Muutke küpsiste eelistusi

E-raamat: Computer Incident Response Planning Handbook: Executable Plans for Protecting Information at Risk

  • Formaat: PDF+DRM
  • Ilmumisaeg: 07-Aug-2012
  • Kirjastus: Osborne/McGraw-Hill
  • Keel: eng
  • ISBN-13: 9780071790406
  • Formaat - PDF+DRM
  • Hind: 68,33 €*
  • * hind on lõplik, st. muud allahindlused enam ei rakendu
  • Lisa ostukorvi
  • Lisa soovinimekirja
  • See e-raamat on mõeldud ainult isiklikuks kasutamiseks. E-raamatuid ei saa tagastada.
  • Formaat: PDF+DRM
  • Ilmumisaeg: 07-Aug-2012
  • Kirjastus: Osborne/McGraw-Hill
  • Keel: eng
  • ISBN-13: 9780071790406

DRM piirangud

  • Kopeerimine (copy/paste):

    ei ole lubatud

  • Printimine:

    ei ole lubatud

  • Kasutamine:

    Digitaalõiguste kaitse (DRM)
    Kirjastus on väljastanud selle e-raamatu krüpteeritud kujul, mis tähendab, et selle lugemiseks peate installeerima spetsiaalse tarkvara. Samuti peate looma endale  Adobe ID Rohkem infot siin. E-raamatut saab lugeda 1 kasutaja ning alla laadida kuni 6'de seadmesse (kõik autoriseeritud sama Adobe ID-ga).

    Vajalik tarkvara
    Mobiilsetes seadmetes (telefon või tahvelarvuti) lugemiseks peate installeerima selle tasuta rakenduse: PocketBook Reader (iOS / Android)

    PC või Mac seadmes lugemiseks peate installima Adobe Digital Editionsi (Seeon tasuta rakendus spetsiaalselt e-raamatute lugemiseks. Seda ei tohi segamini ajada Adober Reader'iga, mis tõenäoliselt on juba teie arvutisse installeeritud )

    Seda e-raamatut ei saa lugeda Amazon Kindle's. 

Publisher's Note: Products purchased from Third Party sellers are not guaranteed by the publisher for quality,  authenticity, or access to any online entitlements included with the product.

Uncertainty and risk, meet planning and action.

Reinforce your organizations security posture using the expert information contained in this tactical guide. The Computer Incident Response Planning Handbook: Executable Plans for Protecting Information at Risk shows you how to build and manage successful response plans for the cyber incidents that have become inevitable for organizations of any size. Find out why these plans work. Learn the step-by-step process for developing and managing plans built to address the wide range of issues organizations face in times of crisis.





