实践信息安全管理：规划与实施指南

5星 · 超过95%的资源需积分: 16 127 浏览量更新于2024-07-20 收藏 8.65MB PDF 举报

身份认证购VIP最低享 7 折!

30元优惠券

"Practical Information Security Management" 本书《实用信息安全管理》是信息安全管理领域的实践指南，旨在帮助读者在商业环境中创建合适且关注安全的提案，同时考虑成本、风险和可用性的平衡，以成为一名成功的信息安全经理。书中深入探讨了如何建立有效的信息安全实践，如何招聘合适的人才，以及如何在安全控制、成本和风险之间找到最佳平衡。全书涵盖了广泛的信息安全主题，包括组织结构、安全架构、技术控制、治理框架和操作安全。作者并未专注于帮助读者通过CISSP、CISM或CISMP等专业认证考试，或成为PCI-DSS审计员，ISO 27001或COBIT合规系统的构建者，或道德黑客和数字取证调查员。相反，它提供的是多年实战经验的结晶，以帮助读者专注于实际工作中的任务完成。读者将学习到以下内容： 1. 如何成为一名高效的信息安全经理，了解该职位的实践方面。 2. 如何在成本与风险之间找到合适的平衡点。 3. 如何将安全政策和标准应用于实际工作场景。 4. 如何利用复杂的安全功能，如数字取证、事件响应和安全架构。本书面向希望在业务中提供有效安全管理的读者，无论是已有一定经验的信息安全经理，还是想要转行进入这个充满挑战的新领域的技术人员或风险管理人员。无论你的职业目标是什么，这本书都能提供有价值的指导。书中的章节包括： 1. 职业的发展演变 2. 威胁与漏洞 3. 信息安全经理的角色 4. 组织安全 5. 信息安全实施 6. 标准、框架、指南和法规 7. 信息保护 8. 人员保护 9. 场地保护 10. 系统保护 11. 数字证据和事件响应 12. 云计算安全 13. 工业控制系统 14. 安全系统开发此书由Tony Campbell撰写，他在信息安全领域有丰富的实践经验，提供了全面的规划和实施信息安全的指导，帮助读者在日益复杂的威胁环境中保护组织的信息资产。

资源详情

资源推荐

xix

Acknowledgments

The acknowledgements section of a book can sometimes read like a celebrity speech at an award ceremony.

They thank everyone that has ever contributed to their career development, all the way from their parents

to their pets. Another factor is that acknowledgements are rarely read by anyone other than the author and

the people being acknowledged, oftentimes because the author has told them about the mention. What

I’ll try and do here is something a little different, since I have too many people to thanks and the things I’d

like to thank them for may be directly unrelated to the topic of cybersecurity but have contributed to my

own perspectives. I grew up in Northern Ireland during the 1970s, which as anyone with an ounce of world

history knowledge will know, was a particularly troubled time for the province. As a young lad trying to find

my way in life, I quickly had to learn which parts of Belfast city were off limits to the likes of me, based on

the intangibles of religion, the school I went to and the color of scarf I wore. I also learned to read situations

well and quickly assess the clientele in pubs so that I could predict any trouble before it escalated, which it

often did. So, from the moment I ventured out on my own as a naïve schoolboy, I was programmed to assess

physical risks that had the potential to lead to harm or even death in pretty much every situation I found

myself in. You might ask yourself what this has to do with information security. That’s easy, I was technically

minded and certainly spent a lot of time building electronics projects, and programming computers (I had a

ZX Spectrum), so coupling that mindset with an innate capability to assess risks, falling into a security career

was almost destined. When I finally left Northern Ireland in 1989, I moved to a job in England, working

for the UK Meteorological Office, where I became a C and Fortran programmer. However, my love was in

systems and administration, as well as network architecture, so I ditched the programming life for a sys

admin job, which is where things turned around. System administration was awesome back then—we were

the guys with all the power. When we finally replaced all of our old DEC equipment with Windows NT 4.0, I

finally realized that security was the job for me. I moved from Meteorological Office to a Ministry of Defence

contractor and from there started working directly on highly-classified military systems. I was in my element

as a security administrator, but always seemed to end up inheriting a team of wannabe security guys that I

had to mentor. This was always fun, but came with some frustrations that what I considered obvious from

a risk perception point of view seemed hard for these guys to grasp. I had no problem in teaching concepts

and methodologies to these guys, but what I noticed was that it took a significant amount of time for people

to just get it. What I had forgotten was that my time was served watching my back on the streets of Belfast,

which had programmed me in a way that was alien these mainlanders, who didn’t have to think twice about

answering a question such as, “What school did you go to?” In Belfast, the wrong answer to that question

could result in your kneecaps being smashed with a tire iron. So security, for me, became a calling and

no matter what kind of role or project I took on, I always covered the security viewpoint. Security became

my career and when it was possible to be classified as a security professional, I was there in line for the

badge, and I’ve never looked back. To me it’s been a calling in life that I have no found, coupled with my

other calling, writing, so the opportunity to fuse these two passions together into this book was an exciting

prospect. Security is all about risk assessment, management, and ensuring you’ve done enough but no too

much, since too much security will stop you from doing the things you want to do.

