Part Two: Types of Policies and Appropriate Frameworks
by Johnson
Security Policies and Implementation Issues, 2nd Edition
- Cover
- Title Page
- Copyright
- Contents
- Dedication
- Preface
- Acknowledgments
- About the Author
- Part One: The Need for IT Security Policy Frameworks
- Chapter 1 Information Systems Security Policy Management
- What Is Information Systems Security?
- What Is Information Assurance?
- What Is Governance?
- Why Is Governance Important?
- What Are Information Systems Security Policies?
- Where Do Information Systems Security Policies Fit Within an Organization?
- Why Information Systems Security Policies Are Important
- When Do You Need Information Systems Security Policies?
- Why Enforcing and Winning Acceptance for Policies Is Challenging
- Chapter Summary
- Key Concepts and Terms
- Chapter 1 Assessment
- Chapter 2 Business Drivers for Information Security Policies
- Chapter 3 U.S. Compliance Laws and Information Security Policy Requirements
- U.S. Compliance Laws
- Whom Do the Laws Protect?
- Which Laws Require Proper Security Controls to Be Included in Policies?
- Aligning Security Policies and Controls with Regulations
- Industry Leading Practices and Self-Regulation
- Some Important Industry Standards
- Chapter Summary
- Key Concepts and Terms
- Chapter 3 Assessment
- Endnotes
- Chapter 4 Business Challenges Within the Seven Domains of IT Responsibility
- Chapter 5 Information Security Policy Implementation Issues
- Human Nature in the Workplace
- Organizational Structure
- The Challenge of User Apathy
- The Importance of Executive Management Support
- The Role of Human Resources Policies
- Policy Roles, Responsibilities, and Accountability
- When Policy Fulfillment Is Not Part of Job Descriptions
- Impact on Entrepreneurial Productivity and Efficiency
- Tying Security Policy to Performance and Accountability
- Chapter Summary
- Key Concepts and Terms
- Chapter 5 Assessment
- Endnote
- Chapter 1 Information Systems Security Policy Management
- Part Two: Types of Policies and Appropriate Frameworks
- Chapter 6 IT Security Policy Frameworks
- What Is an IT Policy Framework?
- What Is a Program Framework Policy or Charter?
- Business Considerations for the Framework
- Information Assurance Considerations
- Information Systems Security Considerations
- Best Practices for IT Security Policy Framework Creation
- Case Studies in Policy Framework Development
- Chapter Summary
- Key Concepts and Terms
- Chapter 6 Assessment
- Chapter 7 How to Design, Organize, Implement, and Maintain IT Security Policies
- Policies and Standards Design Considerations
- Document Organization Considerations
- Considerations for Implementing Policies and Standards
- Policy Change Control Board
- Maintaining Your Policies and Standards Library
- Best Practices for Policies and Standards Maintenance
- Case Studies and Examples of Designing, Organizing, Implementing, and Maintaining IT Security Policies
- Chapter Summary
- Key Concepts and Terms
- Chapter 7 Assessment
- Chapter 8 IT Security Policy Framework Approaches
- IT Security Policy Framework Approaches
- Roles, Responsibilities, and Accountability for Personnel
- Separation of Duties
- Governance and Compliance
- Best Practices for IT Security Policy Framework Approaches
- Case Studies and Examples of IT Security Policy Framework Approaches
- Chapter Summary
- Key Concepts and Terms
- Chapter 8 Assessment
- Endnote
- Chapter 9 User Domain Policies
- The Weakest Link in the Information Security Chain
- Seven Types of Users
- Why Govern Users with Policies?
