Information Security Management : Concepts and Practice

ISBN-13: 9781420078541 / Angielski / Twarda / 2010 / 871 str.

Bel G. Raggad

Opis

Corporate information security is crucial for generating continuous business value in the modern world. Information security audits remain a critical component of achieving corporate security. This book presents a security audit methodology that conforms to the new security standard ISO 27001. Detailed sections illustrate how to conduct a nominal security audit that conforms with the ISO 17799 standard and a technical security audit for certification against the ISO 27001. Along with case studies that demonstrate implementation, the text provides a detailed methodology that explains how to devise a risk-driven security program as well as an effective information security management system.

Recenzje

… a comprehensive overview of security topics related to the management and development of secure systems. This rich collection of literature reviews matches every stage of security management, implementation, and deployment. … The extensive breakdown of risk analysis and threat assessment will be of particular interest to practitioners with background in this area… one of the most comprehensive works to date on the topic, and includes lengthy examples of how to determine and manage the risks associated with a new development project. The book describes most, if not all, security paradigms that are in practice today in terms of analyzing the goals of a project and establishing priorities. … a valuable resource for anyone conducting research in the field of information security as well as for experienced managers seeking to concentrate on security in future endeavors. Summing Up: Highly recommended.
— T.D. Richardson, South University, in CHOICE, November 2010, Vol. 48 No. 03

Spis treści

INTRODUCTION. Introduction to Information Security Management. Introduction to Management Concepts. The Information Security Life Cycle. SECURITY PLAN. Security Plan. Security Policy. Business Continuity Planning. SECURITY ANALYSIS. Security Risk Management. Continual Security: Integrated Fault-Event Analysis and Response Framework (IFEAR). Active Security Assessment. System Availability. SECURITY DESIGN. Nominal Security Enhancement Design Based on ISO/IEC 27002. Technical Security Enhancement Based on ISO/IEC 27001. SECURITY IMPLEMENTATION. Security Solutions. The Common Criteria. SECURITY REVIEW. Security Review through Security Audit. Privacy Rights, Information Technology, and HIPAA. CONTINUAL SECURITY. The Sarbanes–Oxley Act and IT Compliance. Cyberterrorism and Homeland Security. INDEX.

O autorze

Bel G. Raggad