The Executive MBA in Information Security

by Jr., John J. Trinckes

Overview

According to the Brookings Institute, an organization's information and other intangible assets account for over 80 percent of its market value. As the primary sponsors and implementers of information security programs, it is essential for those in key leadership positions to possess a solid understanding of the constantly evolving fundamental conc

Product Details

ISBN-13:	9781439857335
Publisher:	CRC Press
Publication date:	10/09/2009
Sold by:	Barnes & Noble
Format:	eBook
Pages:	352
File size:	2 MB

About the Author

John J. Trinckes Jr.

Table of Contents

Information Security Management Overview. What is Information Security? Responsibilities. Organization. Functions. Ideal Traits of an Information Security Professional. Certification Requirements. Recruiting. Screening. Interviewing. Reference Checks. Retention. Trust and Loyalty. Why is Information Security Important? Information Security Concepts. Interrelationship between Regulations, Policies, Standards, Procedures, and Guidelines. Regulations. Sarbanes-Oxley Act of 2002. The Gramm-Leach-Bliley Act (GLBA). The Health Insurance Portability and Accountability Act (HIPAA). Federal Financial Institutions Examination Council (FFIEC). Payment Card Industry (PCI) Data Security Standard (DSS). Common Elements of Compliance. Security Controls. Industry Best Practice Guidelines. Information Security for Executives Page 2. Standards. Measurement Techniques. Control Objectives for Information and Related Technology (COBIT). ISO 27002 Overview. Capability Maturity Model (CMM). Generally Accepted Information Security Principles (GAISP). Common Pitfalls to an Effective Information Security Program. Overconfidence. Optimism. Anchoring. The Status Quo Bias. Mental Accounting. The Herding Instinct. False Consensus. Defense in Depth. Risk Management. Step 1 - System Characterization. Step 2 - Threat Identification Human Threats. Environmental Threats. Software/Hardware Threats. Regulatory Threats. Emerging Threats. Threat Source References. Step 3 - Vulnerability Identification and Categorization. Step 4 - Control Analysis. Step 5 - Likelihood Rating. Step 6 - Impact Rating - Pre-mitigation Traceability Matrix Development. Loss of Confidentiality, Integrity, Availability Risk Mitigated, Residual Risk, and Adjusted Impact Rating. Step 7 - Risk Determination Impact Rating - Post Mitigation Effort Matrix. Step 8 - Recommendations. Technical Evaluation Plan (TEP). Methodology Overview. Port Scanning. SNMP Scanning. Enumeration and Banner Grabbing. Wireless Enumeration. Vulnerabilit