Leading a Cyber-Security Program: A Guide for Information Security Professionals

Catapulted to the forefront of business operations, the sudden importance of information security has seen many people forced into becoming their organization's security expert - thrust into a new job with unclear and undefined functions This book describes the roles and functions of IS professionals, focusing as much on management as on technology, and including sections on how to manage two distinctly different info-sec environments: 9-to-5 business and 24/7 business. Broad-ranging in focus, it covers both day-to-day operations and long-term strategy from roles, responsibilities, policies and procedures, to risk assessment and incident handling.

Table of Contents:
BACKGROUND AND INTRODUCTION The Security Matrix-A Revolutionary yet Simple Way to Account for all Facets of Security The Security Tenets The Protection Zones Lessons From the Trenches ROLES AND RESPONSIBILITIES What is my Job? What is NOT my Job? The Overlapping Areas Your Many Perceived Roles in Addition to "The Security Guy" What Do I do on my First Day? What do I do on a Daily Basis? What Should I Have Done Over a Year's Time? Lessons From the Trenches UNDERSTANDING THE PROBLEM: What are You in Charge of, Exactly? Figuring Out Where Your Network Begins and Ends What is the Threat? What are the Vulnerabilities? What is the Likelihood Something Could Happen? What are the Consequences? Your Budget What is Your Overall Risk? What is Due Diligence? Lessons from the Trenches YOUR SECURITY POLICY Do You Need a Security Policy? The 4 Parts of Your Organization's Strategy Document Inspection Factors Elements of a Good Security Policy Deriving Your Policy From the Matrix Do you Need a Security Plan? How is a Plan Different From a Policy? Elements of a Good Security Plan Lessons From the Trenches THE DREADED RISK ASSESSMENT Doing You Need to do a Risk Assessment? Doing a Risk Assessment Resources for Risk Assessment Information Lessons From the Trenches TRAINING Yourself Others Resources Lessons From the Trenches YOUR LIBRARY Documents You Must Have Books References Lessons From the Trenches SECURITY PHILOSOPHIES Security is 50% Technical, 50% Psychological The Security Paradox Your Architecture Diagram On Training Should I do it Myself or Outsource It? Brush up on Your People Skills Getting There: The 80/20 Rule Lessons From the Trenches INCIDENT HANDLING Should You Report an Incident? 3 Types of Events to Report How and When to Report an Incident Report Format and Content Follow-On Actions Handling the Press Lessons From the Trenches Acronym List Glossary of Terms Index