Capital Books Pvt. Ltd. Educating the World

Measuring and Managing Information Risk - 1st Edition

Subject ISBN Author Publisher Number of Pages Title Year Price
Business, Management and Accounting 9780124202313 Jack Freund, Jack Jones Elsevier 408 Measuring and Managing Information Risk - 1st Edition 2015 $ 49.95
Author: Jack Freund, Jack Jones
Description: Using the factor analysis of information risk (FAIR) methodology developed over ten years and adopted by corporations worldwide, Measuring and Managing Information Risk provides a proven and credible framework for understanding, measuring, and analyzing information risk of any size or complexity. Intended for organizations that need to either build a risk management program from the ground up or strengthen an existing one, this book provides a unique and fresh perspective on how to do a basic quantitative risk analysis. Covering such key areas as risk theory, risk calculation, scenario modeling, and communicating risk within the organization, Measuring and Managing Information Risk helps managers make better business decisions by understanding their organizational risk.
Table of Content: • Acknowledgments by Jack Jones • About the Authors • Preface by Jack Jones • Preface by Jack Freund • Chapter 1. Introduction o How much risk? o The bald tire o Assumptions o Terminology o The bald tire metaphor o Risk analysis vs risk assessment o Evaluating risk analysis methods o Risk analysis limitations o Warning—learning how to think about risk just may change your professional life o Using this book • Chapter 2. Basic Risk Concepts o Possibility versus probability o Prediction o Subjectivity versus objectivity o Precision versus accuracy • Chapter 3. The FAIR Risk Ontology o Decomposing risk o Loss event frequency o Threat event frequency o Contact frequency o Probability of action o Vulnerability o Threat capability o Difficulty o Loss magnitude o Primary loss magnitude o Secondary risk o Secondary loss event frequency o Secondary loss magnitude o Ontological flexibility • Chapter 4. FAIR Terminology o Risk terminology o Threat o Threat community o Threat profiling o Vulnerability event o Primary and secondary stakeholders o Loss flow o Forms of loss • Chapter 5. Measurement o Measurement as reduction in uncertainty o Measurement as expressions of uncertainty o But we dont have enough data…and neither does anyone else o Calibration o Equivalent bet test • Chapter 6. Analysis Process o The tools necessary to apply the FAIR risk model o How to apply the FAIR risk model o Process flow o Scenario building o The analysis scope o Expert estimation and PERT o Monte Carlo engine o Levels of abstraction • Chapter 7. Interpreting Results o What do these numbers mean? (How to interpret FAIR results) o Understanding the results table o Vulnerability o Percentiles o Understanding the histogram o Understanding the scatter plot o Qualitative scales o Heatmaps o Splitting heatmaps o Splitting by organization o Splitting by loss type o Special risk conditions o Unstable conditions o Fragile conditions o Troubleshooting results • Chapter 8. Risk Analysis Examples o Overview o Inappropriate access privileges o Privileged insider/snooping/confidentiality o Privileged insider/malicious/confidentiality o Cyber criminal/malicious/confidentiality o Unencrypted internal network traffic o Privileged insider/confidentiality o Nonprivileged insider/malicious o Cyber criminal/malicious o Website denial of service o Analysis o Basic attacker/availability • Chapter 9. Thinking about Risk Scenarios Using FAIR o The boyfriend o Security vulnerabilities o Web application risk o Contractors o Production data in test environments o Password security o Basic Risk Analysis o Project prioritization o Smart compliance o Going into business o Chapter summary • Chapter 10. Common Mistakes o Mistake categories o Checking results o Scoping o Data o Variable confusion o Mistaking TEF for LEF o Mistaking response loss for productivity loss o Confusing secondary loss with primary loss o Confusing reputation damage with Competitive Advantage loss o Vulnerability analysis • Chapter 11. Controls o Overview o High-level control categories o Asset-level controls o Variance controls o Decision-making controls o Control wrap up • Chapter 12. Risk Management o Common questions o What we mean by “risk management” o Decisions, decisions o Solution selection o A systems view of risk management • Chapter 13. Information Security Metrics o Current state of affairs o Metric value proposition o Beginning with the end in mind o Missed opportunities • Chapter 14. Implementing Risk Management o Overview o A FAIR-based risk management maturity model o Governance, risks, and compliance o Risk frameworks o Root cause analysis o Third-party risk o Ethics o In closing • Index

Copyright © All rights Reserved | Design by Zaptas Technologies