Information Assurance: Managing Organizational IT Security Risks
Written by two INFOSEC experts, this book provides a systematic and practical approach for establishing, managing and operating a comprehensive Information Assurance program. It is designed to provide ISSO managers, security managers, and INFOSEC professionals with an understanding of the essential issues required to develop and apply a targeted information security posture to both public and private corporations and government run agencies.
There is a growing concern among all corporations and within the security industry to come up with new approaches to measure an organization's information security risks and posture. Information Assurance explains and defines the theories and processes that will help a company protect its proprietary information including:
* The need to assess the current level of risk.
* The need to determine what can impact the risk.
* The need to determine how risk can be reduced.
The authors lay out a detailed strategy for defining information security, establishing IA goals, providing training for security awareness, and conducting airtight incident response to system compromise. Such topics as defense in depth, configuration management, IA legal issues, and the importance of establishing an IT baseline are covered in-depth from an organizational and managerial decision-making perspective.
What people are saying - Write a review
We haven't found any reviews in the usual places.
Other editions - View all
access control access control lists access paths accounts accreditation application approved assessment assets attacks authentication authorized automated availability awareness backups basic changes Chapter COBIT communications components Computer Security confidentiality configuration management connection control mechanisms Defense in Depth Defines Depth strategy detection determine devices digital signature document e-mail employees enclave boundary encryption ensure entity environment example files firewalls function hardware IA architecture IA education IA incidents IA manager IA needs IA policies IA program identify implemented individuals Information Assurance Information Systems Security INFOSEC integrity involves Layer mation monitoring operating system operational events orga organization organization’s IA baseline Organization’s IA Posture organizational IA organizational information password performance personnel privileged users procedures protection risk routers SANS Institute security mechanisms security requirements security services servers static passwords superuser system administrator technical threats tion unauthorized understand virus vulnerabilities workstation YES NO N/A