You are previewing Enterprise Security Architecture.
O'Reilly logo
Enterprise Security Architecture

Book Description

Security is too important to be left in the hands of just one department or employee—it’s a concern of an entire enterprise. Enterprise Security Architecture shows that having a comprehensive plan requires more than the purchase of security software—it requires a framework for developing and maintaining a system that is proactive. The book is based around the SABSA layered framework. It provides a structured approach to the steps and processes involved in developing security architectures. It also considers how some of the major business issues likely to be encountered can be resolved.

Table of Contents

  1. Preliminaries
  2. Dedications
  3. Foreword
  4. Preface
    1. Benefits
    2. The Evolution of Information Security
    3. Information Security Literature
    4. How to Use This Book
    5. About the SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Model Model
    6. Relationship to Other Methods, Models and Standards
    7. And Finally...
  5. Acknowledgements
  6. Part 1: Introduction
    1. Security Architecture
  7. Chapter 1: The Meaning of Security
    1. The Cultural Legacy: Business Prevention
    2. Measuring and Prioritising Business Risk
    3. Information Security as the Enabler of Business
      1. Case Study: The Wrong Accounts
      2. Case Study: In Denial
      3. Case Study: Failure to Deliver
      4. Case Study: A Taxing Problem
      5. Case Study: Disintegration
    4. Adding Value to the Core Product
      1. Case Study: Safety Assurance
      2. Case Study: Raising Expectations
    5. Empowering the Customers
      1. Case Study: Supplying Power to the Customer
    6. Protecting Relationships and Leveraging Trust
      1. Case Study: Trusted Sources
    7. To Summarise: What Does ‘Security’ Mean?
  8. Chapter 2: The Meaning of Architecture
    1. The Origins of Architecture
      1. Case Study: An Icon of Australian Culture
    2. Managing Complexity
    3. Information Systems Architecture
      1. Business Architecture
      2. Information Architecture
      3. Applications Architecture
      4. Infrastructure Architecture
      5. Risk Management Architecture
      6. Management and Governance Architecture
      7. Information Systems Architecture Reference Model
      8. Infrastructure Architecture Reference Model
    4. Enterprise Security Architecture
      1. Case Study: User Authentication
    5. Why Architectures Sometimes Fail to Deliver Benefit – and How to Avoid that Fate
      1. Historical Background
      2. The Wider Business Requirements
        1. Usability
        2. Inter-Operability
        3. Integration
        4. Supportability
        5. Low Cost Development
        6. Fast Time to Market
        7. Scalability of Platforms
        8. Scalability of Cost
        9. Scalability of Security Level
        10. Re-Usability
        11. Operations Costs
        12. Administration Costs
        13. Risk-Based Cost/Benefit Effectiveness
      3. Dealing with Conflicting Objectives
      4. Enabling Business
      5. Being a Successful Security Architect
      6. Ten Rules for the Solution Architect
    6. Security Architecture Needs a Holistic Approach
    7. To Summarise: What Does Architecture Mean?
      1. Figure 2-1
      2. Figure 2-2
      3. Figure 2-3
  9. Chapter 3: Security Architecture Model
    1. The SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Model Model
      1. I Keep Six Honest Serving-Men
      2. The Business View
    2. The Architect’s View
    3. The Designer’s View
    4. The Builder’s View
    5. The Tradesman’s View
    6. The Facilities Manager’s View
    7. The Inspector’s View
    8. The SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Matrix Matrix
    9. Detailed SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Matrix for the Operational Layer Matrix for the Operational Layer
