book

Security Policies and Implementation Issues, 2nd Edition

Name: Security Policies and Implementation Issues, 2nd Edition
Author: Johnson
ISBN: 9781284056006

by Johnson

August 2014

Intermediate to advanced

450 pages

16h 52m

English

Jones & Bartlett Learning

Read now

Unlock full access

Cover
Title Page
Copyright
Contents
Dedication
Preface
Acknowledgments
About the Author
Part One: The Need for IT Security Policy Frameworks
Chapter 1 Information Systems Security Policy Management
What Is Information Systems Security?Information Systems Security Management Life CycleWhat Is Information Assurance?ConfidentialityIntegrityNonrepudiationWhat Is Governance?Why Is Governance Important?What Are Information Systems Security Policies?Where Do Information Systems Security Policies Fit Within an Organization?Why Information Systems Security Policies Are ImportantPolicies That Support Operational SuccessChallenges of Running a Business Without PoliciesDangers of Not Implementing PoliciesDangers of Implementing the Wrong PoliciesWhen Do You Need Information Systems Security Policies?Business Process Reengineering (BPR)Continuous ImprovementMaking Changes in Response to ProblemsWhy Enforcing and Winning Acceptance for Policies Is ChallengingChapter SummaryKey Concepts and TermsChapter 1 Assessment

