{"product_id":"effective-cybersecurity-9780134772806","title":"Effective Cybersecurity","description":"\u003cb\u003eBook Synopsis\u003c\/b\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003cb\u003eTable of Contents\u003c\/b\u003e\u003cbr\u003ePreface     xxvii \u003cbr\u003e \u003cb\u003eChapter 1:  Best Practices, Standards, and a Plan of Action     2\u003c\/b\u003e \u003cbr\u003e1.1 Defining Cyberspace and Cybersecurity     3 \u003cbr\u003e1.2 The Value of Standards and Best Practices Documents     6 \u003cbr\u003e1.3 The Standard of Good Practice for Information Security     7 \u003cbr\u003e1.4 The ISO\/IEC 27000 Suite of Information Security Standards     12 \u003cbr\u003e    ISO 27001     15 \u003cbr\u003e    ISO 27002     17 \u003cbr\u003e1.5 Mapping the ISO 27000 Series to the ISF SGP     18 \u003cbr\u003e1.6 NIST Cybersecurity Framework and Security Documents     21 \u003cbr\u003e    NIST Cybersecurity Framework     22 \u003cbr\u003e    NIST Security Documents     25 \u003cbr\u003e1.7 The CIS Critical Security Controls for Effective Cyber Defense     27 \u003cbr\u003e1.8 COBIT 5 for Information Security     29 \u003cbr\u003e1.9 Payment Card Industry Data Security Standard (PCI DSS)     30 \u003cbr\u003e1.10 ITU-T Security Documents     32 \u003cbr\u003e1.11 Effective Cybersecurity     34 \u003cbr\u003e    The Cybersecurity Management Process     34 \u003cbr\u003e    Using Best Practices and Standards Documents     36 \u003cbr\u003e1.12 Key Terms and Review Questions     38 \u003cbr\u003e    Key Terms     38 \u003cbr\u003e    Review Questions     38 \u003cbr\u003e1.13 References     39 \u003cbr\u003e \u003cbr\u003e \u003cb\u003ePART I:  PLANNING FOR CYBERSECURITY     41\u003cbr\u003eChapter 2:  Security Governance     42\u003c\/b\u003e \u003cbr\u003e2.1 Security Governance and Security Management     43 \u003cbr\u003e2.2 Security Governance Principles and Desired Outcomes     45 \u003cbr\u003e    Principles     45 \u003cbr\u003e    Desired Outcomes     46 \u003cbr\u003e2.3 Security Governance Components     47 \u003cbr\u003e    Strategic Planning     47 \u003cbr\u003e    Organizational Structure     51 \u003cbr\u003e    Roles and Responsibilities     55 \u003cbr\u003e    Integration with Enterprise Architecture     58 \u003cbr\u003e    Policies and Guidance     63 \u003cbr\u003e2.4 Security Governance Approach     63 \u003cbr\u003e    Security Governance Framework     63 \u003cbr\u003e    Security Direction     64 \u003cbr\u003e    Responsible, Accountable, Consulted, and Informed (RACI) Charts     66 \u003cbr\u003e2.5 Security Governance Evaluation     68 \u003cbr\u003e2.6 Security Governance Best Practices     69 \u003cbr\u003e2.7 Key Terms and Review Questions     70 \u003cbr\u003e    Key Terms     70 \u003cbr\u003e    Review Questions     71 \u003cbr\u003e2.8 References     71 \u003cbr\u003e \u003cb\u003eChapter 3:  Information Risk Assessment     74\u003c\/b\u003e \u003cbr\u003e3.1 Risk Assessment Concepts     75 \u003cbr\u003e    Risk Assessment Challenges     78 \u003cbr\u003e    Risk Management     80 \u003cbr\u003e    Structure of This     84 \u003cbr\u003e3.2 Asset Identification     85 \u003cbr\u003e    Hardware Assets     85 \u003cbr\u003e    Software Assets     85 \u003cbr\u003e    Information Assets     86 \u003cbr\u003e    Business Assets     87 \u003cbr\u003e    Asset Register     87 \u003cbr\u003e3.3 Threat Identification     89 \u003cbr\u003e    The STRIDE Threat Model     89 \u003cbr\u003e    Threat Types     90 \u003cbr\u003e    Sources of Information     92 \u003cbr\u003e3.4 Control Identification     98 \u003cbr\u003e3.5 Vulnerability Identification     102 \u003cbr\u003e    Vulnerability Categories     103 \u003cbr\u003e    National