Libro Managing Information Security Risks de Alberts, Christopher J./ Dorofee, Audrey J.

Tabla de Contenidos del libro

List of Figures

List of Tables

xxi

Preface

xxv

Acknowledgments

xxxi

Part I Introduction

(40)

Managing Information Security Risks

(14)

Information Security

(4)

What Is Information Security?

(1)

Vulnerability Assessment

(1)

Information Systems Audit

(1)

Information Security Risk Evaluation

(1)

Managed Service Providers

(1)

Implementing a Risk Management Approach

(1)

Information Security Risk Evaluation and Management

(3)

Evaluation Activities

(1)

Risk Evaluation and Management

(1)

An Approach to Information Security Risk Evaluations

(6)

OCTAVE Approach

(1)

Information Security Risk

(1)

Three Phases

(1)

OCTAVE Variations

(1)

Common Elements

(3)

Principles and Attributes of Information Security Risk Evaluations

(24)

Introduction

(1)

Information Security Risk Management Principles

(7)

Information Security Risk Evaluation Principles

(1)

Risk Management Principels

(2)

Organizational and Cultural Principles

(1)

Information Security Risk Evaluation Attributes

(9)

Information Security Risk Evaluation Outputs

(7)

Phase 1: Build Asset-Based Threat Profiles

(1)

Phase 2: Identify Infrastructure Vulnerabilities

(1)

Phase 3: Develop Security Strategy and Plans

(4)

Part II The OCTAVE Method

(198)

Introduction to the OCTAVE Method

(16)

Overview of the OCTAVE Method

(8)

Prepartion

(1)

Phase 1: Build Asset-Based Threat Profiles

(2)

Phase 2: Identify Infrastructure Vulnerabilities

(1)

Phase 3: Develop Security Strategy and Plans

(3)

Mapping Attributes and Outputs to the OCTAVE Method

(4)

Attributes and the OCTAVE Method

(2)

Outputs and the OCTAVE Method

(2)

Introduction to the Sample Scenario

(3)

Preparing for OCTAVE

(22)

Overview of Preparation

(1)

Obtain Senior Management Sponsorship of OCTAVE

(3)

Select Analysis Team Members

(4)

Select Operational Areas to Participate in OCTAVE

(1)

Select Participants

(4)

Coordinate Logistics

(3)

Sample Scenario

(5)

Identifying Organizational Knowledge (Processes 1 to 3)

(28)

Overview of Processes 1 to 3

(5)

Identify Assets and Relative Priorites

(6)

Identify Areas of Concern

(4)

Identify Security Requirements for Most Important Assets

(6)

Capture Knowledge of Current Security Practices and Organizational Vulnerabilities

103

(6)

Creating Threat Profiles (Process 4)

109

(28)

Overview of Process 4

110

(8)

Before the Workshop: Consolidate Information from Processes 1 to 3

118

(4)

Select Critical Assets

122

(3)

Refine Security Requirements for Critical Assets

125

(3)

Identify Threats to Critical Assets

128

(9)

Identifying Key Components (Process 5)

137

(20)

Overview of Process 5

138

(4)

Identify Key Classes of Components

142

(8)

Identify Infrastructure Components to Examine

150

(7)

Evaluating Selected Components (Process 6)

157

(12)

Overview of Process 6

158

(3)

Before the Workshop: Run Vulnerability Evaluation Tools on Selected Infrastructure Components

161

(4)

Review Technology Vulnerabilities and Summarize Results

165

(4)

Conducting the Risk Analysis (Process 7)

169

(22)

Overview of Process 7

170

(2)

Identify the Impact of Threats to Critical Assets

172

(3)

Create Risk Evaluation Criteria

175

(5)

Evaluate the Impact of Threats to Critical Assets

180

(4)

Incorporating Probability into the Risk Analysis

184

(7)

What Is Probability?

