Information Security Management Handbook [Sixth Edition]

Buy Save With Amazon Book Store

Information Security Management Handbook [Sixth Edition]
Book Details
- Hardcover: 3280 pages
- Publisher: AUERBACH; 6 edition (May 14, 2007)
- Language: English
- ISBN-10: 0849374952
- ISBN-13: 978-0849374951

Book Description
Never before have there been so many laws designed to keep corporations honest. New laws and regulations force companies to develop stronger ethics policies and the shareholders themselves are holding publicly traded companies accountable for their practices. Consumers are also concerned over the privacy of their personal information and current and emerging legislation is reflecting this trend. Under these conditions, it can be difficult to know where to turn for reliable, applicable advice.

The sixth edition of the Information Security Management Handbook addresses up-to-date issues in this increasingly important area. It balances contemporary articles with relevant articles from past editions to bring you a well grounded view of the subject. The contributions cover questions important to those tasked with securing information assets including the appropriate deployment of valuable resources as well as dealing with legal compliance, investigations, and ethics. Promoting the view that the management ethics and values of an organization leads directly to its information security program and the technical, physical, and administrative controls to be implemented, the book explores topics such as risk assessments; metrics; security governance, architecture, and design; emerging threats; standards; and business continuity and disaster recovery. The text also discusses physical security including access control and cryptography, and a plethora of technology issues such as application controls, network security, virus controls, and hacking.

US federal and state legislators continue to make certain that information security is a board-level conversation and the Information Security Management Handbook, Sixth Edition continues to ensure that there you have a clear understanding of the rules and regulations and an effective method for their implementation.

Book Info
Handbook includes chapters that correspond to the 10 domains of the Certified Information System Security Professional (CISSP) examination. Previous edition: c1999. DLC: Computer security--Management--Handbooks, manuals, etc. --This text refers to an out of print or unavailable edition of this title.

IT Auditing: Using Controls to Protect Information Assets [Book]

Save 37% On Amazon Book Store

IT Auditing: Using Controls to Protect Information Assets
Book Details :

- Paperback: 387 pages
- Publisher: McGraw-Hill Osborne Media; 1 edition (December 22, 2006)
- Language: English
- ISBN-10: 0072263431
- ISBN-13: 978-0072263435

Book Description
Protect Your Systems with Proven IT Auditing Strategies

"A must-have for auditors and IT professionals." -Doug Dexter, CISSP-ISSMP, CISA, Audit Team Lead, Cisco Systems, Inc.

Plan for and manage an effective IT audit program using the in-depth information contained in this comprehensive resource. Written by experienced IT audit and security professionals, IT Auditing: Using Controls to Protect Information Assets covers the latest auditing tools alongside real-world examples, ready-to-use checklists, and valuable templates. Inside, you'll learn how to analyze Windows, UNIX, and Linux systems; secure databases; examine wireless networks and devices; and audit applications. Plus, you'll get up-to-date information on legal standards and practices, privacy and ethical issues, and the CobiT standard.

Build and maintain an IT audit function with maximum effectiveness and value

-Implement best practice IT audit processes and controls
-Analyze UNIX-, Linux-, and Windows-based operating systems
-Audit network routers, switches, firewalls, WLANs, and mobile devices
-Evaluate entity-level controls, data centers, and disaster recovery plans
-Examine Web servers, platforms, and applications for vulnerabilities
-Review databases for critical controls
-Use the COSO, CobiT, ITIL, ISO, and NSA INFOSEC methodologies
-Implement sound risk analysis and risk management practices
-Drill down into applications to find potential control weaknesses

About the Author

Chris Davis, CISA, CISSP, shares his experience from architecting, hardening, and auditing systems. He has trained auditors and forensic analysts. Davis is the coauthor of the bestselling Hacking Exposed: Computer Forensics.

Mike Schiller, CISA, has 14 years of experience in the IT audit field, most recently as the worldwide IT Audit Manager at Texas Instruments.

Kevin Wheeler, CISA, CISSP, NSA IAM/IEM, is the founder and CEO of InfoDefense and has over ten years of IT security experience.