Vulnerability Database and Common Vulnerability Scoring System     103 \u003cbr\u003e3.6 Risk Assessment Approaches     107 \u003cbr\u003e    Quantitative Versus Qualitative Risk Assessment     107 \u003cbr\u003e    Simple Risk Analysis Worksheet     113 \u003cbr\u003e    Factor Analysis of Information Risk     114 \u003cbr\u003e3.7 Likelihood Assessment     116 \u003cbr\u003e    Estimating Threat Event Frequency     118 \u003cbr\u003e    Estimating Vulnerability     119 \u003cbr\u003e    Loss Event Frequency     121 \u003cbr\u003e3.8 Impact Assessment     122 \u003cbr\u003e    Estimating the Primary Loss     124 \u003cbr\u003e    Estimating the Secondary Loss     125 \u003cbr\u003e    Business Impact Reference Table     126 \u003cbr\u003e3.9 Risk Determination     128 \u003cbr\u003e3.10 Risk Evaluation     128 \u003cbr\u003e3.11 Risk Treatment     129 \u003cbr\u003e    Risk Reduction     130 \u003cbr\u003e    Risk Retention     130 \u003cbr\u003e    Risk Avoidance     130 \u003cbr\u003e    Risk Transfer     131 \u003cbr\u003e3.12 Risk Assessment Best Practices     131 \u003cbr\u003e3.13 Key Terms and Review Questions     132 \u003cbr\u003e    Key Terms     132 \u003cbr\u003e    Review Questions     133 \u003cbr\u003e3.14 References     134 \u003cbr\u003e \u003cb\u003eChapter 4:  Security Management     136\u003c\/b\u003e \u003cbr\u003e4.1 The Security Management Function     137 \u003cbr\u003e    Security Planning     140 \u003cbr\u003e    Capital Planning     142 \u003cbr\u003e4.2 Security Policy     145 \u003cbr\u003e    Security Policy Categories     146 \u003cbr\u003e    Security Policy Document Content     147 \u003cbr\u003e    Management Guidelines for Security Policies     151 \u003cbr\u003e    Monitoring the Policy     151 \u003cbr\u003e4.3 Acceptable Use Policy     152 \u003cbr\u003e4.4 Security Management Best Practices     154 \u003cbr\u003e4.5 Key Terms and Review Questions     154 \u003cbr\u003e    Key Terms     154 \u003cbr\u003e    Review Questions     155 \u003cbr\u003e4.6 References     155 \u003cbr\u003e \u003cbr\u003e \u003cb\u003ePART II:  MANAGING THE CYBERSECURITY FUNCTION     157\u003cbr\u003eChapter 5:  People Management     160\u003c\/b\u003e \u003cbr\u003e5.1 Human Resource Security     161 \u003cbr\u003e    Security in the Hiring Process     162 \u003cbr\u003e    During Employment     164 \u003cbr\u003e    Termination of Employment     165 \u003cbr\u003e5.2 Security Awareness and Education     166 \u003cbr\u003e    Security Awareness     168 \u003cbr\u003e    Cybersecurity Essentials Program     173 \u003cbr\u003e    Role-Based Training     173 \u003cbr\u003e    Education and Certification     174 \u003cbr\u003e5.3 People Management Best Practices     175 \u003cbr\u003e5.4 Key Terms and Review Questions     176 \u003cbr\u003e    Key Terms     176 \u003cbr\u003e    Review Questions     176 \u003cbr\u003e5.5 References     177 \u003cbr\u003e \u003cb\u003eChapter 6:  Information Management     178\u003c\/b\u003e \u003cbr\u003e6.1 Information Classification and Handling     179 \u003cbr\u003e    Information Classification     179 \u003cbr\u003e    Information Labeling     185 \u003cbr\u003e    Information Handling     186 \u003cbr\u003e6.2 Privacy     186 \u003cbr\u003e    Privacy Threats     189 \u003cbr\u003e    Privacy Principles and Policies     191 \u003cbr\u003e    Privacy Controls     196 \u003cbr\u003e6.3 Document and Records Management     198 \u003cbr\u003e    Document Management     200 \u003cbr\u003e    Records Management     202 \u003cbr\u003e6.4 Sensitive Physical Information     204 \u003cbr\u003e6.5 Information Management Best Practices     205 \u003cbr\u003e6.6 Key Terms and Review Questions     206 \u003cbr\u003e    Key Terms     206 \u003cbr\u003e    Review Questions     207 \u003cbr\u003e6.7 References     208 \u003cbr\u003e \u003cb\u003eChapter 7:  Physical Asset Management     210\u003c\/b\u003e \u003cbr\u003e7.1 Hardware Life Cycle Management     211 \u003cbr\u003e    Planning     213 \u003cbr\u003e    Acquisition     214 \u003cbr\u003e    Deployment     214 \u003cbr\u003e    Management     215 \u003cbr\u003e    Disposition     216 \u003cbr\u003e7.2 Office Equipment     217 \u003cbr\u003e    Threats and Vulnerabilities     217 \u003cbr\u003e    Security Controls     219 \u003cbr\u003e    Equipment Disposal     222 \u003cbr\u003e7.3 Industrial Control Systems     223 \u003cbr\u003e    Differences Between IT Systems and Industrial Control Systems     225 \u003cbr\u003e    ICS Security     227 \u003cbr\u003e7.4 Mobile Device Security     231 \u003cbr\u003e    Mobile Device Technology     233 \u003cbr\u003e    Mobile Ecosystem     234 \u003cbr\u003e    Vulnerabilities     236 \u003cbr\u003e    Mobile Device Security Strategy     238 \u003cbr\u003e    Resources for Mobile Device Security     243 \u003cbr\u003e7.5 Physical Asset Management Best Practices     244 \u003cbr\u003e7.6 Key Terms and Review Questions     245 \u003cbr\u003e    Key Terms     245 \u003cbr\u003e    Review Questions     245 \u003cbr\u003e7.7 References     246 \u003cbr\u003e \u003cb\u003eChapter 8:  System Development     248\u003c\/b\u003e \u003cbr\u003e8.1 System Development Life Cycle     248 \u003cbr\u003e    NIST SDLC Model     249 \u003cbr\u003e    The SGP’s SDLC Model     252 \u003cbr\u003e    DevOps     254 \u003cbr\u003e8.2 Incorporating Security into the SDLC     259 \u003cbr\u003e    Initiation Phase     260 \u003cbr\u003e    Development\/Acquisition Phase     264 \u003cbr\u003e    Implementation\/Assessment Phase     266 \u003cbr\u003e    Operations and Maintenance Phase     270 \u003cbr\u003e    Disposal Phase     272 \u003cbr\u003e8.3 System Development Management     273 \u003cbr\u003e    System Development Methodology     274 \u003cbr\u003e    System Development Environments     275 \u003cbr\u003e    Quality Assurance     277 \u003cbr\u003e8.4 System Development Best Practices     278 \u003cbr\u003e8.5 Key Terms and Review Questions     278 \u003cbr\u003e    Key Terms     278 \u003cbr\u003e    Review Questions     279 \u003cbr\u003e8.6 References     279 \u003cbr\u003e \u003cb\u003eChapter 9:  Business Application Management     280\u003c\/b\u003e \u003cbr\u003e9.1 Application Management Concepts     281 \u003cbr\u003e    Application Life Cycle Management     281 \u003cbr\u003e    Application Portfolio Management     283 \u003cbr\u003e    Application Performance Management     285 \u003cbr\u003e9.2 Corporate Business Application Security     287 \u003cbr\u003e    Business Application Register     287 \u003cbr\u003e    Business Application Protection     288 \u003cbr\u003e    Browser-Based Application Protection     289 \u003cbr\u003e9.3 End User-Developed Applications (EUDAs)     295 \u003cbr\u003e    Benefits of EUDAs     296 \u003cbr\u003e    Risks of EUDAs     296 \u003cbr\u003e    EUDA Security Framework     297 \u003cbr\u003e9.4 Business Application Management Best Practices     300 \u003cbr\u003e9.5 Key Terms and Review Questions     301 \u003cbr\u003e    Key Terms     301 \u003cbr\u003e    Review Questions     302 \u003cbr\u003e9.6 References     302 \u003cbr\u003e \u003cb\u003eChapter 10:  System Access     304\u003c\/b\u003e \u003cbr\u003e10.1 System Access Concepts     304 \u003cbr\u003e    Authorization     306 \u003cbr\u003e10.2 User Authentication     307 \u003cbr\u003e    A Model for Electronic User Authentication     307 \u003cbr\u003e    Means of Authentication     310 \u003cbr\u003e    Multifactor