book

Managing Risk in Information Systems, 3rd Edition

Name: Managing Risk in Information Systems, 3rd Edition
ISBN: 9781284183726

by Darril Gibson, Andy Igonor

November 2020

Intermediate to advanced

437 pages

15h 2m

English

Jones & Bartlett Learning

Read now

Unlock full access

Cover
Title Page
Copyright Page
Brief Contents
Contents
Dedication
Preface
Acknowledgments
About the Authors
CHAPTER 1 Risk Management Fundamentals

What Is Risk?
Compromise of Business FunctionsThreats, Vulnerabilities, Assets, and Impact
Classify Business Risks
Risks Posed by PeopleRisks Posed by a Lack of ProcessRisks Posed by Technology
Risk Identification Techniques
Identifying ThreatsIdentifying VulnerabilitiesAssessing Impact and Likelihood
Risk Management Process
Cost-Benefit AnalysisProfitability Versus Survivability
Risk-Handling Strategies
AvoidingSharing or TransferringMitigatingAcceptingResidual Risk
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 1 ASSESSMENT
CHAPTER 2 Managing Risk: Threats, Vulnerabilities, and Exploits
Understanding and Protecting Assets
Understanding and Managing Threats
Uncontrollable Nature of ThreatsUnintentional ThreatsIntentional ThreatsBest Practices for Managing Risk Within an IT InfrastructureEY Global Information Security Survey 2018–2019
Understanding and Managing Vulnerabilities
Threat/Vulnerability PairsVulnerabilities Can Be MitigatedMitigation TechniquesBest Practices for Managing Vulnerabilities Within an IT Infrastructure
Understanding and Managing Exploits
What Is an Exploit?How Do Perpetrators Initiate an Exploit?Where Do Perpetrators Find Information About Vulnerabilities and Exploits?Mitigation TechniquesBest Practices for Managing Exploits Within an IT Infrastructure
U.S. Federal Government Risk Management Initiatives
National Institute of Standards and TechnologyDepartment of Homeland SecurityNational Cybersecurity and Communications Integration CenterU.S. Computer Emergency Readiness TeamThe MITRE Corporation and the CVE List
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 2 ASSESSMENT
CHAPTER 3 Understanding and Maintaining Compliance
U.S. Compliance Laws
Federal Information Security Modernization ActHealth Insurance Portability and Accountability ActGramm-Leach-Bliley ActSarbanes-Oxley ActFamily Educational Rights and Privacy ActChildren’s Internet Protection ActChildren’s Online Privacy Protection Act
Regulations Related to Compliance
Securities and Exchange CommissionFederal Deposit Insurance CorporationDepartment of Homeland SecurityFederal Trade CommissionState Attorney GeneralU.S. Attorney General
Organizational Policies for Compliance
Standards and Guidelines for Compliance
Payment Card Industry Data Security StandardNational Institute of Standards and TechnologyGenerally Accepted Information Security PrinciplesControl Objectives for Information and Related TechnologyInternational Organization for StandardizationInternational Electrotechnical CommissionInformation Technology Infrastructure LibraryCapability Maturity Model IntegrationGeneral Data Protection RegulationDepartment of Defense Information Assurance Certification and Accreditation Process
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 3 ASSESSMENT
CHAPTER 4 Developing a Risk Management Plan
Objectives of a Risk Management Plan
Objectives Example: WebsiteObjectives Example: HIPAA Compliance
Scope of a Risk Management Plan
Scope Example: WebsiteScope Example: HIPAA Compliance
Assigning Responsibilities
Responsibilities Example: WebsiteResponsibilities Example: HIPAA Compliance
Describing Procedures and Schedules for Accomplishment
Procedures Example: WebsiteProcedures Example: HIPAA Compliance
Reporting Requirements
Presenting RecommendationsDocumenting Management Response to RecommendationsDocumenting and Tracking Implementation of Accepted Recommendations
Plan of Action and Milestones
Charting the Progress of a Risk Management Plan
Milestone Plan ChartGantt ChartCritical Path Chart
Steps of the NIST Risk Management Framework
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 4 ASSESSMENT
CHAPTER 5 Defining Risk Assessment Approaches
Understanding Risk Assessments
Importance of Risk AssessmentsPurpose of a Risk Assessment
Critical Components of a Risk Assessment
Identifying ScopeIdentifying Critical AreasIdentifying Team Members
Types of Risk Assessments
Quantitative Risk AssessmentsQualitative Risk AssessmentsComparing Quantitative and Qualitative Risk Assessments
Risk Assessment Challenges
Using a Static Process to Evaluate a Moving TargetAvailability of Resources and DataData ConsistencyEstimating Impact EffectsProviding Results That Support Resource Allocation and Risk Acceptance
Best Practices for Risk Assessment
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 5 ASSESSMENT
CHAPTER 6 Performing a Risk Assessment
Selecting a Risk Assessment Methodology
Defining the AssessmentReviewing Previous Findings
Identifying the Management Structure
Identifying Assets and Activities Within Risk Assessment Boundaries
System Access and AvailabilitySystem FunctionsHardware and Software AssetsPersonnel AssetsData and Information AssetsFacilities and Supplies
Identifying and Evaluating Relevant Threats
Reviewing Historical DataPerforming Threat Modeling
Identifying and Evaluating Relevant Vulnerabilities
Vulnerability AssessmentsExploit Assessments
Identifying and Evaluating Controls
In-Place and Planned ControlsControl Categories
Selecting a Methodology Based on Assessment Needs
Quantitative MethodQualitative Method
Developing Mitigating Recommendations
Threat/Vulnerability PairsEstimate of Cost and Time to ImplementEstimate of Operational ImpactCost-Benefit Analysis
Presenting Risk Assessment Results
Best Practices for Performing Risk Assessments
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 6 ASSESSMENT
CHAPTER 7 Identifying Assets and Activities to Be Protected
System Access and Availability
System Functions: Manual and Automated
Manual MethodsAutomated Methods
Hardware Assets
Software Assets
Personnel Assets
Data and Information Assets
OrganizationCustomerIntellectual PropertyData Warehousing and Data Mining
Asset and Inventory Management Within the Seven Domains of a Typical IT Infrastructure
User DomainWorkstation DomainLAN DomainLAN-to-WAN DomainWAN DomainRemote Access DomainSystem/Application Domain
Identifying Facilities and Supplies Needed to Maintain Business Operations
Mission-Critical Systems and Applications IdentificationBusiness Impact Analysis PlanningBusiness Continuity PlanningDisaster Recovery PlanningBusiness Liability Insurance PlanningAsset Replacement Insurance Planning
