國立虎尾科技大學 |

Security controls evaluation, testing, and assessment handbook

Record Type:	Language materials, printed : Monograph/item
Title/Author:	Security controls evaluation, testing, and assessment handbook/ Leighton Johnson.
Author:	Johnson, Leighton,
Published:	Waltham, MA :Syngress is an imprint of Elsevier, : 2016.,
Description:	1 online resource.
Notes:	Includes index.
Subject:	Risk management. -
Online resource:	https://www.sciencedirect.com/science/book/9780128023242
ISBN:	9780128025642 (electronic bk.)

Security controls evaluation, testing, and assessment handbook
Johnson, Leighton,

Security controls evaluation, testing, and assessment handbook[electronic resource] /Leighton Johnson. - Waltham, MA :Syngress is an imprint of Elsevier,2016. - 1 online resource.

Includes index.

Includes bibliographical references and index.

Cover; Title Page; Copyright Page; Dedication; Contents; Introduction; Section I; Chapter 1 -- Introduction to Assessments; Chapter 2 -- Risk, Security, and Assurance; Risk management; Risk assessments; Security controls; Chapter 3 -- Statutory and Regulatory GRC; Statutory requirements; Privacy Act -- 1974; CFAA -- 1986; ECPA -- 1986; CSA -- 1987; CCA -- 1996; HIPAA -- 1996; EEA -- 1996; GISRA -- 1998; USA PATRIOT Act -- 2001; FISMA -- 2002; Sarbanes-Oxley -- 2002; Health Information Technology for Economic and Clinical Health Act -- 2009; Executive Orders/Presidential Directives.

Security Controls Evaluation, Testing, and Assessment Handbook provides a current and well-developed approach to evaluation and testing of security controls to prove they are functioning correctly in today's IT systems. This handbook shows you how to evaluate, examine, and test installed security controls in the world of threats and potential breach actions surrounding all industries and systems. If a system is subject to external or internal threats and vulnerabilities - which most are - then this book will provide a useful handbook for how to evaluate the effectiveness of the security controls that are in place. Security Controls Evaluation, Testing, and Assessment Handbook shows you what your security controls are doing and how they are standing up to various inside and outside threats. This handbook provides guidance and techniques for evaluating and testing various computer security controls in IT systems. Author Leighton Johnson shows you how to take FISMA, NIST Guidance, and DOD actions and provide a detailed, hands-on guide to performing assessment events for information security professionals who work with US federal agencies. As of March 2014, all agencies are following the same guidelines under the NIST-based Risk Management Framework. This handbook uses the DOD Knowledge Service and the NIST Families assessment guides as the basis for needs assessment, requirements, and evaluation efforts for all of the security controls. Each of the controls can and should be evaluated in its own unique way, through testing, examination, and key personnel interviews. Each of these methods is discussed. Provides direction on how to use SP800-53A, SP800-115, DOD Knowledge Service, and the NIST Families assessment guides to implement thorough evaluation efforts for the security controls in your organization. Learn how to implement proper evaluation, testing, and assessment procedures and methodologies with step-by-step walkthroughs of all key concepts. Shows you how to implement assessment techniques for each type of control, provide evidence of assessment, and proper reporting techniques.

ISBN: 9780128025642 (electronic bk.)Subjects--Topical Terms:

