Assessing and Managing Security Risk
in IT Systems
by John McCumber
Assessing and Managing Security Risk in IT Systems
- COVER PAGE
- OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
- TITLE PAGE
- COPYRIGHT PAGE
- DEDICATION
- INTRODUCTION
- I SECURITY CONCEPTS
- II THE MCCUMBER CUBE METHODOLOGY
- 6: THE MCCUMBER CUBE
- 7: DETERMINING INFORMATION STATES AND MAPPING INFORMATION FLOW
- 8: DECOMPOSING THE CUBE FOR SECURITY ENFORCEMENT
- 9: INFORMATION STATE ANALYSIS FOR COMPONENTS AND SUBSYSTEMS
- INTRODUCTION
- SHORTCOMINGS OF CRITERIA STANDARDS FOR SECURITY ASSESSMENTS
- APPLYING THE MCCUMBER CUBE METHODOLOGY FOR PRODUCT ASSESSMENTS
- STEPS FOR PRODUCT AND COMPONENT ASSESSMENT
- INFORMATION FLOW MAPPING
- CUBE DECOMPOSITION BASED ON INFORMATION STATES
- DEVELOP SECURITY ARCHITECTURE
- RECAP OF THE METHODOLOGY FOR SUBSYSTEMS, PRODUCTS, AND COMPONENTS
- REFERENCES
- 10: MANAGING THE SECURITY LIFE CYCLE
- 11: SAFEGUARD ANALYSIS
- INTRODUCTION
- TECHNOLOGY SAFEGUARDS
- PROCEDURAL SAFEGUARDS
- HUMAN FACTORS SAFEGUARDS
- VULNERABILITY-SAFEGUARD PAIRING
- HIERARCHICAL DEPENDENCIES OF SAFEGUARDS
- SECURITY POLICIES AND PROCEDURAL SAFEGUARDS
- DEVELOPING COMPREHENSIVE SAFEGUARDS: THE LESSONS OF THE SHOGUN
- IDENTIFYING AND APPLYING APPROPRIATE SAFEGUARDS
- COMPREHENSIVE SAFEGUARD MANAGEMENT: APPLYING THE MCCUMBER CUBE
- THE ROI OF SAFEGUARDS: DO SECURITY SAFEGUARDS HAVE A PAYOFF?
- 12: PRACTICAL APPLICATIONS OF MCCUMBER CUBE ANALYSIS
- INTRODUCTION
- APPLYING THE MODEL TO GLOBAL AND NATIONAL SECURITY ISSUES
- PROGRAMMING AND SOFTWARE DEVELOPMENT
- USING THE MCCUMBER CUBE IN AN ORGANIZATIONAL INFORMATION SECURITY PROGRAM
- USING THE MCCUMBER CUBE FOR PRODUCT OR SUBSYSTEM ASSESSMENT
- USING THE MCCUMBER CUBE FOR SAFEGUARD PLANNING AND DEPLOYMENT
- TIPS AND TECHNIQUES FOR BUILDING YOUR SECURITY PROGRAM
- ESTABLISHING THE SECURITY PROGRAM: DEFINING YOU
- AVOIDING THE SECURITY COP LABEL
- OBTAINING CORPORATE APPROVAL AND SUPPORT
- CREATING PEARL HARBOR FILES
- DEFINING YOUR SECURITY POLICY
- DEFINING WHAT VERSUS HOW
- SECURITY POLICY: DEVELOPMENT AND IMPLEMENTATION
- REFERENCE
- III APPENDICES
- APPENDIX A VULNERABILITIES
- INTRODUCTION
- THE PROBLEM: VULNERABILITY MEANS DIFFERENT THINGS
- THE APPROACH: INTRODUCING A NEW TERM—EXPOSURE
- DISTINGUISHING BETWEEN VULNERABILITIES AND EXPOSURES
- DEFINITION
- SHORT DESCRIPTION
- DEFINITIONS
- RATIONALE
- EXAMPLES
- WHAT IS A CVE CANDIDATE?
- THE TWO WAYS NEW SECURITY ISSUES BECOME CANDIDATES
- HOW LONG IT TAKES FOR CANDIDATES TO BECOME OFFICIAL CVE ENTRIES
- HOW CANDIDATES ARE AFFECTED BY CVE CDS
- THE CANDIDATE NUMBERING PROCESS
- FROM CANDIDATE TO CVE ENTRY
- TO LEARN MORE
- MITRE
- REFERENCE
- APPENDIX B RISK ASSESSMENT METRICS
- APPENDIX C DIAGRAMS AND TABLES
- APPENDIX D OTHER RESOURCES
- APPENDIX A VULNERABILITIES
Table 3.2 University Medical Center Considerations for a New Scheduling System
| Value of Information | Cost of Maintaining Information | Value of Other Information | Cost of Other Information | |
| Current (paper books) | High | Medium | Medium | High |
| Situation 1 (stand-alone) | High | Low | Medium | High |
| Situation 2 (integration) | Medium | Medium | High | Low |
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.