The third edition has expended coverage essential topics such as threat analysis, data gathering, risk analysis, and risk assessment methods and added coverage of new topics essential for current assessment projects (e.g., cloud security, supply chain management, security risk assessment methods).
The third edition has expended coverage essential topics such as threat analysis, data gathering, risk analysis, and risk assessment methods and added coverage of new topics essential for current assessment projects (e.g., cloud security, supply chain management, security risk assessment methods).
Douglas Landoll has over two decades of information security experience. He has led security risk assessments and established security programs for top corporations and government agencies. He is an expert in security risk assessment, security risk management, security criteria, and building corporate security programs. His background includes evaluating security at the National Security Agency (NSA), North Atlantic Treaty Organization (NATO), Central Intelligence Agency (CIA), and other government agencies; co-founding the Arca Common Criteria Testing Laboratory, co-authoring the systems security engineering capability maturity model (SSE-CMM); teaching at NSA's National Cryptologic School; and running the southwest security services division for Exodus Communications. Doug is currently the CEO of Lantego, specializing in risk assessment, policy and training. He is a certified information systems security professional (CISSP) and certified information systems auditor (CISA). He holds a BS degree from James Madison University and an MBA from the University of Texas at Austin. He has published numerous information security articles, speaks regularly at conferences, and serves as an advisor for several high-tech companies.
Inhaltsangabe
Foreword 1. Introduction 2. Information Security Risk Assessment Basics 3. Project Definition 4. Security Risk Assessment Preparation 5. Data Gathering 6. Administrative Data Gathering 7. Technical Data Gathering 8. Physical Data Gathering 9. Security Risk Analysis 10. Security Risk Mitigation 11. Security Risk Assessment Reporting 12. Security Risk Assessment Project Management 13. Cloud Security Risk Assessment 14. Vendor Security Risk Assessment 15. Very small and very large assessments 16. Security Risk Assessment Approaches Appendix. Relevant Standards and Regulations
