Atnaujinkite slapukų nuostatas

Managing Risk In Information Systems 3rd Revised edition [Minkštas viršelis]

3.27/5 (39 ratings by Goodreads)
,
  • Formatas: Paperback / softback, 450 pages, weight: 737 g
  • Išleidimo metai: 20-Nov-2020
  • Leidėjas: Jones and Bartlett Publishers, Inc
  • ISBN-10: 1284183718
  • ISBN-13: 9781284183719
Kitos knygos pagal šią temą:
Managing Risk In Information Systems 3rd Revised editionDidesnis paveikslėlis
  • Formatas: Paperback / softback, 450 pages, weight: 737 g
  • Išleidimo metai: 20-Nov-2020
  • Leidėjas: Jones and Bartlett Publishers, Inc
  • ISBN-10: 1284183718
  • ISBN-13: 9781284183719
Kitos knygos pagal šią temą:
Pastovi nuoroda: https://www.kriso.lt/db/9781284183719.html
Raktažodžiai:
PART OF THE JONES & BARTLETT LEARNING INFORMATION SYSTEMS SECURITY & ASSURANCE SERIES

Revised and updated with the latest data in the field, the Second Edition of Managing Risk in Information Systems provides a comprehensive overview of the SSCP® Risk, Response, and Recovery Domain in addition to providing a thorough overview of risk management and its implications on IT infrastructures and compliance. Written by industry experts, and using a wealth of examples and exercises, this book incorporates hands-on activities to walk the reader through the fundamentals of risk management, strategies and approaches for mitigating risk, and the anatomy of how to create a plan that reduces risk.

Instructor's Material for Managing Risk in Information Systems include:

PowerPoint Lecture Slides Instructor's Guide Course Syllabus Quiz & Exam Questions Case Scenarios/Handouts
Preface xix
Acknowledgments xxiii
About the Authors xxv
PART ONE Risk Management Business Challenges
1(108)
Chapter 1 Risk Management Fundamentals
3(24)
What Is Risk?
4(1)
Compromise of Business Functions
5(1)
Threats, Vulnerabilities, Assets, and Impact
6(3)
Classify Business Risks
9(1)
Risks Posed by People
10(1)
Risks Posed by a Lack of Process
11(1)
Risks Posed by Technology
12(2)
Risk Identification Techniques
14(1)
Identifying Threats
14(2)
Identifying Vulnerabilities
16(1)
Assessing Impact and Likelihood
17(2)
Risk Management Process
19(1)
Cost-Benefit Analysis
20(1)
Profitability Versus Survivability
21(2)
Risk-Handling Strategies
23(1)
Avoiding
23(1)
Sharing or Transferring
23(1)
Mitigating
23(1)
Accepting
24(1)
Residual Risk
24(1)
Chapter Summary
25(1)
Key Concepts And Terms
25(1)
Chapter 1 Assessment
26(1)
Chapter 2 Managing Risk: Threats, Vulnerabilities, and Exploits
27(28)
Understanding and Protecting Assets
28(1)
Understanding and Managing Threats
28(1)
Uncontrollable Nature of Threats
29(1)
Unintentional Threats
29(1)
Intentional Threats
30(2)
Best Practices for Managing Risk Within an IT Infrastructure
32(1)
EY Global Information Security Survey 2018-2019
33(1)
Understanding and Managing Vulnerabilities
34(1)
Threat/Vulnerability Pairs
34(1)
Vulnerabilities Can Be Mitigated
35(1)
Mitigation Techniques
35(4)
Best Practices for Managing Vulnerabilities Within an IT Infrastructure
39(1)
Understanding and Managing Exploits
39(1)
What Is an Exploit?
39(3)
How Do Perpetrators Initiate an Exploit?
42(2)
Where Do Perpetrators Find Information About Vulnerabilities and Exploits?
