LIMITED OFFER
Save 50% on book bundles
Immediately download your ebook while waiting for your print delivery. No promo code needed.
The primary goal of the Information Protection Playbook is to serve as a comprehensive resource for information protection (IP) professionals who must provide adequate informa… Read more
LIMITED OFFER
Immediately download your ebook while waiting for your print delivery. No promo code needed.
The primary goal of the Information Protection Playbook is to serve as a comprehensive resource for information protection (IP) professionals who must provide adequate information security at a reasonable cost. It emphasizes a holistic view of IP: one that protects the applications, systems, and networks that deliver business information from failures of confidentiality, integrity, availability, trust and accountability, and privacy.
Using the guidelines provided in the Information Protection Playbook, security and information technology (IT) managers will learn how to implement the five functions of an IP framework: governance, program planning, risk management, incident response management, and program administration. These functions are based on a model promoted by the Information Systems Audit and Control Association (ISACA) and validated by thousands of Certified Information Security Managers. The five functions are further broken down into a series of objectives or milestones to be achieved in order to implement an IP framework.
The extensive appendices included at the end of the book make for an excellent resource for the security or IT manager building an IP program from the ground up. They include, for example, a board of directors presentation complete with sample slides; an IP policy document checklist; a risk prioritization procedure matrix, which illustrates how to classify a threat based on a scale of high, medium, and low; a facility management self-assessment questionnaire; and a list of representative job descriptions for roles in IP.
The Information Protection Playbook is a part of Elsevier’s Security Executive Council Risk Management Portfolio, a collection of real world solutions and "how-to" guidelines that equip executives, practitioners, and educators with proven information for successful security and risk management programs.
Mid- to upper-level security and information technology managers; security and information technology practitioners; students enrolled in two- and four-year college programs for security or computer science
Acknowledgments
Executive Summary
What is a Playbook?
About the Information Protection Playbook
IP Program
Introduction
Assumptions
IP Strategy
Chapter 1. Information Protection Function One: Governance
Implementation One: Strategic Management
Implementation Two: Reporting and Communication
Implementation Three: Policies
Implementation Four: Regulations and Compliance Management
Implementation Five: Roles and Responsibilities
Implementation Six: Procedures and Guidelines
Implementation Seven: Portfolio Management
Governance Improvement
Additional Information
Chapter 2. Information Protection Function Two: Program Planning
BASELINES, STANDARDS, Procedures, and Guidelines
Accountability and Resources
Metrics
For More Information
Chapter 3. Information Protection Function Three: Risk Management
Risk Assessment
Risk Communication Procedure
Risk Management Methodologies
For More Information
Chapter 4. Information Protection Function Four: Incident Response Management
Process
Plans, Exercises, Activation, Documentation, and Improvement
For More Information
Chapter 5. Information Protection Function Five: Program Administration
Compliance
Metrics
Change Management
Awareness
Key Points
For More Information
Appendix A. Playbook Summary
What’s Here
How to Use This Appendix
Summary
Appendix B. Board of Directors Presentation
What’s Here
How to Use This Appendix
Example Presentation
Appendix C. Information Protection Policies Checklist
What’s Here
How to Use This Appendix
Example Policy Documents
Example Data Classification Policy Elements
Appendix D. An Example Roles and Responsibilities RACI Matrix
What’s Here
How to Use This Appendix
Example RACI Matrix
Appendix E. Risk Prioritization Procedure Matrix
What’s Here
How to Use This Appendix
Risk Prioritization Matrix
Appendix F. Security Awareness and Training Menu
What’s Here
How to Use This Appendix
Security Awareness and Training Delivery Methods
Security Awareness and Training Menu
Appendix G. Risk Assessment and Compliance Checklist
What’s Here
How to Use This Appendix
Risk Assessment and Compliance Checklist
Appendix H. Incident Response
What’s Here
How to Use This Appendix
Incident Response Planning
Incident Reaction
Appendix I. Facility Management Self-Assessment
What’s Here
How to Use This Appendix
Self-assessment Questionnaire
Appendix J. Roles in Information Protection
What’s Here
How to Use This Appendix
Example Positions
Appendix K. Measurement in Information Protection
What’s Here
How to Use This Appendix
Initial Measurement Program
Evolutionary Process Improvement
Additional Resources
References
About the Contributing Editors
About Elsevier’s Security Executive Council Risk Management Portfolio
GK
LK
Her key responsibilities at Iron Mountain include overseeing IS governance, including global policies, standards, and the technology architecture strategy; assessing and managing IS compliance and assurance needs for Iron Mountain’s customers; and overseeing the Computer Incident Response Center, technology risk assessments, and risk management processes.
Lorna has an extensive background in IS with over 20 years of experience in security and systems administration, risk analysis, and the implementation of high-profile global strategic initiatives. Throughout her career, she has worked closely with senior leaders and cross-functional teams to develop and execute strategic and tactical security programs, as well as develop strategies to address regulatory compliance mandates and other security-related requirements.
Prior to joining Iron Mountain, Lorna was the CISO for global consumer goods manufacturer Kohler, and director of global security at network service provider BT/Infonet Services Corp. She began her career as a meteorologist with the US Air Force and has degrees from Bowling Green State University, Penn State, and the State University of New York at Albany.
In November 2010 Lorna was recognized as one of the industry’s “Most Influential People in Security” in the information technology/cyber security practitioners category by Security magazine.