Contains the essentials for developing both data breach and malware outbreak response plansand best practices for maintaining those plans Features ready-to-implement CIRPsderived from living incident response plans that have survived the rigors of repeated execution and numerous audits Clearly explains how to minimize the risk of post-event litigation, brand impact, fines and penaltiesand how to protect shareholder value Supports corporate compliance with industry standards and requirements, including PCI, HIPAA, SOX, and CA SB-24
Acknowledgments xv
Introduction xv
Part I The Threat Landscape
Chapter 1 Introduction to Planning and Crisis
3(14)
The Absence of Planning
5(2)
Key Concepts
7(6)
The OODA Loop
7(1)
Fog of War
8(1)
Friction
9(1)
Center of Gravity
9(1)
Unity of Command
10(1)
Maintaining the Initiative
10(1)
Tactical, Operational, and Strategic Perspectives
11(1)
Requirements-Driven Execution
11(1)
End State
12(1)
Military Decision-Making Process
12(1)
A Plan Is Preparation Manifested
13(4)
Anticipation: Objectives and Requirements
14(1)
Collaboration: Socialization and Normalization
14(1)
Research: The Availability of Relevant Information
14(1)
The Ad Hoc Organization for Time of Crisis
15(1)
The Value of Documentation
15(2)
Chapter 2 Cyber Due Diligence in an Era of Information Risk
17(18)
Regulation
18(4)
Gramm-Leach-Bliley Act (Financial Services Modernization Act of 1999)
19(1)
The Health Insurance Portability and Accountability Act of 1996
19(1)
Sarbanes-Oxley Act of 2002
20(1)
State Breach Requirements
20(1)
Industry Standards
21(1)
Federal/State Enforcement
21(1)
Contractual Enforcement
22(1)
What Standards?
22(3)
ISO/IEC 27000 Series
23(1)
FFIEC
23(1)
PCI DSS
24(1)
Service Organization Controls
24(1)
Shared Assessments
24(1)
How Do I Know that I'm Doing the Right Thing?
25(1)
Independent Review
25(1)
Internal Audit
25(1)
Tabletop Exercises
26(1)
How Do I Keep It Up?
26(1)
COBIT
27(1)
ISO/IEC 27005 (Information Security Risk Management)
27(1)
ITIL
27(1)
Bringing It Together
27(8)
Top-Down Approval
28(1)
Values
28(1)
Policies
28(1)
Ownership
29(1)
Procedures and Controls
29(1)
Measurement and Monitoring
30(1)
Education
30(1)
Calendar for Testing Processes and Controls
30(1)
Independent Review
31(1)
Internal Oversight
31(4)
Part II Planning for Crisis
Chapter 3 Getting More Out of Your Plans
35(6)
Proactively Using Plans During Period of Heightened Risk
36(1)
Understanding How Your ISOC Works
37(1)
Building Relationships Outside of IT
38(1)
Leveraging Your CIRP to Develop Relationships with Law Enforcement
38(2)
Using Plans to Augment Your Current ERM Efforts
40(1)
Chapter 4 Writing Your Computer Incident Response Plan
41(10)
What Problem Are You Solving?
42(1)
Don't Bother if You Don't Have an Executive Sponsor
42(1)
Using an Advisory Committee: My Plan vs. Our Plan
43(1)
Understanding Your Audiences
44(1)
Leveraging the Table of Contents
44(1)
Plan Introduction
45(1)
Incident Preparation
46(1)
Incident Detection, Analysis, and Declaration
46(1)
Incident Response
47(1)
Plan Maintenance/Post Incident
47(1)
Development of an Ad Hoc Organization to Respond to Crisis
48(3)
Part III Plan Development: Data Breach
Chapter 5 Your Data Breach CIRP: Incident Preparation
51(28)
Foreword
54(2)
Plan Introduction
56(1)
Plan Objective
56(1)
Plan Scope and Assumptions
56(1)
Plan Execution and Command Topologies
57(2)
Plan Structure
59(2)
Updating and Synchronization
60(1)
Incident Preparation
61(1)
Statutory/Compliance Framework
61(1)
Sensitive Data
62(1)
PCI Data Map (End 1) **RESTRICTED**
62(1)
ISOC Threat Portfolio (PCI) (Tab B) **RESTRICTED**
62(1)
PCI Log Data (Tab C)
62(1)
Third-Party (Payment) Connections (Tab D)
62(1)
Third-Party Services
63(7)
PCI Forensic Investigator (PFI)
63(1)
Identity Protection Services
63(1)
Compromise Notification Fulfillment
64(3)
Sources of Precursors and Indicators
67(3)
Incident Thresholds
70(3)
Data Threshold
70(1)
Compromise Threshold
71(1)
Incident Analysis
71(1)
Technical Impact
71(1)
Business Impact
72(1)
Incident Categories
73(2)
Priority 1
73(1)
Priority 2
74(1)
Non-Actionable/Informational
74(1)
Incident Declaration
75(4)
Incident Notification and Mobilization
75(3)
Incident Documentation
78(1)
Chapter 6 Your Data Breach CIRP: Plan Execution
79(32)
Plan Execution
80(6)
Organization and Roles
80(5)
Process and Rhythm
85(1)
Synchronization and Decision-Making
86(3)
Status Reports
86(3)
Mandatory Reporting/Notification(s)
89(3)
Payment Card Industry Data Security Standard (PCI DSS)
89(3)
Release of "Public-Facing Documents"
92(4)
Draft/Approve/Release Process
93(1)
Public-Facing Documents Participants
94(2)
Evidence Discovery and Retention
96(2)
Criminal Prosecution
