The Cyber Risk Handbook

Name: The Cyber Risk Handbook | Creating and Measuring Effective Cybersecurity Capabilities
Brand: Wiley
Price: 65.99 EUR
Availability: OnlineOnly

Creating and Measuring Effective Cybersecurity Capabilities

Domenic Antonucci(Autor*in)

Wiley (Verlag)

Erschienen am 3. April 2017

448 Seiten

E-Book

PDF mit Adobe-DRM

Systemvoraussetzungen

978-1-119-30972-7 (ISBN)

65,99 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Actionable guidance and expert perspective for real-world cybersecurity
The Cyber Risk Handbook is the practitioner's guide to implementing, measuring and improving the counter-cyber capabilities of the modern enterprise. The first resource of its kind, this book provides authoritative guidance for real-world situations, and cross-functional solutions for enterprise-wide improvement. Beginning with an overview of counter-cyber evolution, the discussion quickly turns practical with design and implementation guidance for the range of capabilities expected of a robust cyber risk management system that is integrated with the enterprise risk management (ERM) system. Expert contributors from around the globe weigh in on specialized topics with tools and techniques to help any type or size of organization create a robust system tailored to its needs. Chapter summaries of required capabilities are aggregated to provide a new cyber risk maturity model used to benchmark capabilities and to road-map gap-improvement.
Cyber risk is a fast-growing enterprise risk, not just an IT risk. Yet seldom is guidance provided as to what this means. This book is the first to tackle in detail those enterprise-wide capabilities expected by Board, CEO and Internal Audit, of the diverse executive management functions that need to team up with the Information Security function in order to provide integrated solutions.
* Learn how cyber risk management can be integrated to better protect your enterprise
* Design and benchmark new and improved practical counter-cyber capabilities
* Examine planning and implementation approaches, models, methods, and more
* Adopt a new cyber risk maturity model tailored to your enterprise needs
The need to manage cyber risk across the enterprise--inclusive of the IT operations--is a growing concern as massive data breaches make the news on an alarmingly frequent basis. With a cyber risk management system now a business-necessary requirement, practitioners need to assess the effectiveness of their current system, and measure its gap-improvement over time in response to a dynamic and fast-moving threat landscape. The Cyber Risk Handbook brings the world's best thinking to bear on aligning that system to the enterprise and vice-a-versa. Every functional head of any organization must have a copy at-hand to understand their role in achieving that alignment.

