COMPUTER SECURITY HANDBOOK
PART I INFORMATION ASSURANCE BASICS CHAPTER COMPREHENSIVE INDEPENDENT LEGAL AND REGULATORY REQUIREMENTS LIVING DOCUMENT LONG LIFE SPAN CUSTOMIZABLE AND PRAGMATIC RISK-BASED APPROACH ORGANIZATIONALLY SIGNIFICANT STRATEGIC, TACTICAL, AND OPERATIONAL CONCISE, WELL-STRUCTURED, AND EXTENSIBLE CRITICAL THINKING EXERCISES CHAPTER PROTECTION OF CRITICAL AND SENSITIVE ASSETS COMPLIANCE TO REGULATIONS AND CIRCULARS/LAWS MEETING AUDIT AND COMPLIANCE REQUIREMENTS PROVIDING COMPETITIVE ADVANTAGE THE MSR MODEL OF INFORMATION ASSURANCE INFORMATION ASSURANCE INFORMATION SECURITY INFORMATION PROTECTION CYBERSECURITY INFORMATION ASSURANCE: BUSINESS ENABLER INFORMATION ASSURANCE: PROTECTS THE FABRIC OF AN ORGANIZATION’S SYSTEMS INFORMATION ASSURANCE: COST EFFECTIVE AND COST BENEFICIAL CONTENTS INFORMATION ASSURANCE: SHARED RESPONSIBILITIES INFORMATION ASSURANCE: ROBUST APPROACH INFORMATION ASSURANCE: REASSESSED PERIODICALLY INFORMATION ASSURANCE: RESTRICTED BY SOCIAL OBLIGATIONS IMPLICATIONS FROM LACK OF INFORMATION ASSURANCE PENALTIES FROM A LEGAL/REGULATORY AUTHORITIES LOSS OF INFORMATION ASSETS OPERATIONAL LOSSES AND OPERATIONAL RISK MANAGEMENT CUSTOMER LOSSES LOSS OF IMAGE AND REPUTATION FURTHER READING DEFENSE IN DEPTH CONFIDENTIALITY, INTEGRITY, AND AVAILABILITY CONFIDENTIALITY INTEGRITY AVAILABILITY CIA BALANCE NONREPUDIATION AND AUTHENTICATION NONREPUDIATION IDENTIFICATION, AUTHENTICATION, AUTHORIZATION, AND ACCOUNTABILITY IDENTIFICATION AUTHENTICATION AUTHORIZATION ACCOUNTABILITY PRIVACY’S RELATIONSHIP TO INFORMATION ASSURANCE ASSETS, THREATS, VULNERABILITIES, RISKS, AND CONTROLS COMMON THREATS VULNERABILITIES CONTROLS CRYPTOLOGY CODES AND CIPHERS ORGANIZATIONS PROVIDING RESOURCES FOR PROFESSIONALS (ISC)2 INTERNATIONAL INFORMATION SYSTEM SECURITY CERTIFICATION CONSORTIUM COMPUTING TECHNOLOGY INDUSTRY ASSOCIATION INFORMATION SYSTEM AUDIT AND CONTROL ASSOCIATION INFORMATION SYSTEM SECURITY ASSOCIATION SANS INSTITUTE DISASTER RECOVERY INSTITUTE, INTERNATIONAL BUSINESS CONTINUITY INSTITUTE DECIDING AMONG CERTIFICATIONS CODES OF ETHICS SECURITY CONSIDERATIONS FOR THE INFORMATION ASSET LIFE CYCLE PLAN-DO-CHECK-ACT MODEL PLAN CHECK ACT BOYD’S OODA LOOP THE KILL CHAIN DUE CARE AND DUE DILIGENCE DUE CARE DUE DILIGENCE SPECIFIC LAWS AND REGULATIONS COMPUTER LAWS INTELLECTUAL PROPERTY LAW PRIVACY LAWS INTERNATIONAL LAWS AND ACTS STANDARDS AND BEST PRACTICES CRITICAL THINKING EXERCISE PART II INFORMATION ASSURANCE PLANNING PROCESS CHAPTER KEY COMPONENTS OF INFORMATION ASSURANCE APPROACHES LEVELS OF CONTROLS IN MANAGING SECURITY TOP-DOWN APPROACH BOTTOM-UP APPROACH OUTSOURCING AND THE CLOUD BALANCING INFORMATION ASSURANCE AND ASSOCIATED COSTS IMPORTANCE OF MANAGING INFORMATION ASSURANCE AS A PROGRAM STRUCTURE OF AN INFORMATION ASSURANCE ORGANIZATION INFORMATION ASSURANCE STAFFING ROLES AND RESPONSIBILITIES SENIOR MANAGEMENT INFORMATION ASSURANCE UNITS TECHNOLOGY AND SERVICE PROVIDERS USERS ORGANIZATIONAL MATURITY INFORMATION TECHNOLOGY INFRASTRUCTURE