44(1)
Mitigation Techniques
45(1)
Best Practices for Managing Exploits Within an IT Infrastructure
46(1)
U.S. Federal Government Risk Management Initiatives
46(1)
National Institute of Standards and Technology
47(2)
Department of Homeland Security
49(1)
National Cybersecurity and Communications Integration Center
49(1)
U.S. Computer Emergency Readiness Team
49(1)
The MITRE Corporation and the CVE List
50(2)
Chapter Summary
52(1)
Key Concepts And Terms
53(1)
Chapter 2 Assessment
53(2)
Chapter 3 Understanding and Maintaining Compliance
55(28)
U.S. Compliance Laws
56(1)
Federal Information Security Modernization Act
57(1)
Health Insurance Portability and Accountability Act
57(3)
Gramm-Leach-BlileyAct
60(1)
Sarbanes-Oxley Act
60(1)
Family Educational Rights and Privacy Act
60(1)
Children's Internet Protection Act
61(1)
Children's Online Privacy Protection Act
61(1)
Regulations Related to Compliance
62(1)
Securities and Exchange Commission
63(1)
Federal Deposit Insurance Corporation
63(1)
Department of Homeland Security
63(1)
Federal Trade Commission
64(1)
State Attorney General
65(1)
U.S. Attorney General
65(1)
Organizational Policies for Compliance
66(1)
Standards and Guidelines for Compliance
67(1)
Payment Card Industry Data Security Standard
67(2)
National Institute of Standards and Technology
69(1)
Generally Accepted Information Security Principles
70(1)
Control Objectives for Information and Related Technology
70(2)
International Organization for Standardization
72(1)
International Electrotechnical Commission
73(1)
Information Technology Infrastructure Library
74(2)
Capability Maturity Model Integration
76(1)
General Data Protection Regulation
77(1)
Department of Defense Information Assurance Certification and Accreditation Process
78(1)
Chapter Summary
79(1)
Key Concepts And Terms
79(1)
Chapter 3 Assessment
80(3)
Chapter 4 Developing a Risk Management Plan
83(26)
Objectives of a Risk Management Plan
84(1)
Objectives Example: Website
85(1)
Objectives Example: HIPAA Compliance
86(1)
Scope of a Risk Management Plan
87(1)
Scope Example: Website
88(1)
Scope Example: HIPAA Compliance
89(1)
Assigning Responsibilities
89(1)
Responsibilities Example: Website
90(1)
Responsibilities Example: HIPAA Compliance
90(2)
Describing Procedures and Schedules for Accomplishment
92(1)
Procedures Example: Website
93(1)
Procedures Example: HIPAA Compliance
93(1)
Reporting Requirements
94(1)
Presenting Recommendations
94(5)
Documenting Management Response to Recommendations
99(1)
Documenting and Tracking Implementation of Accepted Recommendations
99(1)
Plan of Action and Milestones
100(2)
Charting the Progress of a Risk Management Plan
102(1)
Milestone Plan Chart
102(1)
Gantt Chart
103(1)
Critical Path Chart
104(1)
Steps of the NIST Risk Management Framework
104(1)
Chapter Summary
105(1)
Key Concepts And Terms
105(1)
Chapter 4 Assessment
106(3)
PART TWO Mitigating Risk
109(188)
Chapter 5 Defining Risk Assessment Approaches
111(24)
Understanding Risk Assessments
112(1)
Importance of Risk Assessments
113(1)
Purpose of a Risk Assessment
113(1)
Critical Components of a Risk Assessment
114(1)
Identifying Scope
114(1)
Identifying Critical Areas
115(1)
Identifying Team Members
116(1)
Types of Risk Assessments
116(1)
Quantitative Risk Assessments
116(3)
Qualitative Risk Assessments
119(7)
Comparing Quantitative and Qualitative Risk Assessments
126(1)
Risk Assessment Challenges
127(1)
Using a Static Process to Evaluate a Moving Target
127(1)
Availability of Resources and Data
128(1)
Data Consistency
129(1)
Estimating Impact Effects
130(1)
Providing Results That Support Resource Allocation and Risk Acceptance
131(1)
Best Practices for Risk Assessment
132(1)
Chapter Summary
133(1)
Key Concepts And Terms
133(1)
Chapter 5 Assessment
133(2)
Chapter 6 Performing a Risk Assessment
135(26)
Selecting a Risk Assessment Methodology
136(1)
Defining the Assessment
137(2)
Reviewing Previous Findings
139(1)
Identifying the Management Structure
140(1)
Identifying Assets and Activities Within Risk Assessment Boundaries
141(1)
System Access and Availability
142(1)
System Functions
142(2)
Hardware and Software Assets
144(1)
Personnel Assets
144(1)
Data and Information Assets
144(1)
Facilities and Supplies
145(1)