Chapter 2 Business Drivers for Information Security Policies
Why Are Business Drivers Important?Maintaining ComplianceCompliance Requires Proper Security ControlsSecurity Controls Must Include Information Security PoliciesRelationship Between Security Controls and Information Security PolicyMitigating Risk ExposureEducate Employees and Drive Security AwarenessPrevent Loss of Intellectual PropertyProtect Digital AssetsSecure Privacy of DataLower Risk ExposureMinimizing Liability of the OrganizationSeparation Between Employer and EmployeeAcceptable Use PoliciesConfidentiality Agreement and Nondisclosure AgreementBusiness Liability Insurance PoliciesImplementing Policies to Drive Operational ConsistencyForcing Repeatable Business Processes Across the Entire OrganizationDifferences Between Mitigating and Compensating ControlsPolicies Help Prevent Operational DeviationChapter SummaryKey Concepts and TermsChapter 2 AssessmentEndnotes
Chapter 3 U.S. Compliance Laws and Information Security Policy Requirements
U.S. Compliance LawsWhat Are U.S. Compliance Laws?Why Did U.S. Compliance Laws Come About?Whom Do the Laws Protect?Which Laws Require Proper Security Controls to Be Included in Policies?Which Laws Require Proper Security Controls for Handling Privacy Data?Aligning Security Policies and Controls with RegulationsIndustry Leading Practices and Self-RegulationSome Important Industry StandardsPayment Card Industry Data Security Standard (PCI DSS)Statement on Standards for Attestation Engagements No. 16 (SSAE16)Information Technology Infrastructure Library (ITIL)Chapter SummaryKey Concepts and TermsChapter 3 AssessmentEndnotes
Chapter 4 Business Challenges Within the Seven Domains of IT Responsibility
The Seven Domains of a Typical IT InfrastructureUser DomainWorkstation DomainLAN DomainLAN-to-WAN DomainWAN DomainRemote Access DomainSystem/Application DomainInformation Security Business Challenges and Security Policies That Mitigate Risk Within the Seven DomainsUser DomainWorkstation DomainLAN DomainLAN-to-WAN DomainWAN DomainRemote Access DomainSystem/Application DomainChapter SummaryKey Concepts and TermsChapter 4 Assessment
Chapter 5 Information Security Policy Implementation Issues
Human Nature in the WorkplaceBasic Elements of MotivationPersonality Types of EmployeesLeadership, Values, and EthicsOrganizational StructureFlat OrganizationsHierarchical OrganizationsThe Challenge of User ApathyThe Importance of Executive Management SupportSelling Information Security Policies to an ExecutiveBefore, During, and After Policy ImplementationThe Role of Human Resources PoliciesRelationship Between HR and Security PoliciesLack of SupportPolicy Roles, Responsibilities, and AccountabilityChange ModelResponsibilities During ChangeRoles and AccountabilitiesWhen Policy Fulfillment Is Not Part of Job DescriptionsImpact on Entrepreneurial Productivity and EfficiencyApplying Security Policies to an Entrepreneurial BusinessTying Security Policy to Performance and AccountabilityChapter SummaryKey Concepts and TermsChapter 5 AssessmentEndnote
Part Two: Types of Policies and Appropriate Frameworks
Chapter 6 IT Security Policy Frameworks
What Is an IT Policy Framework?What Is a Program Framework Policy or Charter?Industry-Standard Policy FrameworksWhat Is a Policy?What Are Standards?What Are Procedures?What Are Guidelines?Business Considerations for the FrameworkRoles for Policy and Standards Development and ComplianceInformation Assurance ConsiderationsConfidentialityIntegrityAvailabilityInformation Systems Security ConsiderationsUnauthorized Access to and Use of the SystemUnauthorized Disclosure of the InformationDisruption of the System or ServicesModification of InformationDestruction of Information ResourcesBest Practices for IT Security Policy Framework CreationCase Studies in Policy Framework DevelopmentPrivate Sector Case StudyPublic Sector Case StudyPrivate Sector Case StudyChapter SummaryKey Concepts and TermsChapter 6 Assessment
Chapter 7 How to Design, Organize, Implement, and Maintain IT Security Policies
Policies and Standards Design ConsiderationsArchitecture Operating ModelPrinciples for Policy and Standards DevelopmentThe Importance of Transparency with Regard to Customer DataTypes of Controls for Policies and StandardsDocument Organization ConsiderationsSample TemplatesConsiderations for Implementing Policies and StandardsBuilding Consensus on IntentReviews and ApprovalsPublishing Your Policies and Standards LibraryAwareness and TrainingPolicy Change Control BoardBusiness Drivers for Policy and Standards ChangesMaintaining Your Policies and Standards LibraryUpdates and RevisionsBest Practices for Policies and Standards MaintenanceCase Studies and Examples of Designing, Organizing, Implementing, and Maintaining IT Security PoliciesPrivate Sector Case StudyPublic Sector Case StudyChapter SummaryKey Concepts and TermsChapter 7 Assessment
Chapter 8 IT Security Policy Framework Approaches
IT Security Policy Framework ApproachesRisk Management and Compliance ApproachThe Physical Domains of IT Responsibility ApproachRoles, Responsibilities, and Accountability for PersonnelThe Seven Domains of a Typical IT InfrastructureOrganizational StructureOrganizational CultureSeparation of DutiesLayered Security ApproachDomain of Responsibility and AccountabilityGovernance and ComplianceIT Security ControlsIT Security Policy FrameworkBest Practices for IT Security Policy Framework ApproachesWhat Is the Difference Between GRC and ERM?Case Studies and Examples of IT Security Policy Framework ApproachesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyChapter SummaryKey Concepts and TermsChapter 8 AssessmentEndnote
Chapter 9 User Domain Policies
The Weakest Link in the Information Security ChainSocial EngineeringHuman MistakesInsidersSeven Types of UsersEmployeesSystems AdministratorsSecurity PersonnelContractorsVendorsGuests and General PublicControl PartnersContingentSystemWhy Govern Users with Policies?Acceptable Use Policy (AUP)The Privileged-Level Access Agreement (PAA)Security Awareness Policy (SAP)Best Practices for User Domain PoliciesUnderstanding Least Access Privileges and Best Fit PrivilegesCase Studies and Examples of User Domain PoliciesGovernment Laptop CompromisedThe Collapse of Barings Bank, 1995Unauthorized Access to Defense Department SystemsChapter SummaryKey Concepts and TermsChapter 9 Assessment
Chapter 10 IT Infrastructure Security Policies
Anatomy of an Infrastructure PolicyFormat of a StandardWorkstation Domain PoliciesLAN Domain PoliciesLAN-to-WAN Domain PoliciesWAN Domain PoliciesRemote Access Domain PoliciesSystem/Application Domain PoliciesTelecommunications PoliciesBest Practices for IT Infrastructure Security PoliciesCase Studies and Examples of IT Infrastructure Security PoliciesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyChapter SummaryKey Concepts and TermsChapter 10 Assessment