Information Security : Design, Implementation, Measurement, and Compliance

ORDER THIS BOOK

Author : Timothy P. Layton
Product Details
Hardcover : 222 pages
Publisher : AUERBACH; 1 edition (July 20, 2006)
Language : English
ISBN-10 : 0849370876
ISBN-13 : 978-0849370878

Table of Contents
EVALUATING AND MEASURING AN INFORMATION SECURITY PROGRAM
INFORMATION SECURITY RISK ASSESSMENT MODEL (ISRAM�)
. Background
. Linkage
. Risk Assessment Types
. Relationship to Other Models and Standards
. Terminology
. Risk Assessment Relationship
. Information Security Risk Assessment Model (ISRAM)
. References
GLOBAL INFORMATION SECURITY ASSESSMENT METHODOLOGY (GISAM�)
. GISAM and ISRAM Relationship
. GISAM Design Criteria
. General Assessment Types
. GISAM Components
. References
DEVELOPING AN INFORMATION SECURITY EVALUATION (ISE�) PROCESS
. The Culmination of ISRAM and GISAM
. Business Process
A SECURITY BASELINE
. KRI Security Baseline Controls
. Security Baseline
. Information Security Policy Document
. Management Commitment to Information Security
. Allocation of Information Security Responsibilities
. Independent Review of Information Security
. Identification of Risks Related to External Parties
. Inventory of Assets
. Classification Guidelines
. Screening
. Information Security Awareness, Education, and Training
. Removal of Access Rights
. Physical Security Perimeter
. Protecting Against External and Environmental Threats
. Secure Disposal or Reuse of Equipment
. Documented Operating Procedures
. Change Management
. Segregation of Duties
. System Acceptance
. Controls against Malicious Code
. Management of Removable Media
. Information Handling Procedures
. Physical Media in Transit
. Electronic Commerce
. Access Control Policy
. User Registration
. Segregation in Networks
. Teleworking
. Security Requirements Analysis and Specification
. Policy on the Use of Cryptographic Controls
. Protection of System Test Data
. Control of Technical Vulnerabilities
. Reporting Information Security Events
. Including Information Security in the Business Continuity Process
. Identification of Applicable Legislation
. Data Protection and Privacy of Personal Information
. Technical Compliance Checking
. References
BACKGROUND OF THE ISO/IEC 17799 STANDARD
. History of the Standard
. Internals of the Standard
. Guidance for Use
. High-Level Objectives
. ISO/IEC Defined
. References
ISO/IEC 17799:2005 GAP ANALYSIS
. Overview
. Guidance for Use
. General Changes
. Security Policy
. Organization of Information Security
. Asset Management
. Human Resources Security
. Physical and Environmental Security
. Communications and Operations Management
. Access Control
. Information Systems Acquisition, Development, and Maintenance
. Information Security Incident Management
. Business Continuity Management
. Compliance
. References

ANALYSIS OF ISO/IEC 17799:2005 (27002) CONTROLS
SECURITY POLICY
. Information Security Policy
. Summary
. References
ORGANIZATION OF INFORMATION SECURITY
. Internal Organization
. External Parties
. Summary
. References
ASSET MANAGEMENT
. Responsibility for Assets
. Information Classification
. Summary
. References
HUMAN RESOURCES SECURITY
. Prior to Employment
. During Employment
. Termination or Change of Employment
. Summary
. References
PHYSICAL AND ENVIRONMENTAL SECURITY
. Secure Areas
. Equipment Security
. Summary
. References
COMMUNICATIONS AND OPERATIONS MANAGEMENT
. Operational Procedures and Responsibilities
. Third-Party Service Delivery Management
. System Planning and Acceptance
. Protection against Malicious and Mobile Code
. Backup
. Network Security Management
. Media Handling
. Exchange of Information
. Electronic Commerce Services
. Monitoring
. Summary
. References
ACCESS CONTROL
. Business Requirements for Access Control
. User Access Management
. User Responsibilities
. Network Access Control
. Operating System Access Control
. Application and Information Access Control
. Mobile Computing and Teleworking
. Summary
. References
INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT, AND MAINTENANCE
. Security Requirements of Information Systems
. Correct Processing in Applications
. Cryptographic Controls
. Security of System Files
. Security in Development and Support Processes
. Technical Vulnerability Management
. Summary
. References
INFORMATION SECURITY INCIDENT MANAGEMENT
. Reporting Information Security Events and Weaknesses
. Management of Information Security Incidents and Improvements
. Summary
. References
BUSINESS CONTINUITY MANAGEMENT
. Information Security Aspects of Business Continuity Management
. Summary
. References
COMPLIANCE
. Compliance with Legal Requirements
. Compliance with Security Policies and Standards, and Technical Compliance
. Information Systems Audit Considerations
. Summary
. References
APPENDIX A: ISO STANDARDS CITED IN ISO/IEC 17799:2005 APPENDIX B: GENERAL REFERENCES INDEX

