Information Technology Risk Management in Enterprise Environments A Review of Industry Practices and a Practical Guide to Risk Management Teams

by Kouns, Jake; Minoli, Daniel

• ISBN13: 9780471762546
• ISBN10: 0471762547
• Edition: 1st
• Format: Hardcover
• Copyright: 2010-01-07
• Publisher: Wiley-Interscience

Summary

Discusses all types of corporate risks and practical means of defending against them. Security is currently identified as a critical area of Information Technology management by a majority of government, commercial, and industrial organizations. Offers an effective risk management program, which is the most critical function of an information security program.

Author Biography

Jake Kouns in confounder, CEO, and CFO of the Open Security Foundation. He holds an MBA in information security from James Madison University and a number of certifications, including ISC2's CISSP, ISACA's CISM, CISA, and CGEIT. Daniel Minoli is an expert in the fields of IT, telecommunications, and networking, with work experience at Capital One Financial, Prudential Securities, and ATT, among others. He is the founder and President Emeritus off the IPv6 Institute. He is the author or coauthor of several books on IT, security, and networking, including Minoli-Cordovana's Authoritative Computer and Network Security Dictionary and Network Infrastructure and Architecture: Designing High Availability Networks, both published by Wiley.

Table of Contents

Preface	p. xiii
About the authors	p. xv
Industry Practices in Risk Management	p. 1
Information Security Risk Management Imperatives and Opportunities	p. 3
Risk Management Purpose and Scope	p. 3
Purpose of Risk Management	p. 3
Text Scope	p. 17
References	p. 24
Bibliography of Related Literature	p. 25
Information Security Risk Management Defined	p. 33
Key Risk Management Definitions	p. 33
Survey of Industry Definitions	p. 33
Adopted Definitions	p. 37
A Mathematical Formulation of Risk	p. 40
What is Risk? A Formal Definition	p. 44
Risk in IT Environments	p. 44
Risk Management Procedures	p. 49
Typical Threats/Risk Events	p. 56
What is an Enterprise Architecture?	p. 61
References	p. 65
The CISSPforum/ISO27k Implementers Forum Information Security Risk List for 2008	p. 66
What is Enterprise Risk Management (ERM)?	p. 71
Information security risk management standards	p. 73
ISO/IEC 13335	p. 77
ISO/IEC 17799 (ISO/IEC 27002:2005)	p. 78
ISO/IEC 27000 Series	p. 78
ISO/IEC 27000, Information Technology-Security Techniques-Information Security Management Systems-Fundamentals and Vocabulary	p. 79
ISO/IEC 27001:2005, Information Technology-Security Techniques-Specification for an information Security Management, System-	p. 79
ISO/IEC 27002:2005, Information Technology-Security Techniques-Code of Practice for Information Security Management	p. 84
ISO/IEC 27003 Information Technology-Security Techniques-Information Security Management System Implementation Guidance	p. 90
ISO/IEC 27004 Information Technology-Security Techniques-Information Security Management-Measurement	p. 91
ISO/IEC 27005:2008 Information Technology-Security Techniques-Information Security Risk Management	p. 92
ISO/ICE 31000	p. 92
NIST STANDARDS	p. 94
NIST SP 800-16	p. 96
NIST SP 800-30	p. 99
NIST SP 800-39	p. 101
AS/NZS 4360	p. 105
References	p. 106
Organization for Economic Cooperation and Development (OECD) Guidelines for the Security of Information Systems and Networks: Toward a Culture of Security	p. 107
A Survey of Available Information Security Risk Management Methods and Tools	p. 111
Overview	p. 111
Risk Management/Risk Analysis Methods	p. 114
Austrian IT Security Handbook	p. 114
CCTA Risk Assessment and Management Methodology (CRAMM)	p. 115
Dutch A&K Analysis	p. 117
EBIOS	p. 117
ETSI Threat Vulnerability and Risk Analysis (TVRA) Method	p. 119
FAIR (Factor Analysis of Information Risk)	p. 122
FIRM (Fundamental Information Risk Management)	p. 124
FMEA (Failure Modes and Effects Analysis)	p. 125
FRAP (Facilitated Risk Assessment Process)	p. 128
ISAMM (Information Security Assessment and Monitoring Method)	p. 129
ISO/IEC Baselines	p. 130
ISO 31000 Methodology	p. 130
IT-Grundschutz (IT Baseline Protection Manual)	p. 136
