book

Managing Risk in Information Systems

Name: Managing Risk in Information Systems
Author: Darril Gibson
ISBN: 9780763791889

by Darril Gibson

October 2010

Intermediate to advanced

454 pages

13h 31m

English

Jones & Bartlett Learning

Read now

Unlock full access

Copyright
Preface
Purpose of This BookLearning FeaturesAudience
Acknowledgments
About the Author
ONE. Risk Management Business Challenges
1. Risk Management Fundamentals
What Is Risk?Compromise of Business FunctionsCompromise of Business AssetsDriver of Business CostsProfitability Versus SurvivabilityWhat Are the Major Components of Risk to an IT Infrastructure?Seven Domains of a Typical IT InfrastructureUser DomainWorkstation DomainLAN DomainLAN-to-WAN DomainRemote Access DomainWAN DomainSystem/Application DomainThreats, Vulnerabilities, and ImpactRisk Management and Its Importance to the OrganizationHow Risk Affects an Organization's SurvivabilityReasonablenessBalancing Risk and CostRole-Based Perceptions of RiskRisk Identification TechniquesIdentifying ThreatsIdentifying VulnerabilitiesUsing the Seven Domains of a Typical IT Infrastructure to Identify WeaknessesUsing Reason When Identifying VulnerabilitiesPairing Threats with VulnerabilitiesRisk Management TechniquesAvoidanceTransferMitigationAcceptanceCost-Benefit AnalysisResidual RiskCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 1 ASSESSMENT
2. Managing Risk: Threats, Vulnerabilities, and Exploits
Understanding and Managing ThreatsThe Uncontrollable Nature of ThreatsUnintentional ThreatsIntentional ThreatsBest Practices for Managing Threats Within Your IT InfrastructureUnderstanding and Managing VulnerabilitiesThreat/Vulnerability PairsVulnerabilities Can Be MitigatedMitigation TechniquesBest Practices for Managing Vulnerabilities Within Your IT InfrastructureUnderstanding and Managing ExploitsWhat Is an Exploit?How Do Perpetrators Initiate an Exploit?Where Do Perpetrators Find Information About Vulnerabilities and Exploits?Mitigation TechniquesBest Practices for Managing Exploits Within Your IT InfrastructureU.S. Federal Government Risk Management InitiativesNational Institute of Standards and TechnologyDepartment of Homeland SecurityNational Cyber Security DivisionUS Computer Emergency Readiness TeamThe MITRE Corporation and the CVE ListCommon Vulnerabilities and Exposures (CVE) ListStandard for Information Security Vulnerability NamesCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 2 ASSESSMENT
3. Maintaining Compliance
ComplianceFederal Information Security Management ActHealth Insurance Portability and Accountability ActGramm-Leach-Bliley ActSarbanes-Oxley ActFamily Educational Rights and Privacy ActChildren's Internet Protection ActRegulations Related to ComplianceSecurities and Exchange CommissionFederal Deposit Insurance CorporationDepartment of Homeland SecurityFederal Trade CommissionState Attorney GeneralU.S. Attorney GeneralOrganizational Policies for ComplianceStandards and Guidelines for CompliancePayment Card Industry Data Security StandardNational Institute of Standards and TechnologyGenerally Accepted Information Security PrinciplesControl Objectives for Information and Related TechnologyInternational Organization for StandardizationISO 27002 Information Technology Security TechniquesISO 31000 Risk Management Principles and GuidelinesISO 73 Risk Management—VocabularyInternational Electrotechnical CommissionInformation Technology Infrastructure LibraryCapability Maturity Model IntegrationDepartment of Defense Information Assurance Certification and Accreditation ProcessCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 3 ASSESSMENT
4. Developing a Risk Management Plan
Objectives of a Risk Management PlanObjectives Example: Web SiteObjectives Example: HIPAA ComplianceScope of a Risk Management PlanScope Example: Web SiteScope Example: HIPAA ComplianceAssigning ResponsibilitiesResponsibilities Example: Web SiteResponsibilities Example: HIPAA ComplianceDescribing Procedures and Schedules for AccomplishmentProcedures Example: Web SiteProcedures Example: HIPAA ComplianceReporting RequirementsPresent RecommendationsFindingsRecommendation Cost and Time FrameCost-Benefit AnalysisRisk StatementsDocument Management Response to RecommendationsDocument and Track Implementation of Accepted RecommendationsPlan of Action and MilestonesCharting the Progress of a Risk Management PlanMilestone Plan ChartGantt ChartCritical Path ChartCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 4 ASSESSMENT
TWO. Mitigating Risk