Weitere Details

Weitere Ausgaben

Person

Inhalt

1 - The Cyber Risk Handbook [Seite 3]
2 - Contents [Seite 9]
3 - Foreword: The State of Cybersecurity [Seite 25]
4 - About the Editor [Seite 33]
5 - List of Contributors [Seite 35]
6 - Acknowledgments [Seite 37]
7 - Chapter 1 Introduction [Seite 39]
7.1 - The CEO under Pressure [Seite 39]
7.1.1 - The Need for a Cyber Risk Handbook [Seite 40]
7.2 - Toward an Effectively Cyber Risk-Managed Organization [Seite 41]
7.2.1 - Effectiveness Is All About Doing the Right Things [Seite 41]
7.3 - Handbook Structured for the Enterprise [Seite 42]
7.3.1 - Conceptualizing Cybersecurity for Organization-Wide Solutions [Seite 42]
7.3.2 - Theming the Right Set of Capabilities [Seite 42]
7.3.3 - Cyber Risk Maturity Model Measures Improvements in Capabilities [Seite 44]
7.4 - Handbook Structure, Rationale, and Benefits [Seite 45]
7.4.1 - Balance and Objectivity [Seite 45]
7.4.2 - Enterprise-wide Comprehensiveness [Seite 46]
7.4.3 - Moving Up the Risk Maturity Curve [Seite 46]
7.5 - Which Chapters Are Written for Me? [Seite 46]
8 - Chapter 2 Board Cyber Risk Oversight [Seite 49]
8.1 - What Are Boards Expected to Do Now? [Seite 49]
8.1.1 - The Short Answer [Seite 51]
8.2 - What Barriers to Action Will Well-Intending Boards Face? [Seite 51]
8.2.1 - Barrier 1: Lack of Senior Management Ownership [Seite 51]
8.2.2 - Barrier 2: Failure to Link Cybersecurity Assessments to Key Organization Objectives [Seite 52]
8.2.3 - Barrier 3: Omission of Cybersecurity from Entity-Level Objectives and Strategic Plans [Seite 53]
8.2.4 - Barrier 4: Too Much Focus on Internal Controls [Seite 53]
8.2.5 - Barrier 5: Lack of Reliable Information on Residual Risk Status [Seite 54]
8.3 - What Practical Steps Should Boards Take Now to Respond? [Seite 54]
8.3.1 - Practical Step 1: Use a "Five Lines of Assurance" Approach [Seite 54]
8.3.2 - Practical Step 2: Include Top Objectives and Specific Owners [Seite 56]
8.3.3 - Practical Step 3: Establish a Risk Management Framework [Seite 56]
8.3.4 - Practical Step 4: Require Regular Reporting by the CEO [Seite 57]
8.4 - Cybersecurity-The Way Forward [Seite 58]
8.5 - About Risk Oversight Solutions Inc. [Seite 59]
8.6 - About Tim J. Leech, FCPA, CIA, CRMA, CFE [Seite 59]
8.7 - About Lauren C. Hanlon, CPA, CIA, CRMA, CFE [Seite 59]
9 - Chapter 3 Principles Behind Cyber Risk Management [Seite 61]
9.1 - Cyber Risk Management Principles Guide Actions [Seite 61]
9.2 - Meeting Stakeholder Needs [Seite 63]
9.2.1 - Being Transparent and Inclusive [Seite 63]
9.2.2 - Being Responsive to Change [Seite 63]
9.3 - Covering the Enterprise End to End [Seite 64]
9.3.1 - Creating and Protecting Value [Seite 64]
9.3.2 - Tailoring [Seite 64]
9.3.3 - Addressing Uncertainty [Seite 65]
9.4 - Applying a Single, Integrated Framework [Seite 65]
9.4.1 - Being Structured [Seite 65]
9.5 - Enabling a Holistic Approach [Seite 66]
9.5.1 - Integrating into the Organization [Seite 66]
9.5.2 - Considering Human and Cultural Factors [Seite 67]
9.5.3 - Being Part of Decision Making [Seite 67]
9.5.4 - Using the Best Available Information [Seite 68]
9.6 - Separating Governance from Management [Seite 69]
9.6.1 - Maturity Strategy and Continual Improvement [Seite 69]
9.7 - Conclusion [Seite 69]
9.8 - About RIMS [Seite 70]
9.9 - About Carol Fox [Seite 70]
10 - Chapter 4 Cybersecurity Policies and Procedures [Seite 73]
10.1 - Social Media Risk Policy [Seite 73]
10.1.1 - Understand Your Social Media Risks [Seite 73]
10.1.2 - Prepare for Your Social Media Policy [Seite 74]
10.1.3 - Choose between Social Media Policy Options [Seite 74]