But let’s get back to the point of my life story. I could personally reach out and thank dozens upon

dozens of people who have been with me on my personal journey, but there are a few who need special

mention, those who taught me about risk assessment, contingency planning and writing and self-critique,

to whom I am eternally grateful. My grandfather Davy taught me to question and consider people’s motives

xxi

Introd uction

I wrote this book because I saw the need. As someone who’s been in this game for such a very long time, I felt

somewhat obliged to help those who want to get started. I often get asked how you get started in a career in

infosec. People ask if they should switch over from a management role, or maybe a technical job, or maybe

they work in corporate risk and compliance and want to go deeper into the cybersecurity side of things.

I’ve been having these conversations with increasingly regularity, but I noticed that the line of questioning

always ends up looking at why they think they want a security career? What is it about this weird and often

frustrating field that has piqued their interest?

I now believe that you need to have a passion for this business to make it a success. I also believe that

there are people who are already in security who just don’t get it, while there are countless people not in

security that really could and should be. The passion I speak of comes from an innate personal trait that

many of us are born with, compelling us to rip stuff apart to see how it works. It’s this same innate ability

that drives the best security guys to look beyond the surface of systems, processes, and people, to see the

weaknesses and vulnerabilities that leave them exposed to attack.

■ Note I’ve taken 20 years of experience, academic theory, along with real-world experience and distilled it

into a practical guide that shows you the ropes. You can use this as a textbook that you reference as you work,

not contradicting anything you will need to learn should you want to pursue academic studies at college or

university, or if you intend to shoot for some of the most valued and recognized industry certifications, such as

CISSP, SABSA, CISM, or CISMP.

This book looks at just one of the myriad career paths you could opt for if you want to get started in

security: information security manager (ISM). It’s a truism that being an ISM is no easy ride. Information

security management is a tough subject to master and there are dozens of standards and guidelines that

explain what you need to do to secure your organization, without explaining how to do it.

The reality is that all of these standards and guidelines are useful, but without context, you’re left

scratching your head (or whatever it is you scratch in times of trouble), wondering how it applies to you and

the systems and information that you protect. This textbook bridges some of the gaps between the what and

the how of information security, offering ISMs some practical advice on developing skills and competencies

in this complicated and often-infuriating discipline.

What You Will Learn

• The practical aspects of being an effective information security manager

• How to strike the right balance between cost and risk

■ INTRODUCTION

xxii

• How to take security policies and standards and make them work in reality

• How to leverage complex security functions, such as digital forensics, incident

response, and security architecture

As I said, I’ve aimed this book primarily at newly appointed information security managers or anyone

who is already in a security role but fancies their chances as an ISM. That being said, I’ve also gone wide

in coverage so that this can be as useful a reference as possible even for experienced ISMs and security

engineers who are interested expanding their knowledge.

Let’s start with a short history to put this in perspective.

Somewhere in Time

Over half a century ago, US Defense Advanced Research Projects Agency (DARPA) scientist, J.C.R. Licklider,

had an absurd idea. He proposed the wild notion of a so-called Galactic Network . The concept was simple: a

ubiquitous, global internetwork of computers that anyone could use to access information and programs in

real time.

Licklider’s vision foreshadowed the Internet that we now take for granted every day, however, back

then, the notion was more like science fiction than fact, but with persistence, Licklider's dream became a

reality. Over the next ten years, DARPA developed a plethora of standards and technologies that would laid

the foundation of the global internetwork we use today. Devices such as interface message processors linked

together to form the backbone of a distributed network—the mesh network—that soon became recognized

as ARPANET.

When scientists connected the first two nodes to ARPANET in 1969, they demonstrated host-to-host

message transfer from UCLA’s Network Measurement Center to the Stanford Research Institute (SRI),

serving the simple purpose of proving Licklider’s vision was not just a pipedream.

The US Department of Defense had already developed the Transmission Control Protocol/Internet

Protocol (TCP/IP) in the early 1970s; however, they did not adopt it until later that decade.

By 1985, ARPANET was still only providing government and research services. However, increasing

pressure to extend its reach into commercial and academic sectors accelerated plans to grow over the next

five years. By 1990, ARPANET was decommissioned and the Internet was born.

■ Note Due to the illegal actions of some phreakers, the term phreaker became quickly associated only

illegality. Phreakers were, in the eyes of the media, all criminals, whether they were simply hanging out on

AT&T’s network or acting with criminal intent. Today, we see the same issues with terminology, where modern

media uses hacker to define anyone acting illegally on computer systems and networks. Like phreaker, hacker

described someone with natural talent and aptitude for tinkering with and learning about computers. However,

the media now labels anyone acting with criminal or malicious intent as a hacker, so it is now dangerous to

refer to yourself as a hacker if you are acting with good intentions.

