IT SECURITY MANAGEMENT
CONTENTS PART 1 FROM VULNERABILITY TO PATCH CHAPTER 1 WINDOWS OF VULNERABILITY INTRODUCTION WHAT ARE VULNERABILITIES? UNDERSTANDING THE RISKS POSED BY VULNERABILITIES SUMMARY CHAPTER 2 VULNERABILITY ASSESSMENT 101 WHAT IS A VULNERABILITY ASSESSMENT? STEP 1: INFORMATION GATHERING/DISCOVERY STEP 2: ENUMERATION STEP 3: DETECTION SEEKING OUT VULNERABILITIES DETECTING VULNERABILITIES VIA SECURITY TECHNOLOGIES DECIPHERING VA DATA GATHERED BY SECURITY TECHNOLOGIES ACCESSING VULNERABILITIES VIA REMEDIATION (PATCH) TECHNOLOGIES EXTRACTING VA DATA FROM REMEDIATION REPOSITORIES LEVERAGING CON? GURATION TOOLS TO ASSESS VULNERABILITIES THE IMPORTANCE OF SEEKING OUT VULNERABILITIES LOOKING CLOSER AT THE NUMBERS CHAPTER 3 VULNERABILITY ASSESSMENT TOOLS FEATURES OF A GOOD VULNERABILITY ASSESSMENT TOOL USING A VULNERABILITY ASSESSMENT TOOL STEP 1: IDENTIFY THE HOSTS ON YOUR NETWORK STEP 2: CLASSIFY THE HOSTS INTO ASSET GROUPS STEP 3: CREATE AN AUDIT POLICY STEP 4: LAUNCH THE SCAN STEP 5: ANALYZE THE REPORTS STEP 6: REMEDIATE WHERE NECESSARY CHAPTER 4 VULNERABILITY ASSESSMENT: STEP ONE KNOW YOUR NETWORK CLASSIFYING YOUR ASSETS I THOUGHT THIS WAS A VULNERABILITY ASSESSMENT CHAPTER CHAPTER 5 VULNERABILITY ASSESSMENT: STEP TWO AN EFFECTIVE SCANNING PROGRAM SCANNING YOUR NETWORK WHEN TO SCAN CHAPTER 6 GOING FURTHER TYPES OF PENETRATION TESTS SCENARIO: AN INTERNAL NETWORK ATTACK CLIENT NETWORK STEP 1: INFORMATION GATHERING OPERATING SYSTEM DETECTION DISCOVERING OPEN PORTS AND ENUMERATING STEP 2: DETERMINE VULNERABILITIES SETTING UP THE VA INTERPRETING THE VA RESULTS PENETRATION TESTING STEP 3: ATTACK AND PENETRATE UPLOADING OUR DATA ATTACK AND PENETRATE SEARCHING THE WEB SERVER FOR INFORMATION DISCOVERING WEB SERVICES VULNERABILITY ASSESSMENT VERSUS A PENETRATION TEST TIPS FOR DECIDING BETWEEN CONDUCTING A VA OR A PENETRATION TEST INTERNAL VERSUS EXTERNAL CHAPTER 7 VULNERABILITY MANAGEMENT THE VULNERABILITY MANAGEMENT PLAN THE SIX STAGES OF VULNERABILITY MANAGEMENT STAGE ONE: IDENTIFY STAGE TWO: ASSESS STAGE THREE: REMEDIATE STAGE FOUR: REPORT STAGE FIVE: IMPROVE STAGE SIX: MONITOR GOVERNANCE (WHAT THE AUDITORS WANT TO KNOW) MEASURING THE PERFORMANCE OF A VULNERABILITY MANAGEMENT PROGRAM COMMON PROBLEMS WITH VULNERABILITY MANAGEMENT CHAPTER 8 VULNERABILITY MANAGEMENT TOOLS THE PERFECT TOOL IN A PERFECT WORLD EVALUATING VULNERABILITY MANAGEMENT TOOLS COMMERCIAL VULNERABILITY MANAGEMENT TOOLS EEYE DIGITAL SECURITY SYMANTEC (BINDVIEW) ATTACHMATE (NETIQ) STILLSECURE MCAFEE OPEN SOURCE AND FREE VULNERABILITY MANAGEMENT TOOLS ASSET MANAGEMENT, WORK? OW, AND KNOWLEDGEBASE HOST DISCOVERY VULNERABILITY SCANNING AND CON? GURATION SCANNING CON? GURATION AND PATCH SCANNING VULNERABILITY NOTI? CATION SECURITY INFORMATION MANAGEMENT MANAGED VULNERABILITY SERVICES CHAPTER 9 VULNERABILITY AND CON? GURATION MANAGEMENT PATCH MANAGEMENT SYSTEM INVENTORIES SYSTEM CLASSI? CATION SYSTEM BASELINES CREATING A BASELINE BASELINE EXAMPLE THE COMMON VULNERABILITY