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 7 ASSESSMENT
CHAPTER 8 Identifying and Analyzing Threats, Vulnerabilities, and Exploits
Threat Assessments
Techniques for Identifying ThreatsBest Practices for Threat Assessments Within the Seven Domains of a Typical IT Infrastructure
Vulnerability Assessments
Review of DocumentationReview of System Logs, Audit Trails, and Intrusion Detection and Prevention System OutputsVulnerability Scans and Other Assessment ToolsAudits and Personnel InterviewsProcess Analysis and Output AnalysisSystem TestingBest Practices for Performing Vulnerability Assessments Within the Seven Domains of a Typical IT Infrastructure
Exploit Assessments
Identifying ExploitsMitigating Exploits with a Gap Analysis and Remediation PlanImplementing Configuration or Change ManagementVerifying and Validating the Exploit Has Been MitigatedBest Practices for Performing Exploit Assessments Within an IT Infrastructure
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 8 ASSESSMENT
CHAPTER 9 Identifying and Analyzing Risk Mitigation Security Controls
In-Place Controls
Planned Controls
Control CategoriesNIST Control Families
Procedural Control Examples
Policies and ProceduresSecurity PlansInsurance and BondingBackground and Financial ChecksData Loss Prevention ProgramEducation, Training, and AwarenessRules of BehaviorSoftware Testing
Technical Control Examples
Logon IdentifierSession Time-OutSystem Logs and Audit TrailsData Range and Reasonableness ChecksFirewalls and RoutersEncryptionPublic Key Infrastructure
Physical Control Examples
Locked Doors, Guards, Access Logs, and Closed-Circuit TelevisionFire Detection and SuppressionWater DetectionTemperature and Humidity DetectionElectrical Grounding and Circuit Breakers
Best Practices for Risk Mitigation Security Controls
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 9 ASSESSMENT
CHAPTER 10 Planning Risk Mitigation Throughout an Organization
Where Should an Organization Start with Risk Mitigation?
What Is the Scope of Risk Management for an Organization?
Critical Business OperationsCustomer Service DeliveryMission-Critical Business Systems, Applications, and Data AccessSeven Domains of a Typical IT InfrastructureInformation Systems Security Gap
Understanding and Assessing the Impact of Legal and Compliance Issues on an Organization
Legal Requirements, Compliance Laws, Regulations, and MandatesAssessing the Impact of Legal and Compliance Issues on an Organization’s Business Operations
Translating Legal and Compliance Implications for an Organization
Assessing the Impact of Legal and Compliance Implications on the Seven Domains of a Typical IT Infrastructure
Assessing How Security Countermeasures, Controls, and Safeguards Can Assist With Risk Mitigation
Understanding the Operational Implications of Legal and Compliance Requirements
Identifying Risk Mitigation and Risk Reduction Elements for the Entire Organization
Performing a Cost-Benefit Analysis
Best Practices for Planning Risk Mitigation Throughout an Organization
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 10 ASSESSMENT
CHAPTER 11 Turning a Risk Assessment into a Risk Mitigation Plan
Reviewing the Risk Assessment for the IT Infrastructure
Overlapping CountermeasuresRisk Assessments: Understanding Threats and VulnerabilitiesIdentifying Countermeasures
Translating a Risk Assessment into a Risk Mitigation Plan
Cost to ImplementTime to ImplementOperational Impact
Prioritizing Risk Elements That Require Risk Mitigation
Using a Threat Likelihood/Impact MatrixPrioritizing Countermeasures
Verifying Risk Elements and How They Can Be Mitigated
Performing a Cost-Benefit Analysis on the Identified Risk Elements
Calculating the CBAA CBA Report
Implementing a Risk Mitigation Plan
Staying Within BudgetStaying on Schedule
Following Up on the Risk Mitigation Plan
Ensuring Countermeasures Have Been ImplementedEnsuring Security Gaps Have Been Closed
Best Practices for Enabling a Risk Mitigation Plan from the Risk Assessment
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 11 ASSESSMENT
CHAPTER 12 Mitigating Risk with a Business Impact Analysis
What Is a Business Impact Analysis?
Collecting DataVarying Data Collection Methods
Defining the Scope of the Business Impact Analysis
Objectives of a Business Impact Analysis
Identifying Critical Business FunctionsIdentifying Critical ResourcesIdentifying the MAO and ImpactIdentifying Recovery Requirements
Steps of a Business Impact Analysis Process
Identifying the EnvironmentIdentifying StakeholdersIdentifying Critical Business FunctionsIdentifying Critical ResourcesIdentifying the MAOIdentifying Recovery PrioritiesDeveloping the BIA Report
Identifying Mission-Critical Business Functions and Processes
Mapping Business Functions and Processes to IT Systems
Best Practices for Performing a BIA for an Organization
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 12 ASSESSMENT
CHAPTER 13 Mitigating Risk with a Business Continuity Plan
What Is a Business Continuity Plan?
Elements of a BCP
PurposeScopeAssumptions and Planning PrinciplesSystem Description and ArchitectureResponsibilitiesNotification and Activation PhaseRecovery PhaseReconstitution Phase (Return to Normal Operations)Plan Training, Testing, and ExercisesPlan Maintenance
How Does a BCP Mitigate an Organization’s Risk?
Best Practices for Implementing a BCP for an Organization
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 13 ASSESSMENT
CHAPTER 14 Mitigating Risk with a Disaster Recovery Plan
What Is a Disaster Recovery Plan?
Need for a DRPPurpose of a DRP
Critical Success Factors
What Management Must ProvideWhat DRP Developers NeedPrimary ConcernsDisaster Recovery Financial Budget
Elements of a DRP
PurposeScopeDisaster/Emergency DeclarationCommunicationsEmergency ResponseActivitiesRecovery ProceduresCritical Operations, Customer Service, and Operations RecoveryRestoration and NormalizationTestingMaintenance and DRP Update
How Does a DRP Mitigate an Organization’s Risk?
Best Practices for Implementing a DRP for an Organization
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 14 ASSESSMENT
CHAPTER 15 Mitigating Risk with a Computer Incident Response Team Plan
What Is a Computer Incident Response Team Plan?
Purpose of a CIRT Plan
Elements of a CIRT Plan
CIRT MembersCIRT PoliciesIncident Handling ProcessCommunication Escalation ProceduresIncident Handling Procedures
How Does a CIRT Plan Mitigate an Organization’s Risk?
Best Practices for Implementing a CIRT Plan for an Organization
CHAPTER SUMMARY
KEY CONCEPTS AND TERMSCHAPTER 15 ASSESSMENT
APPENDIX A Answer Key
APPENDIX B Standard Acronyms
Glossary of Key Terms
References
Index