10.1.4 - Examples of Social Media Policies [Seite 75]
10.2 - Ransomware Risk Policies and Procedures [Seite 79]
10.2.1 - Understand Your Ransomware Risks [Seite 80]
10.2.2 - Prepare for Your Ransomware Policy [Seite 81]
10.3 - Cloud Computing and Third-Party Vendors [Seite 83]
10.3.1 - Understand Your Cloud Computing Risks [Seite 84]
10.3.2 - Prepare for Your Cloud Computing Policy [Seite 84]
10.3.3 - Procure Cloud Provider Services Effectively [Seite 85]
10.4 - Big Data Analytics [Seite 88]
10.4.1 - Understand Your Big Data Risks [Seite 88]
10.4.2 - Prepare for Your Big Data Policy [Seite 89]
10.5 - The Internet of Things [Seite 91]
10.5.1 - Understand Your IoT Risks [Seite 91]
10.5.2 - Prepare for Your "Internet of Things" Policy [Seite 92]
10.6 - Mobile or Bring Your Own Devices (BYOD) [Seite 93]
10.6.1 - Understand Your BYOD Risks [Seite 93]
10.6.2 - Prepare for Your BYOD Policy [Seite 94]
10.6.3 - Choose between BYOD Policy Options [Seite 96]
10.6.4 - Examples of BYOD Policies [Seite 96]
10.7 - Conclusion [Seite 98]
10.8 - About IRM [Seite 102]
10.9 - About Elliot Bryan, BA (Hons), ACII [Seite 103]
10.10 - About Alexander Larsen, FIRM, President of Baldwin Global Risk Services [Seite 103]
11 - Chapter 5 Cyber Strategic Performance Management [Seite 105]
11.1 - Pitfalls in Measuring Cybersecurity Performance [Seite 106]
11.2 - Cybersecurity Strategy Required to Measure Cybersecurity Performance [Seite 107]
11.2.1 - Organization Risk Assessment [Seite 107]
11.2.2 - Cybersecurity Capabilities [Seite 107]
11.2.3 - Target State Protections [Seite 109]
11.2.4 - Portfolio of Initiatives [Seite 109]
11.3 - Creating an Effective Cybersecurity Performance Management System [Seite 110]
11.3.1 - Measuring Progress against Initiatives [Seite 110]
11.3.2 - Measuring Capability [Seite 112]
11.3.3 - Measuring Protection [Seite 114]
11.4 - Conclusion [Seite 115]
11.5 - About McKinsey Company [Seite 116]
11.6 - About James Kaplan [Seite 116]
11.7 - About Jim Boehm [Seite 117]
12 - Chapter 6 Standards and Frameworks for Cybersecurity [Seite 119]
12.1 - Putting Cybersecurity Standards and Frameworks in Context [Seite 119]
12.1.1 - Diversity as a Blessing and Curse [Seite 119]
12.1.2 - No "Best" Cybersecurity Standard [Seite 121]
12.1.3 - First Steps [Seite 121]
12.1.4 - Tailoring a Choice of Frameworks [Seite 122]
12.2 - Commonly Used Frameworks and Standards (a Selection) [Seite 122]
12.2.1 - ISO/IEC 27000 Family [Seite 122]
12.2.2 - COBIT 5 for Information Security [Seite 124]
12.2.3 - NIST Computer/Cybersecurity Frameworks [Seite 124]
12.2.4 - ISF Standard of Good Practice for Information Security [Seite 126]
12.2.5 - SANS Top 20 [Seite 127]
12.2.6 - IT Capability Maturity Framework-Information Security Management (IT-CMF:ISM) [Seite 128]
12.2.7 - Payment Card Industry (PCI) Data Security Standard (PCI-DSS) [Seite 129]
12.2.8 - World Economic Forum Cyber Risk Framework (WEF-CRF) [Seite 129]
12.2.9 - European Union Agency for Network and Information Security (ENISA) [Seite 130]
12.3 - Constraints on Standards and Frameworks [Seite 131]
12.3.1 - Good Practice Consistently Applied [Seite 131]
12.4 - Conclusion [Seite 132]
12.5 - About Boston Consulting Group (BCG) [Seite 133]
12.6 - About William Yin [Seite 134]
12.7 - About Dr. Stefan A. Deutscher [Seite 134]
13 - Chapter 7 Identifying, Analyzing, and Evaluating Cyber Risks [Seite 135]
13.1 - The Landscape of Risk [Seite 135]
13.2 - The People Factor [Seite 136]
13.3 - A Structured Approach to Assessing and Managing Risk [Seite 138]
13.4 - Security Culture [Seite 139]