SCORING SYSTEM BUILDING A PATCH TEST LAB ESTABLISH A PATCH TEST LAB WITH “SACRI? CIAL SYSTEMS” VIRTUALIZATION ENVIRONMENTAL SIMULATION PATCH DISTRIBUTION AND DEPLOYMENT LOGGING AND REPORTING CON? GURATION MANAGEMENT CHANGE CONTROL CHAPTER 10 REGULATORY COMPLIANCE REGULATING ASSESSMENTS AND PEN TESTS THE PAYMENT CARD INDUSTRY (PCI) STANDARD THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) THE SARBANES-OXLEY ACT OF 2002 (SOX) COMPLIANCE RECAP DRAFTING AN INFORMATION SECURITY PROGRAM CHAPTER 11 TYING IT ALL TOGETHER A VULNERABILITY MANAGEMENT METHODOLOGY STEP ONE: KNOW YOUR ASSETS WHAT YOU NEED TO DO WHY YOU NEED TO DO IT HOW TO DO IT WHAT TOOLS EXIST TO HELP YOU DO IT STEP TWO: CATEGORIZE YOUR ASSETS STEP THREE: CREATE A BASELINE SCAN OF ASSETS STEP FOUR: PERFORM A PENETRATION TEST ON CERTAIN ASSETS STEP FIVE: REMEDIATE VULNERABILITIES AND RISK STEP SIX: CREATE A VULNERABILITY ASSESSMENT SCHEDULE STEP SEVEN: CREATE A PATCH AND CHANGE MANAGEMENT PROCESS STEP EIGHT: MONITOR FOR NEW RISKS TO ASSETS PART 2 NETWORK SECURITY EVALUATION CHAPTER 12 INTRODUCING THE INFOSEC EVALUATION METHODOLOGY WHAT IS THE IEM? TYING THE METHODOLOGIES TOGETHER WHAT THE IEM IS NOT THE IEM IS NOT AN AUDIT OR INSPECTION THE IEM IS NOT A RISK ASSESSMENT STANDARDS AND REGULATIONS LACK OF EXPERTISE CERTI? CATION DOES NOT GIVE YOU EXPERTISE CHAPTER 13 BEFORE THE EVALUATION STARTS THE EVALUATION REQUEST WHY ARE EVALUATIONS REQUESTED? COMPLIANCE WITH LAWS AND REGULATIONS THE SARBANES-OXLEY ACT FEDERAL INFORMATION SECURITY MANAGEMENT ACT HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 THE GRAMM-LEACH-BLILEY ACT THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT THE DOD INFORMATION TECHNOLOGY SECURITY CERTI? CATION AND ACCREDITATION PROCESS THE NATIONAL INFORMATION ASSURANCE CERTI? CATION AND ACCREDITATION PROCESS DEFENSE INFORMATION ASSURANCE CERTI? CATION AND ACCREDITATION PROCESS ISO 17799 THE NORTH AMERICAN ELECTRIC RELIABILITY COUNCIL RESPONSE TO SUSPICIOUS ACTIVITIES RECENT SUCCESSFUL PENETRATION SUSPECTED POSSIBLE PENETRATION UNSUCCESSFUL PENETRATION ATTEMPT “I DON’T KNOW IF OUR ORGANIZATION HAS BEEN PENETRATED” THIRD-PARTY INDEPENDENT REVIEWS OF SECURITY POSTURE CUSTOMER-REQUIRED REVIEWS INSURANCE-REQUIRED REVIEWS SLA-REQUIRED REVIEWS IT’S THE RIGHT THING TO DO HOW ARE EVALUATIONS REQUESTED? VALIDATING THE EVALUATION REQUEST SOURCES OF INFORMATION FOR VALIDATION VALIDATING WITH THE CUSTOMER THE ENGAGEMENT SCOPING QUESTIONNAIRE CUSTOMER DISCUSSIONS AND INFORMATION CON? RMATION PUBLICLY AVAILABLE INFORMATION UNDERSTANDING THE LEVEL OF EFFORT THE FORMAL ENGAGEMENT AGREEMENT NONDISCLOSURE AGREEMENTS ENGAGEMENT AGREEMENT COMPOSITION MINIMUM ENGAGEMENT AGREEMENT CONTENTS UNDERSTANDING THE PRICING OPTIONS GOVERNMENT CONTRACTING COMMERCIAL CONTRACTING FIXED PRICE VS HOURLY RATE ADDITIONAL ENGAGEMENT AGREEMENT CONTENTS DEALING WITH CONTRACT PITFALLS “SCOPE CREEP” AND TIMELINES UNEDUCATED SALESPEOPLE EVALUATIONS 101 BAD ASSUMPTIONS ASSUMPTION TOPIC AREAS POORLY