Chapter 11 Data Classification and Handling Policies and Risk Management Policies
Data Classification PoliciesWhen Is Data Classified or Labeled?The Need for Data ClassificationLegal Classification SchemesMilitary Classification SchemesBusiness Classification SchemesDeveloping a Customized Classification SchemeClassifying Your DataData Handling PoliciesThe Need for Policy Governing Data at Rest and in TransitPolicies, Standards, and Procedures Covering the Data Life CycleIdentifying Business Risks Related to Information SystemsTypes of RiskDevelopment and Need for Policies Based on Risk ManagementRisk and Control Self-AssessmentRisk Assessment PoliciesRisk ExposurePrioritization of Risk, Threat, and VulnerabilitiesRisk Management StrategiesVulnerability AssessmentsVulnerability WindowsPatch ManagementQuality Assurance Versus Quality ControlBest Practices for Data Classification and Risk Management PoliciesCase Studies and Examples of Data Classification and Risk Management PoliciesPrivate Sector Case StudyPublic Sector Case StudyPrivate Sector Case StudyChapter SummaryKey Concepts and TermsChapter 11 Assessment
Chapter 12 Incident Response Team (IRT) Policies
Incident Response PolicyWhat Is an Incident?Incident ClassificationThe Response Team CharterIncident Response Team MembersResponsibilities During an IncidentUsers on the Front LineSystem AdministratorsInformation Security PersonnelManagementSupport ServicesOther Key RolesBusiness Impact Analysis (BIA) PoliciesComponent PriorityComponent RelianceImpact ReportDevelopment and Need for Policies Based on the BIAProcedures for Incident ResponseDiscovering an IncidentReporting an IncidentContaining and Minimizing the DamageCleaning Up After the IncidentDocumenting the Incident and ActionsAnalyzing the Incident and ResponseCreating Mitigation to Prevent Future IncidentsHandling the Media and Deciding What to DiscloseBusiness Continuity Planning PoliciesDealing with Loss of Systems, Applications, or Data AvailabilityResponse and Recovery Time Objectives Policies Based on the BIABest Practices for Incident Response PoliciesDisaster Recovery Plan PoliciesDisaster Declaration PolicyAssessment of the Disaster’s Severity and of Potential DowntimeCase Studies and Examples of Incident Response PoliciesPrivate Sector Case StudyPublic Sector Case StudyCritical Infrastructure Case StudyChapter SummaryKey Concepts and TermsChapter 12 Assessment
Part Three: Implementing and Maintaining an IT Security Policy Framework
Chapter 13 IT Security Policy Implementations
Simplified Implementation ProcessTarget StateDistributed InfrastructureOutdated TechnologyLack of Standardization Throughout the IT InfrastructureExecutive Buy-in, Cost, and ImpactExecutive Management SponsorshipOvercoming Nontechnical HindrancesPolicy LanguageEmployee Awareness and TrainingOrganizational and Individual AcceptanceMotivationDeveloping an Organization-Wide Security Awareness PolicyConducting Security Awareness Training SessionsHuman Resources Ownership of New Employee OrientationReview of Acceptable Use Policies (AUPs)Information Dissemination—How to Educate EmployeesHard Copy DisseminationPosting Policies on the IntranetUsing E-mailBrown Bag Lunches and Learning SessionsPolicy Implementation IssuesGovernance and MonitoringBest Practices for IT Security Policy ImplementationsCase Studies and Examples of IT Security Policy ImplementationsPrivate Sector Case StudyPublic Sector Case StudyChapter SummaryKey Concepts and TermsChapter 13 Assessment
Chapter 14 IT Security Policy Enforcement
Organizational Support for IT Security Policy EnforcementExecutive Management SponsorshipGovernance Versus Management Organizational StructureThe Hierarchical Organizational Approach to Security Policy ImplementationFront-Line Managers’ and Supervisors’ Responsibility and AccountabilityGrass-Roots EmployeesAn Organization’s Right to Monitor User Actions and TrafficCompliance Law: Requirement or Risk Management?What Is Law and What Is Policy?What Security Controls Work to Enforce Protection of Privacy Data?What Automated Security Controls Can Be Implemented Through Policy?What Manual Security Controls Assist with Enforcement?Legal Implications of IT Security Policy EnforcementWho Is Ultimately Accountable for Risk, Threats, and Vulnerabilities?Where Must IT Security Policy Enforcement Come From?Best Practices for IT Security Policy EnforcementCase Studies and Examples of Successful IT Security Policy EnforcementPrivate Sector Case StudyPublic Sector Case Study No. 1Public Sector Case Study No. 2Chapter SummaryKey Concepts and TermsChapter 14 Assessment
Chapter 15 IT Policy Compliance and Compliance Technologies
Creating a Baseline Definition for Information Systems SecurityPolicy-Defining Overall IT Infrastructure Security DefinitionVulnerability Window and Information Security Gap DefinitionTracking, Monitoring, and Reporting IT Security Baseline Definition and Policy ComplianceAutomated SystemsRandom Audits and Departmental ComplianceOverall Organizational Report Card for Policy ComplianceAutomating IT Security Policy ComplianceAutomated Policy DistributionConfiguration Management and Change Control ManagementCollaboration and Policy Compliance Across Business AreasVersion Control for Policy Implementation Guidelines and ComplianceCompliance Technologies and SolutionsCOSO Internal Controls FrameworkSCAPSNMPWBEMDigital SigningBest Practices for IT Security Policy Compliance MonitoringCase Studies and Examples of Successful IT Security Policy Compliance MonitoringPrivate Sector Case StudyPublic Sector Case StudyNonprofit Sector Case StudyChapter SummaryKey Concepts and TermsChapter 15 Assessment
Appendix A: Answer Key
Appendix B: Standard Acronyms
Glossary of Key Terms
References
Index

Content preview from Security Policies and Implementation Issues, 2nd Edition

Acknowledgments

I would like to thank Jones & Bartlett Learning for the opportunity to write this book and be a part of the Information Systems Security & Assurance Series project. I offer my deep appreciation to Lawrence Goodrich and Ruth Walker, who did an excellent job coordinating this book despite many challenges. Their guidance, patience, and support were instrumental to its success.

A special thank you goes to Mike Chapple, whose experience and debate on risk topics was very helpful. His thought-provoking challenges were much appreciated. Thanks also to Mark Merkow and Darril Gibson for contributing content to this book.

I would also like to thank the staff and volunteers at ISACA, who dedicate themselves to providing global thought leadership ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Security Policies and Implementation Issues

Publisher Resources

ISBN: 9781284055993

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Security Policies and Implementation Issues, 2nd Edition

by Johnson

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.