and Report. The first chapter, Assess, identifies the elements that drive the need for infosec programs, enabling you to conduct an analysis of your business and regulatory requirements. Plan discusses how to build the foundation of your program, allowing you to develop an executive mandate, reporting metrics, and an organizational matrix with defined roles and responsibilities. Design demonstrates how to construct the policies and procedures to meet your identified business objectives, explaining how to perform a gap analysis between the existing environment and the desired end-state, define project requirements, and assemble a rough budget. Execute emphasizes the creation of a successful execution model for the implementation of security projects against the backdrop of common business constraints. Report focuses on communicating back to the external and internal stakeholders with information that fits the various audiences. Each chapter begins with an Overview, followed by Foundation Concepts that are critical success factors to understanding the material presented. The chapters also contain a Methodology section that explains the steps necessary to achieve the goals of the particular chapter.
Author: Eugene M Fredriksen
Publisher: CRC Press
Release Date: 2017-03-16
Genre: Business & Economics
The book takes readers though a series of security and risk discussions based on real-life experiences. While the experience story may not be technical, it will relate specifically to a value or skill critical to being a successful CISO. The core content is organized into ten major chapters, each relating to a "Rule of Information Security" developed through a career of real life experiences. The elements are selected to accelerate the development of CISO skills critical to success. Each segments clearly calls out lessons learned and skills to be developed. The last segment of the book addresses presenting security to senior execs and board members, and provides sample content and materials.
Author: Larry Coyne
Publisher: IBM Redbooks
Release Date: 2017-04-11
Note: The IBM TS7700 Release 4.0 Guide, SG24-8366 is available at: http://www.redbooks.ibm.com/abstracts/sg248366.html IBM® TS7700 is a family of mainframe virtual tape solutions that optimize data protection and business continuance for IBM z SystemsTM data. Through the use of virtualization and disk cache, the TS7700 family operates at disk speeds while maintaining compatibility with existing tape operations. Its fully integrated tiered storage hierarchy takes advantage of both disk and tape technologies to deliver performance for active data and best economics for inactive and archive data. This IBM Redbooks® publication describes the TS7700 R3.3 architecture, planning, migration, implementation, and operations. The latest TS7700 family of z Systems tape virtualization is offered as two models: IBM TS7720 features encryption-capable high-capacity cache that uses 3 TB SAS disk drives with RAID 6, which can scale to large capacities with the highest level of data protection. IBM TS7740 features encryption-capable 600 GB SAS drives with RAID 6 protection. Both models write data by policy to physical tape through attachment to high-capacity, high-performance IBM TS1150 and earlier IBM 3592 model tape drives that are installed in IBM TS3500 tape libraries. Physical tape support is optional on TS7720. TS7700 R3.3 also supports external key management for disk-based encryption by using IBM Security Key Lifecycle Manager. This book intended for system architects who want to integrate their storage systems for smoother operation.
The Best Damn Cisco Internetworking Book Period shows readers everything they need to know about all Cisco internetworking topics. The book provides an understanding of Cisco's current VoIP solutions and the means to put them to work, showing how to configure all of Cisco's core VoIP products—among them Cisco CallManager software, Cisco 7910 series phones, and server-based IP PBXs. It discusses IPv6 Protocols, as well as IP Quality of Service (QoS) and how it applies to Enterprise and Internet Service Provider (ISP) environments. In addition, Cisco wireless technologies are covered in detail. Cisco has placed a high priority on security and here readers will find complete coverage of all the Cisco Security products such as the PIX firewall suite of products, Network Address Translation (NAT), Cisco VPN Concentrator and IPSec, Cisco Authentication, Authorization, and Accounting (AAA), Content Services Switch (CSS), and the Cisco Secure Network Intrusion Detection System. This book is sure to become a dog eared reference for all Cisco engineers and administrators. - The one book that covers all major Cisco Internetworking concepts and configurations. - The only book to cross reference Cisco internetworking topics: Voice Over IP, Remote Access, Wireless, AVVID, and QoS. In addition, new technologies are covered in depth: AVVID, SIP, MGCP, and more. - A 1-stop reference for Cisco professionals needing coverage of core Cisco exam topics.
Managing Data in Motion describes techniques that have been developed for significantly reducing the complexity of managing system interfaces and enabling scalable architectures. Author April Reeve brings over two decades of experience to present a vendor-neutral approach to moving data between computing environments and systems. Readers will learn the techniques, technologies, and best practices for managing the passage of data between computer systems and integrating disparate data together in an enterprise environment. The average enterprise's computing environment is comprised of hundreds to thousands computer systems that have been built, purchased, and acquired over time. The data from these various systems needs to be integrated for reporting and analysis, shared for business transaction processing, and converted from one format to another when old systems are replaced and new systems are acquired. The management of the "data in motion" in organizations is rapidly becoming one of the biggest concerns for business and IT management. Data warehousing and conversion, real-time data integration, and cloud and "big data" applications are just a few of the challenges facing organizations and businesses today. Managing Data in Motion tackles these and other topics in a style easily understood by business and IT managers as well as programmers and architects. Presents a vendor-neutral overview of the different technologies and techniques for moving data between computer systems including the emerging solutions for unstructured as well as structured data types Explains, in non-technical terms, the architecture and components required to perform data integration Describes how to reduce the complexity of managing system interfaces and enable a scalable data architecture that can handle the dimensions of "Big Data"
Author: Craig Smith
Publisher: No Starch Press
Release Date: 2016-03-01
Genre: Technology & Engineering
Modern cars are more computerized than ever. Infotainment and navigation systems, Wi-Fi, automatic software updates, and other innovations aim to make driving more convenient. But vehicle technologies haven’t kept pace with today’s more hostile security environment, leaving millions vulnerable to attack. The Car Hacker’s Handbook will give you a deeper understanding of the computer systems and embedded software in modern vehicles. It begins by examining vulnerabilities and providing detailed explanations of communications over the CAN bus and between devices and systems. Then, once you have an understanding of a vehicle’s communication network, you’ll learn how to intercept data and perform specific hacks to track vehicles, unlock doors, glitch engines, flood communication, and more. With a focus on low-cost, open source hacking tools such as Metasploit, Wireshark, Kayak, can-utils, and ChipWhisperer, The Car Hacker’s Handbook will show you how to: –Build an accurate threat model for your vehicle –Reverse engineer the CAN bus to fake engine signals –Exploit vulnerabilities in diagnostic and data-logging systems –Hack the ECU and other firmware and embedded systems –Feed exploits through infotainment and vehicle-to-vehicle communication systems –Override factory settings with performance-tuning techniques –Build physical and virtual test benches to try out exploits safely If you’re curious about automotive security and have the urge to hack a two-ton computer, make The Car Hacker’s Handbook your first stop.