184

(3)

Probability in the OCTAVE Method

187

(4)

Developing a Protection Strategy---Workshop A (Process 8A)

191

(36)

Overview of Process 8A

192

(2)

Before the Workshop: Consolidate Information from Processes 1 to 3

194

(5)

Review Risk Information

199

(2)

Create Protection Strategy

201

(7)

Create Risk Mitigation Plans

208

(9)

Create Action List

217

(3)

Incorporating Probability into Risk Mitigation

220

(7)

Developing a Protection Strategy---Workshop B (Process 8B)

227

(12)

Overview of Process 8B

228

(2)

Before the Workshop: Prepare to Meet with Senior Management

230

(1)

Present Risk Information

231

(1)

Review and Refine Protection Strategy, Mitigation Plans, and Action List

232

(3)

Create Next Steps

235

(2)

Summary of Part II

237

(2)

Part III Variations on the OCTAVE Approach

239

(54)

An Introduction to Tailoring OCTAVE

241

(14)

The Range of Possibilities

242

(3)

Tailoring the OCTAVE Method to Your Organization

245

(10)

Tailoring the Evaluation

245

(5)

Tailoring Artifacts

250

(5)

Practical Applications

255

(20)

Introduction

256

(1)

The Small Organization

257

(8)

Company S

257

(2)

Implementing OCTAVE in Small Organizations

259

(6)

Very Large, Dispersed Organizations

265

(2)

Integrated Web Portal Service Providers

267

(3)

Large and Small Organizations

270

(2)

Other Considerations

272

(3)

Information Security Risk Management

275

(18)

Introduction

276

(3)

A Framework for Managing Information Security Risks

279

(9)

Identify

281

(1)

Analyze

282

(1)

Plan

283

(1)

Implement

284

(1)

Monitor

285

(1)

Control

286

(2)

Implementing Information Security Risk Management

288

(2)

Summary

290

(3)

Glossary

293

(8)

Bibliography

301

(10)

Appendix A Case Scenario for the OCTAVE Method

311

(52)

A.1 MedSite OCTAVE Final Report: Introduction

312

(1)

A.2 Protection Strategy for MedSite

312

(4)

A.2.1 Near-Term Action Items

315

(1)

A.3 Risks and Mitigation Plans for Critical Assets

316

(19)

A.3.1 Paper Medical Records

317

(3)

A.3.2 Personal Computers

320

(2)

A.3.3 PIDS

322

(5)

A.3.4 ABC Systems

327

(3)

A.3.5 ECDS

330

(5)

A.4 Technology Vulnerability Evaluation Results and Recommended Actions

335

(5)

A.5 Additional Information

340

(23)

A.5.1 Risk Impact Evaluation Criteria

341

(2)

A.5.2 Other Assets

343

(1)

A.5.3 Consolidated Survey Results

344

(19)

Appendix B Worksheets

363

(80)

B.1 Knowledge Elicitation Worksheets

363

(26)

B.1.1 Asset Worksheet

365

(2)

B.1.2 Areas of Concern Worksheet

367

(2)

B.1.3 Security Requirements Worksheet

369

(1)

B.1.4 Practice Surveys

370

(16)

B.1.5 Protection Strategy Worksheet

386

(3)

B.2 Asset Profile Worksheets

389

(26)

B.2.1 Critical Asset Information

390

(1)

B.2.2 Security Requirements

391

(2)

B.2.3 Threat Profile for Critical Asset

393

(6)

B.2.4 System(s) of Interest

399

(1)

B.2.5 Key Classes of Components

400

(2)

B.2.6 Infrastructure Components to Examine

402

(2)

B.2.7 Summarize Technology Vulnerabilities

404

(2)

B.2.8 Record Action Items

406

(1)

B.2.9 Risk Impact Descriptions

407

(3)

B.2.10 Risk Evaluation Criteria Worksheet

410

(2)

B.2.11 Risk Profile Worksheet

412

(1)

B.2.12 Risk Mitigation Plans

412

(3)

B.3 Strategies and Actions

415

(28)

B.3.1 Current Security Practices Worksheets

415

(20)

B.3.2 Protection Strategy Worksheets

435

(6)

B.3.3 Action List Worksheet

441

(2)

Appendix C Catalog of Practices

443

(14)

About the Authors

457

(4)

Index

461

Si compras este libro el...	Te llegará el...
Lunes antes de las 16:00 hrs	Martes
Martes antes de las 16:00 hrs	Miércoles
Miércoles antes de las 16:00 hrs	Jueves
Jueves antes de las 16:00 hrs	Viernes
Viernes antes de las 16:00 hrs	Lunes
Sábados y domingos	Martes

Managing Information Security Risks

por Alberts, Christopher J. ; Dorofee, Audrey J.

Introduccion A La Biologia Celular 2e