信息安全管理（影印版）

ListofFigures
ListofTables
Preface
Acknowledgments

PartIIntroduction
Chapter1ManagingInformationSecurityRisks
1.1informationSecurity
WhatIsInformationSecurity?
VulnerabilityAssessment
InformationSystemsAud/t
InformationSecurityRiskEvaluat/on
ManagedServiceProviders
ImplementingaRiskManagementApproach
1.2InformationSecurityRiskEvaluation
andManagement
EvaluationActivities
RiskEvaluationandManagement
1.3AnApproachtoInformationSecurity
RiskEvaluations
OCTAVEApproach
InformationSecurityRisk
ThreePhases
OCTAVEVariations
CommonElements

Chapter2PrinciplesandAttributesofInformationSecurityRiskEvaluations
2.1Introduction
2.2InformationSecurityRiskManagementPrinciples
2.2.1InformationSecurityRiskEvaluationPrinciples
2.2.2RiskManagementPrinciples
2.2.3OrganizationalandCulturalPrinciples
2.3InformationSecurityRiskEvaluationAttributes
2.4InformationSecurityRiskEvaluationOutputs
2.4.1Phase1:BufidAsset-BasedThreatProfiles
2.4.2Phase2:IdentifyInfrastructureVulnerabilities
2.4.3Phase3:DevelopSecurityStrategyandPlans

PartIITheOCTAVEMethod
Chapter3introductiontotheOCTAVEMethod
3.1OverviewoftheOCTAVEMethod
3.1.1Preparation
3.1.2Phase1:BuildAsset-BasedThreatProfiles
3.1.3Phase2:IdentifyInfrastructureVulnerabilities
3.1.4Phase3:DevelopSecurityStrategyandPlans
3.2MappingAttributesandOutputstotheOCTAVEMethod
3.2.1AttributesandtheOCTAVEMethod
3.2.2OutputsandtheOCTAVEMethod
3.3IntroductiontotheSampleScenario

Chapter4PreparingforOCTAVE
4.1OverviewofPreparation
4.2ObtainSeniorManagementSponsorship
ofOCTAVE
4.3SelectAnalysisTeamMembers
4.4SelectOperationalAreastoParticipateinOCTAVE
4.5SelectParticipants
4.6CoordinateLogistics
4.7SampleScenario

Chapter5IdentifyingOrganizationalKnowledge(Processes1to3)
5.1OverviewofProcesses1to3
5.2IdentifyAssetsandRelativePriorities
5.3IdentifyAreasofConcern
5.4IdentifySecurityRequirementsforMostImportantAssets
5.5CaptureKnowledgeofCurrentSecurityPracticesandOrganizationalVulnerabilities

Chapter6CreatingThreatProfiles(Process4)
6.1OverviewofProcess4
6.2BeforetheWorkshop:ConsolidateInformationfromProcesses1to3
6.3SelectCriticalAssets
6.4RefineSecurityRequirementsforCriticalAssets
6.5IdentifyThreatstoCriticalAssets

Chapter7IdentifyingKeyComponents(Process5)
7.1OverviewofProcess5
7.2IdentifyKeyClassesofComponents
7.3IdentifyInfrastructureComponentstoExamine

Chapter8EvaluatingSelectedComponents(Process6)
8.1OverviewofProcess6
8.2BeforetheWorkshop:RunVulnerabilityEvaluationToolsonSelectedInfrastructureComponents
8.3ReviewTechnologyVulnerabilitiesandSummarizeResults

Chapter9ConductingtheRiskAnalysis(Process7)
9.1OverviewofProcess7
9.2IdentifytheImpactofThreatstoCriticalAssets
9.3CreateRiskEvaluationCriteria
9.4EvaluatetheImpactofThreatstoCriticalAssets
9.5incorporatingProbabilityintotheRiskAnalysis
9.5.1WhatIsProbability?
9.5.2ProbabilityintheOCTAVEMethod

Chapter10DevelopingaProtectionStrategy--WorkshopA(Process8A)
10.1OverviewofProcess8A
10.2BeforetheWorkshop:Consolidate
InformationfromProcesses1to3
10.3ReviewRiskInformation
10.4CreateProtectionStrategy
10.5CreateRiskMitigationPlans
10.6CreateActionList
10.7IncorporatingProbabilityintoRiskMitigation

Chapter11DevelopingaProtectionStrategy--WorkshopB(Process8B)
11.1OverviewofProcess8B
11.2BeforetheWorkshop:PreparetoMeetwithSeniorManagement
11.3PresentRiskInformation
11.4ReviewandRefineProtectionStrategy,MitigationPlans,andActionList
11.5CreateNextSteps
11.6SummaryofPartII

PartIIIVariationsontheOCTAVEApproach
Chapter12AnIntroductiontoTailoringOCTAVE
12.1TheRangeofPossibilities
12.2TailoringtheOCTAVEMethodtoYourOrganization
12.2.1TailoringtheEvaluation
12,2.2TailoringArt/facts

Chapter13PracticalApplications
13.1Introduction
13.2TheSmallOrganization
13.2.1CompanyS
13.2.2ImplementingOCTAVEinSmallOrganizations
13.3VeryLarge,DispersedOrganizations
13.4IntegratedWebPortalServiceProviders
13.5LargeandSmallOrganizations
13.6OtherConsiderations

Chapter14InformationSecurityRiskManagement
14.1Introduction
14.2AFrameworkforManagingInformationSecurityRisks
14:2.1Identify
14.2.2Analyze
14.2.3Plan
14.2.4Implement
14.2.5Monitor
14.2.6Control
14.3ImplementingInformationSecurityRiskManagement
14.4Summary
Glossary
Bibliography

