book

Information Security: Principles and Practices, Second Edition

Name: Information Security: Principles and Practices, Second Edition
ISBN: 9780133589412

by Mark S. Merkow, Jim Breithaupt

June 2014

Intermediate to advanced

368 pages

9h 44m

English

Pearson IT Certification

Read now

Unlock full access

About This eBook
Title Page
Copyright Page
Contents at a Glance
Table of Contents
Preface
About the Authors
Acknowledgments
We Want to Hear from You!
Reader Services

Chapter 1. Why Study Information Security?
IntroductionThe Growing Importance of IT Security and New Career OpportunitiesBecoming an Information Security SpecialistContextualizing Information SecuritySummaryTest Your Skills
Chapter 2. Information Security Principles of Success
IntroductionPrinciple 1: There Is No Such Thing As Absolute SecurityPrinciple 2: The Three Security Goals Are Confidentiality, Integrity, and AvailabilityPrinciple 3: Defense in Depth as StrategyPrinciple 4: When Left on Their Own, People Tend to Make the Worst Security DecisionsPrinciple 5: Computer Security Depends on Two Types of Requirements: Functional and AssurancePrinciple 6: Security Through Obscurity Is Not an AnswerPrinciple 7: Security = Risk ManagementPrinciple 8: The Three Types of Security Controls Are Preventative, Detective, and ResponsivePrinciple 9: Complexity Is the Enemy of SecurityPrinciple 10: Fear, Uncertainty, and Doubt Do Not Work in Selling SecurityPrinciple 11: People, Process, and Technology Are All Needed to Adequately Secure a System or FacilityPrinciple 12: Open Disclosure of Vulnerabilities Is Good for Security!SummaryTest Your Skills
Chapter 3. Certification Programs and the Common Body of Knowledge
IntroductionCertification and Information SecurityInternational Information Systems Security Certifications Consortium (ISC)2The Information Security Common Body of KnowledgeOther Certificate Programs in the IT Security IndustrySummaryTest Your Skills
Chapter 4. Governance and Risk Management
IntroductionSecurity Policies Set the Stage for SuccessUnderstanding the Four Types of PoliciesDeveloping and Managing Security PoliciesProviding Policy Support DocumentsSuggested Standards TaxonomyWho Is Responsible for Security?SummaryTest Your Skills
Chapter 5. Security Architecture and Design
IntroductionDefining the Trusted Computing BaseProtection Mechanisms in a TCBSystem Security Assurance ConceptsThe Trusted Computer Security Evaluation CriteriaThe Canadian Trusted Computer Product Evaluation CriteriaThe Federal Criteria for Information Technology SecurityThe Common CriteriaThe Common Evaluation MethodologyConfidentiality and Integrity ModelsSummaryTest Your Skills
Chapter 6. Business Continuity Planning and Disaster Recovery Planning
IntroductionOverview of the Business Continuity Plan and Disaster Recovery PlanDisaster Recovery PlanningSummaryTest Your Skills
Chapter 7. Law, Investigations, and Ethics
IntroductionTypes of Computer CrimeHow Cybercriminals Commit CrimesThe Computer and the LawIntellectual Property LawPrivacy and the LawComputer ForensicsThe Information Security Professional’s Code of EthicsOther Ethics StandardsSummaryTest Your Skills
Chapter 8. Physical Security Control
IntroductionUnderstanding the Physical Security DomainSummaryTest Your Skills
Chapter 9. Operations Security
IntroductionOperations Security PrinciplesOperations Security Process ControlsOperations Security Controls in ActionSummaryTest Your Skills
Chapter 10. Access Control Systems and Methodology
IntroductionTerms and ConceptsPrinciples of AuthenticationBiometricsSingle Sign-OnRemote User Access and AuthenticationSummaryTest Your Skills
Chapter 11. Cryptography
IntroductionApplying Cryptography to Information SystemsBasic Terms and ConceptsStrength of CryptosystemsPutting the Pieces to WorkExamining Digital CryptographySummaryTest Your Skills
Chapter 12. Telecommunications, Network, and Internet Security
IntroductionAn Overview of Network and Telecommunications SecurityNetwork Security in ContextThe Open Systems Interconnection Reference ModelData Network TypesProtecting TCP/IP NetworksVirtual Private NetworksIPSecCloud ComputingSummaryTest Your Skills
Chapter 13. Software Development Security
IntroductionThe Practice of Software EngineeringSoftware Development Life CyclesDon’t Bolt Security On—Build It InDesign ReviewsMeasuring the Secure Development ProgramSummaryTest Your Skills
Chapter 14. Securing the Future
IntroductionOperation Eligible ReceiverCarders, Account Takeover, and Identity TheftThe Rosy Future for InfoSec SpecialistsSummaryTest Your Skills
Appendix A. Common Body of Knowledge
Access ControlTelecommunications and Network SecurityInformation Security Governance and Risk ManagementSoftware Development SecurityCryptographySecurity Architecture and DesignOperations SecurityBusiness Continuity and Disaster Recovery PlanningLegal Regulations, Investigations, and CompliancePhysical (Environmental) Security
Appendix B. Security Policy and Standards Taxonomy
Appendix C. Sample Policies
Sample Computer Acceptable Use PolicySample Email Use PolicySample Password PolicySample Wireless (WiFi) Use Policy
Appendix D. HIPAA Security Rule Standards
HIPAA Security StandardsAdministrative ProceduresPhysical SafeguardsTechnical Security ServicesTechnical Security Mechanisms
Index

Content preview from Information Security: Principles and Practices, Second Edition

Appendix B. Security Policy and Standards Taxonomy

A complete Policy and Standards Library is essential to a comprehensive security programme (see Chapter 4, “Governance and Risk Management”). This appendix provides a minimum outline of the policies and standards you can expect to see—it is derived from ISO/IEC 27002:2005, “Code of Practice for Information Security Management.” The first level (bolded) indicates where a policy would be expected; the second level (italicized) indicates where a control standard would be expected. Baseline standards, documented security procedures, and guidelines/guidance documents can be tied to the control standards they support. For example, system hardening baseline standards can be tied to Section 6.1.

Topics ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Security Program and Policies: Principles and Practices, Second Edition

Publisher Resources

ISBN: 9780133589412Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Information Security: Principles and Practices, Second Edition

by Mark S. Merkow, Jim Breithaupt

Appendix B. Security Policy and Standards Taxonomy

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.