13.5 - Regulatory Compliance [Seite 140]
13.6 - Maturing Security [Seite 141]
13.7 - Prioritizing Protection [Seite 142]
13.8 - Conclusion [Seite 142]
13.9 - About the Information Security Forum (ISF) [Seite 144]
13.10 - About Steve Durbin [Seite 144]
14 - Chapter 8 Treating Cyber Risks [Seite 147]
14.1 - Introduction [Seite 147]
14.2 - Treating Cybersecurity Risk with the Proper Nuance in Line with an Organization's Risk Profile [Seite 148]
14.3 - Determining the Cyber Risk Profile [Seite 149]
14.4 - Treating Cyber Risk [Seite 150]
14.4.1 - Focus on Your Crown Jewels [Seite 151]
14.4.2 - Humans Remain the Weakest Link [Seite 151]
14.4.3 - Complementing Preventative Measures with Detective Measures [Seite 151]
14.4.4 - Focus on an Organization's Capability to Respond [Seite 151]
14.4.5 - Cooperation Is Essential [Seite 151]
14.5 - Alignment of Cyber Risk Treatment [Seite 152]
14.6 - Practicing Cyber Risk Treatment [Seite 153]
14.6.1 - Business as Usual-to Be Integrated into Enterprise Risk Management [Seite 154]
14.6.2 - Business as Usual-to Be Integrated with the Regular Three Lines of Defense Applies for Model [Seite 155]
14.6.3 - Business as Usual-Managing Your Cyber Risks with a Predefined Risk Appetite [Seite 155]
14.6.4 - Business as Usual-Using Your Embedded Risk Management Processes [Seite 156]
14.6.5 - Business as Usual-Treatment of Cyber Risks [Seite 157]
14.7 - Conclusion [Seite 157]
14.8 - About KPMG [Seite 158]
14.9 - About John Hermans [Seite 159]
14.10 - About Ton Diemont [Seite 159]
15 - Chapter 9 Treating Cyber Risks Using Process Capabilities [Seite 161]
15.1 - Cybersecurity Processes Are the Glue That Binds [Seite 161]
15.1.1 - Undocumented Processes Result in Tribal Knowledge Dependency [Seite 161]
15.2 - No Intrinsic Motivation to Document [Seite 162]
15.2.1 - Move Routine Actions to Operations [Seite 163]
15.3 - Leveraging ISACA COBIT 5 Processes [Seite 163]
15.3.1 - Components of the Cybersecurity Processes [Seite 172]
15.3.2 - Cybersecurity Practices and Activities [Seite 173]
15.3.3 - Different Types of Cybersecurity Processes Work Together [Seite 174]
15.4 - COBIT 5 Domains Support Complete Cybersecurity Life Cycle [Seite 175]
15.4.1 - Why Use a COBIT 5 Process Enabler Approach? [Seite 176]
15.4.2 - So What Does CEO Tom Get Out of the Process Enablers? [Seite 177]
15.5 - Conclusion [Seite 177]
15.6 - About ISACA [Seite 178]
15.7 - About Todd Fitzgerald [Seite 179]
16 - Chapter 10 Treating Cyber Risks-Using Insurance and Finance [Seite 181]
16.1 - Tailoring a Quantified Cost-Benefit Model [Seite 181]
16.1.1 - Constraints on Financial Impact Modeling [Seite 182]
16.1.2 - Modeling the Cost-Benefits of Investments in Insurance versus Cybersecurity [Seite 182]
16.1.3 - Cyber Losses Underinsured Compared to Property Losses [Seite 184]
16.2 - Planning for Cyber Risk Insurance [Seite 187]
16.2.1 - 1. Conduct Pre-Breach Education and Planning [Seite 187]
16.2.2 - 2. Develop an Incident Response Plan and Crisis Management Plan [Seite 188]
16.2.3 - 3. Create a Breach Business Continuity Plan [Seite 188]
16.2.4 - 4. Review or Implement Cyber Insurance [Seite 188]
16.3 - The Risk Manager's Perspective on Planning for Cyber Insurance [Seite 188]
16.4 - Cyber Insurance Market Constraints [Seite 190]
16.4.1 - Regulatory Constraints [Seite 190]
16.4.2 - Capacity Constraints [Seite 190]
16.4.3 - Insurance Placement Constraints [Seite 191]
16.5 - Conclusion [Seite 192]
16.6 - About Aon [Seite 195]
16.7 - About Kevin Kalinich, Esq. [Seite 196]
17 - Chapter 11 Monitoring and Review Using Key Risk Indicators (KRIs) [Seite 197]