Author: Simon Singh
Release Date: 2011-01-26
In his first book since the bestselling Fermat's Enigma, Simon Singh offers the first sweeping history of encryption, tracing its evolution and revealing the dramatic effects codes have had on wars, nations, and individual lives. From Mary, Queen of Scots, trapped by her own code, to the Navajo Code Talkers who helped the Allies win World War II, to the incredible (and incredibly simple) logisitical breakthrough that made Internet commerce secure, The Code Book tells the story of the most powerful intellectual weapon ever known: secrecy. Throughout the text are clear technical and mathematical explanations, and portraits of the remarkable personalities who wrote and broke the world's most difficult codes. Accessible, compelling, and remarkably far-reaching, this book will forever alter your view of history and what drives it. It will also make you wonder how private that e-mail you just sent really is.
"... an engaging book that will empower readers in both large and small software development and engineering organizations to build security into their products. ... Readers are armed with firm solutions for the fight against cyber threats." —Dr. Dena Haritos Tsamitis. Carnegie Mellon University "... a must read for security specialists, software developers and software engineers. ... should be part of every security professional’s library." —Dr. Larry Ponemon, Ponemon Institute "... the definitive how-to guide for software security professionals. Dr. Ransome, Anmol Misra, and Brook Schoenfield deftly outline the procedures and policies needed to integrate real security into the software development process. ...A must-have for anyone on the front lines of the Cyber War ..." —Cedric Leighton, Colonel, USAF (Ret.), Cedric Leighton Associates "Dr. Ransome, Anmol Misra, and Brook Schoenfield give you a magic formula in this book - the methodology and process to build security into the entire software development life cycle so that the software is secured at the source! " —Eric S. Yuan, Zoom Video Communications There is much publicity regarding network security, but the real cyber Achilles’ heel is insecure software. Millions of software vulnerabilities create a cyber house of cards, in which we conduct our digital lives. In response, security people build ever more elaborate cyber fortresses to protect this vulnerable software. Despite their efforts, cyber fortifications consistently fail to protect our digital treasures. Why? The security industry has failed to engage fully with the creative, innovative people who write software. Core Software Security expounds developer-centric software security, a holistic process to engage creativity for security. As long as software is developed by humans, it requires the human element to fix it. Developer-centric security is not only feasible but also cost effective and operationally relevant. The methodology builds security into software development, which lies at the heart of our cyber infrastructure. Whatever development method is employed, software must be secured at the source. Book Highlights: Supplies a practitioner's view of the SDL Considers Agile as a security enabler Covers the privacy elements in an SDL Outlines a holistic business-savvy SDL framework that includes people, process, and technology Highlights the key success factors, deliverables, and metrics for each phase of the SDL Examines cost efficiencies, optimized performance, and organizational structure of a developer-centric software security program and PSIRT Includes a chapter by noted security architect Brook Schoenfield who shares his insights and experiences in applying the book’s SDL framework View the authors' website at http://www.androidinsecurity.com/
Routing and Switching Essentials Companion Guide is the official supplemental textbook for the Routing and Switching Essentials course in the Cisco® Networking Academy® CCNA® Routing and Switching curriculum. This course describes the architecture, components, and operations of routers and switches in a small network. You learn how to configure a router and a switch for basic functionality. By the end of this course, you will be able to configure and troubleshoot routers and switches and resolve common issues with RIPv1, RIPv2, single-area and multi-area OSPF, virtual LANs, and inter-VLAN routing in both IPv4 and IPv6 networks. The Companion Guide is designed as a portable desk reference to use anytime, anywhere to reinforce the material from the course and organize your time. The book’s features help you focus on important concepts to succeed in this course: Chapter objectives–Review core concepts by answering the focus questions listed at the beginning of each chapter. Key terms–Refer to the lists of networking vocabulary introduced and highlighted in context in each chapter. Glossary–Consult the comprehensive Glossary with more than 200 terms. Summary of Activities and Labs–Maximize your study time with this complete list of all associated practice exercises at the end of each chapter. Check Your Understanding–Evaluate your readiness with the end-of-chapter questions that match the style of questions you see in the online course quizzes. The answer key explains each answer. Related Title: Routing and Switching Essentials Lab Manual How To–Look for this icon to study the steps you need to learn to perform certain tasks. Interactive Activities–Reinforce your understanding of topics by doing all the exercises from the online course identified throughout the book with this icon. Videos–Watch the videos embedded within the online course. Packet Tracer Activities–Explore and visualize networking concepts using Packet Tracer exercises interspersed throughout the chapters. Hands-on Labs–Work through all the course labs and additional Class Activities that are included in the course and published in the separate Lab Manual.