Doll / Rai / Granado Defending the Digital Frontier

A Security Agenda
1. Auflage 2003
ISBN: 978-0-471-46630-7
Verlag: John Wiley & Sons
Format: PDF
Kopierschutz: Adobe DRM (»Systemvoraussetzungen)

E-Book, Englisch, 238 Seiten, E-Book

"The charge of securing corporate America falls upon its businessleaders. This book, offered by Ernst & Young and written byMark Doll, Sajay Rai, and Jose Granado, is not only timely, butcomprehensive in outlook and broad in scope. It addresses many ofthe critical security issues facing corporate America today andshould be read by responsible senior management." --Former Mayor ofNew York, Rudolph W. Giuliani
"To achieve the highest possible level of digital security, everymember of an organization's management must realize that digitalsecurity is 'baked in,' not 'painted on.'" --from Defending theDigital Frontier: A Security Agenda
Like it or not, every company finds itself a pioneer in the digitalfrontier. And like all frontiers, this one involves exploration,potentially high returns . . . and high risks.
Consider this: According to Computer Economics, the worldwideeconomic impact of such recent attacks as Nimda, Code Red(s), andSircam worms totaled $4.4 billion. The "Love Bug" virus in 2000inflicted an estimated $8.75 billion in damage worldwide. Thecombined impact of the Melissa and Explorer attacks was $2.12billion. Companies were hurt as much in terms of image and publicconfidence as they were financially. Protecting the "digitalfrontier" is perhaps the greatest challenge facing businessorganizations in this millennium. It is no longer a function of ITtechnologists; it is a risk management operation requiringsponsorship by management at the highest levels.
Written by leading experts at Ernst & Young, Defending theDigital Frontier: A Security Agenda deconstructs digital securityfor executive management and outlines a clear plan for creatingworld-class digital security to protect your organization's assetsand people. Achieving and defending security at the DigitalFrontier requires more than just informed decision-making at thetop level. It requires a willingness to change your organization'smindset regarding security. Step by step, Defending the DigitalFrontier shows you how to accomplish that.
With detailed examples and real-world scenarios, the authorsexplain how to build-in the six characteristics that a world-classdigital security system must possess. You must make yoursystem:
* Aligned with the organization's overall objectives.
* Enterprise-wide, taking a holistic view of security needs for theentire, extended organization.
* Continuous, maintaining constant, real-time monitoring andupdating of policies, procedures, and processes.
* Proactive to effectively anticipate potential threats.
* Validated to confirm that appropriate risk management andmitigation measures are in place.
* Formal, so that policies, standards, and guidelines arecommunicated to every member of the organization.
An intrusion is bound to occur to even the most strongly defendedsystems. Will your organization be prepared to react, or lapse intochaos? Defending the Digital Frontier introduces the Restrict, Run,and Recover(r) model that guides organizations in formulating andimplementing a clear, enterprise-wide, Agenda for Action toanticipate, detect, and react effectively to intrusions. You willlearn how to roll out an effective Security Awareness and TrainingProgram, establish Incident Response procedures, and set in placeDigital Security Teams to control damage and manage risk in evenworst-case scenarios. The digital threat knows no borders andhonors no limits. But for the prepared organization, tremendousrewards await out on the digital frontier. By strengtheningcollective digital security knowledge from the top down anddeveloping a rock-solid, comprehensive, on-going security agenda,every organization can build a secure future. Defending the DigitalFrontier will get you there.

Autoren/Hrsg.

Doll, Mark W.

