Managing Information Security Risks

The Octave Approach

Christopher Alberts, Audrey Dorofee

472 pages, parution le 29/07/2002

Ajouter à une liste

Indisponible

Résumé

Information security requires far more than the latest tool or technology. Organizations must understand exactly what they are trying to protect—and why—before selecting specific solutions. Security issues are complex and often are rooted in organizational and business concerns. A careful evaluation of security needs and risks in this broader context must precede any security implementation to insure that all the relevant, underlying problems are first uncovered.

The OCTAVE approach for self-directed security evaluations was developed at the influential CERT(R) Coordination Center. This approach is designed to help you:

Identify and rank key information assets
Weigh threats to those assets
Analyze vulnerabilities involving both technology and practices

OCTAVE(SM) enables any organization to develop security priorities based on the organization's particular business concerns. The approach provides a coherent framework for aligning security actions with overall objectives.

Managing Information Security Risks, written by the developers of OCTAVE, is the complete and authoritative guide to its principles and implementations. The book:

Provides a systematic way to evaluate and manage information security risks
Illustrates the implementation of self-directed evaluations
Shows how to tailor evaluation methods to different types of organizations

Special features of the book include:

A running example to illustrate important concepts and techniques
A convenient set of evaluation worksheets
A catalog of best practices to which organizationstheir own

Contents

I. INTRODUCTION.
1. Managing Information Security Risks.
2. Principles and Attributes of Information Security Evaluations.
II. THE OCTAVE METHOD.
3. Introduction to the OCTAVE Method.
4. Preparing for OCTAVE.
5. Identify Organizational Knowledge (Processes 1-3).
6. Create Threat Profiles (Process 4).
7. Identify Key Components (Process 5).
8. Evaluate Selected Components (Process 6).
9. Conduct Risk Analysis (Process 7).
10. Develop Protection Strategy (Process 8—Workshop A).
11. Select Protection Strategy (Process 8—Workshop B).
III. VARIATIONS ON THE OCTAVE APPROACH.
12. An Introduction to Tailoring OCTAVE.
13. Practical Applications.
14. Information Security Risk Management.
Glossary.
Bibliography.
IV. APPENDICES.
A. Case Scenario for the OCTAVE Method.
B. Worksheets.
C. Catalog of Practices.
Index.

L'auteur - Christopher Alberts

Christopher Alberts is a senior member of the technical staff in the Networked Systems Survivability Program at the Software Engineering Institute (SEI). He and Audrey Dorofee are the principal developers of OCTAVE. Before joining the SEI, Christopher was a scientist at Carnegie Mellon Research Institute, where he developed mobile robots for hazardous environments. He also worked at AT&T Bell Laboratories, where he designed information systems to support AT&T's advanced manufacturing processes.

L'auteur - Audrey Dorofee

Audrey Dorofee is a senior member of the technical staff in the Networked Systems Survivability Program at the Software Engineering Institute (SEI). She and Christopher Alberts are the principal developers of OCTAVE. Audrey previously was project lead for risk management in the Risk Program at the SEI. Prior to joining the SEI, she worked for the MITRE Corporation, supporting various projects for NASA, including Space Station software environments, user interfaces, and expert systems.

Caractéristiques techniques

	PAPIER
Éditeur(s)	Addison Wesley
Auteur(s)	Christopher Alberts, Audrey Dorofee
Parution	29/07/2002
Nb. de pages	472
Format	19,5 x 24
Couverture	Relié
Poids	985g
Intérieur	Noir et Blanc
EAN13	9780321118868
ISBN13	978-0-321-11886-8