Building a Practical Information Security Program provides users with a strategic view on how to build an information security program that aligns with business objectives. The information provided enables both executive management and IT managers not only to validate existing security programs, but also to build new business-driven security programs. In addition, the subject matter supports aspiring security engineers to forge a career path to successfully manage a security program, thereby adding value and reducing risk to the business. Readers learn how to translate technical challenges into business requirements, understand when to "go big or go home," explore in-depth defense strategies, and review tactics on when to absorb risks. This book explains how to properly plan and implement an infosec program based on business strategy and results.
1. Cover image - p. i 2. Title page - p. ii 3. Table of Contents - p. iii 4. Copyright - p. iv 5. About the Authors - p. ix 6. Chapter 0. Why We Need Security Programs - p. 1 7. Chapter 1. Develop an Information Security Strategy - p. 23 8. Chapter 2. Integrate Security Into the Organization - p. 35 9. Chapter 3. Establish a Security Organization - p. 45 10. Chapter 4. Why Information Security Policies? - p. 63 11. Chapter 5. Manage the Risks - p. 77 12. Chapter 6. Protect the Data - p. 103 13. Chapter 7. Manage the Security of Third Parties and Vendors - p. 125 14. Chapter 8. Conduct Security Awareness and Training - p. 135 15. Chapter 9. Security Compliance Management and Auditing - p. 157 16. Chapter 10. Information Security Program Metrics - p. 169 17. Index - p. 185
Building a Practical Information Security Program provides users with a strategic view on how to build an information security program that aligns with business objectives. The information provided enables both executive management and IT managers not only to validate existing security programs, but also to build new business-driven security programs. In addition, the subject matter supports aspiring security engineers to forge a career path to successfully manage a security program, thereby adding value and reducing risk to the business. Readers learn how to translate technical challenges into business requirements, understand when to "go big or go home," explore in-depth defense strategies, and review tactics on when to absorb risks. This book explains how to properly plan and implement an infosec program based on business strategy and results.
1. Cover image - p. i 2. Title page - p. ii 3. Table of Contents - p. iii 4. Copyright - p. iv 5. About the Authors - p. ix 6. Chapter 0. Why We Need Security Programs - p. 1 7. Chapter 1. Develop an Information Security Strategy - p. 23 8. Chapter 2. Integrate Security Into the Organization - p. 35 9. Chapter 3. Establish a Security Organization - p. 45 10. Chapter 4. Why Information Security Policies? - p. 63 11. Chapter 5. Manage the Risks - p. 77 12. Chapter 6. Protect the Data - p. 103 13. Chapter 7. Manage the Security of Third Parties and Vendors - p. 125 14. Chapter 8. Conduct Security Awareness and Training - p. 135 15. Chapter 9. Security Compliance Management and Auditing - p. 157 16. Chapter 10. Information Security Program Metrics - p. 169 17. Index - p. 185