    10. To Summarise: The Security Architecture Model
      1. Figure 3.1
      1. Table 3-1
      2. Table 3-2
      3. Table 3-3
      4. Table 3-4
  10. Chapter 4: Case Study
    1. Intergalactic Banking and Financial Services Inc
      1. Overview of Intergalactic Banking and Financial Services Inc
      2. Interviews at IBFS
        1. Interview with David Smith, Group Chief Executive Officer
        2. David Smith: Interview Notes
        3. Interview with Juan Carlos, Chief Operating Officer
        4. Juan Carlos: Interview Notes
        5. Interview with Rosemary Brown, Senior Vice President, eBusiness
        6. Rosemary Brown: Interview Notes
        7. Interview with Helmut Meyer, Group Chief Financial Officer
        8. Interview Notes: Helmut Meyer
        9. Interview with Brian Jones, Senior Vice President, Marketing and Distribution
        10. Brian Jones: Interview Notes
        11. Interview with Ranjit Patel, Chief Information Officer
        12. Ranjit Patel: Interview Notes
        13. Interview with Ho Siew Luan (Sarah), Director of Compliance
        14. Ho Siew Luan: Interview Notes
      3. To Summarise: IBFS Inc
  11. Chapter 5: A Systems Approach
    1. The Role of Systems Engineering
    2. Why a Systems Approach?
        1. Managing Complexity
        2. Top-Down Decomposition
        3. Black Box Modelling
        4. Logical Flow Analysis
    3. What Does the Systems Approach Make You Do?
        1. Documenting the Ideas
        2. Peer Review
        3. Communicating Ideas
    4. The Need for Systems Engineering in Security Architectures
    5. Some Basic Concepts
        1. Objectives
        2. Environment
        3. Resources
        4. Parts of the System – Sub-Systems
        5. Management
    6. The Control System Concept
    7. Using the Systems Approach in Security Architecture
        1. Broad Strategic Objectives
        2. Environmental Influences
        3. Simplifying Complexity
        4. Measuring Performance Against Objectives
    8. Case Study
      1. Overview
      2. Initial Observations
      3. Scope of the System
      4. Analysis of Shortcomings
      5. Business Requirements
      6. Total System Objectives
      7. Review of the Design: Functional Problems Identified
      8. Review of the Design: The System’s Environment
      9. Review of the Design: The System’s Resources
      10. Review of the Design: The Sub-Systems, Their Activities, Goals and Measures of Performance
      11. Review of the Design: The Management of the System
      12. Critical Shortcomings of the Design
      13. Using a Systems Approach to Redesign the System
      14. Conclusions
    9. Advanced Modelling Techniques
        1. Business Process Engineering
      1. Case Study on Business Process Failure
      2. The Case of the Missing Taxis
        1. Dependency Tree Modelling
        2. Finite State Machine Models
      3. Finite State Machine Case Study
      4. A Password Authentication Protocol
        1. Exhaustive Model Checking
        2. Other Advanced Modelling Techniques
    10. To Summarise: A Systems Approach
      1. Figure 5-1
      2. Figure 5-2
      3. Figure 5-3
      4. Figure 5-4
      5. Figure 5-5
      6. Figure 5-6
      7. Figure 5-7
      8. Figure 5-8
      9. Figure 5-9
  12. Chapter 6: Measuring Return on Investment in Security Architecture
    1. What Is Meant by ‘Return on Investment’?
    2. Why Do You Need Metrics?
    3. The Security Management Dashboard
    4. The Balanced Scorecard Approach
    5. Business Drivers and Traceability