-------------------------------------------------------------

Editorial Reviews
I have had the pleasure of working with Tim on several large risk assessment projects and I have tremendous respect for his knowledge and experience as an information security practitioner. … Risk assessment is the cornerstone of an effective information security program. … striving to achieve compliance in the absence of a risk-based security strategy can only lead to failure. … Implement an effective risk assessment program and take control of the compliance monster. … This book will help you do just that. I know you will benefit from Tim's guidance on how to get the most from your risk assessment efforts. For today's information security leaders, there is not a topic more important.
-From the Foreword by Gary Geddes, CISSP, Strategic Security Advisor, Microsoft Corporation

-------------------------------------------------------------

Book Description
Organizations rely on digital information today more than ever before. Unfortunately, that information is equally sought after by criminals. New security standards and regulations are being implemented to deal with these threats, but they are very broad and organizations require focused guidance to adapt the guidelines to their specific needs. Fortunately, Information Security: Design, Implementation, Measurement, and Compliance outlines a complete roadmap to successful adaptation and implementation of a security program based on the ISO/IEC 17799:2005 (27002) Code of Practice for Information Security Management. The book first describes a risk assessment model, a detailed risk assessment methodology, and an information security evaluation process. Upon this foundation, the author presents a proposed security baseline for all organizations, an executive summary of the ISO/IEC 17799 standard, and a gap analysis exposing the differences between the recently rescinded version and the newly released version of the standard. Finally, he devotes individual chapters to each of the 11 control areas defined in the standard, covering systematically the 133 controls within the 39 control objectives. Tim Layton's Information Security is a practical tool to help you understand the ISO/IEC 17799 standard and apply its principles within your organization's unique context.

-------------------------------------------------------------

What Documents can I read to help me prepare for BS7799?

There are a number of documents that are available, in addition to the BS 7799 and ISO17799 standards themselves, and these include:

From BSI

- Information Security Management: An Introduction (PD 3000);
- Preparing for BS 7799 Certification (PD 3001);
- Guide to BS 7799 Risk Assessment and Risk Management (PD 3002);
- Are you ready for a BS 7799 Audit? (PD 3003);
- Guide to BS7799 Auditing (PD 3004);
- Guide on the Selection of BS 7799 Controls (PD 3005).

Other publishers

- ISO Guide 62 – General Requirements for Bodies Operating Assessment / Registration of Quality Systems (to merge with ISO Guide 66 to become ISO 17021);
- EA-7/03 – Guidelines for the Accreditation of Bodies Operating Certification/ Registration of Information Security Management Systems;
- ISO 19011 – Guidelines for Quality and / or Environmental Management Systems Auditing.

A number of books have been published on the BS 7799 process, a check of the local IT Bookshop or Amazon should provide numerous titles from which to choose.

The types of Audit that may be undertaken in an organization

There are a number of audits that may be undertaken in an organisation, and these include:

- First Party (Internal Audit) – Within an organisation, internal review etc;

- Second Party (Supplier Audit) – Of a supplier or contractor

- Third Party Audit – By a CB

Back to : How does the BS7799 / ISO 27001 certification audit process actually work?
Source : http://17799-news.the-hamster.com/interviews/interview4-audit.htm

Information Security Management Handbook, Fifth Edition, Volume 2 (Information Security Management Handbook) (Hardcover)

Buy This Book
Amazon.com

Details
- Hardcover: 578 pages
- Publisher: AUERBACH; 5 edition (December 28, 2004)
- Language: English
- ISBN-10: 0849332109
- ISBN-13: 978-0849332104

Book Description

Since 1993, the Information Security Management Handbook has served not only as an everyday reference for information security practitioners but also as an important document for conducting the intense review necessary to prepare for the Certified Information System Security Professional (CISSP) examination. Now completely revised and updated and in its fifth edition, the handbook maps the ten domains of the Information Security Common Body of Knowledge and provides a complete understanding of all the items in it. This is a "must have" book, both for preparing for the CISSP exam and as a comprehensive, up-to-date reference.

