سایبر داینامیکس: هنر و علم ساخت برنامهٔ امنیت دیجیتال ساده‌شده

Table of Contents About the Author About the Technical Reviewer Acknowledgments Preface Introduction Chapter 1: Risk The Ubiquity of Risk Likelihood Impact Risk Score Appetite vs. Tolerance Risk Tolerance Risk Appetite Risk Treatment Risk Management Risk Mitigation Risk Acceptance Risk Register Key Concepts Opportunity Opportunity Matrix Opportunity Tolerance Opportunity Treatment Opportunity Management Opportunity Escalation Opportunity Register Key Concepts Chapter 2: Class What Is Data Classification? Why Data Classification Structured and Unstructured Data Records Key Concepts Chapter 3: Design IT Governance Digital Security Governance Organizational Objectives Alignment Structure Authority Governance Note Key Concepts Security Architecture Untrusted Ext (External) Zone Untrusted In (Internal) Zone Semitrusted Zone Trusted Zone Restricted Zone Management Zone DMZ Management Zone Cloud Final Security Architecture Thoughts Key Concepts Chapter 4: Control Policy Defined Policy Header Policy Summary Policy Approval Policy Scope Policy Enforcement Policy Exceptions Policy Body Policy Definitions Policy Revision History Key Concepts Policy Statements – Part I Policy Directive Data Ownership Data Classification Cryptographic Keys Data Disposal Layered Security Secure Coding Standards, Procedures, and Baselines Malware Prevention Data Encryption ID Management Policy Statements – Part II Data Access Passwords Remote Access Monitoring and Auditing Physical Security Security Incident Response Quantitative Risk Assessment Security Testing Risk Management IT Change Management Security Training and Awareness Metrics Cloud Security Supporting Components Standards Standard Applicability Standard Structure Standard List Standard Approval Standard Scope Baselines Baseline Applicability Baseline Structure Baseline List Baseline Approval Baseline Scope Procedures Procedure Applicability Procedure Structure Procedure List Process Approval Process Scope Guidance Guidance Applicability Guidance Structure Guidance List Passwords Segregation of Duties Major Risk Travel Risk Register Operation Guidance Approval Guidance Scope Key Concepts Chapter 5: Implementation Tone and Leadership Charter or Terms of Reference IT Advisory Organization Advisory Policy Approval Standing Up Standards Stage 1: Consult with IT Advisory (ITA) Stage 2: Consult with Security Advisory Team (SAT) Stage 3: Consult with Digital Security Leader and Endorsement Stage 4: Publish and Communications Getting to Guidance Priming the Processes Beginning with Baselines Key Concepts