book

Assessing and Managing Security Risk in IT Systems

Name: Assessing and Managing Security Risk in IT Systems
Author: John McCumber
ISBN: 9781135488963

by John McCumber

August 2004

Intermediate to advanced

288 pages

8h 19m

English

Auerbach Publications

Read now

Unlock full access

COVER PAGE
OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
TITLE PAGE
COPYRIGHT PAGE
DEDICATION
INTRODUCTION
HOW TO USE THIS TEXTWHAT YOU WILL NOT SEEACKNOWLEDGMENTSTHE TEXTTERMS AND DEFINITIONSREFERENCES
I SECURITY CONCEPTS
1: USING MODELS
INTRODUCTION: UNDERSTANDING, SELECTING, AND APPLYING MODELSUNDERSTANDING ASSETSLAYERED SECURITYUSING MODELS IN SECURITYSECURITY MODELS FOR INFORMATION SYSTEMSSHORTCOMINGS OF MODELS IN SECURITYSECURITY IN CONTEXTREFERENCE
2: DEFINING INFORMATION SECURITY
CONFIDENTIALITY, INTEGRITY, AND AVAILABILITYINFORMATION ATTRIBUTESINTRINSIC VERSUS IMPUTED VALUEINFORMATION AS AN ASSETTHE ELEMENTS OF SECURITYCONFIDENTIALITYINTEGRITYAVAILABILITYSECURITY IS SECURITY ONLY IN CONTEXT
3: INFORMATION AS AN ASSET
INTRODUCTIONDETERMINING VALUEMANAGING INFORMATION RESOURCESREFERENCES