LIBRARY CAPABILITY MATURITY MODEL ORGANIZATIONAL CHANGE MATURITY MODEL OUTSOURCING AND CLOUD COMPUTING TYPES OF ASSETS RESPONSIBILITIES FOR ASSETS INVENTORY OF ASSETS OWNERSHIP OF ASSETS ACCEPTABLE USE OF ASSETS INFORMATION CLASSIFICATION AND HANDLING CLASSIFICATION GUIDELINES INFORMATION LABELING AND HANDLING INFORMATION CLASSIFICATION (CATEGORIZATION) EXAMPLE BENEFITS OF RISK MANAGEMENT RISK MANAGEMENT PROCESS BACKGROUND PLANNING ASSET ANALYSIS THREAT ANALYSIS VULNERABILITY ANALYSIS RISK IDENTIFICATION RISK ANALYSIS RISK TREATMENT MONITORING RISK INTEGRATION WITH OTHER MANAGEMENT PRACTICES IMPORTANCE OF POLICY POLICY AND OTHER GOVERNANCE FUNCTIONS POLICY IN RELATION TO STANDARDS POLICY IN RELATION TO GUIDELINES POLICY IN RELATION TO PROCEDURES POLICY DEVELOPMENT STEPS INFORMATION GATHERING POLICY FRAMEWORK DEFINITION POLICY DEVELOPMENT REVIEW AND APPROVAL ENFORCEMENT POLICY LAYOUT RECRUITMENT INCLUDE SECURITY IN JOB SCOPE/DESCRIPTION DEFINED LEVEL OF CONFIDENTIALITY OR SENSITIVITY FILLING THE POSITION USE OF LEGAL DOCUMENTS TO PROTECT INFORMATION EMPLOYMENT SUPERVISORY CONTROLS ROTATION OF DUTIES MONITORING AND PRIVACY EXPECTATIONS PERIODIC MONITORING EMPLOYEE TRAINING AND AWARENESS DISCIPLINARY PROCESS TERMINATION OR CHANGE OF EMPLOYMENT CONCEPTS AND DEFINITIONS PURPOSE OF CERTIFICATION AND ACCREDITATION PRIMARY ROLES FOR SUPPORTING CERTIFICATION AND ACCREDITATION CERTIFICATION AND ACCREDITATION PROCESS CERTIFICATION BASELINES CONSIDERATIONS FOR PRODUCT EVALUATION, CERTIFICATION, AND ACCREDITATION PART III RISK MITIGATION PROCESS CHAPTER BENEFITS OF INCORPORATING SECURITY CONSIDERATIONS OVERVIEW OF THE SYSTEM DEVELOPMENT LIFE CYCLE INFORMATION ASSURANCE IN THE SYSTEM DEVELOPMENT LIFE CYCLE INFORMATION ASSURANCE IN THE SYSTEM OR SERVICE ACQUISITION LIFE CYCLE SYSTEM DEVELOPMENT SYSTEM ACQUISITION CHANGE MANAGEMENT CONFIGURATION MANAGEMENT PHYSICAL AND ENVIRONMENTAL SECURITY CONTROLS BENEFITS PHYSICAL SECURITY OF PREMISES AND OFFICES HANDLING OF MEDIA MANAGEMENT OF REMOVABLE MEDIA DISPOSAL OF MEDIA PURPOSE OF THE AT&E PROGRAM BENEFITS OF THE AT&E PROGRAM DESIGN, DEVELOPMENT, AND ASSESSMENT OF PROGRAMS TYPES OF LEARNING PROGRAMS INFORMATION ASSURANCE AWARENESS INFORMATION ASSURANCE TRAINING INFORMATION ASSURANCE EDUCATION PREVENTIVE INFORMATION ASSURANCE TOOLS CONTENT FILTERS CRYPTOGRAPHIC PROTOCOLS AND TOOLS FIREWALLS NETWORK INTRUSION PREVENTION SYSTEM PROXY SERVERS PUBLIC KEY INFRASTRUCTURE VIRTUAL PRIVATE NETWORKS PREVENTIVE INFORMATION ASSURANCE CONTROLS BACKUPS CHANGE MANAGEMENT AND CONFIGURATION MANAGEMENT IT SUPPORT MEDIA CONTROLS AND DOCUMENTATION PATCH MANAGEMENT ACCESS CONTROL: THE BENEFITS ACCESS CONTROL TYPES ACCESS CONTROL MODELS ACCESS CONTROL TECHNIQUES RULE-BASED ACCESS CONTROL ACCESS CONTROL MATRIX ACCESS CONTROL LISTS CAPABILITY TABLES CONSTRAINED USER INTERFACES CONTENT-DEPENDENT ACCESS CONTROL CONTEXT-DEPENDENT ACCESS CONTROL ACCESS CONTROL ADMINISTRATION CENTRALIZED ACCESS CONTROL ADMINISTRATION DECENTRALIZED ACCESS CONTROL ADMINISTRATION