Authentication     311 \u003cbr\u003e10.3 Password-Based Authentication     312 \u003cbr\u003e    The Vulnerability of Passwords     313 \u003cbr\u003e    The Use of Hashed Passwords     315 \u003cbr\u003e    Password Cracking of User-Chosen Passwords     317 \u003cbr\u003e    Password File Access Control     319 \u003cbr\u003e    Password Selection     320 \u003cbr\u003e10.4 Possession-Based Authentication     322 \u003cbr\u003e    Memory Cards     322 \u003cbr\u003e    Smart Cards     323 \u003cbr\u003e    Electronic Identity Cards     325 \u003cbr\u003e    One-Time Password Device     328 \u003cbr\u003e    Threats to Possession-Based Authentication     329 \u003cbr\u003e    Security Controls for Possession-Based Authentication     330 \u003cbr\u003e10.5 Biometric Authentication     330 \u003cbr\u003e    Criteria for Biometric Characteristics     331 \u003cbr\u003e    Physical Characteristics Used in Biometric Applications     332 \u003cbr\u003e    Operation of a Biometric Authentication System     333 \u003cbr\u003e    Biometric Accuracy     335 \u003cbr\u003e    Threats to Biometric Authentication     337 \u003cbr\u003e    Security Controls for Biometric Authentication     339 \u003cbr\u003e10.6 Risk Assessment for User Authentication     341 \u003cbr\u003e    Authenticator Assurance Levels     341 \u003cbr\u003e    Selecting an AAL     342 \u003cbr\u003e    Choosing an Authentication Method     345 \u003cbr\u003e10.7 Access Control     347 \u003cbr\u003e    Subjects, Objects, and Access Rights     348 \u003cbr\u003e    Access Control Policies     349 \u003cbr\u003e    Discretionary Access Control     350 \u003cbr\u003e    Role-Based Access Control     351 \u003cbr\u003e    Attribute-Based Access Control     353 \u003cbr\u003e    Access Control Metrics     358 \u003cbr\u003e10.8 Customer Access     360 \u003cbr\u003e    Customer Access Arrangements     360 \u003cbr\u003e    Customer Contracts     361 \u003cbr\u003e    Customer Connections     361 \u003cbr\u003e    Protecting Customer Data     361 \u003cbr\u003e10.9 System Access Best Practices     362 \u003cbr\u003e10.10 Key Terms and Review Questions     363 \u003cbr\u003e    Key Terms     363 \u003cbr\u003e    Review Questions     363 \u003cbr\u003e10.11 References     364 \u003cbr\u003e \u003cb\u003eChapter 11:  System Management     366\u003c\/b\u003e \u003cbr\u003e11.1 Server Configuration     368 \u003cbr\u003e    Threats to Servers     368 \u003cbr\u003e    Requirements for Server Security     368 \u003cbr\u003e11.2 Virtual Servers     370 \u003cbr\u003e    Virtualization Alternatives     371 \u003cbr\u003e    Virtualization Security Issues     374 \u003cbr\u003e    Securing Virtualization Systems     376 \u003cbr\u003e11.3 Network Storage Systems     377 \u003cbr\u003e11.4 Service Level Agreements     379 \u003cbr\u003e    Network Providers     379 \u003cbr\u003e    Computer Security Incident Response Team     381 \u003cbr\u003e    Cloud Service Providers     382 \u003cbr\u003e11.5 Performance and Capacity Management     383 \u003cbr\u003e11.6 Backup     384 \u003cbr\u003e11.7 Change Management     386 \u003cbr\u003e11.8 System Management Best Practices     389 \u003cbr\u003e11.9 Key Terms and Review Questions     390 \u003cbr\u003e    Key Terms     390 \u003cbr\u003e    Review Questions     390 \u003cbr\u003e11.10 References     391 \u003cbr\u003e \u003cb\u003eChapter 12:  Networks and Communications     392\u003c\/b\u003e \u003cbr\u003e12.1 Network Management Concepts     393 \u003cbr\u003e    Network Management Functions     393 \u003cbr\u003e    Network Management Systems     399 \u003cbr\u003e    Network Management Architecture     402 \u003cbr\u003e12.2 Firewalls     404 \u003cbr\u003e    Firewall