WRITTEN CONTRACTS POOR SCOPE DE? NITION UNDERBID OR OVERBID: THE ART OF POOR COST ESTIMATING CUSTOMER AND EVALUATION TEAM APPROVAL THE CUSTOMER APPROVAL PROCESS THE EVALUATION TEAM APPROVAL PROCESS CHAPTER 14 SETTING EXPECTATIONS OBJECTIVES OF THE PRE-EVALUATION PHASE UNDERSTANDING CONCERNS AND CONSTRAINTS WHAT ARE THE REQUIREMENTS? OTHER SIGNI? CANT REGULATIONS BUDGETARY CONCERNS CYBER-INSURANCE SYSTEM ACCREDITATION FISMA DOD INFORMATION TECHNOLOGY SECURITY CERTI? CATION AND ACCREDITATION PROCESS NATIONAL INFORMATION ASSURANCE CERTI? CATION AND ACCREDITATION PROCESS RESPONSE TO SUSPECTED THREATS OR INTRUSIONS OBTAINING MANAGEMENT BUY-IN OBTAINING TECHNICAL STAFF BUY-IN ESTABLISHING POINTS OF CONTACT CHAPTER 15 SCOPING THE EVALUATION FOCUSING THE EVALUATION THE POWER OF EXPECTATIONS WHAT DOES THE CUSTOMER EXPECT FOR DELIVERY? ADJUSTING CUSTOMER EXPECTATIONS WHEN SCOPING FAILS “SCOPE CREEP” AND TIME LINES RESTRICTING SCOPE SLIPPAGE IN THE CONTRACT CONTRACTING DIFFERENCES IDENTIFYING THE RULES OF ENGAGEMENT CUSTOMER CONCERNS STATING THE EVALUATION PURPOSE CUSTOMER CONSTRAINTS IMPACT RESISTANCE AND ACCEPTABLE LEVELS OF INVASIVENESS IDENTIFYING SCANNING TIMES OFF-LIMIT NODES EVALUATION TOOL LIMITATIONS NOTI? CATION PROCEDURES EVALUATION ADDRESSING REPORTING LEVEL OF DETAIL CLEAR AND CONCISE WRITING ESTABLISHING THE EVALUATION BOUNDARIES PHYSICAL BOUNDARIES LOGICAL BOUNDARIES CRITICAL PATH AND CRITICAL COMPONENTS FINDING THE SOURCES OF SCOPING INFORMATION CUSTOMER THE SCOPING QUESTIONNAIRE INFORMATION GAINED FROM THE QUESTIONNAIRE VALUE OF THE QUESTIONNAIRE EXAMPLE RESPONSES ON A SCOPING QUESTIONNAIRE EVALUATION REQUESTOR CUSTOMER SENIOR LEADERSHIP ADMINISTRATIVE CUSTOMER CONTACT TECHNICAL CUSTOMER CONTACTS EVALUATION TEAM EVALUATION TEAM LEAD EVALUATION TEAM MEMBERS VALIDATING SCOPING INFORMATION STAF? NG YOUR PROJECT JOB REQUIREMENTS NETWORKING AND OPERATING SYSTEMS HARDWARE KNOWLEDGE PICKING THE RIGHT PEOPLE MATCHING CONSULTANTS TO CUSTOMERS PERSONALITY ISSUES CHAPTER 16 LEGAL PRINCIPLES FOR INFORMATION SECURITY EVALUATIONS UNCLE SAM WANTS YOU: HOW YOUR COMPANY’S INFORMATION SECURITY CAN AFFECT U S NATIONAL SECURITY LEGAL STANDARDS RELEVANT TO INFORMATION SECURITY SELECTED FEDERAL LAWS GRAMM-LEACH-BLILEY ACT HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT SARBANES-OXLEY FEDERAL INFORMATION SECURITY AND MANAGEMENT ACT FERPA AND THE TEACH ACT ELECTRONIC COMMUNICATIONS PRIVACY ACT AND COMPUTER FRAUD AND ABUSE ACT STATE LAWS UNAUTHORIZED ACCESS DECEPTIVE TRADE PRACTICES ENFORCEMENT ACTIONS THREE FATAL FALLACIES THE “SINGLE LAW” FALLACY THE PRIVATE ENTITY FALLACY THE “PEN TEST ONLY” FALLACY DO IT RIGHT OR BET THE COMPANY: TOOLS TO MITIGATE LEGAL LIABILITY WE DID OUR BEST; WHAT IS THE PROBLEM? THE BASIS FOR LIABILITY NEGLIGENCE AND THE “STANDARD OF CARE” WHAT CAN BE DONE? UNDERSTAND YOUR LEGAL ENVIRONMENT COMPREHENSIVE AND ONGOING SECURITY ASSESSMENTS, EVALUATIONS, AND IMPLEMENTATION USE CONTRACTS TO DE? NE RIGHTS AND PROTECT INFORMATION