5. Defining Risk Assessment Approaches
Understanding Risk AssessmentImportance of Risk AssessmentsPurpose of a Risk AssessmentCritical Components of a Risk AssessmentIdentify ScopeIdentify Critical AreasIdentify TeamTypes of Risk AssessmentsQuantitative Risk AssessmentsBenefitsLimitationsQualitative Risk AssessmentsPrioritizing the RiskEvaluating the Effectiveness of ControlsBenefitsLimitationsComparing Quantitative and Qualitative Risk AssessmentsRisk Assessment ChallengesUsing a Static Process to Evaluate a Moving TargetAvailabilityData ConsistencyDifferences in Data FormatChanges in Data CollectionChanges in the BusinessEstimating Impact EffectsProviding Results That Support Resource Allocation and Risk AcceptanceResource AllocationRisk AcceptanceBest Practices for Risk AssessmentCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 5 ASSESSMENT
6. Performing a Risk Assessment
Selecting a Risk Assessment MethodologyDefining the AssessmentOperational CharacteristicsMission of the SystemReview Previous FindingsIdentifying the Management StructureIdentifying Assets and Activities Within Risk Assessment BoundariesSystem Access and System AvailabilitySystem FunctionsHardware and Software AssetsPersonnel AssetsData and Information AssetsFacilities and SuppliesIdentifying and Evaluating Relevant ThreatsReviewing Historical DataModelingIdentifying and Evaluating Relevant VulnerabilitiesVulnerability AssessmentsExploit AssessmentsIdentifying and Evaluating CountermeasuresIn-Place and Planned CountermeasuresControl CategoriesAdministrative Security ControlsTechnical Security ControlPhysical Security ControlsSelecting a Methodology Based on Assessment NeedsQuantitativeQualitativeDevelop Mitigating RecommendationsThreat/Vulnerability PairsEstimate of Cost and Time to ImplementEstimate of Operational ImpactPrepare Cost-Benefit AnalysisPresent Risk Assessment ResultsBest Practices for Performing Risk AssessmentsCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 6 ASSESSMENT
7. Identifying Assets and Activities to Be Protected
System Access and AvailabilitySystem Functions: Manual and AutomatedManual MethodsAutomated MethodsHardware AssetsSoftware AssetsPersonnel AssetsData and Information AssetsOrganizationCustomerIntellectual PropertyData Warehousing and Data MiningAsset and Inventory Management Within the Seven Domains of a Typical IT InfrastructureUser DomainWorkstation DomainLAN DomainLAN-to-WAN DomainWAN DomainRemote Access DomainSystem/Application DomainIdentifying Facilities and Supplies Needed to Maintain Business OperationsMission-Critical Systems and Applications IdentificationBusiness Impact Analysis PlanningBusiness Continuity PlanningDisaster Recovery PlanningBusiness Liability Insurance PlanningAsset Replacement Insurance PlanningCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 7 ASSESSMENT
8. Identifying and Analyzing Threats, Vulnerabilities, and Exploits
Threat AssessmentsTechniques for Identifying ThreatsReview Historical DataOrganization Historical Data.Similar Organization's Historical Data.Local Area Data.Threat ModelingAnalogy and Comparison with Similar Situations and ActivitiesBest Practices for Threat Assessments Within the Seven Domains of a Typical IT InfrastructureVulnerability AssessmentsDocumentation ReviewReview of System Logs, Audit Trails, and Intrusion Detection System OutputsSystem LogsAudit TrailsIntrusion Detection System OutputsVulnerability Scans and Other Assessment ToolsAudits and Personnel InterviewsProcess Analysis and Output AnalysisSystem TestingFunctionality TestingAccess Controls TestingPenetration TestingTransaction and Applications TestingBest Practices for Performing Vulnerability Assessments Within the Seven Domains of a Typical IT InfrastructureExploit AssessmentsIdentify ExploitsSocial EngineeringMAC Flood AttackTCP Syn Flood AttackMitigate Exploits with a Gap Analysis and Remediation PlanImplement Configuration or Change ManagementVerify and Validate the Exploit Has Been MitigatedBest Practices for Performing Exploit Assessments Within an IT InfrastructureCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 8 ASSESSMENT
9. Identifying and Analyzing Risk Mitigation Security Controls