Book Info
Handbook includes chapters that correspond to the 10 domains of the Certified Information System Security Professional (CISSP) examination. Previous edition: c1999. DLC: Computer security--Management--Handbooks, manuals, etc. --This text refers to an out of print or unavailable edition of this title.

Risk Analysis and the Security Survey, Third Edition (Hardcover)

Risk Analysis and the Security Survey, Third Edition (Hardcover)

Order Now

Product Details

• Hardcover: 392 pages
• Publisher: Butterworth-Heinemann; 3 edition (February 22, 2006)
• Language: English
• ISBN-10: 0750679220
• ISBN-13: 978-0750679220
• Product Dimensions: 10.3 x 7.4 x 1.2 inches

Editorial Reviews

Review
Security is an element of risk management, asserts James F. Broder in the third edition of his classic Risk Analysis and the Security Survey. And he ably backs up that statement in this wonderfully written book, which should be required reading for all current and future security professionals.-Jerry D. Loghry, Security Management, March 2007

Review
'...it provides the reader with a thorough understanding of the vital subjects of risk analysis and the art/science of conducting and producing effective, results-oriented security surveys. It is written to meet the needs of security professionals from student to master. Broder and his contributing authors have addressed today's changes while retaining the spirit, quality, and fundamental principles described in the first edition. As we evolve into an information based society, the principles and advice in this book will serve the reader well, particularly when dealing with the increasing demands of asset protection, information protection, high technology issues, terrorism, and unkown risks. An excellent book in its original iteration, this edition is far superior to the first. It is highly recommended both an as excellent resource and as a study aid the CPP examination.' - Security Management

This text sets out to understand the principles of risk analysis and to relate these to security students and professionals. Its aim is to help those individuals produce more effective results-oriented security surveys geared to the ever-changing needs of the organization. -The Computer Law and Security Report

The text takes the reader through the relevant issues based on a fundamental philosophy of risk control that the program should be as self-sufficient as possible in all matters pertaining to security. -The Computer Law and Security Report

As a study text for those involved in security risk analysis this book would be an important addition to a professional's library, but it would also be very valuable to an investigator involved in post-incident investigations. -The Institute of Professional Investigators

The 1984 edition was still in the ASIS "top-ten" before the compilation of this volume, indicating what security professionals think of it's value as a security text book. -The Institute of Professional Investigators --This text refers to an out of print or unavailable edition of this title.

Book Description
Security and risk management are principally concerned with the protection and conservation of corporate assets and resources. The task of protection continues to be an increasingly complex one in a time when technology is creating new products (and thus risk) at an explosive rate. Add this to the crime rate -- now aggravated by domestic and international terrorism -- and the importance of risk analysis and evaluation to design proper protection becomes self-evident.

With an awareness of the growing threat of global terrorism, the third edition of RISK ANALYSIS AND THE SECURITY SURVEY has been completely updated. It includes two new chapters covering disaster recover planning, mitigation, and the evolving methodologies that are a result of the Homeland Security Act. The following topics will also be added and covered among the various chapters: contingency planning, testing of disaster response plan, managing during a crisis, maintaining and testing a response plan (team drills, etc.), bomb threats and suicide bombings, and prevention techniques to better prepare business for new post 9/11 security risks.

- Covers Business Impact Analysis (BIA), Project Planning, Data Collection, Data Analysis and Report of Findings, and Prediction of Criminal Behavior
- Presents updated statistical information and practical case examples
- Helps professionals and students produce more effective results-oriented security surveys

Card catalog description
"Risk Analysis and the Security Survey, Second Edition provides an understanding of the principles of risk analysis to security students and professionals. It will help them produce more effective, results-oriented security surveys geared to the ever-changing needs of the organization."--BOOK JACKET. "The most fundamental philosophy of risk control, design, and implementation is to make the program as self-sufficient as possible in all matters pertaining to security. This includes the two-sided coin of risk control: (1) the protection of assets by identifying, analyzing, and prioritizing the risk, and (2) contingency and disaster recovery planning."--BOOK JACKET. --This text refers to an out of print or unavailable edition of this title.

