book

Asset Protection through Security Awareness

Name: Asset Protection through Security Awareness
Author: Tyler Justin Speed
ISBN: 9781439809839

by Tyler Justin Speed

April 2016

Intermediate to advanced

337 pages

8h 22m

English

Auerbach Publications

Read now

Unlock full access

Cover Page
Half Title Page
Title Page
Copyright Page
Table of Contents
Introduction
What Is Information Security?
Chapter 1 Creating a Culture of Security Awareness
Protecting Corporate AssetsProtective MeasuresTechnical Protective MeasuresPhysical Protective MeasuresPersonnel Protective MeasuresA Culture of Security AwarenessEducation Is KeyCreating the CultureAcknowledging Security IssuesAccepting ResponsibilityAssessing RiskCrafting Security PoliciesTraining at All LevelsCreating Benchmarks for SuccessSecurity AuditsEncouraging Secure OperationsBuilding a Security TeamPlanning for DisasterRemaining Dynamic
Chapter 2 Overview of Security Awareness Categories
Industry StandardsPrivacy ConcernsVisual Data Privacy ProtectionAuditory Privacy ProtectionDigital Data PrivacyHealth Information ConcernsClient RecordsPassword ManagementCredit Card Compliance (PCI)General File ManagementFile Access ControlPhysical Access ControlExamples of Security Regulations and LawsFinancial InstitutionsIndustry-Specific Regulations
Chapter 3 Who Is an IS Professional?
Empowering Security ProfessionalsTop-Down ApproachC-Level ManagersUpper ManagementMid-Level ManagersLow-Level ManagersEnd UsersA Workforce of Security Professionals