17.1 - Definitions [Seite 198]
17.1.1 - Key Risk Indicator [Seite 198]
17.1.2 - Key Performance Indicator [Seite 198]
17.1.3 - Key Control Indicator [Seite 198]
17.2 - KRI Design for Cyber Risk Management [Seite 198]
17.2.1 - A Risk Taxonomy Provides Clarity [Seite 199]
17.2.2 - Organizational Risk [Seite 199]
17.2.3 - Functional Risk [Seite 200]
17.2.4 - KRI Design Links Objectives, Risks, and Controls [Seite 200]
17.2.5 - Case Study Where Triggered KRIs Were Apparently Ignored [Seite 201]
17.2.6 - Using KRIs for Improved Decision Making [Seite 203]
17.2.7 - Stakeholders Want to Be Informed [Seite 204]
17.2.8 - Inherent Risk, Residual Risk, and Big-Picture KRIs [Seite 204]
17.2.9 - Dashboard Samples Tailored to Stakeholders [Seite 205]
17.3 - Conclusion [Seite 207]
17.4 - About Wability [Seite 207]
17.5 - About Ann Rodriguez [Seite 208]
18 - Chapter 12 Cybersecurity Incident and Crisis Management [Seite 209]
18.1 - Cybersecurity Incident Management [Seite 209]
18.1.1 - When a Cybersecurity Event Becomes an Incident [Seite 209]
18.1.2 - Qualifying the Two Categories of Incident Sources [Seite 210]
18.1.3 - Follow the Incident Management Policy and Process Steps [Seite 211]
18.1.4 - Integrating Incident Reporting with Enterprise-wide Risk Management (ERM) [Seite 211]
18.2 - Cybersecurity Crisis Management [Seite 212]
18.2.1 - Going from Incident to Crisis Management [Seite 213]
18.2.2 - Crisis Management Operating Principles [Seite 213]
18.2.3 - Structuring and Mobilizing an Operational Cybersecurity Crisis Unit [Seite 214]
18.2.4 - Tools and Techniques for Managing a Cyber Crisis [Seite 215]
18.2.5 - Cyber Crisis Management Steps [Seite 216]
18.3 - Conclusion [Seite 220]
18.4 - About CLUSIF [Seite 221]
18.5 - About Gérôme Billois, CISA, CISSP and ISO27001 Certified [Seite 221]
18.6 - About Wavestone [Seite 221]
19 - Chapter 13 Business Continuity Management and Cybersecurity [Seite 223]
19.1 - Good International Practices for Cyber Risk Management and Business Continuity [Seite 224]
19.1.1 - Cyber and the Business Continuity Management System (BCMS) [Seite 224]
19.1.2 - BCMS Components and ISO 22301 [Seite 225]
19.2 - Embedding Cybersecurity Requirements in BCMS [Seite 226]
19.3 - Developing and Implementing BCM Responses for Cyber Incidents [Seite 227]
19.4 - Conclusion [Seite 228]
19.5 - Appendix: Glossary of Key Terms [Seite 229]
19.6 - About Marsh [Seite 229]
19.7 - About Marsh Risk Consulting [Seite 230]
19.8 - About Sek Seong Lim, CBCP, PMC [Seite 230]
20 - Chapter 14 External Context and Supply Chain [Seite 231]
20.1 - External Context [Seite 232]
20.1.1 - External Context Specific to Cyber Risks [Seite 232]
20.1.2 - External Context and the Supply Chain and Third Parties [Seite 234]
20.1.3 - Transportation Sector Key Role for Supply Chain [Seite 236]
20.1.4 - The External Context to the Growing Importance of Cyber Risk and IT Failure [Seite 237]
20.2 - Building Cybersecurity Management Capabilities from an External Perspective [Seite 238]
20.2.1 - Seven Key Roles to Drive Capability from an External Perspective [Seite 238]
20.2.2 - Cybersecurity Task Force to Focus on Maturity Targets [Seite 239]
20.2.3 - Avoiding Silos to Focus on External and Internal Alignment [Seite 239]
20.2.4 - Integrating Supply Chain Capability from an External Perspective [Seite 239]
20.3 - Measuring Cybersecurity Management Capabilities from an External Perspective [Seite 242]
20.3.1 - Supply Chain Risk Maturity Measured by Peer Organizations [Seite 242]
20.4 - Conclusion [Seite 242]