      1. Case Study: IBFS Real-Time Settlement System (RTSS)
    6. Business Attributes and Metrics
    7. Setting Up a Metrics Framework
    8. Maturity Models Applied to Security Architecture
      1. System Security Engineering Capability Maturity Model
      2. CobiT™ Capability Maturity Model
      3. Applying CMMs to Measure Return on Investment
      4. Benchmarking Security Architecture
      5. To Summarise: Measuring Return on Investment in Security Architecture?
      1. Figure 6-1
      2. Figure 6-2
      3. Figure 6-3
      4. Figure 6-4
      5. Figure 6-5
      6. Figure 6-6
      7. Figure 6-7
      1. Table 6-1
      2. Table 6-2
      3. Table 6-3
      4. Table 6-4
      5. Table 6-5
      6. Table 6-6
      7. Table 6-7
      8. Table 6-8
      9. Table 6-9
      10. Table 6-10
      11. Table 6-11
  13. Chapter 7: Using This Book as a Practical Guide
    1. Using the SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Model to Define a Development Process Model to Define a Development Process
    2. Strategy and Concept Phase
      1. Contextual Security Architecture Deliverables
      2. Conceptual Security Architecture Deliverables
      3. How Does the Strategy and Concept Phase Fit Together?
    3. Design Phase
      1. Logical Security Architecture Development Process
      2. Logical Architecture Deliverables
      3. Functional Specification
      4. Physical Security Architecture Development Process
      5. Physical Security Architecture Deliverables
      6. Component Security Architecture Development Process
      7. Component Security Architecture Deliverables
      8. Operational Security Architecture Development Process
      9. Operational Security Architecture Deliverables
      10. How Does the Strategy and Concept/Design Process Fit Together?
      11. Case Study – Directory Infrastructure Project at IBFS
    4. Implementation Phase
    5. Manage and Measure Phase
    6. To Summarise: How to Use This Book as a Practical Guide
      1. Figure 7-1
      2. Figure 7-2
      3. Figure 7-3
      4. Figure 7-4
      5. Figure 7-5
      6. Figure 7-6
      7. Figure 7-7
      8. Figure 7-8
      9. Figure 7-9
      10. Figure 7-10
      11. Figure 7-11
      12. Figure 7-12
      13. Figure 7-13
      14. Figure 7-14
      15. Figure 7-15
      16. Figure 7-16
      17. Figure 7-17
      18. Figure 7-18
      19. Figure 7-19
      20. Figure 7-20
  14. Chapter 8: Managing the Security Architecture Programme
      1. Ensuring That You Solve Business Problems
      2. Maximum Return on Investment
      3. Economies of Scale and Standardisation
      4. Improved Corporate Governance
    1. Selling the Benefits of Security Architecture
      1. Rules for Influencing Opinion or Behaviour
      2. Better Risk Management
      3. Improved Preparedness for Formal Audit
      4. Influencing the Financial and Business Analyst Community
      5. More Flexible Response to New Business Opportunities
      6. More Flexible Response to Business Reorganisation
      7. Reduced Operating Costs
      8. Improved Productivity Through Better User Support
      9. Case Study: The Operational Cost of User Login
      10. Base Information
      11. User Set-Up
      12. Login Activity
      13. Problem Management
      14. Total Resource Effort
      15. Lost Productivity
      16. The Quick Win
      17. Support for Outsourcing Strategy
      18. Reduced Total Cost of Ownership
      19. Leveraging Trusted Business Relationships
      20. Consistent User Experience
    2. Getting Sponsorship and Budget
    3. Building the Team