USE QUALI? ED THIRD-PARTY PROFESSIONALS MAKING SURE YOUR STANDARDS-OF-CARE ASSESSMENTS KEEP UP WITH EVOLVING LAW PLAN FOR THE WORST INSURANCE WHAT TO COVER IN IEM CONTRACTS WHAT, WHO, WHEN, WHERE, HOW, AND HOW MUCH WHAT DESCRIPTION OF THE SECURITY EVALUATION AND BUSINESS MODEL DE? NITIONS USED IN THE CONTRACT DESCRIPTION OF THE PROJECT ASSUMPTIONS, REPRESENTATIONS, AND WARRANTIES BOUNDARIES AND LIMITATIONS IDENTI? CATION OF DELIVERABLES WHO STATEMENT OF PARTIES TO THE CONTRACTUAL AGREEMENT AUTHORITY OF SIGNATORIES TO THE CONTRACTUAL AGREEMENT ROLES AND RESPONSIBILITIES OF EACH PARTY TO THE CONTRACTUAL AGREEMENT NON-DISCLOSURE AND SECRECY AGREEMENTS ASSESSMENT PERSONNEL CRISIS MANAGEMENT AND PUBLIC COMMUNICATIONS INDEMNI? CATION, HOLD HARMLESS, AND DUTY TO DEFEND OWNERSHIP AND CONTROL OF INFORMATION INTELLECTUAL PROPERTY CONCERNS LICENSES WHEN ACTIONS OR EVENTS THAT AFFECT SCHEDULE WHERE HOW HOW MUCH FEES AND COST BILLING METHODOLOGY PAYMENT EXPECTATIONS AND SCHEDULE RIGHTS AND PROCEDURES TO COLLECT PAYMENT INSURANCE FOR POTENTIAL DAMAGE DURING EVALUATION MURPHY’S LAW (WHEN SOMETHING GOES WRONG) GOVERNING LAW ACTS OF GOD, TERROR ATTACKS, AND OTHER UNFORESEEABLE EVEN WHEN AGREEMENT IS BREACHED AND REMEDIES LIQUIDATED DAMAGES LIMITATION ON LIABILITY SURVIVAL OF OBLIGATIONS WAIVER AND SEVERABILITY AMENDMENTS TO THE CONTRACT WHERE THE RUBBER MEETS THE ROAD: THE LOA AS LIABILITY PROTECTION BEYOND YOU AND YOUR CUSTOMER SOFTWARE LICENSE AGREEMENTS YOUR CUSTOMER’S CUSTOMER THE FIRST THING WE DO…? WHY YOU WANT YOUR LAWYERS INVOLVED FROM START TO FINISH ATTORNEY-CLIENT PRIVILEGE ADVICE OF COUNSEL DEFENSE ESTABLISHMENT AND ENFORCEMENT OF RIGOROUS ASSESSMENT, INTERVIEW, AND REPORT-WRITING STANDARDS CREATING A GOOD RECORD FOR FUTURE LITIGATION MAXIMIZING ABILITY TO DEFEND LITIGATION DEALING WITH REGULATORS, LAW ENFORCEMENT, INTELLIGENCE, AND HOMELAND SECURITY OF? CIALS THE ETHICS OF INFORMATION SECURITY EVALUATION CHAPTER 17 BUILDING THE TECHNICAL EVALUATION PLAN PURPOSE OF THE TECHNICAL EVALUATION PLAN THE IEM TEP AS AN AGREEMENT THE TEP AS ROAD MAP BUILDING THE TECHNICAL EVALUATION PLAN SOURCE OF THE TECHNICAL EVALUATION PLAN INFORMATION TEP SECTION I: POINTS OF CONTACT EVALUATION TEAM CONTACTS CUSTOMER CONTACTS TEP SECTION II: METHODOLOGY OVERVIEW PURPOSE OF THE IEM DESCRIPTION OF THE IEM EVALUATION TOOLS TO BE USED TEP SECTION III: CRITICALITY INFORMATION ORGANIZATIONAL CRITICALITY MATRICES SYSTEM CRITICALITY INFORMATION TEP SECTION IV: DETAILED NETWORK INFORMATION TEP SECTION V: CUSTOMER CONCERNS TEP SECTION VI: CUSTOMER CONSTRAINTS TEP SECTION VII: RULES OF ENGAGEMENT EVALUATION TEAM REQUIREMENTS EXTERNAL REQUIREMENTS INTERNAL REQUIREMENTS CUSTOMER REQUIREMENTS TEP SECTION VIII: COORDINATION AGREEMENTS LEVEL OF DETAIL OF RECOMMENDATIONS LIST OF AGREED-ON DELIVERABLES THE COORDINATION AGREEMENTS SECTION: A CATCHALL TEP SECTION IX: LETTER OF AUTHORIZATION TEP SECTION X: TIMELINE OF EVENTS CUSTOMIZING AND MODIFYING THE TECHNICAL EVALUATION PLAN