In-Place ControlsPlanned ControlsControl CategoriesNIST Control ClassesAdministrative Control ExamplesPolicies and ProceduresSecurity PlansBusiness Continuity Plan.Disaster Recovery Plan.Backup Plan.Incident Response Plan.Insurance and BondingBackground Checks and Financial ChecksData Loss Prevention ProgramAwareness and TrainingRules of BehaviorSoftware TestingTechnical Control ExamplesLogon IdentifierSession TimeoutSystem Logs and Audit TrailsData Range and Reasonableness ChecksFirewalls and RoutersEncryptionPublic Key Infrastructure (PKI)Physical Control ExamplesLocked Doors, Guards, Access Logs, and Closed-Circuit Television (CCTV)Fire Detection and SuppressionWater DetectionTemperature and Humidity DetectionElectrical Grounding and Circuit BreakersBest Practices for Risk Mitigation Security ControlsCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 9 ASSESSMENT
10. Planning Risk Mitigation Throughout Your Organization
Where Should Your Organization Start with Risk Mitigation?What Is the Scope of Risk Management for Your Organization?Critical Business OperationsCustomer Service DeliveryMission-Critical Business Systems, Applications, and Data AccessSeven Domains of a Typical IT InfrastructureUser DomainWorkstation DomainLAN DomainLAN-to-WAN DomainRemote Access DomainWAN DomainSystem/Application DomainInformation Systems Security GapUnderstanding and Assessing the Impact of Legal and Compliance Issues on Your OrganizationLegal Requirements, Compliance Laws, Regulations, and MandatesHealth Insurance Portability and Accountability Act (HIPAA)Sarbanes-Oxley Act (SOX)Federal Information Security Management Act (FISMA)Family Educational Rights and Privacy Act (FERPA)Children's Internet Protection Act (CIPA)Payment Card Industry Data Security Standard (PCI DSS)Assessing the Impact of Legal and Compliance Issues on Your Business OperationsHealth Insurance Portability and Accountability Act (HIPAA)Sarbanes-Oxley Act (SOX)Federal Information Security Management Act (FISMA)Family Educational Rights and Privacy Act (FERPA)Children's Internet Protection Act (CIPA)Payment Card Industry Data Security Standard (PCI DSS)Translating Legal and Compliance Implications for Your OrganizationAssessing the Impact of Legal and Compliance Implications on the Seven Domains of a Typical IT InfrastructureAssessing How Security Countermeasures and Safeguards Can Assist with Risk MitigationUnderstanding the Operational Implications of Legal and Compliance RequirementsIdentifying Risk Mitigation and Risk Reduction Elements for the Entire OrganizationPerforming a Cost-Benefit AnalysisBest Practices for Planning Risk Mitigation Throughout Your OrganizationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 10 ASSESSMENT
11. Turning Your Risk Assessment into a Risk Mitigation Plan
Review the Risk Assessment for Your IT InfrastructureOverlapping CountermeasuresMatching Threats with VulnerabilitiesIdentifying CountermeasuresTranslating Your Risk Assessment into a Risk Mitigation PlanCost to ImplementInitial Purchase CostFacility CostsInstallation CostsTraining CostsTime to ImplementOperational ImpactPrioritizing Risk Elements That Require Risk MitigationUsing a Threat/Vulnerability MatrixPrioritizing CountermeasuresVerifying Risk Elements and How These Risks Can Be MitigatedPerforming a Cost-Benefit Analysis on the Identified Risk ElementsCalculate the CBAA CBA ReportImplementing a Risk Mitigation PlanStay Within BudgetStay on ScheduleFollowing Up on the Risk Mitigation PlanEnsuring Countermeasures Are ImplementedEnsuring Security Gaps Have Been ClosedBest Practices for Enabling a Risk Mitigation Plan from Your Risk AssessmentCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 11 ASSESSMENT
THREE. Risk Mitigation Plans
12. Mitigating Risk with a Business Impact Analysis
What Is a Business Impact Analysis?Collecting DataVarying Data Collection MethodsDefining the Scope of Your Business Impact AnalysisObjectives of a Business Impact AnalysisIdentify Critical Business FunctionsIdentify Critical ResourcesIdentify MAO and ImpactDirect CostsIndirect CostsIdentify Recovery RequirementsThe Steps of a Business Impact Analysis ProcessIdentify the EnvironmentIdentify StakeholdersIdentify Critical Business FunctionsIdentify Critical ResourcesIdentify Maximum DowntimeIdentify Recovery PrioritiesDevelop BIA ReportIdentifying Mission-Critical Business Functions and ProcessesMapping Business Functions and Processes to IT SystemsBest Practices for Performing a BIA for Your OrganizationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 12 ASSESSMENTENDNOTE
13. Mitigating Risk with a Business Continuity Plan