4: UNDERSTANDING THREAT AND ITS RELATION TO VULNERABILITIES
INTRODUCTIONTHREAT DEFINEDANALYZING THREATASSESSING PHYSICAL THREATSINFRASTRUCTURE THREAT ISSUES
5: ASSESSING RISK VARIABLES: THE RISK ASSESSMENT PROCESS
INTRODUCTIONLEARNING TO ASK THE RIGHT QUESTIONS ABOUT RISKTHE BASIC ELEMENTS OF RISK IN IT SYSTEMSINFORMATION AS AN ASSETDEFINING THREAT FOR RISK MANAGEMENTDEFINING VULNERABILITIES FOR RISK MANAGEMENTDEFINING SAFEGUARDS FOR RISK MANAGEMENTTHE RISK ASSESSMENT PROCESS
II THE MCCUMBER CUBE METHODOLOGY
6: THE MCCUMBER CUBE
INTRODUCTIONTHE NATURE OF INFORMATIONCRITICAL INFORMATION CHARACTERISTICSCONFIDENTIALITYINTEGRITYAVAILABILITYSECURITY MEASURESTECHNOLOGYPOLICY AND PRACTICEEDUCATION, TRAINING, AND AWARENESS (HUMAN FACTORS)THE MODELOVERVIEWUSE OF THE MODELREFERENCES
7: DETERMINING INFORMATION STATES AND MAPPING INFORMATION FLOW
INTRODUCTIONINFORMATION STATES: A BRIEF HISTORICAL PERSPECTIVEAUTOMATED PROCESSING: WHY CRYPTOGRAPHY IS NOT SUFFICIENTSIMPLE STATE ANALYSISINFORMATION STATES IN HETEROGENEOUS SYSTEMSBOUNDARY DEFINITIONDECOMPOSITION OF INFORMATION STATESSTEP 1: DEFINING THE BOUNDARYSTEP 2: MAKE AN INVENTORY OF ALL IT RESOURCESSTEP 3: DECOMPOSE AND IDENTIFY INFORMATION STATESDEVELOPING AN INFORMATION STATE MAPREFERENCE
8: DECOMPOSING THE CUBE FOR SECURITY ENFORCEMENT
INTRODUCTIONA WORD ABOUT SECURITY POLICYDEFINITIONSTHE MCCUMBER CUBE METHODOLOGYTHE TRANSMISSION STATETRANSMISSION: CONFIDENTIALITYTRANSMISSION: INTEGRITYTRANSMISSION: AVAILABILITYTHE STORAGE STATESTORAGE: CONFIDENTIALITYSTORAGE: INTEGRITYSTORAGE: AVAILABILITYTHE PROCESSING STATEPROCESSING: CONFIDENTIALITYPROCESSING: INTEGRITYPROCESSING: AVAILABILITYRECAP OF THE METHODOLOGY
9: INFORMATION STATE ANALYSIS FOR COMPONENTS AND SUBSYSTEMS
INTRODUCTIONSHORTCOMINGS OF CRITERIA STANDARDS FOR SECURITY ASSESSMENTSAPPLYING THE MCCUMBER CUBE METHODOLOGY FOR PRODUCT ASSESSMENTSSTEPS FOR PRODUCT AND COMPONENT ASSESSMENTINFORMATION FLOW MAPPINGDEFINE THE BOUNDARYTAKE AN INVENTORY OF INFORMATION RESOURCES AND COMPONENTSDECOMPOSE AND IDENTIFY ALL INFORMATION STATESCUBE DECOMPOSITION BASED ON INFORMATION STATESCALL OUT THE INFORMATION STATE COLUMNDECOMPOSE BLOCKS BY ATTRIBUTEIDENTIFY EXISTING AND POTENTIAL VULNERABILITESDEVELOP SECURITY ARCHITECTUREDESCRIBE REQUIRED SAFEGUARDSCOST OUT ARCHITECTURE COMPONENTS AND ENFORCEMENT MECHANISMSRECAP OF THE METHODOLOGY FOR SUBSYSTEMS, PRODUCTS, AND COMPONENTSREFERENCES
10: MANAGING THE SECURITY LIFE CYCLE
11: SAFEGUARD ANALYSIS
INTRODUCTIONTECHNOLOGY SAFEGUARDSPROCEDURAL SAFEGUARDSHUMAN FACTORS SAFEGUARDSVULNERABILITY-SAFEGUARD PAIRINGHIERARCHICAL DEPENDENCIES OF SAFEGUARDSSECURITY POLICIES AND PROCEDURAL SAFEGUARDSDEVELOPING COMPREHENSIVE SAFEGUARDS: THE LESSONS OF THE SHOGUNIDENTIFYING AND APPLYING APPROPRIATE SAFEGUARDSCOMPREHENSIVE SAFEGUARD MANAGEMENT: APPLYING THE MCCUMBER CUBETHE ROI OF SAFEGUARDS: DO SECURITY SAFEGUARDS HAVE A PAYOFF?
12: PRACTICAL APPLICATIONS OF MCCUMBER CUBE ANALYSIS
INTRODUCTIONAPPLYING THE MODEL TO GLOBAL AND NATIONAL SECURITY ISSUESPROGRAMMING AND SOFTWARE DEVELOPMENTUSING THE MCCUMBER CUBE IN AN ORGANIZATIONAL INFORMATION SECURITY PROGRAMUSING THE MCCUMBER CUBE FOR PRODUCT OR SUBSYSTEM ASSESSMENTUSING THE MCCUMBER CUBE FOR SAFEGUARD PLANNING AND DEPLOYMENTTIPS AND TECHNIQUES FOR BUILDING YOUR SECURITY PROGRAMESTABLISHING THE SECURITY PROGRAM: DEFINING YOUAVOIDING THE SECURITY COP LABELOBTAINING CORPORATE APPROVAL AND SUPPORTCREATING PEARL HARBOR FILESDEFINING YOUR SECURITY POLICYDEFINING WHAT VERSUS HOWSECURITY POLICY: DEVELOPMENT AND IMPLEMENTATIONREFERENCE
III APPENDICES
APPENDIX A VULNERABILITIES
INTRODUCTIONTHE PROBLEM: VULNERABILITY MEANS DIFFERENT THINGSTHE APPROACH: INTRODUCING A NEW TERM—EXPOSUREDISTINGUISHING BETWEEN VULNERABILITIES AND EXPOSURESDEFINITIONSHORT DESCRIPTIONDEFINITIONSRATIONALEEXAMPLESWHAT IS A CVE CANDIDATE?THE TWO WAYS NEW SECURITY ISSUES BECOME CANDIDATESDATA SOURCESCANDIDATE NUMBERING AUTHORITIESHOW LONG IT TAKES FOR CANDIDATES TO BECOME OFFICIAL CVE ENTRIESHOW CANDIDATES ARE AFFECTED BY CVE CDSTHE CANDIDATE NUMBERING PROCESSCVE CANDIDATESCANDIDATE NUMBERING AUTHORITYCVE EDITORPHASES OF A CVE CANDIDATEFROM CANDIDATE TO CVE ENTRYTO LEARN MOREMITREREFERENCE
APPENDIX B RISK ASSESSMENT METRICS
OVERVIEW OF THE BASIC RISK ASSESSMENT PROCESSRISK ASSESSMENT METRICSTHREAT METRICSVULNERABILITY METRICSASSET METRICSBASELINE RISK FACTORSSAFEGUARD CALCULATIONSOBTAINING RISK ASSESSMENT DATARISK ASSESSMENT DECISION SUPPORT TOOLSREFERENCE
APPENDIX C DIAGRAMS AND TABLES
INTRODUCTIONREFERENCE
APPENDIX D OTHER RESOURCES
INTRODUCTIONTHREAT INFORMATIONVULNERABILITY AND SAFEGUARD INFORMATIONASSET INFORMATION

Content preview from Assessing and Managing Security Risk in IT Systems

9: INFORMATION STATE ANALYSIS FOR COMPONENTS AND SUBSYSTEMS

INTRODUCTION

One of the most daunting challenges currently facing security researchers and practitioners is one of determining how secure a specific computer subsystem, product, or component may be. There have been numerous attempts to apply a variety of criteria to this problem so information systems implementers and purchasers can make judgments about security issues in the acquisition and implementation of specific products and architectures. This unrewarding pursuit finds its highest expression in the search for the secure computer out of the box.

Currently, the methodology in use for the government is known as the Common Criteria. This is the evaluation process that evolved from ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

The Complete Guide to Cybersecurity Risks and Controls

Publisher Resources

ISBN: 9780203490426

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Assessing and Managing Security Risk in IT Systems

by John McCumber

9: INFORMATION STATE ANALYSIS FOR COMPONENTS AND SUBSYSTEMS

INTRODUCTION

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.