Security Planning: An Applied Approach

This book guides readers through building an IT security plan. Offering a template, it helps readers to prioritize risks, conform to regulation, plan their defense and secure proprietary/confidential information. The process is documented in the supplemental online security workbook. Security Planning is designed for the busy IT practitioner, who does not have time to become a security expert, but needs a security plan now. It also serves to educate the reader of a broader set of concepts related to the security environment through the Introductory Concepts and Advanced sections. The book serves entry level cyber-security courses through those in advanced security planning. Exercises range from easier questions to the challenging case study. This is the first text with an optional semester-long case study: Students plan security for a doctor’s office, which must adhere to HIPAA regulation. For software engineering-oriented students, a chapter on secure software development introduces security extensions to UML and use cases (with case study). The text also adopts the NSA’s Center of Academic Excellence (CAE) revamped 2014 plan, addressing five mandatory and 15 Optional Knowledge Units, as well as many ACM Information Assurance and Security core and elective requirements for Computer Science.

Table of Contents

Part I: The Problem of Security
Chapter 1: Security Awareness: Brave New World
Chapter 2: Combatting Fraud
Chapter 3: Complying with Security Regulation and Standards

Part II: Strategic Security Planning
Chapter 4: Managing Risk
Chapter 5: Addressing Business Impact Analysis and Business Continuity
Chapter 6: Governing: Policy, Maturity Models and Planning

Part III: Tactical Security Planning
III.1 Important Tactical Concepts
Chapter 7: Designing Information Security
Chapter 8: Planning for Network Security
Chapter 9: Designing Physical Security
Chapter 10: Organizing Personnel Security
Chapter 11: Planning for Incident Response

Part IV: Measure, Test and Audit
Chapter 12: Defining Security Metrics
Chapter 13: Performing an Audit or Security Test
Chapter 14: Complying with HIPAA and HITECH
Chapter 15: Developing Secure Software