What Is a Business Continuity Plan (BCP)?Elements of a BCPPurposeScopeAssumptions and Planning PrinciplesIncidents to Be Included and ExcludedStrategyPrioritiesRequired SupportSystem Description and ArchitectureOverviewFunctional DescriptionSensitivity of Data and Criticality of OperationsIdentifying Critical Equipment, Software, Data, Documents, and SuppliesTelecommunicationsResponsibilitiesBCP Program ManagerBCP CoordinatorBCP TeamsKey PersonnelOrder of Succession and Delegation of AuthorityNotification/Activation PhaseNotification ProceduresDamage Assessment ProceduresPlan ActivationAlternate Assessment ProceduresPersonal Location Control FormRecovery PhaseRecovery PlanningRecovery GoalTechnical Recovery Team LeadTechnical Recovery TeamReconstitution Phase (Return to Normal Operations)Original or New Site RestorationConcurrent ProcessingPlan DeactivationPlan Training, Testing, and ExercisesBCP TrainingBCP TestingBCP Test ExercisesTabletop ExercisesFunctional ExercisesFull-Scale ExercisesPlan MaintenanceBCP Plan Revisions TrackingBCP Updates Based on Changes Within the IT InfrastructureBCP Annual Updates and Content RefreshmentBCP TestingHow Does a BCP Mitigate an Organization's Risk?Best Practices for Implementing a BCP for Your OrganizationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 13 ASSESSMENT
14. Mitigating Risk with a Disaster Recovery Plan
What Is a Disaster Recovery Plan (DRP)?NeedPurposeCritical Success FactorsWhat Management Must ProvideResourcesLeadershipWhat DRP Developers NeedKnowledge of Disaster RecoveryKnowledge of How the Organization FunctionsAuthorityPrimary ConcernsRecovery Time Objectives (RTOs)Off-Site Data Storage, Backup, and RecoveryAlternate LocationsCold Site.Hot Site.Warm Site.Redundant Backup Site.User Access.Management Access.Customer Access.Disaster Recovery Financial BudgetElements of a DRPPurposeScopeDisaster/Emergency DeclarationCommunicationsEmergency ResponseActivitiesRecovery Steps and ProceduresRecovery PlansBackup PlansCritical Business OperationsRecovery ProceduresCritical Operations, Customer Service, and Operations RecoveryTestingMaintenance and DRP UpdateHow Does a DRP Mitigate an Organization's Risk?Best Practices for Implementing a DRP for Your OrganizationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 14 ASSESSMENT
15. Mitigating Risk with a Computer Incident Response Team Plan
What Is a Computer Incident Response Team (CIRT) Plan?Purpose of a CIRT PlanElements of a CIRT PlanCIRT MembersRoles.Responsibilities.Accountabilities.CIRT PoliciesIncident Handling ProcessHandling DoS Attack Incidents.Handling Malware Incidents.Handling Unauthorized Access Incidents.Handling Inappropriate Usage Incidents.Handling Multiple Component Incidents.Communication Escalation ProceduresIncident Handling ProceduresCalculating the Impact and Priority.Using a Generic Checklist.Handling DoS Attack Incidents.Handling Malware Incidents.Handling Unauthorized Access Incidents.Handling Inappropriate Usage Incidents.How Does a CIRT Plan Mitigate an Organization's Risk?Best Practices for Implementing a CIRT Plan for Your OrganizationCHAPTER SUMMARYKEY CONCEPTS AND TERMSCHAPTER 15 ASSESSMENT
A. Answer Key
B. Standard Acronyms
Glossary of Key Terms
References

Content preview from Managing Risk in Information Systems

Chapter 15. Mitigating Risk with a Computer Incident Response Team Plan

COMPUTER SECURITY INCIDENTS can result in the loss of confidentiality, integrity, or availability of data or services. Attackers will attack. Incidents will happen. However, you can be prepared with computer incident response teams (CIRTs). These teams are trained and have the knowledge and expertise to reduce the damage resulting from attacks. Their actions are guided by a CIRT plan.

The primary purpose of a CIRT plan is to help an organization prepare for incidents and mitigate the damage. The plan identifies members based on their roles and responsibilities. It includes policy statements related to incidents, such as if CIRT members are authorized to attack back. It also ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Managing Risk in Information Systems, 2nd Edition

Publisher Resources

ISBN: 9780763791872

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Managing Risk in Information Systems

by Darril Gibson

Chapter 15. Mitigating Risk with a Computer Incident Response Team Plan

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.