20.5 - About the SCRLC [Seite 243]
20.6 - About Nick Wildgoose, BA (Hons), FCA, FCIPS [Seite 243]
21 - Chapter 15 Internal Organization Context [Seite 245]
21.1 - The Internal Organization Context for Cybersecurity [Seite 245]
21.1.1 - Standards and Guidance Approaches [Seite 245]
21.1.2 - Cybersecurity within the Enterprise [Seite 246]
21.2 - Tailoring Cybersecurity to Enterprise Exposures [Seite 247]
21.2.1 - Designing Your Own Cyber Risk Function Operating Model [Seite 247]
21.2.2 - Typical Enterprise Functional Roles Most Involved in Cybersecurity across the Enterprise [Seite 249]
21.2.3 - Aligning Cybersecurity within Enterprise Functions [Seite 250]
21.2.4 - Governance and Risk Oversight Functions for Cybersecurity [Seite 253]
21.2.5 - Executive Management Functions for Cybersecurity [Seite 253]
21.2.6 - Other Enterprise Management Functions Supporting Cybersecurity [Seite 257]
21.3 - Conclusion [Seite 278]
21.4 - About Domenic Antonucci [Seite 279]
21.5 - About Bassam Alwarith [Seite 279]
22 - Chapter 16 Culture and Human Factors [Seite 281]
22.1 - Organizations as Social Systems [Seite 281]
22.1.1 - Cybersecurity Not Merely a Technology Issue [Seite 282]
22.1.2 - Organizational Culture [Seite 283]
22.2 - Human Factors and Cybersecurity [Seite 284]
22.2.1 - Insider Threats [Seite 285]
22.2.2 - Social Engineering Threats [Seite 285]
22.3 - Training [Seite 286]
22.4 - Frameworks and Standards [Seite 287]
22.4.1 - ISO 27001:2013 [Seite 287]
22.4.2 - Business Model for Information Security (BMIS) [Seite 287]
22.4.3 - NIST Framework [Seite 288]
22.5 - Technology Trends and Human Factors [Seite 288]
22.5.1 - Measuring Human Behaviors for Security [Seite 289]
22.5.2 - Reducing Cyber Risks That Occur Due to Human Mistakes [Seite 289]
22.6 - Conclusion [Seite 290]
22.7 - About ISACA [Seite 291]
22.8 - About Avinash Totade [Seite 291]
22.9 - About Sandeep Godbole [Seite 292]
23 - Chapter 17 Legal and Compliance [Seite 293]
23.1 - European Union and International Regulatory Schemes [Seite 293]
23.1.1 - Transfer of Data Out of the EU, Including the United States [Seite 295]
23.1.2 - Post-Brexit United Kingdom [Seite 295]
23.1.3 - International Organization for Standardization (ISO) [Seite 295]
23.2 - U.S. Regulations [Seite 296]
23.2.1 - Cybersecurity Negligence Remains Undefined [Seite 296]
23.2.2 - Specific U.S. Industry/Sector Regulations [Seite 297]
23.2.3 - General Fiduciary Duty in the United States [Seite 298]
23.2.4 - Forecasting the Future U.S. Cyber Regulatory Environment [Seite 299]
23.3 - Counsel's Advice and "Boom" Planning [Seite 299]
23.3.1 - Left of Boom [Seite 300]
23.3.2 - Boom and Right of Boom [Seite 303]
23.4 - Conclusion [Seite 304]
23.5 - About the Cybersecurity Legal Task Force [Seite 307]
23.6 - About Harvey Rishikof [Seite 307]
23.7 - About Conor Sullivan [Seite 308]
24 - Chapter 18 Assurance and Cyber Risk Management [Seite 309]
24.1 - Cyber Risk Is Ever Present [Seite 309]
24.2 - What the Internal Auditor Expects from an Organization Managing Its Cyber Risks Effectively [Seite 310]
24.2.1 - Risk Assessment Expected by Internal Audit [Seite 311]
24.2.2 - The Case for Combined Assurance Model [Seite 311]
24.2.3 - The Role for an Information, Communication, and Technology (ICT) Unit [Seite 312]
24.2.4 - The Role for a Cybersecurity-Specific Line of Defense [Seite 313]
24.2.5 - Roles for ERM and Organization Strategy to Work Closely with ICT [Seite 313]
24.2.6 - Roles for Compliance and Quality Assurance [Seite 314]
24.2.7 - The CEO Obtains Combined Assurance [Seite 314]