96(1)
Civil Litigation
97(1)
Managing Evidence
97(1)
Liaison with Local Law Enforcement
98(2)
XYZ Loss Prevention (LE Liaison)
98(1)
Law Enforcement Points of Contact (POC) (Tab 1)
99(1)
Incident Containment, Eradication, and Recovery
100(2)
The XYZ (Data Compromise) CIRP SWAT Team
100(1)
Containment
100(2)
Eradication and Recovery
102(2)
Remediation
102(1)
Compensating Controls
102(2)
Disaster Recovery/Business Continuity
104(1)
CIRP Roles and Responsibilities
104(7)
Human Resources
105(6)
Chapter 7 Your Data Breach CIRP: Post Incident Planning and Maintenance
111(12)
Post-Incident Activity
112(2)
Incident Termination
112(2)
Plan Maintenance
114(1)
Overview
114(1)
Regular Updates
115(8)
Verification/Updates of Perishable Data
115(1)
Annual Testing of the Plan
115(8)
Part IV Plan Development: Malware
Chapter 8 Your Malware Outbreak CIRP: Incident Preparation
123(20)
Foreword
125(2)
Plan Introduction
127(1)
Plan Objective
127(1)
Plan Execution and Command Topologies
128(2)
Plan Ownership
130(2)
Supporting Documentation
130(2)
Incident Preparation
132(3)
Isolotion Points within the XYZ Enterprise
133(1)
Business Impact Overlay of Isolation Points
133(1)
ISOC Threat Portfolio
133(2)
Third-Party Support Services
135(1)
PCI Forensics Investigator (PFI)
135(1)
BXD LongSight Threat Management System
135(1)
Incident Detection, Analysis, and Declaration
135(2)
Sources of Precursors and Indicators
135(1)
ISOC Monitoring Feeds
136(1)
Field Services Responding to Malware Calls
136(1)
NOC, Service Desk, and Other Internal Sources of Detection
136(1)
Incident Threshold
137(1)
Incident Analysis
137(1)
Technical Impact
137(1)
Business Impact
138(1)
Incident Dedaration
138(4)
Incident Notification and Mobilization
139(3)
Incident Documentation
142(1)
Chapter 9 Your Malware Outbreak CIRP: Plan Execution
143(16)
Plan Execution
144(7)
Organization and Roles
144(7)
Operational Sequencing
151(1)
Operational Priorities
152(1)
Operational Resources
153(6)
Synchronization and Decision Making
153(6)
Chapter 10 Your Malware Outbreak CIRP: Post Incident Planning and Maintenance
159(6)
Incident Termination
160(2)
Criteria for Terminating an Incident
160(2)
Plan Maintenance
162(3)
Overview
162(1)
Quarterly Updates
162(1)
Annual Testing of the Plan
163(2)
Chapter 11 Closing Thoughts
165(18)
New Age for InfoSec Professionals
166(1)
Paradigm #1 The New Consciousness of the Zero-Day Attack
167(5)
Paradigm #2 The Need for Transparent Due Diligence
172(1)
Paradigm #3 Consequence-Based Information Security
173(2)
Paradigm #4 The Constant Challenge of Change
175(2)
Paradigm #5 While We're All Focusing on the Silicon-Based Systems, the Bad Guys Are Targeting the Carbon-Based Ones
177(6)
Part V Appendixes
A Useful Online Resources
183(4)
B Computer Incident Response Plan (CIRP) Management Checklist
187(2)
Glossary 189(12)
Index 201
N.K. McCarthy previously managed the Information Security Operations / Threat & Vulnerability Management for a Fortune 50 Corporation for several years. His international staff performed round-the-clock security event monitoring and response. His responsibilities included: security patch remediation, vulnerability scans, and remediation, penetration testing, system configuration monitoring and remediation, maintaining the various Computer Incident Response Plans (CIRP), and an active threat portfolio for key business functions, users, application platforms and persistent vulnerabilities. With a career in over 20 plus years in IT, Mr. McCarthy has held a wide range of roles within IT including systems programming, IT consultant, technical management, and IT sales. He recently retired after 30 plus years as a Marine Corps reservist obtaining the rank of Lieutenant Colonel. His last reserve assignment of five years was with the U.S. Cyber Command. After 9/11, Lt. Col. McCarthy was mobilized and spent almost four years on active duty as an Information Warfare Officer working at the U.S. Strategic Command, the Pentagon, and the National Security Agency (NSA). Mr. McCarthy also has 17 years of experience as a volunteer reserve police officer. In this capacity he was able to attend U.S. DOJ (Law Enforcement Only) training in computer forensics and advanced Internet investigations. He was also certified by FEMA for its Incident Command System (ICS) and the National Incident Management System (NIMS). Mr. McCarthy is currently on the Board of Directors of the San Francisco Bay Area and Silicon Valley chapter of the FBI's Infragard program. Mr. McCarthy has a B.S. degree in Computer Science, an M.B.A. and a CISSP. He is also the CEO of an SDVOB S-corporation with established and developing business in California and Nevada.