      1. Team Roles
      2. Belbin’s Team Roles
      3. Teambuilding
    4. Getting Started: Fast Track™ Workshops
      1. Prior to the On-Site Programme
      2. During the On-Site Program
      3. After the On-Site Program
    5. Programme Planning and Management
    6. Collecting the Information You Need
      1. Information about the Business
      2. Structured Interviews with Business Managers
      3. Case Study: A US-based eLearning Provider
      4. Case Study: An Experience of Interviewing the Chief Financial Officer of a Global Materials Manufacturer
      5. Reference to Existing Materials
      6. Collecting Technical Information
    7. Getting Consensus on the Conceptual Architecture
    8. Architecture Governance and Compliance
      1. The Architecture Board
      2. Design Authority
    9. Architecture Maintenance
    10. Long-Term Confidence of Senior Management
      1. Case Study: Senior Management Losing Its Religion
      2. Quick Wins
    11. To Summarise: Managing the Security Architecture Programme
  15. Part 2: Strategy and Planning
    1. Strategy and Planning
    2. Contextual Security Architecture
    3. Conceptual Security Architecture
  16. Chapter 9: Contextual Security Architecture
    1. Business Needs for Information Security
    2. Security As a Business Enabler
      1. Electronic Publishing
      2. On-Demand Entertainment
      3. Value-Added Information Services
      4. Remote Process Control
      5. Case Study: Remote Control of an Electrical Power Plant
      6. Supply Chain Management
      7. Research and Information Gathering
    3. Digital Business
      1. eBanking
      2. Case Study: IBFS Internet Bank – Gone Phishing
      3. eProcurement
      4. eGovernment
    4. Operational Continuity and Stability
      1. Revenue Generation
      2. Customer Service
      3. Market Reputation
      4. Management Control
      5. Operating Licences
      6. Case Study: Pharmaceutical Industry – 21 CFR Part 11
      7. Employee Confidence
      8. Case Study: Republic of Ireland
      9. Shareholder Confidence
      10. Other Stakeholders
    5. Safety-Critical Dependencies
      1. Remote Communications to Safety-Critical Systems
      2. Systems Assurance
    6. Business Goals, Success Factors and Operational Risks
      1. Brand Protection
      2. Fraud Prevention
      3. Loss Prevention
      4. Business Continuity
      5. Strategic Business Development
      6. Case Study: A Major Healthcare Administration Agency
      7. Legal Obligations
      8. Confidence of Key Stakeholders
    7. Operational Risk Assessment
      1. Basel II Definition of Operational Risk
      2. Risk Modelling
      3. Risk Assessment
      4. Threat Modelling Framework
      5. Threat Domains
      6. Threat Categories
      7. Threat Scenarios
      8. Risk Prioritisation
      9. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Risk Assessment Method Risk Assessment Method
        1. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Risk Assessment Method: Step 1 Risk Assessment Method: Step 1
        2. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Risk Assessment Method: Step 2 Risk Assessment Method: Step 2
        3. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Risk Assessment Method: Step 3 Risk Assessment Method: Step 3
        4. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Risk Assessment Method: Step 4 Risk Assessment Method: Step 4
        5. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Risk Assessment Method: Step 5 Risk Assessment Method: Step 5
