Integrating IT Security Into the Capital Planning and Investment Control Process

Integrating IT Security Into the Capital Planning and Investment Control Process

Author: nist

Publisher:

Published: 2013-12-23

Total Pages: 74

ISBN-13: 9781494786731

DOWNLOAD EBOOK

Traditionally, information technology (IT) security and capitalplanning and investment control (CPIC) processes have been performed independently by security and capital planning practitioners. However, the Federal Information Security Management Act (FISMA) of 2002 and other existing federal regulations charge agencies with integrating the two activities. In addition, with increased competition for limited federal budgets and resources, agencies must ensure that available funding is applied towards the agencies' highest priority IT security investments. Applying funding towards high-priority security investments supports the objective of maintaining appropriate security controls, both at the enterprise-wide and system level, commensurate with levels of risk and data sensitivity. This special publication (SP) introduces common criteria against which agencies can prioritize security activities to ensure that corrective actions identifiedin the annual FISMA reporting process are incorporated into the capital planning process to deliver maximum security in a cost-effective manner.


Integrating It Security Into the Capital Planning and Investment Control Process

Integrating It Security Into the Capital Planning and Investment Control Process

Author: National Institute of Standards and Technology

Publisher: Createspace Independent Publishing Platform

Published: 2014-01-21

Total Pages: 66

ISBN-13: 9781494787462

DOWNLOAD EBOOK

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the United States economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of non-national-security-related information in federal information systems. This Special Publication 800 series reports on ITL's research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations.


FISMA and the Risk Management Framework

FISMA and the Risk Management Framework

Author: Daniel R. Philpott

Publisher: Newnes

Published: 2012-12-31

Total Pages: 585

ISBN-13: 1597496421

DOWNLOAD EBOOK

FISMA and the Risk Management Framework: The New Practice of Federal Cyber Security deals with the Federal Information Security Management Act (FISMA), a law that provides the framework for securing information systems and managing risk associated with information resources in federal government agencies. Comprised of 17 chapters, the book explains the FISMA legislation and its provisions, strengths and limitations, as well as the expectations and obligations of federal agencies subject to FISMA. It also discusses the processes and activities necessary to implement effective information security management following the passage of FISMA, and it describes the National Institute of Standards and Technology's Risk Management Framework. The book looks at how information assurance, risk management, and information systems security is practiced in federal government agencies; the three primary documents that make up the security authorization package: system security plan, security assessment report, and plan of action and milestones; and federal information security-management requirements and initiatives not explicitly covered by FISMA. This book will be helpful to security officers, risk managers, system owners, IT managers, contractors, consultants, service providers, and others involved in securing, managing, or overseeing federal information systems, as well as the mission functions and business processes supported by those systems. - Learn how to build a robust, near real-time risk management system and comply with FISMA - Discover the changes to FISMA compliance and beyond - Gain your systems the authorization they need


Information Security Risk Analysis

Information Security Risk Analysis

Author: Thomas R. Peltier

Publisher: CRC Press

Published: 2005-04-26

Total Pages: 361

ISBN-13: 1420031198

DOWNLOAD EBOOK

The risk management process supports executive decision-making, allowing managers and owners to perform their fiduciary responsibility of protecting the assets of their enterprises. This crucial process should not be a long, drawn-out affair. To be effective, it must be done quickly and efficiently. Information Security Risk Analysis, Second


Cyber security

Cyber security

Author: United States. Congress. House. Committee on Government Reform. Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census

Publisher:

Published: 2003

Total Pages: 160

ISBN-13:

DOWNLOAD EBOOK


Offensive and Defensive Security

Offensive and Defensive Security

Author: Harry I Nimon PhD PMP

Publisher: Xlibris Corporation

Published: 2013-05-21

Total Pages: 457

ISBN-13: 1483637670

DOWNLOAD EBOOK

Numerous publications exist which examine elements of the security discipline. Few address these elements as a continuum of interrelated functions. None examine the structure of Offensive vice Defensive security in anything other than the domain of international security . This text has been written to fill this gap and to support a course in Offensive-Defensive Security, developed by Henley-Putnam University, which briefly reviews the history of the field of strategic security and its three component parts protection, intelligence, and counterterrorism as well as its two distinguishing characteristics: offensive tactics and operations combined with technological innovation. The course then moves to an in-depth assessment of related security areas that focus on defensive tactics and operations: homeland security, criminal justice, conflict and peace studies, and emergency management. While these fields may appear at first to be part of strategic security, this course and the associated text explores the critical differences and the fact that they are also critical elements of industrial, governmental, and military security. Emphasis will be placed at an introductory level both academic and professional distinctions and discuss the structures associated within these domains. The text is divided into the following key sections: Section 1: The Basics Section 2: The Environment Section 3: Security Planning and Management Section 1 provides an orientation for the reader to a common frame of reference through information provided in the following chapters. It is not intended to be a single source of all relevant information. Additionally, this text is not intended to be the exhaustive single source for all conditions. Rather, it provides a roadmap of considerations on how to reach a specific goal in an efficient and informed manner. Section 2 examines the world the security professional must inhabit, again, in a generalized manner and, likely, in a way never before considered. Elements of neurology, biology, physics, philosophy, logic, analytics, and finance are presented in a manner unique to the changing paradigm of Offensive-Defensive Security philosophy. The various chapters are labeled as terrains as the best representation of the environmental information to be discussed. Each will approach the topics in as clear a manner possible of current thinking and science within each as critical to the understanding of the total security environment; the how, why, and in what ways they will affect the world of this security paradigm. Finally, Section 3 incorporates the information of the first two sections and applies the knowledge gained to the planning and management of an integrated security plan. The objective of this section is to utilize the concepts and processes developed via international agencies such as the Project Management Institute to demonstrate how to create an integrated and manageable enterprise structure and not a one-size fits all template. As the knowledge consolidates, integration begins, that of incorporating the security entity into the enterprise as a whole be that enterprise be a business, government entity, or military operation. The only difference is the scale. This is a vital step in that the act of protection cannot interfere with the process of performing the enterprise function. In fact, it must enhance the enterprise function and assist in ensuring its success. Key Learning Points The approach and purpose of this text has been outlined. The following are the key reasons or learning points in summary. a. Define the key elements and environments within which the security plan and operational management activities must occur b. Familiarize the student with cultural, biological, financial, informational, and legal aspects necessary for the understanding of how these domains influence human behavior; the primary aspect of security planning and operations c. Familiarize the


Enterprise Architecture and Information Assurance

Enterprise Architecture and Information Assurance

Author: James A. Scholz

Publisher: CRC Press

Published: 2013-07-29

Total Pages: 269

ISBN-13: 104005966X

DOWNLOAD EBOOK

This book provides guidance on designing complex, highly available enterprise architectures that integrate the most critical aspects of an organization's business processes. Considering the lack of tolerance of enterprise for operational interruptions or the risks that accompany theft and loss of data, this reference describes how to ensure your organization is prepared for the unexpected. The text also aids in containing liability with guidance on network and application vulnerability assessments, intrusion detection and penetration testing, incident response planning, risk mitigation audits/reviews, and business continuity and disaster recovery planning.