Content preview from Managing Risk in Information Systems, 3rd Edition

Answer Key

APPENDIX A

CHAPTER 1 Risk Management Fundamentals

1. D 2. B 3. A 4. A and C 5. intangible value 6. control 7. B 8. D 9. CVE 10. A 11. CBA, or cost-benefit analysis 12. transfer 13. A, B, and C 14. D 15. C

CHAPTER 2 Managing Risk: Threats, Vulnerabilities, and Exploits

1. D 2. A 3. B 4. C 5. D 6. C 7. B 8. A 9. A 10. E 11. A 12. C 13. C 14. the MITRE Corporation 15. A

CHAPTER 3 Understanding and Maintaining Compliance

1. C 2. D 3. A 4. C 5. B 6. A 7. D 8. A 9. C 10. A 11. B 12. C 13. D 14. 5 15. D

CHAPTER 4 Developing a Risk Management Plan

1. E 2. E 3. D 4. C 5. B 6. A 7. A and B 8. B 9. D 10. A 11. ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Managing Risk in Information Systems, 2nd Edition

Publisher Resources

ISBN: 9781284183726

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Managing Risk in Information Systems, 3rd Edition

by Darril Gibson, Andy Igonor

Answer Key

APPENDIX A

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Managing Risk in Information Systems, 2nd Edition

Enterprise Risk Management, 2nd Edition

Mastering Risk Management

Operational Risk Management, 2nd Edition

Publisher Resources