      10. Risk Mitigation
    8. Business Processes and Their Need for Security
      1. Business Interactions
      2. Business Communications
      3. Business Transactions
    9. Organisation and Relationships Affecting Business Security-Needs
    10. Location Dependence of Business Security Needs
      1. The Global Village Marketplace
      2. Remote Working
    11. Time Dependency of Business Security Needs
      1. Time-Related Business Drivers
      2. Time-Based Security
    12. To Summarise: Contextual Security Architecture
      1. Figure 9-1
      2. Figure 9-2
      3. Figure 9-3
      1. Table 9-1
      2. Table 9-2
      3. Table 9-3
      4. Table 9-4
      5. Table 9-5
      6. Table 9-6
      7. Table 9-7
      8. Table 9-8
      9. Table 9-9
  17. Chapter 10: Conceptual Security Architecture
    1. Conceptual Thinking
    2. Business Attributes Profile
    3. Control Objectives
    4. Security Strategies and Architectural Layering
      1. Multi-Layered Security
      2. Multi-Tiered Incident Handling
      3. Security Infrastructure Layered Architecture
      4. The Common Security Services API Architecture
      5. Application Security Services Architecture
      6. Placing of Security Services in the Architecture Layers
      7. Security Services in the Applications Layer
      8. Security Services in the Middleware Layer
      9. Explicit Security Services:
      10. Implicit Security Services:
      11. Data Management Security Services
      12. Security Services in the Information Transfer (Network) Layer
      13. Security Services for the Information Processing Layer
      14. Authentication, Authorisation and Audit Strategy
      15. Security Service Management Strategy
      16. System Assurance Strategy
      17. Directory Services Strategy
      18. Directory Services Strategy: Management
      19. Directory Services Strategy: Objects
      20. PKI Strategy
      21. PKI Strategy: What Is Public Key Cryptography?
      22. PKI Strategy: What Is Public Key Infrastructure?
      23. PKI Strategy: The Way Forward
    5. Security Entity Model and Trust Framework
      1. SABSA<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> Matrix cross-reference Matrix cross-reference
      2. Security Entities
      3. Security Entity Naming
      4. Security Entity Relationships
      5. Understanding and Modelling Trust
      6. Protecting Trust Relationships – Trust Brokers and PKI
      7. Trust Broker Models that Work
      8. Extended Trust Broker Models for PKI
      9. Levels of Trust
    6. Security Domain Model
      1. Security Domains
      2. Inter-Domain Relationships
      3. Trust in Domains
      4. Secure Interaction Between Domains
      5. Security Associations
      6. Logical Domains
      7. Physical Domains
      8. Multi-Domain Environments
      9. Applying the Security Domain Concept
      10. New Security Paradigm for Digital Business
      11. VPN Concept
      12. Firewall Concept
    7. Security Lifetimes and Deadlines
      1. Registration Lifetimes
      2. Certification Lifetimes
      3. Cryptographic Key Lifetimes
      4. Policy Lifetimes
      5. Rule Lifetimes
      6. Password Lifetimes
      7. Token Lifetimes
      8. Message Time to Live
      9. Stored Data Lifetimes
      10. Data Secrecy Lifetimes
      11. User Session Lifetimes
      12. System Session Lifetimes
      13. Response Time-Out
      14. Inactivity Time-Outs
      15. Context-Based Access Control
      16. Replay Protection
      17. Trusted Time
      18. Time Stamps
      19. Time Performance Issues
      20. Case Study: Cryptographic Processing in an IBFS Application
      21. Disaster Recovery Time Targets
    8. Assessing the Current State of your Security Architecture
    9. To Summarise: Conceptual Security Architecture
      1. Figure 10-1
      2. Figure 10-2
      3. Figure 10-3
      4. Figure 10-4
      5. Figure 10-5
      6. Figure 10-6
      7. Figure 10-7
      8. Figure 10-8
      9. Figure 10-9
      10. Figure 10-10
      11. Figure 10-11
      12. Figure 10-12
      13. Figure 10-13
      14. Figure 10-14
      15. Figure 10-15
      16. Figure 10-16
      17. Figure 10-17
      18. Figure 10-18
      19. Figure 10-19
      20. Figure 10-20
      21. Figure 10-21
      22. Figure 10-22
      23. Figure 10-23
      24. Figure 10-24
      25. Figure 10-25
      1. Table 10-1
  18. Part 3: Design
    1. Design
    2. Logical Security Architecture
    3. Physical Security Architecture