MODIFYING THE TEN NSA-DE? NED AREAS LEVEL OF DETAIL FORMAT GETTING THE SIGNATURES CUSTOMER APPROVAL EVALUATION TEAM APPROVAL CHAPTER 18 STARTING YOUR ONSITE EFFORTS PREPARING FOR THE ONSITE EVALUATION PHASE SCHEDULING DAY ONE ACCOMPLISHMENTS DAY TWO ACCOMPLISHMENTS DAY THREE ACCOMPLISHMENTS DAY FOUR ACCOMPLISHMENTS DAY FIVE ACCOMPLISHMENTS FLEXIBILITY AND ADAPTATION ADMINISTRATIVE PLANNING TECHNICAL PLANNING IAM VS IEM VULNERABILITY DE? NITIONS ONSITE EVALUATION PHASE OBJECTIVES VERI? CATION OF “KNOWN” AND “ROGUE” COMPONENTS DISCOVERY OF TECHNICAL VULNERABILITIES VALIDATION = VALUE ADD? IEM BASELINE ACTIVITIES I PORT SCANNING II SNMP SCANNING III ENUMERATION AND BANNER GRABBING IV WIRELESS ENUMERATION V VULNERABILITY SCANNING VI HOST EVALUATION VII NETWORK DEVICE ANALYSIS VIII PASSWORD COMPLIANCE TESTING IX APPLICATION-SPECI? C SCANNING X NETWORK SNIF? NG OTHER ACTIVITIES THE ROLE OF CVE AND CAN THE IN-BRIEF PRESENTING THE TEP CULTURAL SENSITIVITY CHAPTER 19 NETWORK DISCOVERY ACTIVITIES GOALS AND OBJECTIVES RESULTS AS FINDINGS AND EVALUATION TASK ATTRIBUTES SYSTEM MAPPING TOOL BASICS EXPECTED USAGE AND REQUIREMENTS PORT SCANNING NMAP NMAP OPTIONS TCP SYN UDP SCANNING PING SCANNING BASIC NMAP OPTIONS SUPERSCAN SCANLINE SOLARWINDS PORT SCAN SYSTEM MAPPING SNMP SCANNING SNMPSWEEP MIB WALK MIB BROWSER SNSCAN WS_PING PRO-PAK SNMP SCAN SYSTEM MAPPING ENUMERATION AND BANNER GRABBING THC-AMAP NBTSCAN UNIX ENUMERATION TELNET DNS QUERIES ENUMERATION AND BANNER-GRABBING SYSTEM MAPPING WIRELESS ENUMERATION WIRELESS ENUMERATION OBSTACLES KISMET NETSTUMBLER WIRELESS ENCRYPTION EVALUATION WIRELESS ENUMERATION SYSTEM MAPPING CHAPTER 20 COLLECTING THE MAJORITY OF VULNERABILITIES VULNERABILITY AND ATTACK TRENDS VULNERABILITY SCANNING’S ROLE IN THE IEM CONDUCTING VULNERABILITY SCANS BREAKING OUT THE SCANNING TOOLS VULNERABILITY SCANNERS: COMMERCIAL AND FREEWARE CONDUCTING HOST EVALUATIONS HOST EVALUATION EXAMPLE TOOLS AND SCRIPTS BENCHMARK SCRIPTS AND CUSTOM SCRIPTS HOST EVALUATIONS: WHAT TO LOOK FOR AUDITING FILE/DIRECTORY PERMISSIONS OS AND APPLICATION SERVICES USER RIGHTS ASSIGNMENTS MAPPING THE FINDINGS TO THE IEM PROCESS VULNERABILITY SCANS AND HOST EVALUATIONS: CORRELATING THE DATA SUMMARIZE AND VALIDATE FINDINGS CHAPTER 21 FINE-TUNING THE EVALUATION NETWORK DEVICE ANALYSIS APPROACHES USED IN NETWORK DEVICE ANALYSIS EVALUATING THE PERIMETER DESIGN AND DEFENSES EVALUATING NETWORK DEVICE CON? GURATIONS PASSWORD-COMPLIANCE TESTING PASSWORD-COMPLIANCE TESTING METHODS METHODS OF OBTAINING THE PASSWORD FILE PASSWORD-COMPLIANCE TESTING TOOLS APPLICATION-SPECI? C SCANNING THE DMZ TYPES OF APPLICATIONS TO BE SCANNED NETWORK PROTOCOL ANALYSIS WHY PERFORM NETWORK PROTOCOL ANALYSIS? INTRODUCING NETWORK PROTOCOL ANALYZERS CHAPTER 22 THE ONSITE CLOSING MEETING ORGANIZING THE MEETING TIME AND LOCATION EVALUATION TEAM AND CUSTOMER INVOLVEMENT THE CUSTOMER THE EVALUATION TEAM PRESENTATION NEEDS THE AGENDA TEP OVERVIEW THE EVALUATION PROCESS HOW WAS INFORMATION COLLECTED? THE