559158
Risk management.
Index Terms--Genre/Form:

554714
Electronic books.

LC Class. No.: HD61

Dewey Class. No.: 658.15/5

Security controls evaluation, testing, and assessment handbook
LDR:06261cam a2200337 a 4500 001 1000305
006 o d
007 cnu|unuuu||
008 201225s2016 mau ob 001 0 eng d
020 $a 9780128025642 (electronic bk.)
020 $a 0128025646 (electronic bk.)
020 $a 9780128023242
020 $a 0128023244
035 $a (OCoLC)932016626
035 $a EL2020124
040 $a N$T $b eng $c N$T $d YDXCP $d OPELS $d N$T $d OCLCF $d CDX $d EBLCP $d IDEBK $d MERUC $d DEBSZ $d IDB $d OCLCQ $d WRM $d U3W $d D6H $d OCLCQ $d CUY $d ZCU $d ICG $d DKC $d OCLCQ $d LQU $d CNCEN $d DCT $d UKMGB $d OCLCQ $d MM9
041 0 $a eng
050 4 $a HD61
082 0 4 $a 658.15/5 $2 23
100 1 $a Johnson, Leighton, $e author. $3 1292669
245 1 0 $a Security controls evaluation, testing, and assessment handbook $h [electronic resource] / $c Leighton Johnson.
260 $a Waltham, MA : $b Syngress is an imprint of Elsevier, $c 2016.
300 $a 1 online resource.
500 $a Includes index.
504 $a Includes bibliographical references and index.
505 0 $a Cover; Title Page; Copyright Page; Dedication; Contents; Introduction; Section I; Chapter 1 -- Introduction to Assessments; Chapter 2 -- Risk, Security, and Assurance; Risk management; Risk assessments; Security controls; Chapter 3 -- Statutory and Regulatory GRC; Statutory requirements; Privacy Act -- 1974; CFAA -- 1986; ECPA -- 1986; CSA -- 1987; CCA -- 1996; HIPAA -- 1996; EEA -- 1996; GISRA -- 1998; USA PATRIOT Act -- 2001; FISMA -- 2002; Sarbanes-Oxley -- 2002; Health Information Technology for Economic and Clinical Health Act -- 2009; Executive Orders/Presidential Directives.
505 8 $a Federal processing standardsFIPS-140 -- Security Requirements for Cryptographic Modules; FIPS-186 -- Digital Signature Standard (DSS); FIPS-190 -- Guideline for the Use of Advanced Authentication Technology Alternatives; FIPS-191 -- Guideline for the Analysis Local Area Network Security; FIPS-199 -- Standards for Security Categorization of Federal Information and Information Systems; FIPS-200 -- Minimum Security Requirements for Federal Information and Information Systems; FIPS-201 -- Personal Identity Verification of Federal Employees and Contractors; Regulatory requirements; DOD; CNSS; HHS.
505 8 $a HIPAA Security RuleHIPAA Privacy Rule; HITECH Breach Reporting; OMB requirements for each agency; References; Chapter 4 -- Federal RMF Requirements; Federal civilian agencies; DOD -- DIACAP -- RMF for DOD IT; IC -- ICD 503; FedRAMP; NIST Cybersecurity Framework; References; Chapter 5 -- Risk Management Framework; Step 1 -- categorization; Step 2 -- selection; Step 3 -- implementation; Step 4 -- assessment; Step 5 -- authorization; Step 6 -- monitoring; Continuous Monitoring for Current Systems; Chapter 6 -- Roles and Responsibilities; Organizational roles; White House; Congress; OMB; NIST; CNSS; NSA.
505 8 $a NIAPDHS; DOD; Individual roles; System Owner; Authorizing Official; Information System Security Officer; Information System Security Engineer; Security Architect; Common Control Provider; Authorizing Official Designated Representative; Information Owner/Steward; Risk Executive (Function); User Representative; Agency Head; Security Control Assessor; Senior Information Security Officer; Chief Information Officer; DOD roles; Section II ; Introduction; Chapter -- 7 -- Assessment Process; Focus; Guidance; SP 800-53A; RMF Step 4 -- Assess Security Controls; SP 800-115; RMF Knowledge Service.
505 8 $a ISO 27001/27002Chapter -- 8 -- Assessment Methods; Evaluation methods and their attributes; Processes; Interviews; Examinations; Observations; Document Reviews; Testing; Automated; Manual; Chapter -- 9 -- Assessment Techniques for Each Kind of Control; Security assessment plan developmental process; Security assessment actions; Security controls by family; Chapter -- 10 -- System and Network Assessments; 800-115 introduction; Assessment techniques; Network testing purpose and scope; ACL Reviews; System-Defined Reviews; Testing roles and responsibilities; Security testing techniques.
520 $a Security Controls Evaluation, Testing, and Assessment Handbook provides a current and well-developed approach to evaluation and testing of security controls to prove they are functioning correctly in today's IT systems. This handbook shows you how to evaluate, examine, and test installed security controls in the world of threats and potential breach actions surrounding all industries and systems. If a system is subject to external or internal threats and vulnerabilities - which most are - then this book will provide a useful handbook for how to evaluate the effectiveness of the security controls that are in place. Security Controls Evaluation, Testing, and Assessment Handbook shows you what your security controls are doing and how they are standing up to various inside and outside threats. This handbook provides guidance and techniques for evaluating and testing various computer security controls in IT systems. Author Leighton Johnson shows you how to take FISMA, NIST Guidance, and DOD actions and provide a detailed, hands-on guide to performing assessment events for information security professionals who work with US federal agencies. As of March 2014, all agencies are following the same guidelines under the NIST-based Risk Management Framework. This handbook uses the DOD Knowledge Service and the NIST Families assessment guides as the basis for needs assessment, requirements, and evaluation efforts for all of the security controls. Each of the controls can and should be evaluated in its own unique way, through testing, examination, and key personnel interviews. Each of these methods is discussed. Provides direction on how to use SP800-53A, SP800-115, DOD Knowledge Service, and the NIST Families assessment guides to implement thorough evaluation efforts for the security controls in your organization. Learn how to implement proper evaluation, testing, and assessment procedures and methodologies with step-by-step walkthroughs of all key concepts. Shows you how to implement assessment techniques for each type of control, provide evidence of assessment, and proper reporting techniques.
588 0 $a Online resource; title from PDF title page (ScienceDirect, viewed December 16, 2015).
650 0 $a Risk management. $3 559158
655 4 $a Electronic books. $2 local $3 554714
856 4 0 $u https://www.sciencedirect.com/science/book/9780128023242