PART IV INFORMATION ASSURANCE DETECTION AND RECOVERY PROCESSES CHAPTER INTRUSION DETECTION SYSTEMS HOST INTRUSION DETECTION SYSTEM NETWORK INTRUSION DETECTION SYSTEM LOG MANAGEMENT TOOLS SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) HONEYPOT/HONEYNET MALWARE DETECTION SIGNATURE DETECTION CHANGE DETECTION STATE DETECTION VULNERABILITY SCANNERS VULNERABILITY SCANNER STANDARDS HOST-BASED SCANNER NETWORK-BASED SCANNER DATABASE VULNERABILITY SCANNER DISTRIBUTED NETWORK SCANNER PENETRATION TEST EXTERNAL PENETRATION TEST INTERNAL PENETRATION TEST WIRELESS PENETRATION TEST PHYSICAL CONTROLS PERSONNEL MONITORING TOOLS NETWORK SURVEILLANCE THE CONCEPT OF CONTINUOUS MONITORING AND AUTHORIZATION IMPORTANCE OF INFORMATION ASSURANCE MEASUREMENT INFORMATION ASSURANCE MEASUREMENT PROCESS DEVELOP MEASUREMENTS COLLECT DATA ANALYZE AND REPORT INTEGRATE MEASUREMENT OUTPUT IMPROVE MEASUREMENT PROCESS IMPORTANCE OF INFORMATION ASSURANCE METRICS INFORMATION ASSURANCE METRICS PROGRAM DATA COLLECTION PREPARATION DATA COLLECTION AND ANALYSIS CORRECTIVE ACTION IDENTIFICATION BUSINESS CASE DEVELOPMENT CORRECTIVE ACTION APPLICATIONS IMPORTANCE OF INCIDENT HANDLING INCIDENT REPORTING INCIDENT HANDLING PROCESS PHASE 1: PREPARATION PHASE 2: DETECTION/IDENTIFICATION PHASE 3: CONTAINMENT PHASE 4: ERADICATION PHASE 5: RECOVERY PHASE 6: REVIEW IMPORTANCE OF COMPUTER FORENSICS PREREQUISITES OF A COMPUTER FORENSIC EXAMINER FORENSIC SKILLS SUPPLEMENTAL FORENSIC SKILLS RULES OF COMPUTER FORENSICS CHAIN OF CUSTODY COMPUTER FORENSIC STEPS RULES OF EVIDENCE COMPUTER FORENSICS TEAMS ESTABLISHING A COMPUTER FORENSICS TEAM IMPORTANCE OF BUSINESS CONTINUITY MANAGEMENT CRITICAL SUCCESS FACTORS FOR BCM IMPLEMENTATION BUSINESS CONTINUITY MANAGEMENT PROCESSES STAGE 1: RECOGNIZE BCP IS ESSENTIAL STAGE 2: IDENTIFY THE BUSINESS NEEDS STAGE 3: DEVELOP BCM STRATEGIES STAGE 4: DEVELOPING AND IMPLEMENTING A BCM RESPONSE STAGE 5: DEVELOPING A BCM CULTURE STAGE 6: EXECUTE, TEST, MAINTAIN, AND AUDIT BUSINESS CONTINUITY IN THE CLOUD IMPORTANCE OF BACKUP BACKUP CONSIDERATIONS BACKUP SOLUTIONS MEDIA BACKUP INFRASTRUCTURE BACKUP SOFTWARE TYPES OF BACKUP SCHEDULING RETENTION TAPE MEDIA ADMINISTRATION RESTORATION OF DATA BYOD AND CLOUD BACKUPS PART V APPLICATION OF INFORMATION ASSURANCE TO SELECT INDUSTRIES CHAPTER OVERVIEW OF INFORMATION ASSURANCE APPROACH HEALTHCARE-SPECIFIC TERMINOLOGY INFORMATION ASSURANCE MANAGEMENT PERSONNEL MANAGEMENT APPROACH REGULATIONS AND LEGAL REQUIREMENTS INFORMATION ASSURANCE RISK MANAGEMENT ASSETS THREATS RISK ASSESSMENT RISK MITIGATION POLICY, PROCEDURES, STANDARDS, AND GUIDANCE HUMAN RESOURCES CERTIFICATION, ACCREDITATION, AND ASSURANCE INFORMATION ASSURANCE IN SYSTEM DEVELOPMENT AND ACQUISITION AWARENESS, TRAINING, AND EDUCATION ACCESS CONTROL CONTINUOUS MONITORING, INCIDENT RESPONSE, AND FORENSICS BUSINESS CONTINUITY AND BACKUPS OVERVIEW OF THE INFORMATION ASSURANCE APPROACH INFORMATION ASSURANCE: SYSTEM DEVELOPMENT AND ACQUISITION INDUSTRIAL CONTROL–SPECIFIC LANGUAGE