- Acceptable Use Policy (AUP)
- The Privileged-Level Access Agreement (PAA)
- Security Awareness Policy (SAP)
- Best Practices for User Domain Policies
- Understanding Least Access Privileges and Best Fit Privileges
- Case Studies and Examples of User Domain Policies
- Chapter Summary
- Key Concepts and Terms
- Chapter 9 Assessment
- Chapter 10 IT Infrastructure Security Policies
- Anatomy of an Infrastructure Policy
- Workstation Domain Policies
- LAN Domain Policies
- LAN-to-WAN Domain Policies
- WAN Domain Policies
- Remote Access Domain Policies
- System/Application Domain Policies
- Telecommunications Policies
- Best Practices for IT Infrastructure Security Policies
- Case Studies and Examples of IT Infrastructure Security Policies
- Chapter Summary
- Key Concepts and Terms
- Chapter 10 Assessment
- Chapter 11 Data Classification and Handling Policies and Risk Management Policies
- Data Classification Policies
- Data Handling Policies
- Identifying Business Risks Related to Information Systems
- Risk and Control Self-Assessment
- Risk Assessment Policies
- Quality Assurance Versus Quality Control
- Best Practices for Data Classification and Risk Management Policies
- Case Studies and Examples of Data Classification and Risk Management Policies
- Chapter Summary
- Key Concepts and Terms
- Chapter 11 Assessment
- Chapter 12 Incident Response Team (IRT) Policies
- Incident Response Policy
- Incident Classification
- The Response Team Charter
- Incident Response Team Members
- Responsibilities During an Incident
- Business Impact Analysis (BIA) Policies
- Procedures for Incident Response
- Discovering an Incident
- Reporting an Incident
- Containing and Minimizing the Damage
- Cleaning Up After the Incident
- Documenting the Incident and Actions
- Analyzing the Incident and Response
- Creating Mitigation to Prevent Future Incidents
- Handling the Media and Deciding What to Disclose
- Business Continuity Planning Policies
- Dealing with Loss of Systems, Applications, or Data Availability
- Response and Recovery Time Objectives Policies Based on the BIA
- Best Practices for Incident Response Policies
- Disaster Recovery Plan Policies
- Case Studies and Examples of Incident Response Policies
- Chapter Summary
- Key Concepts and Terms
- Chapter 12 Assessment
- Chapter 6 IT Security Policy Frameworks
- Part Three: Implementing and Maintaining an IT Security Policy Framework
- Chapter 13 IT Security Policy Implementations
- Simplified Implementation Process
- Target State
- Executive Buy-in, Cost, and Impact
- Policy Language
- Employee Awareness and Training
- Information Dissemination—How to Educate Employees
- Policy Implementation Issues
- Governance and Monitoring
- Best Practices for IT Security Policy Implementations
- Case Studies and Examples of IT Security Policy Implementations
- Chapter Summary
- Key Concepts and Terms
- Chapter 13 Assessment
- Chapter 14 IT Security Policy Enforcement
- Organizational Support for IT Security Policy Enforcement
- An Organization’s Right to Monitor User Actions and Traffic
- Compliance Law: Requirement or Risk Management?
- What Is Law and What Is Policy?
- What Automated Security Controls Can Be Implemented Through Policy?
- Legal Implications of IT Security Policy Enforcement
- Who Is Ultimately Accountable for Risk, Threats, and Vulnerabilities?
- Best Practices for IT Security Policy Enforcement
- Case Studies and Examples of Successful IT Security Policy Enforcement
- Chapter Summary
- Key Concepts and Terms
- Chapter 14 Assessment
- Chapter 15 IT Policy Compliance and Compliance Technologies
- Creating a Baseline Definition for Information Systems Security
- Tracking, Monitoring, and Reporting IT Security Baseline Definition and Policy Compliance
- Automating IT Security Policy Compliance
- Compliance Technologies and Solutions
- Best Practices for IT Security Policy Compliance Monitoring
- Case Studies and Examples of Successful IT Security Policy Compliance Monitoring
- Chapter Summary
- Key Concepts and Terms
- Chapter 15 Assessment
- Chapter 13 IT Security Policy Implementations
- Appendix A: Answer Key
- Appendix B: Standard Acronyms
- Glossary of Key Terms
- References
- Index
Types of Policies and Appropriate Frameworks
CHAPTER 6 IT Security Policy Frameworks
CHAPTER 7 How to Design, Organize, Implement, and Maintain IT Security Policies
CHAPTER 8 IT Security Policy Framework Approaches
CHAPTER 9 User Domain Policies
CHAPTER 10 IT Infrastructure Security Policies
CHAPTER 11 Data Classification and Handling Policies and Risk Management Policies
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.