AppendixACaseScenariofortheOCTAVEMethod
A.1MedSiteOCTAVEFinalReport:Introduction
A.2ProtectionStrategyforMedSite
A.2.1Near-TermActionItems
A.3RisksandMitigationPlansforCriticalAssets
A.3.1PaperMedicalRecords
A.3,2PersonalComputers
A.3.3PIDS
A.3.4ABCSystems
A.3.5ECDS
A.4TechnologyVulnerabilityEvaluationResults
andRecommendedActions
A.5AdditionalInformation
A.5.1RiskImpactEvaluationCriteria
A.5.20therAssets
A.5.3ConsolidatedSurveyResults
AppendixBWorksheets
B.1KnowledgeElicitationWorksheets
B.1.1AssetWorksheet
B.1.2AreasofConcernWorksheet
B.1.3SecurityRequirementsWorksheet
B.1.4PracticeSurveys
B.1.5ProtectionStrategyWorksheet
B.2AssetProfileWorksheets
B.2.1CriticalAssetInformation
B.2.2SecurityRequirements
B.2.3ThreatProNeforCriticalAsset
B.2.4System(s)ofInterest
B.2.5KeyClassesofComponents
B.2.6InfrastructureComponentstoExamine
B.2.7SummarizeTechnologyVulnerabilities
B.2.8RecordActionItems
B.2.9RiskImpactDescriptions
B.2.10RiskEvaluationCriteriaWorksheet
B.2.11RiskProfileWorksheet
B.2.12RiskMitigationPlans
B.3StrategiesandActions
B.3.1CurrentSecurityPracticesWorksheets
B.3.2ProtectionStrategyWorksheets
B.3.3ActionListWorksheet
AppendixCCatalogofPractices
AbouttheAuthors
Index

第I部分引言
第1章信息安全管理
1.1信息安全
1.2信息安全風險評估和管理
1.3一種信息安全風險評估的方法
第2章信息安全風險評估的原則和屬性
2.1簡介
2.2信息安全風險管理原則
2.3信息安全風險評估的屬性
2.4信息安全風險評估的輸出,

第II部分OCTAVE方法
第3章OCTAVEMethod簡介
3.1OCTAVE方法簡介
3.2把屬性和輸出映射到OCTAVEMethod
3.3情節(jié)實例簡介
第4章為OCTAVE做準備
4.1準備概述
4.2爭取高層管理部門支持OCTAVE
4.3挑選分析團隊成員
4.4選擇OCTAVE涉及的業(yè)務(wù)區(qū)域
4.5選擇參與者
4.6協(xié)調(diào)后勤工作
4.7情節(jié)實例
第5章標識組織的知識
5.1過程1到3概述
5.2標識資源及其相對優(yōu)先級
5.3標識涉及區(qū)域
5.4標識最重要的資源的安全需求
5.5獲取當前的安全實踐和組織弱點的知識
第6章建立威脅配置文件
6.1過程4概述
6.2討論會之前：整理從過程1到3中收集的信息
6.3選擇關(guān)鍵資源
6.4提煉關(guān)鍵資源的安全需求
6.5標識對關(guān)鍵資源的威脅
第7章標識關(guān)鍵組件
7.1過程5概述
7.2標識組件的關(guān)鍵種類
7.3標識要研究的基礎(chǔ)結(jié)構(gòu)組件
第8章評估選定的組件
8.1過程6概述
8.2討論會之前：對基礎(chǔ)結(jié)構(gòu)組件運行弱點評估工具
8.3技術(shù)弱點評估及結(jié)果總結(jié)
第9章執(zhí)行風險分析
9.1過程7簡介
9.2標識關(guān)鍵資源的威脅所產(chǎn)生的影響
9.3建立風險評估標準
9.4評估關(guān)鍵資源的威脅產(chǎn)生的影響
9.5應(yīng)用概率于風險分析
第10章開發(fā)保護策略--討論會A
10.1過程8A簡介
10.2討論會之前：整理從過程1到3中收集的信息
10.3評審風險信息
10.4制定保護策略
10.5建立風險緩和計劃
10.6制定行動列表
10.7在風險緩和中應(yīng)用概率
第11章開發(fā)保護策略--討論會B
11.1過程8B簡介
11.2討論會之前：準備與高層管理部門會面
11.3介紹風險信息
11.4評審并提煉保護策略.緩和計劃和行動列表
11.5確定后續(xù)步驟
11.6第Ⅱ部分總結(jié)

第III部分OCTAVE方法的變體
第12章剪裁OCTAVE方法簡介
12.1可能性范圍
12.2為組織剪裁OCTAVE方法
第13章實際應(yīng)用
13.1引言
13.2小型組織
13.3超大型的.分散的組織
13.4綜合的Web入口服務(wù)提供商
13.5大型組織和小型組織
13.6其他需要考慮的問題
第14章信息安全風險管理
14.1引言
14.2信息安全風險管理的框架
14.3實施信息安全風險管理
14.4總結(jié)
術(shù)語表

附錄
附錄AOCTAVE方法的實例情節(jié)
A.1MedSite的OCTAVE最終報告：引言
A.2為MedSite制定的保護策略
A.3對關(guān)鍵資源的風險和緩和計劃
A.4技術(shù)弱點評估結(jié)果及建議的行動
A.5補充信息
附錄B工作表
B.1問題征集工作表
B.2資源配置文件工作表
B.3策略和行動
附錄C實踐目錄