Acknowledgments |
|
xv | |
Introduction |
|
xvii | |
Chapter 1 Risk Concepts |
|
1 | (36) |
|
|
2 | (5) |
|
Goals of Information Security |
|
|
2 | (1) |
|
Supporting Security Goals |
|
|
3 | (4) |
|
|
7 | (12) |
|
Risk Terms and Definitions |
|
|
8 | (4) |
|
Standards, Frameworks, and Best Practices |
|
|
12 | (7) |
|
Business Perspective of IT Risk Management |
|
|
19 | (5) |
|
Business Goals and Objectives |
|
|
19 | (1) |
|
Business Information Criteria |
|
|
20 | (1) |
|
Organizational Structures |
|
|
21 | (1) |
|
Information Systems Architecture |
|
|
22 | (2) |
|
|
24 | (6) |
|
|
25 | (1) |
|
|
26 | (2) |
|
|
28 | (2) |
|
|
30 | (7) |
|
|
31 | (4) |
|
|
35 | (2) |
Chapter 2 Threats and Vulnerabilities in the Enterprise |
|
37 | (32) |
|
Threats and Vulnerabilities |
|
|
38 | (4) |
|
Identifying Threats and Vulnerabilities in the Enterprise |
|
|
38 | (4) |
|
Business Processes and Initiatives |
|
|
42 | (20) |
|
Environmental Risk Factors |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
44 | (1) |
|
Project and Program Management |
|
|
44 | (3) |
|
|
47 | (2) |
|
Systems Development Life Cycle |
|
|
49 | (4) |
|
|
53 | (1) |
|
Management of IT Operations |
|
|
54 | (2) |
|
|
56 | (2) |
|
Business Continuity and Disaster Recovery Management |
|
|
58 | (4) |
|
|
62 | (7) |
|
|
62 | (4) |
|
|
66 | (3) |
Chapter 3 Identifying and Managing Risk Scenarios |
|
69 | (22) |
|
Developing and Managing Risk Scenarios |
|
|
69 | (15) |
|
Risk Identification and Classification |
|
|
70 | (1) |
|
|
71 | (4) |
|
Developing Risk Scenarios |
|
|
75 | (5) |
|
|
80 | (2) |
|
|
82 | (2) |
|
|
84 | (7) |
|
|
84 | (4) |
|
|
88 | (3) |
Chapter 4 Risk Assessment and Analysis |
|
91 | (34) |
|
Risk Assessment Processes |
|
|
92 | (11) |
|
|
92 | (1) |
|
|
93 | (2) |
|
|
95 | (1) |
|
|
96 | (2) |
|
Performing a Risk Assessment |
|
|
98 | (5) |
|
Quantitative and Qualitative Techniques |
|
|
103 | (7) |
|
|
104 | (2) |
|
|
106 | (1) |
|
Combining Quantitative and Qualitative Techniques |
|
|
107 | (1) |
|
Other Analysis Techniques |
|
|
108 | (2) |
|
|
110 | (9) |
|
|
111 | (5) |
|
Reporting Risk Assessment Results |
|
|
116 | (3) |
|
|
119 | (6) |
|
|
119 | (4) |
|
|
123 | (2) |
Chapter 5 Risk Response and Mitigation |
|
125 | (34) |
|
|
126 | (5) |
|
Risk Response Standards and Frameworks |
|
|
127 | (4) |
|
Understanding Risk Response Options |
|
|
131 | (6) |
|
Evaluating Risk Response Options |
|
|
131 | (2) |
|
|
133 | (1) |
|
Prioritizing Risk Responses |
|
|
134 | (3) |
|
|
137 | (15) |
|
Risk Response Action Plans |
|
|
137 | (1) |
|
|
138 | (8) |
|
System Development Life Cycle |
|
|
146 | (2) |
|
|
148 | (1) |
|
Project Management Frameworks |
|
|
148 | (4) |
|
|
152 | (7) |
|
|
153 | (3) |
|
|
156 | (3) |
Chapter 6 Control and Risk Monitoring |
|
159 | (22) |
|
|
160 | (14) |
|
Control Testing and Assessment |
|
|
160 | (6) |
|
|
166 | (8) |
|
|
174 | (7) |
|
|
175 | (3) |
|
|
178 | (3) |
Chapter 7 Information Systems Control Concepts |
|
181 | (28) |
|
Information Security Control Concepts |
|
|
182 | (4) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
186 | (15) |
|
|
186 | (4) |
|
|
190 | (2) |
|
|
192 | (1) |
|
|
193 | (2) |
|
|
195 | (6) |
|
|
201 | (8) |
|
|
203 | (3) |
|
|
206 | (3) |
Chapter 8 Designing and Implementing Controls |
|
209 | (30) |
|
Business Perspectives of Controls |
|
|
210 | (23) |
|
Business Cases for Controls |
|
|
210 | (3) |
|
Regulatory Guidance and Controls |
|
|
213 | (3) |
|
Business Functions and Controls |
|
|
216 | (2) |
|
Information System Security Engineering |
|
|
218 | (6) |
|
|
224 | (3) |
|
|
227 | (1) |
|
|
228 | (5) |
|
|
233 | (6) |
|
|
234 | (3) |
|
|
237 | (2) |
Chapter 9 Measuring Risk and Control Effectiveness |
|
239 | (28) |
|
Applying Key Performance Indicators |
|
|
239 | (24) |
|
Key Performance Indicator Review |
|
|
240 | (1) |
|
Key Performance Indicator Development |
|
|
240 | (23) |
|
|
263 | (4) |
|
|
263 | (2) |
|
|
265 | (2) |
Appendix A The NIST Risk Management Framework |
|
267 | (8) |
|
|
268 | (2) |
|
|
268 | (1) |
|
|
268 | (1) |
|
|
269 | (1) |
|
|
270 | (5) |
|
Step 1: Categorize Information Systems |
|
|
270 | (1) |
|
Step 2: Select Security Controls |
|
|
270 | (2) |
|
Step 3: Implement Security Controls |
|
|
272 | (1) |
|
Step 4: Assess Security Controls |
|
|
273 | (1) |
|
Step 5: Authorize Information Systems |
|
|
273 | (1) |
|
Step 6: Monitor Security Controls |
|
|
274 | (1) |
Appendix B ISACA's Risk IT Framework |
|
275 | (10) |
|
|
275 | (4) |
|
|
277 | (1) |
|
|
277 | (2) |
|
|
279 | (1) |
|
|
279 | (1) |
|
RG1: Establish and Maintain a Common Risk View |
|
|
280 | (1) |
|
|
280 | (1) |
|
RG3: Make Risk-Aware Business Decisions |
|
|
280 | (1) |
|
|
280 | (2) |
|
|
281 | (1) |
|
|
281 | (1) |
|
RE3: Maintain Risk Profile |
|
|
281 | (1) |
|
|
282 | (3) |
|
|
282 | (1) |
|
|
283 | (1) |
|
|
283 | (2) |
Appendix C About the CD-ROM |
|
285 | (2) |
|
|
285 | (1) |
|
Total Tester Premium Practice Exam Software |
|
|
285 | (1) |
|
Installing and Running Total Tester Premium Practice Exam Software |
|
|
285 | (1) |
|
|
286 | (1) |
|
|
286 | (1) |
|
Total Seminars Technical Support |
|
|
286 | (1) |
|
McGraw-Hill Education Content Support |
|
|
286 | (1) |
Glossary |
|
287 | (8) |
Index |
|
295 | |