Identifying and Evaluating Relevant Threats
145(1)
Reviewing Historical Data
146(1)
Performing Threat Modeling
146(1)
Identifying and Evaluating Relevant Vulnerabilities
147(1)
Vulnerability Assessments
147(1)
Exploit Assessments
148(1)
Identifying and Evaluating Controls
149(1)
In-Place and Planned Controls
149(1)
Control Categories
149(3)
Selecting a Methodology Based on Assessment Needs
152(1)
Quantitative Method
153(1)
Qualitative Method
154(1)
Developing Mitigating Recommendations
155(1)
Threat/Vulnerability Pairs
155(1)
Estimate of Cost and Time to Implement
155(1)
Estimate of Operational Impact
156(1)
Cost-Benefit Analysis
157(1)
Presenting Risk Assessment Results
157(1)
Best Practices for Performing Risk Assessments
157(1)
Chapter Summary
158(1)
Key Concepts And Terms
159(1)
Chapter 6 Assessment
159(2)
Chapter 7 Identifying Assets and Activities to Be Protected
161(26)
System Access and Availability
162(2)
System Functions: Manual and Automated
164(1)
Manual Methods
164(1)
Automated Methods
165(1)
Hardware Assets
166(1)
Software Assets
167(2)
Personnel Assets
169(1)
Data and Information Assets
169(2)
Organization
171(1)
Customer
172(1)
Intellectual Property
172(1)
Data Warehousing and Data Mining
173(2)
Asset and Inventory Management Within the Seven Domains of a Typical IT Infrastructure
175(1)
User Domain
176(1)
Workstation Domain
176(1)
LAN Domain
177(1)
LAN-to-WAN Domain
177(1)
WAN Domain
178(1)
Remote Access Domain
178(1)
System/Application Domain
178(1)
Identifying Facilities and Supplies Needed to Maintain Business Operations
179(1)
Mission-Critical Systems and Applications Identification
179(1)
Business Impact Analysis Planning
180(1)
Business Continuity Planning
181(1)
Disaster Recovery Planning
182(1)
Business Liability Insurance Planning
183(1)
Asset Replacement Insurance Planning
183(1)
Chapter Summary
184(1)
Key Concepts And Terms
184(1)
Chapter 7 Assessment
184(3)
Chapter 8 Identifying and Analyzing Threats, Vulnerabilities, and Exploits
187(28)
Threat Assessments
188(3)
Techniques for Identifying Threats
191(3)
Best Practices for Threat Assessments Within the Seven Domains of a Typical IT Infrastructure
194(1)
Vulnerability Assessments
195(2)
Review of Documentation
197(1)
Review of System Logs, Audit Trails, and Intrusion Detection and Prevention System Outputs
198(1)
Vulnerability Scans and Other Assessment Tools
199(1)
Audits and Personnel Interviews
200(1)
Process Analysis and Output Analysis
201(1)
System Testing
202(3)
Best Practices for Performing Vulnerability Assessments Within the Seven Domains of a Typical IT Infrastructure
205(1)
Exploit Assessments
206(1)
Identifying Exploits
207(3)
Mitigating Exploits with a Gap Analysis and Remediation Plan
210(1)
Implementing Configuration or Change Management
210(1)
Verifying and Validating the Exploit Has Been Mitigated
211(1)
Best Practices for Performing Exploit Assessments Within an IT Infrastructure
211(1)
Chapter Summary
212(1)
Key Concepts And Terms
212(1)
Chapter 8 Assessment
212(3)
Chapter 9 Identifying and Analyzing Risk Mitigation Security Controls
215(26)
In-Place Controls
216(1)
Planned Controls
216(1)
Control Categories
217(1)
NIST Control Families
217(3)
Procedural Control Examples
220(1)
Policies and Procedures
220(2)
Security Plans
222(1)
Insurance and Bonding
223(1)
Background and Financial Checks
224(1)
Data Loss Prevention Program
225(1)
Education, Training, and Awareness
225(1)
Rules of Behavior
226(1)
Software Testing
227(1)
Technical Control Examples
227(1)
Logon Identifier
228(1)
Session Time-Out
228(1)
System Logs and Audit Trails
229(1)
Data Range and Reasonableness Checks
229(1)
Firewalls and Routers
230(2)
Encryption
232(1)
Public Key Infrastructure
233(2)
Physical Control Examples
235(1)
Locked Doors, Guards, Access Logs, and Closed-Circuit Television
235(1)
Fire Detection and Suppression
236(1)
Water Detection
237(1)
Temperature and Humidity Detection
237(1)
Electrical Grounding and Circuit Breakers
238(1)
Best Practices for Risk Mitigation Security Controls
239(1)
Chapter Summary
239(1)
Key Concepts And Terms
239(1)
Chapter 9 Assessment
240(1)
Chapter 10 Planning Risk Mitigation Throughout an Organization
241(28)
Where Should an Organization Start with Risk Mitigation?
