Information Security Management Handbook

This handbook covers the ten domains of the Information Security Common Body of Knowledge. It is designed to empower the security professional and the chief information officer with information such that they can do their duty, protect the information assets of their organizations.

Table of Contents:
Part I: Access Control Systems And Methodology Section 1: Access Control Techniques 1. Enhancing Security through Biometric Technology 2. Biometrics: What’s New? Section 2: Access Control Administration 3. Privacy in the Healthcare Industry 4. The Case for Privacy Section 3: Identification and Authentication Techniques 5. Biometric Identification 6. Single Sign-On for the Enterprise Section 4: Access Control Methodologies and Implementation 7. Centralized Authentication Services (RADIUS, TACACS, DIAMETER) 8. An Introduction to Secure Remote Access Section 5: Methods of Attack 9. Hacker Tools and Techniques 10. A New Breed of Hacker Tools and Defenses 11. Social Engineering: The Forgotten Risk 12. Breaking News: The Latest Hacker Attacks and Defense 13. Counter-Economic Espionage Section 6: Monitoring and Penetration Testing 14. Penetration Testing 15. Penetration Testing Part II: Telecommunications, Network, and Internet Security Section 1: Communications and Network Security 16. Understanding SSL 17. Packet Sniffers and Network Monitors 18. Secured Connections to External Networks 19. Security and Network Technologies 20. Wired and Wireless Physical Layer Security Issues 21. Network Router Security 22. What’s Not So Simple about SNMP? 23. Network and Telecommunications Media: Security from the Ground Up 24. Security and the Physical Network Layer 25. Security of Wireless Local Area Networks 26. Securing Wireless Networks 27. Wireless Security Mayhem: Restraining the Insanity of Convenience 28. Wireless LAN Security Challenge 29. ISO/OSI Layers and Characteristics Section 2: Internet/Intranet/Extranet 30. Enclaves: The Enterprise as an Extranet 31. IPSec Virtual Private Networks 32. Firewalls: An Effective Solution for Internet Security 33. Internet Security: Securing the Perimeter 34. Extranet Access Control Issues 35. Application-Layer Security Protocols for Networks 36. Application Layer: Next Level of Security 37. Security of Communication Protocols and Services 38. An Introduction to IPSec 39. VPN Deployment and Evaluation Strategy 40. How to Perform a Security Review of a Checkpoint Firewall 41. Comparing Firewall Technologies 42. The (In) Security of Virtual Private Networks 43. Cookies and Web Bugs 44. Leveraging Virtual Private Networks 45. Wireless LAN Security 46. Security for Broadband Internet Access Users 47. New Perspectives on VPNs 48. An Examination of Firewall Architectures Section 3: E-mail Security 49. Instant Messaging Security Issues Section 4: Secure Voice Communications 50. Voice Security 51. Secure Voice Communications (Vol) Section 5: Network Attacks and Countermeasures 52. Packet Sniffers: Use and Misuse 53. ISPs and Denial-of-Service Attacks Part III: Information Security Management Section 1: Security Management Concepts and Principles 54. The Human Side of Information Security 55. Security Management 56. Measuring ROI on Security 57. Security Patch Management Section 2: Change Control Management 58. Configuration Management: Charting the Course for the Organization Section 3: Data Classification 59. Information Classification: A Corporate Implementation Guide Section 4: Risk Management 60. A Matter of Trust 61. Trust Governance in a Web Services World 62. Risk Management and Analysis 63. New Trends in Information Risk Management 64. Information Security in the Enterprise 65. Managing Enterprise Security Information 66. Risk Analysis and Assessment 67. Security Assessment 68. Cyber-Risk Management: Technical and Insurance Controls for Enterprise Level Security Enterprise-Level Security Section 5: Employment Policies and Practices 69. A Progress Report on the CVE Initiative 70. Roles and Responsibilities of the Information Systems Security Officer 71. Information Protection: Organization, Roles, and Separation of Duties 72. Organizing for Success: Some Human Resources Issues in Information Security 73. Ownership and Custody of Data 74. Hiring Ex-Criminal Hackers Section 6: Risk Management 75. Information Security Policies from the Ground Up 76. Policy Development 77. Toward Enforcing Security Policy: Encouraging Personal Accountability for Corporate Information Security Policy 78. The Common Criteria for IT Security Evaluation 79. A Look at the Common Criteria 80. The Security Policy Life Cycle: Functions and Responsibilities Section 7: Security Awareness Training 81. Maintaining Management’s Commitment 82. Making Security Awareness Happen 83. Making Security Awareness Happen: Appendices Section 8: Security Management Planning 84. Maintaining Information Security during Downsizing 85. The Business Case for Information Security: Selling Management on the 86. Protection of Vital Secrets and Products 87. How to Work with a Managed Security Service Provider 88. Considerations for Outsourcing Security 