Characteristics     404 \u003cbr\u003e    Types of Firewalls     406 \u003cbr\u003e    Next-Generation Firewalls     414 \u003cbr\u003e    DMZ Networks     414 \u003cbr\u003e    The Modern IT Perimeter     416 \u003cbr\u003e12.3 Virtual Private Networks and IP Security     417 \u003cbr\u003e    Virtual Private Networks     417 \u003cbr\u003e    IPsec     418 \u003cbr\u003e    Firewall-Based VPNs     420 \u003cbr\u003e12.4 Security Considerations for Network Management     421 \u003cbr\u003e    Network Device Configuration     421 \u003cbr\u003e    Physical Network Management     423 \u003cbr\u003e    Wireless Access     426 \u003cbr\u003e    External Network Connections     427 \u003cbr\u003e    Firewalls     428 \u003cbr\u003e    Remote Maintenance     429 \u003cbr\u003e12.5 Electronic Communications     430 \u003cbr\u003e    Email     430 \u003cbr\u003e    Instant Messaging     436 \u003cbr\u003e    Voice over IP (VoIP) Networks     438 \u003cbr\u003e    Telephony and Conferencing     444 \u003cbr\u003e12.6 Networks and Communications Best Practices     444 \u003cbr\u003e12.7 Key Terms and Review Questions     445 \u003cbr\u003e    Key Terms     445 \u003cbr\u003e    Review Questions     445 \u003cbr\u003e12.8 References     446 \u003cbr\u003e \u003cb\u003eChapter 13:  Supply Chain Management and Cloud Security     448\u003c\/b\u003e \u003cbr\u003e13.1 Supply Chain Management Concepts     449 \u003cbr\u003e    The Supply Chain     449 \u003cbr\u003e    Supply Chain Management     451 \u003cbr\u003e13.2 Supply Chain Risk Management     453 \u003cbr\u003e    Supply Chain Threats     456 \u003cbr\u003e    Supply Chain Vulnerabilities     459 \u003cbr\u003e    Supply Chain Security Controls     460 \u003cbr\u003e    SCRM Best Practices     463 \u003cbr\u003e13.3 Cloud Computing     466 \u003cbr\u003e    Cloud Computing Elements     466 \u003cbr\u003e    Cloud Computing Reference Architecture     470 \u003cbr\u003e13.4 Cloud Security     473 \u003cbr\u003e    Security Considerations for Cloud Computing     473 \u003cbr\u003e    Threats for Cloud Service Users     474 \u003cbr\u003e    Risk Evaluation     475 \u003cbr\u003e    Best Practices     476 \u003cbr\u003e    Cloud Service Agreement     477 \u003cbr\u003e13.5 Supply Chain Best Practices     478 \u003cbr\u003e13.6 Key Terms and Review Questions     479 \u003cbr\u003e    Key Terms     479 \u003cbr\u003e    Review Questions     479 \u003cbr\u003e13.7 References     480 \u003cbr\u003e \u003cb\u003eChapter 14:  Technical Security Management     482\u003c\/b\u003e \u003cbr\u003e14.1 Security Architecture     483 \u003cbr\u003e14.2 Malware Protection Activities     487 \u003cbr\u003e    Types of Malware     487 \u003cbr\u003e    The Nature of the Malware Threat     490 \u003cbr\u003e    Practical Malware Protection     490 \u003cbr\u003e14.3 Malware Protection Software     494 \u003cbr\u003e    Capabilities of Malware Protection Software     494 \u003cbr\u003e    Managing Malware Protection Software     495 \u003cbr\u003e14.4 Identity and Access Management     496 \u003cbr\u003e    IAM Architecture     497 \u003cbr\u003e    Federated Identity Management     498 \u003cbr\u003e    IAM Planning     500 \u003cbr\u003e    IAM Best Practices     501 \u003cbr\u003e14.5 Intrusion Detection     502 \u003cbr\u003e    Basic Principles     503 \u003cbr\u003e    Approaches to Intrusion Detection     504 \u003cbr\u003e    Host-Based Intrusion Detection Techniques     505 \u003cbr\u003e    Network-Based Intrusion Detection Systems     506 \u003cbr\u003e    IDS Best Practices     508 \u003cbr\u003e14.6 Data Loss Prevention     509 \u003cbr\u003e    Data Classification and Identification     509 \u003cbr\u003e    Data States     510 \u003cbr\u003e14.7 