Dr. Matthew Todd is the Chief Security Officer and Vice President of Risk and Technical Operations for Financial Engines (NASDAQ: FNGN), a financial advisor with more than $47 billion in assets under management. At Financial Engines, he is responsible for security, privacy, business continuity, audit, and risk management for the firm.In addition to his work at Financial Engines, Dr. Todd is the president of the San Francisco Bay Area InfraGard chapter, representing more than 1000 volunteer InfraGard members. He has been a local mentor for the SANS Institute, is a CISM and CIPP, and holds the GSEC certification. He has more than 20 years of experience in the technology space and has been actively involved in information security for the last 15 years. He obtained his Ph.D. from Northwestern University and was a fellow of both the National Science Foundation (U.S.) and the Danish National Science Foundation.





Jeff Klaben is an Adjunct Professor with Santa Clara Universitys College of Engineering, where he currently teaches Information Assurance and Computer Forensics. He is also a principal with Neohapsis, helping Fortune 500 organizations and leading security technology providers overcome global challenges in technology risk management, competitive strategy, product engineering, compliance, and trusted collaboration to achieve break-through innovation. Previously, Jeff served as Group Director of Technology Risk Management at SanDisk, Chief Information Security Officer for Life Technologies, Engineering Group Director with Cadence Design Systems, and Senior Manager of Enterprise Architecture, IT Security, and Compliance at Applied Materials. He also led product management, professional services delivery, and start-up incubation at Accenture.Jeff is a frequent speaker at industry conferences, and for the past decade, has served on the board of directors of the San Francisco Bay Area InfraGard, a 501(c)(3) nonprofit and public/private partnership dedicated to information sharing for critical infrastructure protection. He assisted the White House as town hall moderator for the rollout of the National Strategy to Secure Cyberspace and was recognized by the U.S. Department of Justice with awards for Dedicated Service and Exceptional Service in the Public Interest. He also received the Belotti Award for Outstanding Business Policy in High Technology Firms from Santa Clara Universitys Leavey School of Business. Jeff earned an M.B.A. from Santa Clara University, a B.S. in Information Systems from Wright State University, and the credentials of Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Systems Auditor (CISA).