89. Outsourcing Security Part IV: Application Program Security Section 1: Application Issues 90. Security Models for Object-Oriented Databases 91. Web Application Security 92. Security for XML and Other Metadata Languages 93. XML and Information Security 94. Application Security 95. Covert Channels 96. Security as a Value Enhancer in Application Systems Development 97. Open Source versus Closed Source Section 2: Databases and Data Warehousing 98. Reflections on Database Integrity 99. Digital Signatures in Relational Database Applications 100. Security and Privacy for Data Warehouses: Opportunity or Threat? Section 3: Systems Development Controls 101. Enterprise Security Architecture 102. Certification and Accreditation Methodology 103. System Development Security Methodology 104. A Security-Oriented Extension of the Object Model for the Development of an Information System Section 4: Malicious Code 105. A Look at Java Security 106. Malware and Computer Viruses Section 5: Methods of Attack 107. Methods of Auditing Applications Part V: Cryptography Section 1: Use of Cryptography 108. Three New Models for the Application of Cryptography 109. Auditing Cryptography: Assessing System Security Section 2: Cryptographic Concepts, Methodologies, and Practices 110. Message Authentication 111. Steganography: The Art of Hiding Messages 112. An Introduction to Cryptography 113. Hash Algorithms: From Message Digests to Signatures 114. A Look at the Advanced Encryption Standard (AES) Section 3: Private Key Algorithms 115. Principles and Applications of Cryptographic Key Management Section 4: Public Key Infrastructure (PKI) 116. Preserving Public Key Hierarchy 117. PKI Registration Section 5: System Architecture for Implementing Cryptographic Functions 118. Implementing Kerberos in Distributed Systems Section 6: Methods of Attack 119. Methods of Attacking and Defending Cryptosystems Part VI: Enterprise Security Architecture Section 1: Principles of Computer and Network Organizations, Architectures, and Designs 120. Security Infrastructure: Basics of Intrusion Detection Systems 121. Firewalls, 10 Percent of the Solution: A Security Architecture Primer 122. The Reality of Virtual Computing 123. Overcoming Wireless LAN Security Vulnerabilities Section 2: Principles of Security Models, Architectures and Evaluation Criteria 124. Formulating an Enterprise Information Security Architecture 125. Security Architecture and Models Section 3: Common Flaws and Security Issues—System Architecture and Design 126. Common System Design Flaws and Security Issues Part VII: Operations Security Section 1: Concepts 127. Operations: The Center of Support and Control 128. Why Today’s Security Technologies Are So Inadequate: History, Implications, and New Approaches Section 2: Resource Protection Requirements 129. Physical Access Control Section 3: Auditing 130. Auditing the Electronic Commerce Environment Section 4: Intrusion Detection 131. Improving Network-Level Security through Real-Time Monitoring and Intrusion Detection 132. Intelligent Intrusion Analysis: How Thinking Machines Can Recognize Computer Intrusions Section 5: Operations Controls 133. Directory Security Part VIII: Business Continuity Planning Section 1: Business Continuity Planning 134. Reengineering the Business Continuity Planning Process 135. The Changing Face of Continuity Planning 136. The Role of Continuity Planning in the Enterprise Risk Management Structure Section 2: Disaster Recovery Planning 137. Restoration Component of Business Continuity Planning 138. Business Resumption Planning and Disaster Recovery: A Case History 139. Business Continuity Planning: A Collaborative Approach Section 3: Elements of Business Continuity Planning 140. The Business Impact Assessment Process Part IX: Law, Investigation, And Ethics Section 1: Information Law 141. Jurisdictional Issues in Global Transmissions 142. Liability for Lax Computer Security in DDoS Attacks 143. The Final HIPAA Security Rule Is Here! Now What? 144. HIPAA 201: A Framework Approach to HIPAA Security Readiness Section 2: Investigations 145. Computer Crime Investigations: Managing a Process without Any Golden Rules 146. Computer Crime Investigation and Computer Forensics 147. Operational Forensics 148. What Happened Section 3: Major Categories of Computer Crime 149. The International Dimensions of Cybercrime Section 4: Incident Handling 150. Honeypot Essentials 151. CIRT: Responding to Attack 152. Incident Response Management 153. Managing the Response to a Computer Security Incident 154. Cyber Crime: Response, Investigation, and Prosecution 155. Incident Response Exercises 156. Software Forensics Section 5: Ethics 157. Ethics and the Internet Part X: Physical Security Section 1: Facility Requirements 158. Physical Security: A Foundation for Information Security 159. Physical Security: Controlled Access and Layered Defense 160. Computing Facility Physical Security 161. Closed Circuit Television and Video Surveillance Section 2: Technical Controls 162. Types of Information Security Controls Section 3: Environment and Life Safety 163. Physical Security: The Threat after September 11th