TOOLS CUSTOMER DOCUMENTATION WHAT IS DRIVING THE EVALUATION? PROTECTING TESTING DATA SETTING TIMELINES IMPORTANT EVENTS DURING TESTING FINAL REPORT DELIVERY OVERVIEW OF CRITICAL FINDINGS HOW DOES THE VULNERABILITY IMPACT THE SYSTEM? WHAT IS THE LIKELIHOOD THAT A THREAT WILL EXPLOIT THE VULNERABILITY? MAPPING TO BUSINESS MISSION AND OBJECTIVES POSITIVE VS NEGATIVE FINDINGS POINTS OF IMMEDIATE RESOLUTION SHORT TERM VS LONG TERM WHAT DO YOU DO WITH THE INFORMATION THAT YOU HAVE COLLECTED? CHAPTER 23 POST-EVALUATION ANALYSIS GETTING ORGANIZED ANALYSIS NEEDS REPORTING NEEDS CATEGORIZATION, CONSOLIDATION, CORRELATION, AND CONSULTATION FALSE POSITIVES AND FALSE NEGATIVES EVALUATION PERSPECTIVES EXTERNAL EXPOSURES INTERNAL EXPOSURES SYSTEM BOUNDARIES CONDUCTING ADDITIONAL RESEARCH RESOURCES CONSULTING SUBJECT MATTER EXPERTS OTHER TEAM MEMBERS EXTERNAL RESOURCES ANALYZING CUSTOMER DOCUMENTATION INFOSEC POLICIES AND PROCEURES PREVIOUS EVALUATIONS/VA/PENETRATION-TESTING RESULTS DEVELOPING PRACTICAL RECOMMENDATIONS FINDING DESCRIPTION REFERENCES CRITICALITY RATING BUSINESS IMPACT THREAT LIKELIHOOD RECOMMENDATIONS TYING IN REGULATIONS, LEGISLATION, ORGANIZATIONAL POLICIES, AND INDUSTRY BEST PRACTICES CHAPTER 24 CREATING MEASUREMENTS AND TRENDING RESULTS THE PURPOSE AND GOAL OF THE MATRIXES INFORMATION TYPES COMMON VULNERABILITIES AND EXPOSURES NIST ICAT DEVELOPING SYSTEM VULNERABILITY CRITICALITY MATRIXES DEVELOPING OVERALL VULNERABILITY CRITICALITY MATRIXES USING THE OVCM AND SVCM CHAPTER 25 TRENDING METRICS METRICS AND THEIR USEFULNESS RETURN ON INVESTMENT HOW DO WE COMPARE? THE INFOSEC POSTURE PRO? LE DEFENSE IN DEPTH ADVERSARIES OR THREATS PROTECT DETECT RESPOND SUSTAIN PEOPLE TECHNOLOGY DEFENSE IN MULTIPLE PLACES LAYERED DEFENSES SPECIFY THE SECURITY ROBUSTNESS ROBUST KEY MANAGEMENT EVENT CORRELATION OPERATIONS DEVELOPING THE INFOSEC POSTURE PRO? LE THE INFOSEC POSTURE RATING VALUE-ADDED TRENDING CHAPTER 26 FINAL REPORTING PULLING ALL THE INFORMATION TOGETHER THE TEAM MEETING RESEARCH THE SVCM AND OVCM REVIEW MAKING RECOMMENDATIONS FINDINGS CREATING THE FINAL REPORT ORGANIZING THE DATA DISCUSSION OF FINDINGS FINAL REPORT DELIVERY DATE THE COVER LETTER THE EXECUTIVE SUMMARY THE INFOSEC PRO? LE THE INTRODUCTION INFOSEC ANALYSIS TECHNICAL AREAS HIGH-CRITICALITY FINDINGS MEDIUM-CRITICALITY FINDINGS LOW-CRITICALITY FINDINGS THE CONCLUSION POSTURE DESCRIPTION POSTURE PRO? LE SECURITY PRACTICES PRESENTING THE FINAL REPORT CHAPTER 27 SUMMING UP THE INFOSEC EVALUATION METHODOLOGY THE PRE-EVALUATION PHASE THE ONSITE EVALUATION THE POST-EVALUATION PHASE EXAMPLES OF INFOSEC TOOLS BY BASELINE ACTIVITY VULNERABILITY SCANNING HOST EVALUATION TECHNICAL EVALUATION PLAN OUTLINE AND SAMPLE SAMPLE TECHNICAL EVALUATION PLAN I EVALUATION POINTS OF CONTACT II METHODOLOGY OVERVIEW III ORGANIZATIONAL AND SYSTEM CRITICALITY INFORMATION THE OUCH MISSION OUCH IMPACT DE? NITIONS OUCH ORGANIZATIONAL CRITICALITY SYSTEM INFORMATION CRITICALITY IV DETAILED NETWORK INFORMATION