Digital Rights Management     512 \u003cbr\u003e    DRM Structure and Components     513 \u003cbr\u003e    DRM Best Practices     515 \u003cbr\u003e14.8 Cryptographic Solutions     517 \u003cbr\u003e    Uses of Cryptography     517 \u003cbr\u003e    Cryptographic Algorithms     518 \u003cbr\u003e    Selection of Cryptographic Algorithms and Lengths     525 \u003cbr\u003e    Cryptography Implementation Considerations     526 \u003cbr\u003e14.9 Cryptographic Key Management     528 \u003cbr\u003e    Key Types     530 \u003cbr\u003e    Cryptoperiod     532 \u003cbr\u003e    Key Life Cycle     534 \u003cbr\u003e14.10 Public Key Infrastructure     536 \u003cbr\u003e    Public Key Certificates     536 \u003cbr\u003e    PKI Architecture     538 \u003cbr\u003e    Management Issues     540 \u003cbr\u003e14.11 Technical Security Management Best Practices     541 \u003cbr\u003e14.12 Key Terms and Review Questions     543 \u003cbr\u003e    Key Terms     543 \u003cbr\u003e    Review Questions     543 \u003cbr\u003e14.13 References     544 \u003cbr\u003e \u003cb\u003eChapter 15:  Threat and Incident Management     546\u003c\/b\u003e \u003cbr\u003e15.1 Technical Vulnerability Management     547 \u003cbr\u003e    Plan Vulnerability Management     547 \u003cbr\u003e    Discover Known Vulnerabilities     548 \u003cbr\u003e    Scan for Vulnerabilities     549 \u003cbr\u003e    Log and Report     551 \u003cbr\u003e    Remediate Vulnerabilities     551 \u003cbr\u003e15.2 Security Event Logging     554 \u003cbr\u003e    Security Event Logging Objective     556 \u003cbr\u003e    Potential Security Log Sources     556 \u003cbr\u003e    What to Log     557 \u003cbr\u003e    Protection of Log Data     557 \u003cbr\u003e    Log Management Policy     558 \u003cbr\u003e15.3 Security Event Management     559 \u003cbr\u003e    SEM Functions     560 \u003cbr\u003e    SEM Best Practices     561 \u003cbr\u003e15.4 Threat Intelligence     563 \u003cbr\u003e    Threat Taxonomy     564 \u003cbr\u003e    The Importance of Threat Intelligence     566 \u003cbr\u003e    Gathering Threat Intelligence     568 \u003cbr\u003e    Threat Analysis     569 \u003cbr\u003e15.5 Cyber Attack Protection     570 \u003cbr\u003e    Cyber Attack Kill Chain     570 \u003cbr\u003e    Protection and Response Measures     573 \u003cbr\u003e    Non-Malware Attacks     576 \u003cbr\u003e15.6 Security Incident Management Framework     577 \u003cbr\u003e    Objectives of Incident Management     579 \u003cbr\u003e    Relationship to Information Security Management System     579 \u003cbr\u003e    Incident Management Policy     580 \u003cbr\u003e    Roles and Responsibilities     581 \u003cbr\u003e    Incident Management Information     583 \u003cbr\u003e    Incident Management Tools     583 \u003cbr\u003e15.7 Security Incident Management Process     584 \u003cbr\u003e    Preparing for Incident Response     585 \u003cbr\u003e    Detection and Analysis     586 \u003cbr\u003e    Containment, Eradication, and Recovery     587 \u003cbr\u003e    Post-Incident Activity     588 \u003cbr\u003e15.8 Emergency Fixes     590 \u003cbr\u003e15.9 Forensic Investigations     592 \u003cbr\u003e    Prepare     593 \u003cbr\u003e    Identify     594 \u003cbr\u003e    Collect     594 \u003cbr\u003e    Preserve     595 \u003cbr\u003e    Analyze     595 \u003cbr\u003e    Report     596 \u003cbr\u003e15.10 Threat and Incident Management Best Practices     597 \u003cbr\u003e15.11 Key Terms and Review Questions     598 \u003cbr\u003e    Key Terms     598 \u003cbr\u003e    Review Questions     599 \u003cbr\u003e15.12 References     599 \u003cbr\u003e \u003cb\u003eChapter 16:  Local Environment Management     602\u003c\/b\u003e \u003cbr\u003e16.1 Local Environment