    4. Component Security Architecture
  19. Chapter 11: Logical Security Architecture
    1. Business Information Model
      1. Information Architecture
      2. Static and Dynamic Information
      3. Business Transactions
    2. Security Policies
      1. The Meaning of Security Policy: A Theoretical View
      2. Security Policy Architecture
    3. Security Services
      1. Common Security Services and Their Descriptions
      2. Security Service Integration
      3. Entity Security Services
      4. Unique Naming
      5. Registration
      6. Public Key Certification
      7. Credentials Certification
      8. Directory Service
      9. Directory Service Information Model
      10. Directory Service Naming Model
      11. Directory Service Functional Model
      12. Directory Service Security Model
      13. Authorisation Services
      14. Entity Authentication
      15. User Authentication
      16. Device Authentication
      17. Communications Security Services
      18. Session Authentication
      19. Message Origin Authentication
      20. Message Integrity Protection
      21. Message Replay Protection
      22. Message Content Confidentiality
      23. Non-Repudiation
      24. Traffic Flow Confidentiality
    4. Application and System Security Services
      1. Authorisation
      2. Access Control
      3. Audit Trails
      4. Case Study: Premature Release of Prisoners
      5. Stored Data Integrity Protection
      6. Stored Data Confidentiality
      7. Software Integrity Protection
      8. Software Licensing Protection
      9. System Configuration Protection
      10. Data Replication and Backup
      11. Software Replication and Backup
      12. Trusted Time
      13. User Interface for Security
    5. Security Management Services
      1. Security Policy Management
      2. Security Training and Awareness
      3. Security Operations Management
      4. Security Provisioning
      5. Security Administration (Privilege Management)
      6. Security Monitoring
      7. Security Measurement and Metrics
      8. Security Alarm Management
      9. Intrusion Detection
      10. Incident Response
      11. User Support
      12. Disaster Recovery
      13. Crisis Management
      14. System Audit
      15. Physical Security
      16. Personnel Security
      17. Environmental Security
    6. Entity Schema and Privilege Profiles
      1. Entity Schemas
      2. Role Association
      3. Authorisation, Privilege Profiles and Credentials
      4. Certificates and Tickets
    7. Security Domain Definitions and Associations
      1. Network Domains
      2. Middleware Domains
      3. Application Domains
      4. Security Service Management Domains
      5. Policy Interactions Between Domains
    8. Security Processing Cycle
    9. Security Improvements Programme
    10. To Summarise: Logical Security Architecture
      1. Figure 11-1
      2. Figure 11-2
      3. Figure 11-3
      4. Figure 11-4
      5. Figure 11-5
      6. Figure 11-6
      7. Figure 11-7
      8. Figure 11-8
      9. Figure 11-9
      10. Figure 11-10
      11. Figure 11-11
      12. Figure 11-12
      13. Figure 11-13
      14. Figure 11-14
      15. Figure 11-15
      16. Figure 11-16
      17. Figure 11-17
      18. Figure 11-18
      1. Table 11-1
      2. Table 11-2
  20. Chapter 12: Physical Security Architecture
    1. Business Data Model
      1. File and Directory Access Control
      2. File Encryption
      3. Database Security
      4. Security Mechanisms in SQL Databases
      5. Distributed Databases
      6. Data Storage
    2. Security Rules, Practices and Procedures
      1. Security Rules
      2. Security Practices and Procedures
    3. Security Mechanisms
      1. Mapping Security Mechanisms to Security Services
      2. Cryptographic Mechanisms and Their Uses
      3. Encryption Mechanisms
      4. Data Integrity Mechanisms
      5. Public Key Certificates
      6. Digital Signature Mechanisms
      7. Authentication Exchange Mechanisms
      8. Cryptographic Key Management Mechanisms
      9. Cryptographic Services Physical Architecture
      10. Strength of Cryptographic Mechanisms
      11. Other Cryptographic Mechanisms
      12. The Future of Cryptographic Mechanisms
      13. Vulnerabilities in Security Mechanisms
      14. Vulnerability Case Study 1
      15. Vulnerability Case Study 2
    4. User and Application Security
      1. Directory Mechanisms
      2. Central Access Manager (CAM) Mechanisms
      3. Database Mechanisms
      4. File System Mechanisms