V CUSTOMER CONCERNS VI CUSTOMER CONSTRAINTS VII RULES OF ENGAGEMENT VIII INTERNAL AND EXTERNAL CUSTOMER REQUIREMENTS IX COORDINATION AGREEMENTS DELIVERABLES OTHER AGREEMENTS X LETTER OF AUTHORIZATION XI TIMELINE OF EVALUATION EVENTS PART 3 BUSINESS CONTINUITY & DISASTER RECOVERY CHAPTER 28 BUSINESS CONTINUITY AND DISASTER RECOVERY OVERVIEW BUSINESS CONTINUITY AND DISASTER RECOVERY DE? NED COMPONENTS OF BUSINESS PEOPLE IN BC/DR PLANNING PROCESS IN BC/DR PLANNING TECHNOLOGY IN BC/DR PLANNING THE COST OF PLANNING VERSUS THE COST OF FAILURE PROCESS TYPES OF DISASTERS NATURAL HAZARDS COLD WEATHER RELATED HAZARDS WARM WEATHER RELATED HAZARDS GEOLOGICAL HAZARDS HUMAN-CAUSED HAZARDS ACCIDENTS AND TECHNOLOGICAL HAZARDS ELECTRONIC DATA THREATS PERSONAL PRIVACY PRIVACY STANDARDS AND LEGISLATION GRAMM-LEACH-BLILEY ACT (GLBA) HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) SOCIAL ENGINEERING FRAUD AND THEFT GENERAL BUSINESS FRAUD MANAGING ACCESS BUSINESS CONTINUITY AND DISASTER RECOVERY PLANNING BASICS PROJECT INITIATION RISK ASSESSMENT BUSINESS IMPACT ANALYSIS MITIGATION STRATEGY DEVELOPMENT PLAN DEVELOPMENT TRAINING, TESTING, AUDITING PLAN MAINTENANCE CHAPTER 29 PROJECT INITIATION ELEMENTS OF PROJECT SUCCESS EXECUTIVE SUPPORT USER INVOLVEMENT EXPERIENCED PROJECT MANAGER CLEARLY DE? NED PROJECT OBJECTIVES CLEARLY DE? NED PROJECT REQUIREMENTS CLEARLY DE? NED SCOPE SHORTER SCHEDULE, MULTIPLE MILESTONES CLEARLY DE? NED PROJECT MANAGEMENT PROCESS PROJECT PLAN COMPONENTS PROJECT DE? NITION PROBLEM AND MISSION STATEMENT POTENTIAL SOLUTIONS REQUIREMENTS AND CONSTRAINTS SUCCESS CRITERIA PROJECT PROPOSAL ESTIMATES PROJECT SPONSOR FORMING THE PROJECT TEAM ORGANIZATIONAL TECHNICAL LOGISTICAL POLITICAL PROJECT ORGANIZATION PROJECT OBJECTIVES BUSINESS CONTINUITY PLAN CONTINUITY OF OPERATIONS PLAN DISASTER RECOVERY PLAN CRISIS COMMUNICATION PLAN CYBER INCIDENT RESPONSE PLAN (CIRP) OCCUPANT EMERGENCY PLAN PROJECT STAKEHOLDERS PROJECT REQUIREMENTS PROJECT PARAMETERS PROJECT INFRASTRUCTURE PROJECT PROCESSES TEAM MEETINGS REPORTING ESCALATION PROJECT PROGRESS QUALITY CONTROL PROJECT COMMUNICATION PLAN PROJECT PLANNING WORK BREAKDOWN STRUCTURE CRITICAL PATH PROJECT IMPLEMENTATION MANAGING PROGRESS MANAGING CHANGE PROJECT TRACKING PROJECT CLOSE OUT KEY CONTRIBUTORS AND RESPONSIBILITIES INFORMATION TECHNOLOGY EXPERIENCE WORKING ON A CROSS-DEPARTMENTAL TEAM ABILITY TO COMMUNICATE EFFECTIVELY ABILITY TO WORK WELL WITH A WIDE VARIETY OF PEOPLE EXPERIENCE WITH CRITICAL BUSINESS AND TECHNOLOGY SYSTEMS IT PROJECT MANAGEMENT LEADERSHIP HUMAN RESOURCES FACILITIES/SECURITY FINANCE/LEGAL WAREHOUSE/INVENTORY/MANUFACTURING/RESEARCH PURCHASING/LOGISTICS MARKETING AND SALES PUBLIC RELATIONS BUSINESS REQUIREMENTS FUNCTIONAL REQUIREMENTS TECHNICAL REQUIREMENTS BUSINESS CONTINUITY AND DISASTER RECOVERY PROJECT PLAN PROJECT DE? NITION, RISK ASSESSMENT RISK MITIGATION STRATEGIES EMERGENCY PREPARATION CHAPTER 30 RISK ASSESSMENT RISK MANAGEMENT BASICS RISK MANAGEMENT PROCESS