242(1)
What Is the Scope of Risk Management for an Organization?
243(1)
Critical Business Operations
244(1)
Customer Service Delivery
245(1)
Mission-Critical Business Systems, Applications, and Data Access
246(3)
Seven Domains of a Typical IT Infrastructure
249(3)
Information Systems Security Gap
252(1)
Understanding and Assessing the Impact of Legal and Compliance Issues on an Organization
253(2)
Legal Requirements, Compliance Laws, Regulations, and Mandates
255(2)
Assessing the Impact of Legal and Compliance Issues on an Organization's Business Operations
257(4)
Translating Legal and Compliance Implications for an Organization
261(1)
Assessing the Impact of Legal and Compliance Implications on the Seven Domains of a Typical IT Infrastructure
261(1)
Assessing How Security Countermeasures, Controls, and Safeguards Can Assist With Risk Mitigation
262(1)
Understanding the Operational Implications of Legal and Compliance Requirements
263(1)
Identifying Risk Mitigation and Risk Reduction Elements for the Entire Organization
263(1)
Performing a Cost-Benefit Analysis
264(1)
Best Practices for Planning Risk Mitigation Throughout an Organization
265(1)
Chapter Summary
266(1)
Key Concepts And Terms
266(1)
Chapter 10 Assessment
267(2)
Chapter 11 Turning a Risk Assessment into a Risk Mitigation Plan
269(28)
Reviewing the Risk Assessment for the IT Infrastructure
270(1)
Overlapping Countermeasures
271(1)
Risk Assessments: Understanding Threats and Vulnerabilities
272(1)
Identifying Countermeasures
273(3)
Translating a Risk Assessment into a Risk Mitigation Plan
276(1)
Cost to Implement
276(4)
Time to Implement
280(3)
Operational Impact
283(1)
Prioritizing Risk Elements That Require Risk Mitigation
283(1)
Using a Threat Likelihood/Impact Matrix
284(1)
Prioritizing Countermeasures
284(2)
Verifying Risk Elements and How They Can Be Mitigated
286(1)
Performing a Cost-Benefit Analysis on the Identified Risk Elements
287(1)
Calculating the CBA
287(1)
A CBA Report
288(1)
Implementing a Risk Mitigation Plan
289(1)
Staying Within Budget
289(1)
Staying on Schedule
290(2)
Following Up on the Risk Mitigation Plan
292(1)
Ensuring Countermeasures Have Been Implemented
293(1)
Ensuring Security Gaps Have Been Closed
293(1)
Best Practices for Enabling a Risk Mitigation Plan from the Risk Assessment
294(1)
Chapter Summary
295(1)
Key Concepts And Terms
295(1)
Chapter 11 Assessment
296(1)
PART THREE Risk Mitigation Plans
297(108)
Chapter 12 Mitigating Risk with a Business Impact Analysis
299(24)
What Is a Business Impact Analysis?
300(1)
Collecting Data
301(1)
Varying Data Collection Methods
302(1)
Defining the Scope of the Business Impact Analysis
302(2)
Objectives of a Business Impact Analysis
304(1)
Identifying Critical Business Functions
305(1)
Identifying Critical Resources
306(2)
Identifying the MAO and Impact
308(2)
Identifying Recovery Requirements
310(2)
Steps of a Business Impact Analysis Process
312(1)
Identifying the Environment
313(1)
Identifying Stakeholders
313(1)
Identifying Critical Business Functions
314(1)
Identifying Critical Resources
314(1)
Identifying the MAO
315(1)
Identifying Recovery Priorities
315(1)
Developing the BIA Report
316(1)
Identifying Mission-Critical Business Functions and Processes
317(1)
Mapping Business Functions and Processes to IT Systems
318(1)
Best Practices for Performing a BIA for an Organization
319(1)
Chapter Summary
320(1)
Key Concepts And Terms
320(1)
Chapter 12 Assessment
320(3)
Chapter 13 Mitigating Risk with a Business Continuity Plan
323(26)
What Is a Business Continuity Plan?