MAGERIT (Metodologia de Analisis y Gestion de Riesgos de los Sistemas de Informacion) (Methodology for Information Systems Risk Analysis and Management)	p. 137
MEHARI (Méthode Harmonisée d'Analyse de Risques-Harmonised Risk Analysis Method)	p. 142
Microsoft's Security Risk Management Guide	p. 146
MIGRA (Metodologia Integrata per la Gestione del Rischio Aziendale)	p. 152
NIST	p. 153
National Security Agency (NSA) IAM / IEM / IA-CMM	p. 153
Open Source Approach	p. 155
PTA (Practical Threat Analysis)	p. 158
SOMAP (Security Officers Management and Analysis Project)	p. 160
Summary	p. 161
References	p. 162
Methodologies examples: COBIT and octave	p. 164
Overview	p. 164
COBIT	p. 166
COBIT Framework	p. 172
The Need for a Control Framework for IT Governance	p. 173
How COBIT Meets the Need	p. 175
COBIT's Information Criteria	p. 175
Business Goals and IT Goals	p. 176
COBTT Framework	p. 177
IT Resources	p. 178
Plan and Organize (PO)	p. 180
Acquire and Implement (AI)	p. 180
Deliver and Support (DS)	p. 180
Monitor and Evaluate (ME)	p. 181
Processes Need Controls	p. 181
COBIT Framework	p. 181
Business and IT Controls	p. 184
IT General Controls and Application Controls	p. 185
Maturity Models	p. 187
Performance Measurement	p. 194
OCTAVE	p. 205
The OCTAVE Approach	p. 205
The OCTAVE Method	p. 208
References	p. 210
Developing Risk Management Teams	p. 211
Risk Management Issues and Organization Specifics	p. 213
Purpose and Scope	p. 213
Risk Management Policies	p. 216
A Snapshot of Risk Management in the Corporate World	p. 219
Motivations for Risk Management	p. 224
Justifying Risk Management Financially	p. 225
The Human Factors	p. 230
Priority-Oriented Rational Approach	p. 232
Overview of Pragmatic Risk Management Process	p. 234
Creation of a Risk Management Team, and Adoption of Methodologies	p. 234
Iterative Procedure for Ongoing Risk Management	p. 236
Roadmap to Pragmatic Risk Management	p. 236
References	p. 239
Example of a Security Policy	p. 239
Assessing Organization and Establishing Risk Management Scope	p. 243
Assessing the Current Enterprise Environment	p. 244
Soliciting Support from Senior Management	p. 248
Establishing Risk Management Scope and Boundaries	p. 259
Defining Acceptable Risk for Enterprise	p. 260
Risk Management Committee	p. 263
Organization-Specific Risk Methodology	p. 264
Quantitative Methods	p. 265
Qualitative Methods	p. 267
Other Approaches	p. 269
Risk Waivers Programs	p. 272
References	p. 274
Summary of Applicable Legislation	p. 275
Identifying Resources and Implementing the Risk Management Team	p. 280
Operating Costs to Support Risk Management and Staffing Requirements	p. 281
Organizational Models	p. 286
Staffing Requirements	p. 287
Specialized Skills Required	p. 290
Sourcing Options	p. 291
Risk Management Tools	p. 295
Risk Management Services	p. 296
Alerting and Analysis Services	p. 296
Assessments, Audits, and Project Consulting	p. 296
Developing and Implementing the Risk Management/ Assessment Team	p. 298
Creating Security Standards	p. 298
Defining Subject Matter Experts	p. 300
Determining Information Sources	p. 300
References	p. 301
Sizing Example for Risk Management Team	p. 302
Example of Vulnerability Alerts by Vendors and CERT	p. 331
Examples of Data Losses-A One-Month Snapshot	p. 336
Identifying Assets and Organization Risk Exposures	p. 338
Importance of Asset Identification and Management	p. 338
Enterprise Architecture	p. 340
Identifying IT Assets	p. 346
Assigning Value to IT Assets	p. 353
Vulnerability Identification/Classification	p. 354
Base Parameters	p. 360
Temporal Parameters	p. 362
Environmental Parameters	p. 363
Threat Analysis: Type of Risk Exposures	p. 367
Type of Risk Exposures	p. 368
Internal Team Programs (to Uncover Risk Exposures)	p. 371
Summary	p. 371
References	p. 371
Common Information Systems Assets	p. 372
Remediation planning and compliance reporting	p. 377
Determining Risk Value	p. 377
Remediation Approaches	p. 380
Prioritizing Remediations	p. 384
Determining Mitigating Timeframes	p. 385
Compliance Monitoring and Security Metrics	p. 387
Compliance Reporting	p. 390
References	p. 391
Basic Glossary of Terms Used in This Text	p. 392
Index	p. 415
Table of Contents provided by Ingram. All Rights Reserved.