内容

目次

List of Figures. List of Tables. Preface. Acknowledgments. I.INTRODUCTION. 1. Managing Information Security Risks. Information Security.What Is Information Security? Vulnerability Assessment. InformationSystems Audit. Information Security Risk Evaluation. Managed ServiceProviders. Implementing a Risk Management Approach. Information SecurityRisk Evaluation and Management. Evaluation Activities. Risk Evaluation andManagement. An Approach to Information Security Risk Evaluations. OCTAVEApproach. Information Security Risk. Three Phases. OCTAVE Variations.Common Elements. 2. Principles and Attributes of Information Security RiskEvaluations. Introduction. Information Security Risk Management Principles.Information Security Risk Evaluation Principles. Risk ManagementPrinciples. Organizational and Cultural Principles. Information SecurityRisk Evaluation Attributes. Information Security Risk Evaluation Outputs.Phase 1: Build Asset-BasedThreat Profiles. Phase 2: IdentifyInfrastructureVulnerabilities. Phase 3: Develop Security Strategy and Plans.II. THE OCTAVE METHOD. 3. Introduction to the OCTAVE Method. Overview ofthe OCTAVE Method. Preparation. Phase 1: Build Asset-Based Threat Profiles.Phase 2: Identify InfrastructureVulnerabilities. Phase 3: Develop SecurityStrategyand Plans. Mapping Attributes and Outputs to the OCTAVE Method.Attributes and the OCTAVE Method. Outputs and the OCTAVE Method.Introduction to the Sample Scenario. 4. Preparing for OCTAVE. Overview ofPreparation. Obtain Senior Management Sponsorship of OCTAVE. SelectAnalysis Team Members. Select Operational Areas to Participatein OCTAVE.Select Participants. Coordinate Logistics. Sample Scenario. 5. IdentifyingOrganizational Knowledge(Processes 1 to 3). Overview of Processes 1 to 3.Identify Assets and Relative Priorities. Identify Areas of Concern.Identify Security Requirements for MostImportant Assets. Capture Knowledgeof Current Security Practices and Organizational Vulnerabilities. 6.Creating Threat Profiles (Process 4). Overview of Process 4. Before theWorkshop: Consolidate Information from Processes 1 to 3. Select CriticalAssets. Refine Security Requirements for Critical Assets. Identify Threatsto Critical Assets. 7. Identifying Key Components (Process 5). Overview ofProcess 5. Identify Key Classes of Components. Identify InfrastructureComponents to Examine. 8. Evaluating Selected Components (Process 6).Overview of Process 6. Before the Workshop: Run Vulnerability EvaluationTools on Selected Infrastructure Components. Review TechnologyVulnerabilities and Summarize Results. 9. Conducting the Risk Analysis(Process 7). Overview of Process 7. Identify the Impact of Threats toCritical Assets. Create Risk Evaluation Criteria. Evaluate the Impact ofThreats to Critical Assets. Incorporating Probability into the RiskAnalysis. What Is Probability? Probability in the OCTAVE Method. 10.Developing a Protection Strategy--Workshop A (Process 8A). Overview ofProcess 8A. Before the Workshop: Consolidate Information from Processes 1 to3. Review Risk Information. Create Protection Strategy. Create RiskMitigation Plans. Create Action List. Incorporating Probability into RiskMitigation. 11. Developing a Protection Strategy--Workshop B (Process 8B).Overview of Process 8B. Before the Workshop: Prepare to Meet with SeniorManagement. Present Risk Information. Review and Refine ProtectionStrategy, Mitigation Plans, and Action List. Create Next Steps. Summary ofPart II. III. VARIATIONS ON THE OCTAVE APPROACH. 12. An Introduction toTailoring OCTAVE. The Range of Possibilities. Tailoring the OCTAVE Methodto Your Organization. Tailoring the Evaluation. Tailoring Artifacts. 13.Practical Applications. Introduction. The Small Organization. Company S.Implementing OCTAVE in Small Organizations. Very Large, DispersedOrganizations. Integrated Web Portal Service Providers. Large and SmallOrganizations. Other Considerations. 14. Information Security RiskManagement. Introduction. A Framework for Managing Information SecurityRisks. Identify. Analyze. Plan. Implement. Monitor. Control.Implementing Information Security Risk Management. Summary. Glossary.Bibliography. Appendix A. Case Scenario for the OCTAVE Method. MedSiteOCTAVE Final Report: Introduction. Protection Strategy for MedSite.Near-Term Action Items. Risks and Mitigation Plans for Critical Assets.Paper Medical Records. Personal Computers. PIDS. ABC Systems. ECDS.Technology Vulnerability Evaluation Results and Recommended Actions.Additional Information. Risk Impact Evaluation Criteria. Other Assets.Consolidated Survey Results. Appendix B. Worksheets. Knowledge ElicitationWorksheets. Asset Worksheet. Areas of Concern Worksheet. SecurityRequirements Worksheet. Practice Surveys. Protection Strategy Worksheet.Asset Profile Worksheets. Critical Asset Information. SecurityRequirements. Threat Profile for Critical Asset. System(s) of Interest.Key Classes of Components. Infrastructure Components to Examine. SummarizeTechnology Vulnerabilities. Record Action Items. Risk Impact Descriptions.Risk Evaluation Criteria Worksheet. Risk Profile Worksheet. Risk MitigationPlans. Strategies and Actions. Current Security Practices Worksheets.Protection Strategy Worksheets. Action List Worksheet. Appendix C. Catalogof Practices. About the Authors. Index. 0321118863T03112002