You might ask yourself what the point of this history lesson is—fair question, given this book is about

information security management. However, remembering that timeline of development of the Internet,

let us now jump sideways onto a different timeline and track a different historical course that brings us to

today’s understanding of where security is.

During the late 1950s and early 1960s, AT&T’s management learned of the existence of an underground

group of technology geeks, known as phone phreakers . The phreakers were accessing AT&T’s telephone

network without permission, sometimes for their own gain, such as those using custom tone-generators,

■ INTRODUCTION

xxiii

dubbed as blue boxes , to obtain free calls. In 1964, AT&T started monitoring their exchanges, trying to catch

and prosecute the phreakers who were stealing calls. This audit program ran for six long years, with no more

than 200 viable convictions to show for all their efforts. What’s interesting is that the majority of phreakers

were nothing more than interested hobbyists and geeks, all with a love of technology and a yearning to

explore the mysteries of the telephone network.

Computer security has been around for as long as networks and computers, since the innate nature

of humankind is to look for ways to turn systems and tools against us. Just like every society-changing

evolution throughout history, the global community has today come to rely, almost ubiquitously, on the

interconnectedness of all things. We have built connectivity into our businesses and homes, but more so

we are not connecting all sorts of things that previously were autonomous. Fridges are ordering food for

themselves. Microwave ovens are reaching out to the Internet to acquire cooking times for the meals we are

preparing rather than you having to work these out yourself. We are even using fast ordering technologies,

such as Amazon Dash Buttons, to order replacement products directly from its online shop.

■ Note German chemist Martin Klaproth discovered uranium in 1789. In 1932, James Chadwick discovered

the neutron, while experiments by John Cockcroft and Ernest Walton showed that transformations were

possible through atomic bombardment. It wasn’t until 1939 that a German team of physicists, led by Niels Bohr,

proved that the astounding amount of energy released from splitting the atom was as much as 200 million

electron volts. This kicked off research right across the world into harnessing that energy to provide potentially

infinite power. Six years later, scientists were turning this society-changing science into the most devastating

weapon of our time, dropping it on two Japanese cities and killing hundreds of thousands of innocent civilians.

When systems are initially conceived, it’s rare that the consideration of how they might be misused is at

the fore of the inventor’s mind. Normally, the imagination of science fiction writers yields the most insight

into how systems turn against their creators. Think of all those science fiction stories that have become

Hollywood blockbusters over the years.

• Do Androids Dream of Electric Sheep? . This Philip K. Dick novel was turned into

the movie Blade Runner . It tells the story of synthetically created humans (a.k.a the

replicants ) that disobey their orders and return to Earth, causing trouble as they go.

• The Terminator . This 1984 movie tells the story of a post-apocalyptic future where

the robots have turned against their masters to take over the world.

• Frankenstein . Mary Wollstonecraft Shelley’s 1823 novel is probably the most famous

and most reproduced story about a scientific creation turning against its master.

While we’ve digressed somewhat from computer security, the point I’m making is that we have

recognized for some time that science and technology can be used for good or ill. However, the technology

itself is impartial to how it’s used—it just does what it’s predisposed to do. It’s humans and their innate

nature of attacking one another and taking from one another that causes the problems. Our computer

systems and networks are no exception. Coupled with the copious number of vulnerabilities, bugs and

design flaws we hear of every day, affecting the systems we use to access our bank accounts, plays games,

run our businesses and orchestrate military conflicts, it’s little wonder that those that wish us harm use these

weaknesses to attack us.

It was not long ago that a bank heist involved rushing into a branch with a couple of double-barreled

shotguns and taking physical cash from the vault. This was highly dangerous for the criminals and very risky

for all concerned.

剩余252页未读，继续阅读

ramissue

粉丝: 354
资源: 1487

实践信息安全管理：规划与实施指南

Management of Information Security, 6th Edition (PART 2)

Management of Information Security, 6th EditionB (PART 1)

A Practical Guide to Security Engineering and Information Assurance

sar sensor有什么作用

springsecurity 相关书籍

practical linux security cookbook, 云盘

practical node.js, 2nd edition

docker cookbook: over 100 practical and in...

请你简单介绍一下A Practical Logic Obfuscation Technique for Hardware Security这篇论文的主要内容

信息安全公认学习书籍

ElGamal短签名的相关文献

操作系统安全相关参考文献

参考文献图书馆管理系统

min-max normalization的参考文献

Brute-force algorithm

"[string \"/home/tpy/practical-cryptdb/wrapper.lua\"]:6: /home/tpy/practical-cr"

图书管理系统数据库设计参考文献

请帮我整理最新的哈希算法参考文献

网络攻防技术分析的参考文献

数据爬取与可视化分析参考文献

最新资源