324(1)
Elements of a BCP
325(1)
Purpose
326(1)
Scope
326(1)
Assumptions and Planning Principles
327(2)
System Description and Architecture
329(4)
Responsibilities
333(3)
Notification and Activation Phase
336(3)
Recovery Phase
339(1)
Reconstitute Phase (Return to Normal Operations)
340(2)
Plan Training, Testing, and Exercises
342(2)
Plan Maintenance
344(2)
How Does a BCP Mitigate an Organization's Risk?
346(1)
Best Practices for Implementing a BCP for an Organization
346(1)
Chapter Summary
347(1)
Key Concepts And Terms
347(1)
Chapter 13 Assessment
347(2)
Chapter 14 Mitigating Risk with a Disaster Recovery Plan
349(28)
What Is a Disaster Recovery Plan?
350(2)
Need for a DRP
352(1)
Purpose of a DRP
352(1)
Critical Success Factors
352(1)
What Management Must Provide
353(1)
What DRP Developers Need
353(2)
Primary Concerns
355(7)
Disaster Recovery Financial Budget
362(1)
Elements of a DRP
362(1)
Purpose
363(1)
Scope
364(1)
Disaster/Emergency Declaration
365(1)
Communications
365(1)
Emergency Response
366(1)
Activities
366(1)
Recovery Procedures
367(2)
Critical Operations, Customer Service, and Operations Recovery
369(1)
Restoration and Normalization
370(1)
Testing
370(1)
Maintenance and DRP Update
371(1)
How Does a DRP Mitigate an Organization's Risk?
372(1)
Best Practices for Implementing a DRP for an Organization
372(2)
Chapter Summary
374(1)
Key Concepts And Terms
374(1)
Chapter 14 Assessment
374(3)
Chapter 15 Mitigating Risk with a Computer Incident Response Team Plan
377(28)
What Is a Computer Incident Response Team Plan?
378(1)
Purpose of a CIRT Plan
379(2)
Elements of a CIRT Plan
381(1)
CIRT Members
381(4)
CIRT Policies
385(1)
Incident Handling Process
386(8)
Communication Escalation Procedures
394(1)
Incident Handling Procedures
395(5)
How Does a CIRT Plan Mitigate an Organization's Risk?
400(1)
Best Practices for Implementing a CIRT Plan for an Organization
400(1)
Chapter Summary
401(1)
Key Concepts And Terms
401(1)
Chapter 15 Assessment
402(3)
Appendix A Answer Key 405(2)
Appendix B Standard Acronyms 407(4)
Glossary of Key Terms 411(12)
References 423(4)
Index 427
Darril Gibson, (ISC)2 SSCP and CISSP, CompTIA Security+ and CASP, is the CEO of YCDA (short for You Can Do Anything), and he has authored or coauthored more than 40 books. Darril regularly writes, consults, and teaches on a wide variety of technical and security topics and holds several certifications. He regularly posts blog articles at http://blogs.getcertifiedgetahead.com/ about certification topics and uses that site to help people stay abreast of changes in certification exams. He loves hearing from readers, especially when they pass an exam after using one of his books, and you can contact him through the blogging site.

Andy Igonor has spent over 20 years working with various organizations in creating and enhancing their business processes & workflows, selecting, and implementing complex automated information technology solutions. Some of these solutions include enterprise resource planning (ERP) systems for clients in manufacturing, production, oil & gas, and food & beverage industries. He has also implemented learning management solutions (LMS) for clients in the education sector, as well as electronic health and medical record (EHR/EMR) systems for clients in healthcare. He has consulted for several clients in Canada including the Government of Alberta, Health Canada, Alberta Medical Association/the Physician Office System Program (POSP) and the Business Development Bank of Canada. He has also worked internationally with clients in Singapore, the United Arab Emirates, and the USA. Andy currently works at WGU as an Associate Dean and Director of Academic Programs, Information Technology/Cloud Computing.