24.3 - How to Deal with Two Differing Assurance Maturity Scenarios [Seite 315]
24.3.1 - Scenario 1: Mature Assurance [Seite 315]
24.3.2 - Scenario 2: Less Mature Assurance [Seite 315]
24.4 - Combined Assurance Reporting by ERM Head [Seite 316]
24.5 - Conclusion [Seite 316]
24.6 - About Stig Sunde, CISA, CIA, CGAP, CRISC, IRM Cert. [Seite 318]
25 - Chapter 19 Information Asset Management for Cyber [Seite 319]
25.1 - The Invisible Attacker [Seite 319]
25.2 - A Troubling Trend [Seite 320]
25.3 - Thinking Like a General [Seite 321]
25.4 - The Immediate Need-Best Practices [Seite 321]
25.5 - Cybersecurity for the Future [Seite 322]
25.5.1 - From Exploitation to Attack [Seite 323]
25.5.2 - Reimagining the Attack Surface [Seite 323]
25.5.3 - OODA: Observe, Orient, Decide, and Act [Seite 323]
25.5.4 - New Opportunities for Network Agility [Seite 324]
25.6 - Time to Act [Seite 324]
25.7 - Conclusion [Seite 324]
25.8 - About Booz Allen Hamilton [Seite 325]
25.9 - About Christopher Ling [Seite 325]
26 - Chapter 20 Physical Security [Seite 327]
26.1 - Tom Commits to a Plan [Seite 328]
26.2 - Get a Clear View on the Physical Security Risk Landscape and the Impact on Cybersecurity [Seite 329]
26.3 - Manage or Review the Cybersecurity Organization [Seite 332]
26.4 - Design or Review Integrated Security Measures [Seite 333]
26.5 - Reworking the Data Center Scenario [Seite 337]
26.5.1 - Understanding Objectives for Security Measures [Seite 338]
26.5.2 - Understanding Controls for the Data Center Scenario [Seite 339]
26.6 - Calculate or Review Exposure to Adversary Attacks [Seite 340]
26.6.1 - Simulating the Path of an Adversary [Seite 340]
26.6.2 - Calculating the Probability of Interrupting the Adversary [Seite 340]
26.7 - Optimize Return on Security Investment [Seite 343]
26.8 - Conclusion [Seite 344]
26.9 - About Radar Risk Group [Seite 345]
26.10 - About Inge Vandijck [Seite 345]
26.11 - About Paul Van Lerberghe [Seite 345]
27 - Chapter 21 Cybersecurity for Operations and Communications [Seite 347]
27.1 - Do You Know What You Do Not Know? [Seite 347]
27.2 - Threat Landscape-What Do You Know About Your Organization Risk and Who Is Targeting You? [Seite 348]
27.3 - Data and Its Integrity-Does Your Risk Analysis Produce Insight? [Seite 348]
27.4 - Digital Revolution-What Threats Will Emerge as Organizations Continue to Digitize? [Seite 349]
27.5 - Changes-How Will Your Organization or Operational Changes Affect Risk? [Seite 350]
27.6 - People-How Do You Know Whether an Insider or Outsider Presents a Risk? [Seite 350]
27.7 - What's Hindering Your Cybersecurity Operations? [Seite 350]
27.8 - Challenges from Within [Seite 351]
27.9 - What to Do Now [Seite 351]
27.9.1 - Drive for Clarity [Seite 351]
27.9.2 - Fill in the Knowledge Gap [Seite 353]
27.9.3 - Understand the Speed of Change [Seite 354]
27.9.4 - Know Your Assets [Seite 354]
27.9.5 - Make Cyber Risk More Tangible [Seite 355]
27.9.6 - Adapt to Your Environment-Establish/Improve Your SOC [Seite 355]
27.9.7 - Adapt Your Organization [Seite 356]
27.10 - Conclusion [Seite 356]
27.11 - About EY [Seite 357]
27.12 - About Chad Holmes [Seite 357]
27.13 - About James Phillippe [Seite 357]
28 - Chapter 22 Access Control [Seite 359]
28.1 - Taking a Fresh Look at Access Control [Seite 359]
28.2 - Organization Requirements for Access Control [Seite 360]
28.3 - User Access Management [Seite 361]
28.3.1 - User Registration and Deregistration [Seite 361]
28.3.2 - User Access Provisioning [Seite 362]
28.3.3 - Management of Privileged Access Rights [Seite 362]
28.3.4 - Management of Secret Authentication Information of Users [Seite 363]
