IT Security Controls

A Guide to Corporate Standards and Frameworks
1. Auflage 2022
ISBN: 978-1-4842-7798-0
Verlag: Apress

Buch, Englisch, 354 Seiten, Format (B × H): 178 mm x 254 mm, Gewicht: 706 g

Use this reference for IT security practitioners to get an overview of the major standards and frameworks, and a proposed architecture to meet them. The book identifies and describes the necessary controls and processes that must be implemented in order to secure your organization's infrastructure.

The book proposes a comprehensive approach to the implementation of IT security controls with an easily understandable graphic implementation proposal to comply with the most relevant market standards (ISO 27001, NIST, PCI-DSS, and COBIT) and a significant number of regulatory frameworks from central banks across the World (European Union, Switzerland, UK, Singapore, Hong Kong, India, Qatar, Kuwait, Saudi Arabia, Oman, etc.).

To connect the book with the real world, a number of well-known case studies are featured to explain what went wrong with the biggest hacks of the decade, and which controls should have been in place to prevent them. The book also describes a set of well-known security tools available to support you.

What You Will Learn

• Understand corporate IT security controls, including governance, policies, procedures, and security awareness
• Know cybersecurity and risk assessment techniques such as penetration testing, red teaming, compliance scans, firewall assurance, and vulnerability scans
• Understand technical IT security controls for unmanaged and managed devices, and perimeter controls
• Implement security testing tools such as steganography, vulnerability scanners, session hijacking, intrusion detection, and more

Who This Book Is For

IT security managers, chief information security officers, information security practitioners, and IT auditors will use the book as a reference and support guide to conduct gap analyses and audits of their organizations’ IT security controls implementations.

Zielgruppe

Professional/practitioner

Autoren/Hrsg.

Kuyucu, Oben

Viegas, Virgilio

Fachgebiete

• Mathematik | Informatik EDV | Informatik Technische Informatik Computersicherheit
• Wirtschaftswissenschaften Betriebswirtschaft Management Risikomanagement

Inhaltsverzeichnis

About the authors

Introduction

Chapter 1. Standards and frameworks

ISO 27001

ISO 27002

ISO 27018 n17

NIST sp 800-53

NIST sp 800-160      

PCI DSS

Cloud standards

ISO 17789

NIST sp 500-292

Cobit for it security

CIS controls

Chapter 2. Corporate security controls

Information security processes and services

Security governance

Governance of information security (ISO 27014:2013)

Security metrics

Policies and procedures

Cyber security and risk assessment

Penetration testing

Red teaming

Owasp code review

Compliance scans

Vulnerability scans

Firewall assurance

Risk assessments

Security awareness

Security awareness training

Simulated attacks

Security operations center

Incident response and recovery

Threat hunting

Ediscovery/forensics

Threat intelligence

Cyber crisis management plan

Security engineering

Asset management

Configuration management and security baselines

Security architecture and design

It security technical controls

Off premises unmanaged devices

Secure connections

Clean pipes

DDOS protection

Ipsec / tls encryption

EMM – enterprise mobility management (mdm, mam, mcm)

NAC – network access control

Multi factor authentication

Managed devices

Active directory integration

SCCM – system center configuration manager

TPM – trusted platform module

VPN client

NAC – network access control (agent)

Data classification

UAM – user activity monitoring

Phishing reporting tool

Endpoint protection

Host ips / edr           

Desktop firewall

Antivirus

Antispyware

Full disk encryption

App-control / white-listing

Perimeter controls

Firewall

IDS / IPS

Proxy and content filtering

DLP – data leakage/loss protection

Honeypot

WAF – web application firewall

Ssl / vpn

Dns

Message security

Adfs

Sandbox

File integrity

Encrypted email

On premises controls

Mandatory requirements

Vlan segmentation

Criticality

Nature

Type

Security baselines

Redundancy

Load balancing

Production traffic encryption

Multilayer implementation

Tls decryption

Static routing

Disaster recovery

Time synchronization

Redundancy

Physical network segmentation

Distinct heartbeat interfaces

Centralized management

Default gateways

Sinkhole

Public key infrastructure

Security monitoring and enforcement

Privileged access management

Log concentrator

Identity and access management

Vulnerability management and penetration testing

Security information and event management

Database activity monitoring

Risk register

Single sign-on

Chapter 3. It security technical control matrix

Chapter 4. It security processes maturity level matrix

Chapter 5. More about cloud

ISO 17789 and NIST sp500-292 developed

IaaS

SaaS & secaas

Chapter 6. Security testing tools

Web applications attacks

Passive online password hacking

Steganography

Windows log tools

Vulnerability scanner

SQL injection

Wireless attacks

Session hijacking

Bluetooth attacks

Arp poisoning

Website mirroring

Intrusion detection

Mobile devices

Social engineering

IoT (internet of things)

Cloud security and tools

Chapter 7. Case Studies

Chapter 8. Acronyms

Über Autor(innen)

Virgilio Viegas, CISSP, CCSP, CISM, CISA, CRISC, CEH, has more than 25 years of experience in the banking sector, having worked in Europe, Asia and the Middle East. Currently he is the Group Head of International IT Security in one of the largest financial institutions in the Middle East and Africa with a strong presence across Europe, Africa and Asia.

Virgilio previously worked for more than 20 years for a major Portuguese financial institution, where he participated in the design and implementation of a Internet services reference platform and later developed an information security reference architecture.

While working in Asia, Virgilio developed projects related to information security, compliance, and retail such as Internet banking, ATM and POS network implementation, issuing and acquiring international card schemes, anti-money laundering, customer fingerprint authentication, amongst others. He also supported projects with significant impact in the Timor-Leste financial sector such as the definition of the country International Bank Account Number (IBAN) standard, the implementation of the Real Time Gross Settlement System (RTGS), and the national ATM and POS switch.

Oben Kuyucu, CISSP, CISA, has 15 years of experience in IT security, cybersecurity, governance, risk, compliance, and PCI DSS, as well as other international standards and regulations. Currently, he is an IT Security Governance and Oversight Senior Analyst at one of the largest financial institutions in the Middle East and Africa.

Oben previously worked as Senior Information Security Expert and PCI Qualified Security Assessor (QSA) at a leading information security company in Turkey. He was the first PCI 3DSecure Assessor and one of the first PCI QSAs in Turkey, and he carried out more than 150 IT security-related engagements, mainly related to PCI DSS and ISO 27001 internal audits.

Throughout his career Oben has performed PCI DSS auditing, system administration, design, penetration testing, security analysis, consulting, pre-sales activities and post-sales support for companies in Europe, Asia, and the Middle East. He also has made a significant contribution to many information security projects, including providing support to a PCI SSC Approved Scanning Vendor portal and transforming it into a governance, risk, and compliance vulnerability management tool.