Hjem

Chapter 1: Understanding Policy 2 Looking at Policy Through the Ages....................................................................3 The Bible as Ancient Policy
........................................................................4 The United States Constitution as a Policy Revolution
..............................5 Policy Today
...............................................................................................5 Information Security Policy
..................................................................................7 Successful Policy Characteristics
...............................................................8 The Role of Government
...........................................................................13 Information Security Policy Lifecycle
................................................................16 Policy Development
..................................................................................17 Policy Publication
.....................................................................................18 Policy Adoption
.........................................................................................19 Policy Review
............................................................................................20 Test Your Skills
..................................................................................................22
Chapter 2: Policy Elements and Style 32 Policy Hierarchy
.................................................................................................32 Standards..................................................................................................33 Baselines
...................................................................................................34 Guidelines
.................................................................................................34 Procedures
................................................................................................35 Plans and Programs..................................................................................36 Policy Format
.....................................................................................................36 Policy Audience
........................................................................................36 Policy Format Types
.................................................................................37 Policy Components
...................................................................................38 Writing Style and Technique
..............................................................................48 Using Plain Language
...............................................................................48 The Plain Language Movement
................................................................49 Plain Language Techniques for Policy Writing
.........................................50 Test Your Skills
..................................................................................................54
Chapter 3: Information Security Framework 64 CIA
.....................................................................................................................65 What Is Confidentiality?
............................................................................66 What Is Integrity?
......................................................................................68 What Is Availability?
..................................................................................69 Who Is Responsible for CIA?
....................................................................72 Information Security Framework
.......................................................................72 What Is NIST''s Function?
.........................................................................72 What Does the ISO Do?
............................................................................74 Can the ISO Standards and NIST Publications Be Used to Build a Framework?
......75 Test Your Skills
..................................................................................................82
Chapter 4: Governance and Risk Management 92 Understanding Information Security Policies
....................................................93 What Is Meant by Strategic Alignment?
...................................................94 Regulatory Requirements
.........................................................................94 User Versions of Information Security Policies
.........................................94 Vendor Versions of Information Security Policies
.....................................95 Client Synopsis of Information Security Policies
......................................95 Who Authorizes Information Security Policy?
...........................................96 Revising Information Security Policies: Change Drivers
...........................97 Evaluating Information Security Polices
...................................................97 Information Security Governance
....................................................................100 What Is a Distributed Governance Model?
.............................................101 Regulatory Requirements
.......................................................................104 Information Security Risk
................................................................................105 Is Risk Bad?
............................................................................................105 Risk Appetite and Tolerance
...................................................................106 What Is a Risk Assessment?
...................................................................106 Risk Assessment Methodologies
............................................................108 What Is Risk Management?
....................................................................109 Test Your Skills
................................................................................................113
Chapter 5: Asset Management 124 Information Assets and Systems
.....................................................................125 Who Is Responsible for Information Assets?
..........................................126 Information Classification
................................................................................128 How Does the Federal Government Classify Data?
...............................129 Why Is National Security Information Classified Differently?
..................131 Who Decides How National Security Data Is Classified?
.......................133 How Does the Private Sector Classify Data?..........................................134 Can Information Be Reclassified or Even Declassified?
.........................135 Labeling and Handling Standards
...................................................................136 Why Label?
.............................................................................................136 Why Handling Standards?
......................................................................136 Information Systems Inventory
........................................................................139 What Should Be Inventoried?
.................................................................139 Test Your Skills
................................................................................................145
Chapter 6: Human Resources Security 156 The Employee Lifecycle
...................................................................................157 What Does Recruitment Have to Do with Security?
...............................158 What Happens in the Onboarding Phase?
.............................................165 What Is User Provisioning?
.....................................................................166 What Should an Employee Learn During Orientation?
...........................167 Why Is Termination Considered the Most Dangerous Phase?
...............168 The Importance of Employee Agreements
......................................................170 What Are Confidentiality or Non-disclosure Agreements?
.....................170 What Is an Acceptable Use Agreement?
................................................170 The Importance of Security Education and Training
.......................................172 What Is the SETA Model?
.......................................................................173 Test Your Skills
................................................................................................177
Chapter 7: Physical and Environmental Security 188 Understanding the Secure Facility Layered Defense Model
.....................190 How Do We Secure the Site?
.................................................................190 How Is Physical Access Controlled?
......................................................192 Protecting Equipment
......................................................................................196 No Power, No Processing?
.....................................................................196 How Dangerous Is Fire?
.........................................................................198 What About Disposal?
............................................................................200 Stop, Thief!
.....