THREAT ASSESSMENT VULNERABILITY ASSESSMENT IMPACT ASSESSMENT RISK MITIGATION STRATEGY DEVELOPMENT PEOPLE, PROCESS, TECHNOLOGY, AND INFRASTRUCTURE IN RISK MANAGEMENT INFRASTRUCTURE IT-SPECI? C RISK MANAGEMENT IT RISK MANAGEMENT OBJECTIVES THE SYSTEM DEVELOPMENT LIFECYCLE MODEL RISK ASSESSMENT COMPONENTS INFORMATION GATHERING METHODS NATURAL AND ENVIRONMENTAL THREATS FIRE FLOODS SEVERE WINTER STORMS ELECTRICAL STORMS DROUGHT EARTHQUAKE TORNADOS HURRICANES/TYPHOONS/CYCLONES TSUNAMIS VOLCANOES AVIAN FLU/PANDEMICS HUMAN THREATS THEFT, SABOTAGE, VANDALISM LABOR DISPUTES WORKPLACE VIOLENCE TERRORISM CHEMICAL OR BIOLOGICAL HAZARDS WAR CYBER THREATS CYBER CRIME LOSS OF RECORDS OR DATA—THEFT, SABOTAGE, VANDALISM IT SYSTEM FAILURE—THEFT, SABOTAGE, VANDALISM INFRASTRUCTURE THREATS BUILDING SPECI? C FAILURES PUBLIC TRANSPORTATION DISRUPTION LOSS OF UTILITIES DISRUPTION TO OIL OR PETROLEUM SUPPLIES FOOD OR WATER CONTAMINATION REGULATORY OR LEGAL CHANGES LOOKING BACK THREAT CHECKLIST THREAT ASSESSMENT METHODOLOGY QUANTITATIVE THREAT ASSESSMENT QUALITATIVE THREAT ASSESSMENT PEOPLE, PROCESS, TECHNOLOGY, AND INFRASTRUCTURE CHAPTER 31 BUSINESS IMPACT ANALYSIS BUSINESS IMPACT ANALYSIS OVERVIEW UPSTREAM AND DOWNSTREAM LOSSES UNDERSTANDING THE HUMAN IMPACT KEY POSITIONS HUMAN NEEDS UNDERSTANDING IMPACT CRITICALITY CRITICALITY CATEGORIES MISSION-CRITICAL VITAL IMPORTANT MINOR RECOVERY TIME REQUIREMENTS IDENTIFYING BUSINESS FUNCTIONS FACILITIES AND SECURITY FINANCE LEGAL/COMPLIANCE MANUFACTURING (ASSEMBLY) RESEARCH AND DEVELOPMENT WAREHOUSE (INVENTORY, ORDER FUL? LLMENT,SHIPPING, RECEIVING) OTHER AREAS GATHERING DATA FOR THE BUSINESS IMPACT ANALYSIS DATA COLLECTION METHODOLOGIES QUESTIONNAIRES INTERVIEWS WORKSHOPS DETERMINING THE IMPACT BUSINESS IMPACT ANALYSIS DATA POINTS UNDERSTANDING IT IMPACT EXAMPLE OF BUSINESS IMPACT ANALYSIS FOR SMALL BUSINESS PREPARING THE BUSINESS IMPACT ANALYSIS REPORT CHAPTER 32 MITIGATION STRATEGY DEVELOPMENT TYPES OF RISK MITIGATION STRATEGIES RISK ACCEPTANCE RISK AVOIDANCE RISK LIMITATION RISK TRANSFERENCE THE RISK MITIGATION PROCESS RECOVERY REQUIREMENTS RECOVERY OPTIONS AS NEEDED PREARRANGED PREESTABLISHED RECOVERY TIME OF OPTIONS COST VERSUS CAPABILITY OF RECOVERY OPTIONS RECOVERY SERVICE LEVEL AGREEMENTS REVIEW EXISTING CONTROLS DEVELOPING YOUR RISK MITIGATION STRATEGY SAMPLE 1: SECTION FROM MITIGATION STRATEGY FOR CRITICAL DATA SAMPLE 2: SECTION FROM MITIGATION STRATEGY FOR CRITICAL DATA PEOPLE, BUILDINGS, AND INFRASTRUCTURE IT RISK MITIGATION CRITICAL DATA AND RECORDS CRITICAL SYSTEMS AND INFRASTRUCTURE REVIEWING CRITICAL SYSTEM PRIORITIES BACKUP AND RECOVERY CONSIDERATIONS ALTERNATE BUSINESS PROCESSES IT RECOVERY SYSTEMS ALTERNATE SITES FULLY MIRRORED SITE HOT SITE WARM SITE MOBILE SITE COLD SITE RECIPROCAL SITE DISK SYSTEMS RAID REMOTE JOURNALING REPLICATION ELECTRONIC VAULTING STANDBY OPERATING SYSTEMS NETWORK-ATTACHED STORAGE (NAS) STORAGE AREA NETWORK (SAN) DESKTOP SOLUTIONS SOFTWARE AND LICENSING WEB SITES CHAPTER 33 BUSIN