Wheeler Security Risk Management

Building an Information Security Risk Management Program from the Ground Up
1. Auflage 2011
ISBN: 978-1-59749-616-2
Verlag: Elsevier Science & Techn.
Format: EPUB
Kopierschutz: 6 - ePub Watermark

E-Book, Englisch, 360 Seiten

Security Risk Management is the definitive guide for building or running an information security risk management program. This book teaches practical techniques that will be used on a daily basis, while also explaining the fundamentals so students understand the rationale behind these practices. It explains how to perform risk assessments for new IT projects, how to efficiently manage daily risk activities, and how to qualify the current risk level for presentation to executive level management. While other books focus entirely on risk analysis methods, this is the first comprehensive text for managing security risks. This book will help you to break free from the so-called best practices argument by articulating risk exposures in business terms. It includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment. It explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk. It also presents a roadmap for designing and implementing a security risk management program. This book will be a valuable resource for CISOs, security managers, IT managers, security consultants, IT auditors, security analysts, and students enrolled in information security/assurance college programs. - Named a 2011 Best Governance and ISMS Book by InfoSec Reviews - Includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment - Explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk - Presents a roadmap for designing and implementing a security risk management program

Evan Wheeler currently is a Director of Information Security for Omgeo (A DTCC | Thomson Reuters Company), an instructor at both Clark and Northeastern Universities, and the author of the Information Security Risk Management course for the SANS Institute. Previously he spent six years as a Security Consultant for the U.S. Department of Defense.

Autoren/Hrsg.

Wheeler, Evan

Inhaltsverzeichnis

1;Front Cover;1
2;Security Risk Management: Building an InformationSecurity Risk Management Program from the Ground Up;4
3;Copyright;5
4;Table of Contents;6
5;Preface;14
5.1;Intended Audience;15
5.2;Organization of This Book;16
5.3;Acknowledgments;20
5.4;About the Author;21
5.5;About the Technical Editor;21
6;Part I: Introduction to Risk Management;22
6.1;Chapter 1. The Security Evolution;24
6.1.1;Introduction;24
6.1.2;How We Got Here;24
6.1.3;A Risk-Focused Future;27
6.1.4;Information Security Fundamentals;29
6.1.5;The Death of Information Security;37
6.1.6;Summary;40
6.1.7;References;40
6.2;Chapter 2. Risky Business;42
6.2.1;Introduction;42
6.2.2;Applying Risk Management to Information Security;42
6.2.3;Business-Driven Security Program;49
6.2.4;Security as an Investment;55
6.2.5;Qualitative versus Quantitative;58
6.2.6;Summary;61
6.2.7;References;62
6.3;Chapter 3. The Risk Management Lifecycle;64
6.3.1;Introduction;64
6.3.2;Stages of the Risk Management Lifecycle;64
6.3.3;Business Impact Assessment;69
6.3.4;A Vulnerability Assessment Is Not a Risk Assessment;71
6.3.5;Making Risk Decisions;74
6.3.6;Mitigation Planning and Long-Term Strategy;77
6.3.7;Process Ownership;80
6.3.8;Summary;81
7;Part II: Risk Assessment and AnalysisTechniques;82
7.1;Chapter 4. Risk Profiling;84
7.1.1;Introduction;84
7.1.2;How Risk Sensitivity Is Measured;84
7.1.3;Asking the Right Questions;92
7.1.4;Assessing Risk Appetite;102
7.1.5;Summary;105
7.1.6;Reference;106
7.2;Chapter 5. Formulating a Risk;108
7.2.1;Introduction;108
7.2.2;Breaking Down a Risk;108
7.2.3;Who or What Is the Threat?;116
7.2.4;Summary;123
7.2.5;References;124
7.3;Chapter 6. Risk Exposure Factors;126
7.3.1;Introduction;126
7.3.2;Qualitative Risk Measures;126
7.3.3;Risk Assessment;138
7.3.4;Summary;145
7.3.5;Reference;146
7.4;Chapter 7. Security Controls and Services;148
7.4.1;Introduction;148
7.4.2;Fundamental Security Services;148
7.4.3;Recommended Controls;165
7.4.4;Summary;166
7.4.5;Reference;167
7.5;Chapter 8. Risk Evaluation and Mitigation Strategies;168
7.5.1;Introduction;168
7.5.2;Risk Evaluation;168
7.5.3;Risk Mitigation Planning;175
7.5.4;Policy Exceptions and Risk Acceptance;177
7.5.5;Summary;182
7.6;Chapter 9. Reports and Consulting;184
7.6.1;Introduction;184
7.6.2;Risk Management Artifacts;184
7.6.3;A Consultant’s Perspective;186
7.6.4;Writing Audit Responses;204
7.6.5;Summary;208
7.6.6;References;209
7.7;Chapter 10. Risk Assessment Techniques;210
7.7.1;Introduction;210
7.7.2;Operational Assessments;210
7.7.3;Project-Based Assessments;219
7.7.4;Third-Party Assessments;226
7.7.5;Summary;232
7.7.6;References;233
8;Part III: Building and Running a Risk Management Program;234
8.1;Chapter 11. Threat and Vulnerability Management;236
8.1.1;Introduction;236
8.1.2;Building Blocks;236
8.1.3;Threat Identification;241
8.1.4;Advisories and Testing;243
8.1.5;An Efficient Workflow;249
8.1.6;The FAIR Approach;251
8.1.7;Summary;257
8.1.8;References;258
8.2;Chapter 12. Security Risk Reviews;260
8.2.1;Introduction;260
8.2.2;Assessing the State of Compliance;260
8.2.3;Implementing a Process;263
8.2.4;Process Optimization: A Review of Key Points;272
8.2.5;The NIST Approach;274
8.2.6;Summary;278
8.2.7;References;278
8.3;Chapter 13. A Blueprint for Security;280
8.3.1;Introduction;280
8.3.2;Risk in the Development Lifecycle;280
8.3.3;Security Architecture;284
8.3.4;Patterns and Baselines;294
8.3.5;Architectural Risk Analysis;299
8.3.6;Summary;304
8.3.7;Reference;305
8.4;Chapter 14. Building a Program from Scratch;306
8.4.1;Introduction;306
8.4.2;Designing a Risk Program;306
8.4.3;Prerequisites for a Risk Management Program;312
8.4.4;Risk at the Enterprise Level;316
8.4.5;Linking the Program Components;319
8.4.6;Program Roadmap;321
8.4.7;Summary;323
8.4.8;Reference;323
9;Appendix A: Sample Security Risk Profile;324
9.1;A. General Information;324
9.2;B. Information Sensitivity;324
9.3;C Regulatory Requirements;327
9.4;D. Business Requirements;328
9.5;E. Definitions;329
10;Appendix B: Qualitative Risk Scale Reference Tables;330
11;Appendix C: Architectural Risk Analysis Reference Tables;334
11.1;Baseline Security Levels and Sample Controls;334
11.2;Security Enhancement Levels and Sample Controls;340
11.3;Mapping Security Levels;348
12;Index;352