Rai, Sajay

Granado, Jose

Inhaltsverzeichnis

List of Figures and Tables.
Foreword.
Preface.
Acknowledgments.
PART ONE: THE CHALLENGE OF THE FRONTIER.
Chapter 1: The Security Frontier.
Identifying the Security Frontier.
Environment.
Responsibilities.
Priorities.
Challenges at the Frontier.
Threats and Vulnerabilities.
An Attack Scenario.
Chapter 2: Security Characteristics.
Aligned.
Enterprise-Wide.
Continuous.
Proactive.
Validated.
Formal.
Chapter 3: Organizational Components and Security Objectives.
Organizational Components.
People.
Process.
Technology.
Security Objectives.
Confidentiality, Integrity, and Availability.
Access Control.
PART TWO: THE AGENDA FOR ACTION.
Chapter 4: The Security Agenda.
Restrict, Run, and Recover(SM).
Security Agenda Items.
Planning, Architecture, Operations, and Monitoring Capabilities.
Organizational Model.
Capabilities.
Chapter 5: The Three Rs of Digital Security.
Restrict.
Intrusion and Virus Detection.
Incident Response.
Privacy.
Policies, Standards, and Guidelines.
Physical Security.
Run.
Asset and Service Management.
Vulnerability Management.
Entitlement Management.
Recover.
Business Continuity Planning.
PART THREE: THE APPROACH FOR SAFETY.
Chapter 6: The Security Culture.
The Chief Executive as an Agent of Change.
Instill a Heightened Sense of Awareness.
Build a Digital Security Guidance Council.
Establish a Time Table and Monitor Progress.
Roll Out an Enterprise-Wide Security Awareness and Training Program.
Chapter 7: The Risk Frontier.
Modeling and Defining Digital Security Risk.
Low and Slow Scenario: Lessons to Be Learned.
High-Impact Risk Scenario: Lessons to Be Learned.
Containment and Control Scenarios: Lessons to Be Learned.
Approaching Risk Management.
Chapter 8: Road Map for Success.
Positioning the Organization within the Industry.
Resource Allocation.
Insuring against Digital Security Events.
Table-Top Exercises.
The Orbit of Regard.
Appendix A: Security-Related Laws and Regulations.
U.S. Laws.
The USA Patriot Act of 2001.
The Digital Privacy Act of 2000.
The Electronic Communications Privacy Act of 1986, 2000.
The Gramm Leach Bliley (GLB) Act of 1999 (Financial Services Modernization Act).
The Electronic Freedom of Information Act of 1996 161 The Healthcare Insurance Portability and Accountability Act (HIPAA) of 1996.
The National Information Infrastructure Protection Act of 1996.
The Computer Security Act of 1987.
The Computer Fraud and Abuse Act of 1986.
The Computer Crime Control Act of 1984.
U.S. Federal Privacy Act of 1974.
U.S. Regulations, Agencies, and Guidelines.
The National Infrastructure Assurance Council (NIAC, 1999).
Federal Guidelines for Searching and Seizing Computers (U.S. Dept. of Justice, 2001).
International Laws, Regulations, and Guidelines Related to Digital Security and Privacy.
Australia.
European Union.
India.
Japan.
Malaysia.
Mauritius.
Philippines.
Poland.
United Kingdom.
Appendix B: Threat Vectors.
2002 Top 10 Digital Security Threat Vectors.
Appendix C: Ernst & Young 2002 Digital Security Overview: An Executive Guide and Diagnostic.
Endnotes.
Glossary of Digital Security Terminology.
Index.

Über Autor(innen)

ERNST & YOUNG is one of the nation's leading professionalservices firms, providing tax, assurance, and advisory businessservices to thousands of individuals as well as domestic and globalbusinesses.
MARK W. DOLL is a Partner and the Americas Director of Ernst &Young's Security Services. As the Americas Director, Mark isresponsible overall for security projects, including securityassessments, architecture design, and security implementation aswell as business continuity. Mr. Doll is a sought-after speaker onthe topic of digital security, and has recently appeared before theHouse Energy and Commerce Subcommittee on Commerce, Trade, andConsumer Protection as an expert witness on the subject.
SAJAY RAI is a Partner in Ernst & Young's SecurityServices. He is a Certified Information Systems SecurityProfessional (CISSP) and is a frequent speaker on the topics ofsecurity and business continuity. He serves on the advisory boardof several organizations.
JOSE GRANADO is a Partner in Ernst & Young's SecurityServices, and Director of the Advanced Security Center focused onattack and penetration services. He is a Certified InformationSystems Security Professional (CISSP).