Chapter 4 Diplomacy
The “People” Portion of Information SecurityA Breakdown in Trust = A Breakdown in SecurityThe IS SpecialistAn Issue of CommunicationTwo Different WorldsDiplomacy—The IS Professional’s Best FriendSoftening the Security MessageThe IS ServantA Caretaker’s ApproachEnd Users Are Great Network MonitorsSuper-UsersThe End User’s Diplomatic Responsibility
Chapter 5 Privacy Concerns
What Is Privacy?Why Does Privacy Matter?Types of Private DataProprietary InformationCustomer RecordsEmployment RecordsHealth-Related InformationIndustry ResearchKeeping Files PrivateDigital DataPhysical DataManagement NotesVerbal DataPrivacy-Related Regulations and LawsGramm–Leach–Bliley (GLB) Financial Modernization Act of 1999—Year Enacted: 1999Health Insurance Portability and Accountability Act (HIPAA)—Year Enacted: 2003 (Final Ruling)Children’s Online Privacy Protection Act—Year Enacted: 1998Privacy Policies
Chapter 6 Interdepartmental Security
Interdepartmental SecurityAdministrative PersonnelHuman Resources DepartmentAccounting DepartmentLegal DepartmentInformation Technology (IT) DepartmentPurchasingSales and Customer ServiceMarketing DepartmentManufacturingFacilities CrewShipping & Receiving DepartmentInterdepartmental IS Committee
Chapter 7 Risk Management
Risk Management and Asset ProtectionData LossDisastersRisk ManagementRisk AnalysisDetermine the Single Loss Expectancy (SLE)Complete a Threat AnalysisCalculate Annual Loss Expectancy (ALE)Manage the Risk
Chapter 8 Social Engineering
What Is Social Engineering?Psychology of Social EngineeringRecognition of and Respect for AuthorityPoliteness, Professional Customs, and CourtesyConformity in the WorkplaceSocial Engineering Information Gathering MethodsDumpster DivingTailgatingShoulder SurfingPosing as an Employee
Chapter 9 Incident Detection and Response
What Is an Incident?Incident Detection Types of Intrusion Detection System InstallationsProcess of Intrusion Detection SystemsIDS ConsiderationsIDS BenefitsIDS Drawbacks and WeaknessesIncident ResponseComputer Security Incident Response TeamsCSIRT ManualTypes of CSIRT TeamsResponse to EventsPreparedness Is KeyRecognizing ScopeManagement of OccurrencesEvent PostmortemsRecommendations for ImprovementsLaw Enforcement Liaisons
Chapter 10 Physical Security
Human-Caused IncidentsAccidental SpillsAccidental DestructionAccidental Transport DamageServer Room AccidentsIntentional DestructionPhysical Security MeasuresPerimeter FencesSecurity SystemsDoor LocksCamerasSecurity GuardsCheckpointsConstruction ConsiderationsWeather/Natural DisastersWindstormsFloodsFires
Chapter 11 PCI Compliance
PCI ComplianceGoal of PCI DSSWho Must Adhere to PCI Compliance?Who Is Authorized to Perform PCI Security Scans?The Five Levels of PCI ComplianceLevel 1 ComplianceLevel 2 ComplianceLevel 3 ComplianceLevel 4 ComplianceLevel 5 CompliancePCI DSS OverviewCategory 1. Protect and Maintain a Secure NetworkCategory 2: Protect Cardholder DataCategory 3: Maintain a Vulnerability Management ProgramCategory 4: Implement Strong Access Control MeasuresCategory 5: Regularly Monitor and Test NetworksCategory 6: Maintain an Information Security PolicyA Good Place to Start
Chapter 12 Business Continuity Planning
Evaluation of Critical Systems and ResourcesPrioritization of Critical Systems and ResourcesIdentify Threats Posed to Critical Systems and ResourcesAssign Business Continuity ResponsibilitiesDevelop the Continuity Planning Policy StatementWhat Should the Continuity Planning Statement Include?Listing Critical FunctionsDevelop Recovery PrioritiesIdentify Preventive ControlsDevelop Recovery StrategiesDevelop the Contingency PlanKey PersonnelKey ResourcesImplement Business Continuity PlanMaintain the PlanTrain According to Business Continuity Plan Objectives
Chapter 13 User Authentication Methods
User AuthenticationCryptosystemsCryptographic HashingData CompressionSymmetric and Asymmetric KeysPublic Key InfrastructureCertificate AuthorityRegistration AuthorityX.509 or PKIXKey ManagementPKI VendorsWeb of TrustPretty Good Privacy
Chapter 14 Computer and Network Forensics
AcquireChain of CustodyIdentificationCryptographyDigital Forensic ToolsEvidence PreservationAuthenticateAnalyzeThe Digital Investigator
Chapter 15 Malware
VirusesWormsFamous WormsProtecting Against WormsKeyloggersRootkitsSpywareAdwareTrojan HorsesTypes of Antivirus ProgramsSignature-Based ScanningBehavior-Based ScanningMemory Resident DetectionInoculationDetecting and Removing VirusesStart-Up DetectionRestore PointsRecommended Antivirus ProgramsSpybot - Search and Destroy (Spybot-S&D)Lavasoft’s Ad-AwareHijackthisAVG Technologies’ Anti-Virus Free Edition (AVG Free)Software Updates
Chapter 16 Crafting A Security Policy
Planning Versus Reactionary Response (Or—Why It’s Important to Have a Security Plan)No Cost AnalysisIncomplete ControlsCompounded Security IssuesDon’t Wait to PlanImportance of a Security PolicySetting Goals and Measuring SuccessDaily OperationsSecurity AwarenessResources for Crafting Security PoliciesCrafting the PolicyThe Team of Policy CraftersManagement SupportStandards, Policies, Procedures, and ControlsStandardsPoliciesProceduresControlsAccessibility, Supportability, and ClarityAccessibilitySupportabilityClarityAssessing the Organization’s Network InfrastructureAssessing/Categorizing AssetsSecurity Policy Structure OutlineDistribution of the PolicyPhysical DistributionDigital Distribution
Chapter 17 Performing Security Analyses and Audits
The NecessityAudit CommitteesInternal Versus External AuditorsPreaudit ConsiderationsSecurity PolicyDefining Security RulesDefinition of User RequirementsPerforming a Risk AssessmentIdentify All Network AssetsList All ThreatsList VulnerabilitiesDetermine Threat Occurrence FrequencyPerform Threat AnalysisDetermine CountermeasuresDetermine Uncovered AssetsBuild the Security ArchitectureMigration of Security ArchitectureEvaluate Security MeasuresManaging Security ImplementationsHow Frequently Should Audits Be Performed?
Chapter 18 Access Control
AccountabilityIdentification and AuthenticationSomething a User HasSomething a User KnowsSomething a User IsSomewhere a User IsDual Factor AuthenticationAuthorizationDifferent Access Control MethodologiesRole-Based Access ControlMandatory Access ControlDiscretionary Access Control
Chapter 19 Security Checklists
Checklist for Creating a Security PolicyNetwork Inventory ChecklistPhysical Security Checklist
Index
About the Author

Overview

Supplying a high-level overview of how to protect your company's physical and intangible assets, this book explains how to enlist the assistance of your employees as the first line of defense in safeguarding company assets and mitigating security risks. It reviews key topics surrounding computer security and provides detailed instruction on how to put together an effective security awareness team. Requiring no previous networking or programming experience, the book specifies managers' and employees' roles in establishing a company-wide culture of security awareness.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781439809839

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills