Complete Guide to CISM Certification

ISBN-13: 9780849353567 / Angielski / Twarda / 2006 / 474 str.

Thomas R. Peltier; Justin Peltier

Opis

Complete Guide to CISM Certification describes the tasks performed by information security managers and offers the necessary knowledge to manage, design, and oversee an information security program. The author explains each task and related knowledge statement, as well as applicable information security management principles, practices, and strategies. The book also covers the areas of information security governance, risk management, information security program management, information security management, and response management. With definitions and practical examples, this text is ideal for information security managers, IT auditors, and network and system administrators.

Recenzje

“Developed by Information Systems Audit and Controls Association, The Certified Information Security Manager certification program is aimed towards information security managers with five or more years of prior experience in enterprise information security management. … have structured their book along the same lines a s the certification class, presenting advanced information on information security governance, information security risk management, information security program management, information security management, and response management. …”
— In Book News Inc., June 2007

Spis treści

Information Security Governance
Functional Area Overview
Introduction
Developing an Information Security Strategy in Support of Business Strategy and Direction
Senior Management Commitment and Support
Definitions of Roles and Responsibilities
Obtaining Senior Management Commitment
Establish Reporting Communications That Support Information
Security Governance Activities
Legal and Regulatory Issues
Establish and Maintain Information Security Policies
Ensure the Development of Procedures and Guidelines
Develop Business Case and Enterprise Value Analysis Support
Summary
Questions
Information Security Risk Management
Functional Area Overview
Introduction
Develop a Systematic and Continuous Risk Management Process
Ensure Risk Identification, Analysis, and Mitigation Activities Are Integrated Into the Life Cycle Process
Apply Risk Identification and Analysis Methods
Define Strategies and Prioritize Options to Mitigate Risks to
Levels Acceptable to the Enterprise
Report Significant Changes in Risk
Knowledge Statements
Summary
Questions
Information Security Program Management
Functional Area Overview
CISM^® Mapping
Introduction
The OSI Model
The TCP/IP Model
IP Addressing
Transmission Control Protocol (TCP)
User Datagram Protocol (UDP)
Internet Control Message Protocol (ICMP)
CIA Triad
PPPN
Threats
Controls
Buffer Overflows versus Application Security
Virtual Private Networks (VPNs)
Web Server Security versus Internet Security
Security Testing
Summary
Questions
Information Security Management
Functional Area Overview
Introduction
Information Systems Comply
Ensure the Administrative Procedures for Information Systems Comply with the Enterprise’s Information Security Policy
Ensure Services Outsourced Are Consistent
Measure, Monitor, and Report on the Effectiveness and Efficiency of the Controls and Compliance with Information Security Policies
Ensure That Information Security Is Not Compromised Throughout the Change Management Process
Perform Vulnerability Assessments to Evaluate Effectiveness of Existing Controls
Ensure That Noncompliance Issues and Other Variances are Resolved in a Timely Manner
Information Security Awareness and Education
Summary
Questions
Response Management
Functional Area Overview
CISM Mapping
Introduction
Threat Source Information
Business Continuity Planning and Disaster Recovery Planning
Incident Response
Summary
Questions
Index

O autorze

Thomas R. Peltier, Justin Peltier