Developing Cybersecurity Programs and Policies, 3rd Edition

Developing Cybersecurity Programs and Policies, 3rd Edition

by Omar Santos, Sari Greene
Released August 2018
Publisher(s): Pearson IT Certification
ISBN: 9780134858623

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

All the Knowledge You Need to Build Cybersecurity Programs and Policies That Work

Clearly presents best practices, governance frameworks, and key standards

Includes focused coverage of healthcare, finance, and PCI DSS compliance

An essential and invaluable guide for leaders, managers, and technical professionals

Today, cyberattacks can place entire organizations at risk. Cybersecurity can no longer be delegated to specialists: success requires everyone to work together, from leaders on down. Developing Cybersecurity Programs and Policies offers start-to-finish guidance for establishing effective cybersecurity in any organization. Drawing on more than 20 years of real-world experience, Omar Santos presents realistic best practices for defining policy and governance, ensuring compliance, and collaborating to harden the entire organization.

First, Santos shows how to develop workable cybersecurity policies and an effective framework for governing them. Next, he addresses risk management, asset management, and data loss prevention, showing how to align functions from HR to physical security. You’ll discover best practices for securing communications, operations, and access; acquiring, developing, and maintaining technology; and responding to incidents.

Santos concludes with detailed coverage of compliance in finance and healthcare, the crucial Payment Card Industry Data Security Standard (PCI DSS) standard, and the NIST Cybersecurity Framework.

Whatever your current responsibilities, this guide will help you plan, manage, and lead cybersecurity–and safeguard all the assets that matter.

Learn How To

· Establish cybersecurity policies and governance that serve your organization’s needs

· Integrate cybersecurity program components into a coherent framework for action

· Assess, prioritize, and manage security risk throughout the organization

· Manage assets and prevent data loss

· Work with HR to address human factors in cybersecurity

· Harden your facilities and physical environment

· Design effective policies for securing communications, operations, and access

· Strengthen security throughout the information systems lifecycle

· Plan for quick, effective incident response and ensure business continuity

· Comply with rigorous regulations in finance and healthcare

· Plan for PCI compliance to safely process payments

· Explore and apply the guidance provided by the NIST Cybersecurity Framework..

Table of contents

  1. Cover
  2. About This E-Book
  3. Title Page
  4. Copyright Page
  5. Contents at a Glance
  6. Table of Contents
  7. About the Author
  8. Dedication
  9. Acknowledgments
  10. We Want to Hear from You!
  11. Reader Services
  12. Introduction
  13. Chapter 1 Understanding Cybersecurity Policy and Governance
    1. Information Security vs. Cybersecurity Policies
    2. Looking at Policy Through the Ages
    3. Cybersecurity Policy
    4. Cybersecurity Policy Life Cycle
    5. Summary
    6. Test Your Skills
  14. Chapter 2 Cybersecurity Policy Organization, Format, and Styles
    1. Policy Hierarchy
    2. Writing Style and Technique
    3. Policy Format
    4. Summary
    5. Test Your Skills
  15. Chapter 3 Cybersecurity Framework
    1. Confidentiality, Integrity, and Availability
    2. NIST’s Cybersecurity Framework
    3. Summary
    4. Test Your Skills
  16. Chapter 4 Governance and Risk Management
    1. Understanding Cybersecurity Policies
    2. Cybersecurity Risk
    3. Summary
    4. Test Your Skills
  17. Chapter 5 Asset Management and Data Loss Prevention
    1. Information Assets and Systems
    2. Information Classification
    3. Labeling and Handling Standards
    4. Information Systems Inventory
    5. Understanding Data Loss Prevention Technologies
    6. Summary
    7. Test Your Skills
  18. Chapter 6 Human Resources Security
    1. The Employee Life Cycle
    2. The Importance of Employee Agreements
    3. The Importance of Security Education and Training
    4. Summary
    5. Test Your Skills
  19. Chapter 7 Physical and Environmental Security
    1. Understanding the Secure Facility Layered Defense Model
    2. Protecting Equipment
    3. Summary
    4. Test Your Skills
  20. Chapter 8 Communications and Operations Security
    1. Standard Operating Procedures
    2. Operational Change Control
    3. Malware Protection
    4. Data Replication
    5. Secure Messaging
    6. Activity Monitoring and Log Analysis
    7. Service Provider Oversight
    8. Threat Intelligence and Information Sharing
    9. Summary
    10. Test Your Skills
  21. Chapter 9 Access Control Management
    1. Access Control Fundamentals
    2. Infrastructure Access Controls
    3. User Access Controls
    4. Summary
    5. Test Your Skills
  22. Chapter 10 Information Systems Acquisition, Development, and Maintenance
    1. System Security Requirements
    2. Secure Code
    3. Cryptography
    4. Summary
    5. Test Your Skills
  23. Chapter 11 Cybersecurity Incident Response
    1. Incident Response
    2. What Happened? Investigation and Evidence Handling
    3. Data Breach Notification Requirements
    4. Summary
    5. Test Your Skills
  24. Chapter 12 Business Continuity Management
    1. Emergency Preparedness
    2. Business Continuity Risk Management
    3. The Business Continuity Plan
    4. Plan Testing and Maintenance
    5. Summary
    6. Test Your Skills
  25. Chapter 13 Regulatory Compliance for Financial Institutions
    1. The Gramm-Leach-Bliley Act
    2. New York’s Department of Financial Services Cybersecurity Regulation (23 NYCRR Part 500)
    3. What Is a Regulatory Examination?
    4. Personal and Corporate Identity Theft
    5. Summary
    6. Test Your Skills
  26. Chapter 14 Regulatory Compliance for the Health-Care Sector
    1. The HIPAA Security Rule
    2. The HITECH Act and the Omnibus Rule
    3. Understanding the HIPAA Compliance Enforcement Process
    4. Summary
    5. Test Your Skills
  27. Chapter 15 PCI Compliance for Merchants
    1. Protecting Cardholder Data
    2. PCI Compliance
    3. Summary
    4. Test Your Skills
  28. Chapter 16 NIST Cybersecurity Framework
    1. Introducing the NIST Cybersecurity Framework Components
    2. The Framework Core
    3. Framework Implementation Tiers (“Tiers”)
    4. NIST’s Recommended Steps to Establish or Improve a Cybersecurity Program
    5. NIST’s Cybersecurity Framework Reference Tool
    6. Adopting the NIST Cybersecurity Framework in Real Life
    7. Summary
    8. Test Your Skills
  29. Appendix A Cybersecurity Program Resources
  30. Appendix B Answers to the Multiple Choice Questions
  31. Index
  32. Code Snippets

Product information

  • Title: Developing Cybersecurity Programs and Policies, 3rd Edition
  • Author(s): Omar Santos, Sari Greene
  • Release date: August 2018
  • Publisher(s): Pearson IT Certification
  • ISBN: 9780134858623