Assessing and Managing Security Risk in IT Systems A Structured Methodology

Name: Assessing and Managing Security Risk in IT Systems A Structured Methodology
Availability: InStock
ISBN: 9780849322327

ISBN-10: 0849322324

ISBN-13: 9780849322327

Edition: 2004

Authors: John McCumber

List price: $90.95

30 day, 100% satisfaction guarantee!

Sell

Get cash fast!

Rent eBooks

180 day rental: $52.23 Expiration date: 10/20/2024

365 day rental: $61.72 Expiration date: 4/23/2025

Marketplace

4 new & used from $6.75

what's this?

Rush Rewards U
Members Receive:

You have reached 400 XP and carrot coins. That is the daily max!

Description:

This book begins with an overview of information systems security, offering the basic underpinnings of information security and concluding with an analysis of risk management. Part II describes the McCumber Cube, providing the original paper from 1991 and detailing ways to accurately map information flow in computer and telecom systems. It also explains how to apply the methodology to individual system components and subsystems. Part III serves as a resource for analysts and security practitioners who want access to more detailed information on technical vulnerabilities and risk assessment analytics. McCumber details how information extracted from this resource can be applied to his…

Book details

List price: $90.95
Copyright year: 2004
Publisher: Auerbach Publishers, Incorporated
Publication date: 8/12/2004
Binding: Hardcover
Pages: 288
Size: 6.30" wide x 9.45" long x 0.98" tall
Weight: 1.188
Language: English

John McCumber is Professor of German at the University of California, Los Angeles. He is author of Metaphysics and Oppression (IUP, 1999) and Philosophy and Freedom (IUP, 2000).




Security Concepts



Using Models


Introduction: Understanding, Selecting, and Applying Models


Understanding Assets


Layered Security


Using Models in Security


Security Models for Information Systems


Shortcomings of Models in Security


Security in Context


Reference



Defining Information Security


Confidentiality, Integrity, and Availability


Information Attributes


Intrinsic versus Imputed Value


Information as an Asset


The Elements of Security


Confidentiality


Integrity


Availability


Security Is Security Only in Context



Information as an Asset


Introduction


Determining Value


Managing Information Resources


References



Understanding Threat and Its Relation to Vulnerabilities


Introduction


Threat Defined


Analyzing Threat


Assessing Physical Threats


Infrastructure Threat Issues



Assessing Risk Variables: The Risk Assessment Process


Introduction


Learning to Ask the Right Questions about Risk


The Basic Elements of Risk in IT Systems


Information as an Asset


Defining Threat for Risk Management


Defining Vulnerabilities for Risk Management


Defining Safeguards for Risk Management


The Risk Assessment Process



The McCumber Cube Methodology



The McCumber Cube


Introduction


The Nature of Information


Critical Information Characteristics


Confidentiality


Integrity


Availability


Security Measures


Technology


Policy and Practice


Education, Training, and Awareness (Human Factors)


The Model


Overview


Use of the Model


References



Determining Information States and Mapping Information Flow


Introduction


Information States: A Brief Historical Perspective


Automated Processing: Why Cryptography Is Not Sufficient


Simple State Analysis


Information States in Heterogeneous Systems


Boundary Definition


Decomposition of Information States



Defining the Boundary



Make an Inventory of All IT Resources



Decompose and Identify Information States


Developing an Information State Map


Reference



Decomposing the Cube for Security Enforcement


Introduction


A Word about Security Policy


Definitions


The McCumber Cube Methodology


The Transmission State


Transmission: Confidentiality


Transmission: Integrity


Transmission: Availability


The Storage State


Storage: Confidentiality


Storage: Integrity


Storage: Availability


The Processing State


Processing: Confidentiality


Processing: Integrity


Processing: Availability


Recap of the Methodology



Information State Analysis for Components and Subsystems


Introduction


Shortcomings of Criteria Standards for Security Assessments


Applying the McCumber Cube Methodology for Product Assessments


Steps for Product and Component Assessment


Information Flow Mapping


Define the Boundary


Take an Inventory of Information Resources and Components


Decompose and Identify All Information States


Cube Decomposition Based on Information States


Call Out the Information State Column


Decompose Blocks by Attribute


Identify Existing and Potential Vulnerabilites


Develop Security Architecture


Describe Required Safeguards


Cost Out Architecture Components and Enforcement Mechanisms


Recap of the Methodology for Subsystems, Products, and Components


References



Managing the Security Life Cycle


Introduction



Safeguard Analysis


Introduction


Technology Safeguards


Procedural Safeguards


Human Factors Safeguards


Vulnerability-Safeguard Pairing


Hierarchical Dependencies of Safeguards


Security Policies and Procedural Safeguards


Developing Comprehensive Safeguards: The Lessons of the Shogun


Identifying and Applying Appropriate Safeguards


Comprehensive Safeguard Management: Applying the McCumber Cube


The ROI of Safeguards: Do Security Safeguards Have a Payoff?



Practical Applications of McCumber Cube Analysis


Introduction


Applying the Model to Global and National Security Issues


Programming and Software Development


Using the McCumber Cube in an Organizational Information Security Program


Using the McCumber Cube for Product or Subsystem Assessment


Using the McCumber Cube for Safeguard Planning and Deployment


Tips and Techniques for Building Your Security Program


Establishing the Security Program: Defining You


Avoiding the Security Cop Label


Obtaining Corporate Approval and Support


Creating Pearl Harbor Files


Defining Your Security Policy


Defining What versus How


Security Policy: Development and Implementation


Reference



Appendices



Vulnerabilities



Risk Assessment Metrics



Diagrams and Tables



Other Resources


Index