28.3.5 - Review of User Access [Seite 364]
28.3.6 - Removal and Adjustment of User Rights [Seite 364]
28.4 - User Responsibility [Seite 365]
28.5 - System and Application Access Control [Seite 365]
28.5.1 - Information Access Restriction [Seite 365]
28.5.2 - Secure Log-in Procedures [Seite 365]
28.5.3 - Password Management System [Seite 366]
28.5.4 - Use of Privileged Utility Programs [Seite 366]
28.5.5 - Access Control to Program Source Code [Seite 367]
28.6 - Mobile Devices [Seite 367]
28.7 - Teleworking [Seite 369]
28.8 - Other Considerations [Seite 370]
28.9 - Conclusion [Seite 371]
28.10 - About PwC [Seite 372]
28.11 - About Sidriaan de Villiers, PwC Partner South Africa [Seite 372]
29 - Chapter 23 Cybersecurity Systems: Acquisition, Development, and Maintenance [Seite 373]
29.1 - Build, Buy, or Update: Incorporating Cybersecurity Requirements and Establishing Sound Practices [Seite 374]
29.1.1 - Governance and Planning [Seite 374]
29.1.2 - Development and Implementation [Seite 376]
29.1.3 - Maintenance and Operations [Seite 378]
29.1.4 - Sunset and Disposal [Seite 379]
29.2 - Specific Considerations [Seite 380]
29.2.1 - Commercial Off-the-Shelf Applications [Seite 380]
29.2.2 - Cloud/SaaS Applications [Seite 381]
29.3 - Conclusion [Seite 382]
29.4 - About Deloitte Advisory Cyber Risk Services [Seite 384]
29.5 - About Michael Wyatt [Seite 384]
30 - Chapter 24 People Risk Management in the Digital Age [Seite 385]
30.1 - Rise of the Machines [Seite 385]
30.2 - Enterprise-Wide Risk Management [Seite 386]
30.2.1 - The People Risk Management System [Seite 386]
30.2.2 - The Digital Governance Gap [Seite 387]
30.3 - Tomorrow's Talent [Seite 388]
30.3.1 - The Digital Quotient [Seite 389]
30.3.2 - Digital Leadership and the Emergence of the Digital Risk and Digital Risk Officer [Seite 390]
30.4 - Crisis Management [Seite 392]
30.4.1 - Cyber Crisis Management Can Have a Number of Unique Characteristics [Seite 392]
30.5 - Risk Culture [Seite 393]
30.6 - Conclusion [Seite 394]
30.7 - About Airmic [Seite 396]
30.8 - About Julia Graham [Seite 396]
31 - Chapter 25 Cyber Competencies and the Cybersecurity Officer [Seite 397]
31.1 - The Evolving Information Security Professional [Seite 397]
31.2 - The Duality of the CISO [Seite 398]
31.2.1 - Technical Specialist [Seite 398]
31.2.2 - Executive Strategist [Seite 399]
31.3 - Job Responsibilities and Tasks [Seite 401]
31.3.1 - Information Security Governance [Seite 401]
31.3.2 - Information Risk Management and Compliance [Seite 402]
31.3.3 - Information Security Program Development and Management [Seite 403]
31.3.4 - Information Security Incident Management [Seite 404]
31.4 - Conclusion [Seite 404]
31.5 - About ISACA [Seite 406]
31.6 - About Ron Hale [Seite 406]
32 - Chapter 26 Human Resources Security [Seite 407]
32.1 - Needs of Lower-Maturity HR Functions [Seite 407]
32.1.1 - An Example Human Resource Security Standard [Seite 407]
32.2 - Needs of Mid-Maturity HR Functions [Seite 408]
32.2.1 - Capabilities to Meet a Certifiable International Standard [Seite 408]
32.3 - Needs of Higher-Maturity HR Functions [Seite 410]
32.3.1 - Certified Professionals [Seite 410]
32.3.2 - Academia [Seite 411]
32.4 - Conclusion [Seite 411]
32.5 - About Domenic Antonucci [Seite 412]
33 - Epilogue [Seite 413]
33.1 - Background [Seite 413]
33.2 - Becoming CyberSmartT [Seite 414]
33.3 - About Domenic Antonucci [Seite 430]
33.4 - About Didier Verstichel [Seite 430]
34 - Glossary [Seite 431]
35 - Index [Seite 437]
36 - EULA [Seite 451]

Systemvoraussetzungen

Als PDF speichern Als Link merken