Security     602 \u003cbr\u003e    Local Environment Profile     603 \u003cbr\u003e    Local Security Coordination     604 \u003cbr\u003e16.2 Physical Security     606 \u003cbr\u003e    Physical Security Threats     606 \u003cbr\u003e    Physical Security Officer     609 \u003cbr\u003e    Defense in Depth     610 \u003cbr\u003e    Physical Security: Prevention and Mitigation Measures     612 \u003cbr\u003e    Physical Security Controls     615 \u003cbr\u003e16.3 Local Environment Management Best Practices     619 \u003cbr\u003e16.4 Key Terms and Review Questions     620 \u003cbr\u003e    Key Terms     620 \u003cbr\u003e    Review Questions     620 \u003cbr\u003e16.5 References     621 \u003cbr\u003e \u003cb\u003eChapter 17:  Business Continuity     622\u003c\/b\u003e \u003cbr\u003e17.1 Business Continuity Concepts     625 \u003cbr\u003e    Threats     626 \u003cbr\u003e    Business Continuity in Operation     628 \u003cbr\u003e    Business Continuity Objectives     629 \u003cbr\u003e    Essential Components for Maintaining Business Continuity     630 \u003cbr\u003e17.2 Business Continuity Program     630 \u003cbr\u003e    Governance     631 \u003cbr\u003e    Business Impact Analysis     631 \u003cbr\u003e    Risk Assessment     632 \u003cbr\u003e    Business Continuity Strategy     634 \u003cbr\u003e17.3 Business Continuity Readiness     637 \u003cbr\u003e    Awareness     637 \u003cbr\u003e    Training     638 \u003cbr\u003e    Resilience     639 \u003cbr\u003e    Control Selection     640 \u003cbr\u003e    Business Continuity Plan     642 \u003cbr\u003e    Exercising and Testing     647 \u003cbr\u003e    Performance Evaluation     650 \u003cbr\u003e17.4 Business Continuity Operations     655 \u003cbr\u003e    Emergency Response     655 \u003cbr\u003e    Crisis Management     656 \u003cbr\u003e    Business Recovery\/Restoration     657 \u003cbr\u003e17.5 Business Continuity Best Practices     660 \u003cbr\u003e17.6 Key Terms and Review Questions     661 \u003cbr\u003e    Key Terms     661 \u003cbr\u003e    Review Questions     661 \u003cbr\u003e17.7 References     662 \u003cbr\u003e \u003cbr\u003e \u003cb\u003ePART III:  SECURITY ASSESSMENT     665\u003cbr\u003eChapter 18:  Security Monitoring and Improvement     666\u003c\/b\u003e \u003cbr\u003e18.1 Security Audit     666 \u003cbr\u003e    Security Audit and Alarms Model     667 \u003cbr\u003e    Data to Collect for Auditing     668 \u003cbr\u003e    Internal and External Audit     672 \u003cbr\u003e    Security Audit Controls     673 \u003cbr\u003e18.2 Security Performance     678 \u003cbr\u003e    Security Performance Measurement     678 \u003cbr\u003e    Security Monitoring and Reporting     686 \u003cbr\u003e    Information Risk Reporting     688 \u003cbr\u003e    Information Security Compliance Monitoring     690 \u003cbr\u003e18.3 Security Monitoring and Improvement Best Practices     691 \u003cbr\u003e18.4 Key Terms and Review Questions     692 \u003cbr\u003e    Key Terms     692 \u003cbr\u003e    Review Questions     692 \u003cbr\u003e18.5 References     693 \u003cbr\u003e \u003cb\u003eAppendix A:  References and Standards     694\u003cbr\u003eAppendix B:  Glossary     708\u003cbr\u003eIndex     726\u003cbr\u003e\u003cbr\u003eAppendix C:  Answers to Review Questions    (Online Only)\u003c\/b\u003e \u003cbr\u003e \u003cbr\u003e \u003cbr\u003e","brand":"Pearson Education (US)","offers":[{"title":"Default Title","offer_id":48864171688279,"sku":"9780134772806","price":35.19,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0817\/1739\/5799\/files\/9780134772806.jpg?v=1791453932","url":"https:\/\/bookcurl.com\/products\/effective-cybersecurity-9780134772806","provider":"Book Curl","version":"1.0","type":"link"}