A Practical Guide to Security Engineering and Information Assurance (Hardcover)

Introduction
Background
Purpose
Scope
Intended Audience
Organization
What is Information Assurance, How Does it Relate to Information Security, and Why Are Both Needed?
Definition
Application Domains
Technology Domains
Importance
Stakeholders
Summary
Discussion Problems
Historical Approaches to Information Security and Information Assurance
Physical Security
Communications Security (COMSEC)
Computer Security (COMPUSEC)
Information Security (INFOSEC)
Operations Security (OPSEC)
System Safety
System Reliability
Summary
Discussion Problems
Define the System Boundaries
Determine What is Being Protected and Why
Identify the System
Characterize System Operation
Ascertain What You Do/Do Not Have Control Over
Summary
Discussion Problems
Perform Vulnerability and Threat Analyses
Definitions
Select/Use IA Analysis Techniques
Identify Vulnerabilities, Their Type, Source, and Severity
Identify Threats, Their Type, Source, and Likelihood
Evaluate Transaction Paths, Critical Threat Zones, and Risk Exposure
Summary
Discussion Problems
Implement Threat Control Measures
Determine How Much Protection is Needed
Operational Procedures, In-Service Considerations, Controllability
Contingency Planning and Disaster Recovery
Perception Management
Select/Implement IA Design Features and Techniques
Summary
Discussion Problems
Verify Effectiveness of Threat Control Measures
Select/Employ IA Verification Techniques
Determine Residual Risk
Monitor Ongoing Risk Exposure, Responses, and Survivability
Summary
Discussion Problems
Conduct Accident/Incident Investigations
Introduction
Analyze Cause, Extent, and Consequences of Failure/Compromise
Initiate Short-term Recovery Mechanisms
Report Accident/Incident
Deploy Long-term Remedial Measures
Evaluate Legal Issues
Summary
Discussion Problems
Annex A - Glossary of Terms
Annex B - Glossary of Techniques
Annex C - Additional Resources
Annex D - Summary of the components, activities, and tasks of an effective information security/IA program
Index