Foreword |
|
ix | |
Introduction |
|
xi | |
Editors |
|
xvii | |
Contributors |
|
xix | |
|
Domain 1 Security Leadership & Management |
|
|
|
Security Leadership & Management |
|
|
1 | (4) |
|
|
5 | (3) |
|
|
8 | (10) |
|
|
8 | (4) |
|
|
12 | (6) |
|
Define the Security Governance Structure |
|
|
18 | (69) |
|
What Is Security Governance? |
|
|
18 | (1) |
|
Why Is Security Governance Necessary? |
|
|
18 | (1) |
|
Security Governance Roles |
|
|
19 | (1) |
|
Information Security Concepts |
|
|
20 | (13) |
|
System Development Life Cycle (SDLC) |
|
|
33 | (1) |
|
Enterprise System Security Framework |
|
|
34 | (6) |
|
Service Management Agreements |
|
|
40 | (3) |
|
Other Forms of Agreements |
|
|
43 | (1) |
|
|
43 | (10) |
|
Service Level Agreement Key Performance Indicators |
|
|
53 | (7) |
|
Information System Security Cycles |
|
|
60 | (2) |
|
Plan of Action and Milestones |
|
|
62 | (2) |
|
Managing the Security Organization |
|
|
64 | (2) |
|
Roles and Responsibilities |
|
|
66 | (7) |
|
Security Professional's Goals are to |
|
|
73 | (1) |
|
Security Professional's Goals are NOT to |
|
|
73 | (4) |
|
Security Awareness, Education, and Training |
|
|
77 | (10) |
|
Domain 2 Security Lifecycle Management |
|
|
|
Security Lifecycle Management |
|
|
87 | (4) |
|
Managing Security in Different Methods of Systems Development |
|
|
91 | (9) |
|
Systems Development Life Cycle |
|
|
91 | (9) |
|
Approval of Security Design |
|
|
100 | (59) |
|
|
100 | (3) |
|
|
103 | (4) |
|
|
107 | (3) |
|
|
110 | (11) |
|
|
121 | (5) |
|
|
126 | (1) |
|
Project under Development |
|
|
127 | (3) |
|
|
130 | (11) |
|
Service-Oriented Architecture Security |
|
|
141 | (2) |
|
|
143 | (1) |
|
|
143 | (1) |
|
Integrated System Testing |
|
|
143 | (1) |
|
|
143 | (1) |
|
Certification and Accreditation |
|
|
144 | (4) |
|
Prioritizing Threats and Vulnerabilities |
|
|
148 | (11) |
|
Domain 3 Security Compliance Management |
|
|
|
Security Compliance Management |
|
|
159 | (4) |
|
|
163 | (2) |
|
|
163 | (2) |
|
|
165 | (84) |
|
|
167 | (8) |
|
Enterprise Security Standard |
|
|
175 | (6) |
|
|
181 | (11) |
|
|
192 | (10) |
|
|
202 | (5) |
|
|
207 | (14) |
|
|
221 | (13) |
|
|
234 | (4) |
|
|
238 | (11) |
|
Domain 4 Contingency Management |
|
|
|
|
249 | (10) |
|
|
259 | (64) |
|
|
259 | (3) |
|
Policy Development and Strategy Planning |
|
|
262 | (9) |
|
Business Continuity Plan and Disaster Recovery Plan---Project Planning |
|
|
271 | (2) |
|
The Business Impact Analysis (BIA) Process |
|
|
273 | (4) |
|
Planning, Designing, and Development of Plans |
|
|
277 | (8) |
|
Risk Assessment and Management |
|
|
285 | (12) |
|
Contingency Management Summary |
|
|
297 | (11) |
|
|
308 | (6) |
|
|
314 | (9) |
|
Domain 5 Law, Ethics, and Incident Management |
|
|
|
Law, Ethics, and Incident Management |
|
|
323 | (4) |
|
Information Security Laws |
|
|
327 | (40) |
|
|
329 | (11) |
|
|
340 | (8) |
|
|
348 | (1) |
|
|
349 | (3) |
|
|
352 | (4) |
|
|
356 | (11) |
|
Security Incident Management Process |
|
|
367 | (26) |
|
Interviewing and Fact-Finding |
|
|
373 | (4) |
|
|
377 | (6) |
|
|
383 | (10) |
Appendix A Answers to Domain Review Questions |
|
393 | (34) |
Index |
|
427 | |