About the Author
James F. Broder, CFE, CPP, BCFE, has more than 35 years experience in security and law enforcement. He has worked as a security executive, instructor, and consultant as well as having served in Vietnam as a Police Advisor in the Counter Insurgency Directorate, Vietnamese National Police. A former FBI Special Agent and employee for the US State Department, Mr. Border is considered to be one of the most highly recognized security authorities in the United States.


Table of Content

Acknowledgments
Introdution
1.RISK
2.VULNERBILITY AND THREAT IDENTIFICATION
3.RISK MEASUREMENT
4.QUANTIFYING AND PRIORITIZING LOSS POTENTIAL
5.COST/BENEFIT ANALYSIS
6.THE SECURITY SURVEY: AN OVERVIEW
7.MANAGEMENT AUDIT TECHNIQUES AND THE PRELIMINARY SURVEY
8.THE SURVEY REPORT
9.CRIME PREDICTION
10.DETERMINING INSURANCE REQUIREMENTS
11.BUSINESS IMPACT ANALYSIS
12.BUSINESS CONTINUITY PLANNING
13.PLAN DOCUMENTATION
14.RESPONSE PLANNING
15.CRSIS MANADEMENT PLANNING FOR KINDNAP, EXTORTION, OR RANDOM
16.MONITORING SAFEGUARDS
17.THE SECURITY CONSULTANT

APPENDICES
A. Security Survey Work Sheets
B. Danger Signs of Fraud, Embezzlement, and Theft
C. Professional Pratices for Bisiness Continuity Plan
D. Sample BIA Introdution Letter
E. Sample Kindnap and Random Contingency Plan
F. How to Establish Notice
G. Handling Media Inquiries
H. Security System Specifications
I. Sample Introdution Memorandum: Disaster Recovery Planning
Index

Order Now

Nine Steps to Success: an ISO 27001 Implementation Overview

Nine Steps to Success: an ISO 27001 Implementation Overview




This book is the ideal guide for anyone tackling - or about to tackle - ISO27001 for the first time. It gives a clear overview of:

• how to get management and board buy-in;
• how to get cross-organizational, cross functional buy-in;
• the gap analysis: how much do you really need to do?
• the relationship between ISO27001 and ISO17799;
• how to integrate with ISO9001 and other management systems;
• how to structure and resource your project;
• use consultants or do it youself?
• the PDCA cycle;
• the timetable and project plan;
• risk assessment methodologies and tools;
• the documentation challenges;
• how to choose a certification body;
• and much more.

Read about and learn to apply the 6 secrets for a positive certification audit - and achieve the project goal painlessly!

Completely updated to reflect all the changes to both ISO 17799 and ISO 27001, this popular book is one you can't afford to be without!

Product Details

• Paperback: 120 pages
• Author: Alan Calder
• Publisher: IT Governance Ltd (January 1, 2006)
• Language: English.
• Format: Soft Covers
• ISBN-10: 1905356129
• ISBN-13: 978-1905356126
• Product Dimensions: 8.3 x 5.5 x 0.4 inches

Alan Calder, the author of "IT Governance: a Manager's Guide to Data Protection and BS7799/ISO17799" (now in its 3rd edition and the Open University's post graduate information security text book), led one of the first successful BS7799 certification efforts in the world. He is also a member of the certification committee of a global certification body. This book contains the experience and secrets drawn from many successful BS7799 implementations.

Order This Book

Good Ebook

Risk Management Guide for Information Technology Systems
(NIST Special Publication 800-30)
INTRODUCTION
Every organization has a mission. In this digital era, as organizations use automated information technology (IT) systems1 to process their information for better support of their missions, risk management plays a critical role in protecting an organization’s information assets, and therefore its mission, from IT-related risk.
An effective risk management process is an important component of a successful IT security program. The principal goal of an organization’s risk management process should be to protect the organization and its ability to perform their mission, not just its IT assets. Therefore, the risk management process should not be treated primarily as a technical function carried out by the IT experts who operate and manage the IT system, but as an essential management function of the organization.
Risk Management Guide for Information Technology Systems