      5. Operating System Mechanisms
      6. Application Mechanisms
      7. User Authentication Mechanisms
      8. Password Management
    5. Platform and Network Infrastructure Security
      1. Resilience
      2. Performance and Capacity Planning
      3. Platform Security
      4. Hardware Security
      5. Network Topology
      6. Directory Topology
    6. Control Structure Execution
    7. To Summarise: Physical Security Architecture
      1. Figure 12-1
      2. Figure 12-2
      3. Figure 12-3
      4. Figure 12-4
      5. Figure 12-5
      6. Figure 12-6
      7. Figure 12-7
      8. Figure 12-8
      9. Figure 12-9
      10. Figure 12-10
      11. Figure 12-11
      12. Figure 12-12
      13. Figure 12-13
      14. Figure 12-14
      1. Table 12-1
      2. Table 12-2
  21. Chapter 13: Component Security Architecture
    1. Detailed Data Structures
      1. Inter-Operability
      2. Abstract Syntax Notation (ASN.1)
      3. Extensible Markup Language (XML)
      4. Relationship between ASN.1 and XML
      5. Standard Security Data Structures
    2. Security Standards
      1. International Organisation for Standards (ISO)
      2. International Electrotechnical Commission (IEC)
      3. Internet Engineering Task Force (IETF)
      4. Common Criteria
      5. American National Standards Institute (ANSI)
      6. British Standards Institute (BSI)
      7. International Telecommunication Union (ITU)
      8. Institute of Electrical and Electronics Engineers (IEEE)
      9. Information Systems Audit and Control Association (ISACA)
      10. Object Management Group (OMG)
      11. Organisation for Advancement of Structured Information Standards (OASIS)
      12. The World Wide Web Consortium (W3C)
      13. Organisation for Economic Co-operation and Development (OECD)
      14. US Federal Government
      15. Standards Australia (SAA) and Standards New Zealand (SNZ)
      16. Japanese Industrial Standards Committee (JISC)
      17. European Computer Manufacturers Association (ECMA)
      18. European Telecommunications Standards Institute (ETSI)
      19. European Forum for Electronic Business (EEMA)
      20. Wi-Fi Alliance
      21. Trusted Computing Group (TCG)
      22. International Security Forum (ISF)
      23. Vendor Standards
      24. Internal Security Standards
    3. Security Products and Tools
    4. Identities, Functions, Actions and ACLs
      1. Web Services
      2. XML Schema
      3. Simple Object Access Protocol (SOAP)
      4. Web Services Security and Trust
      5. XML Encryption
      6. XML Signature
      7. SOAP Extensions: Digital Signature
      8. XML Key Management
      9. Security Service Markup Language (S2ML)
      10. Security Assertion Markup Language (SAML)
      11. Web Services Security Language (WS-Security)
      12. eXtensible Access Control Markup Language (XACML)
      13. eXtensible Business Reporting Language (XBRL)
      14. XML Benefits
      15. XML Security Architecture Issues
      16. XML Firewalls
      17. Non-Web Applications
    5. Processes, Nodes, Addresses and Protocols
      1. Protocol Stack
      2. Hypertext Transfer Protocol (HTTP)
      3. Secure HTTP (S-HTTP)
      4. HTTPS
      5. SSL and TLS
      6. IPSec
      7. DNSSec
      8. SASL
    6. Security Step-Timing and Sequencing
    7. To Summarise: Component Security Architecture
      1. Figure 13-1
      2. Figure 13-2
      3. Figure 13-3
      4. Figure 13-4
      5. Figure 13-5
      1. Table 13-1
  22. Part 4: Operations
    1. Operations
    2. Operational Security Architecture
    3. Style of Part 4
  23. Chapter 14: Security Policy Management
    1. The Meaning of Security Policy
      1. A Theoretical View
      2. A Cultural View
    2. Structuring the Content of a Security Policy
    3. Policy Hierarchy and Architecture
      1. Example: Data Backup Policy
    4. Corporate Security Policy
    5. Policy Principles
      1. More About the Least-Privilege Principle
      2. Case Study: The 9/11 Commission Report
    6. Information Classification
    7. System Classification
    8. CA and RA Security Policies
      1. Certificate Policy (CP)
      2. Certificate Practices Statement (CPS)
      3. Relationship between a CP and a CPS
    9. Application System Security Policies
    10. Platform Security Policies
    11. Network Security Policies
    12. Other Infrastructure Security Policies
    13. Security Organisation and Responsibilities
    14. Security Culture Development
    15. Outsourcing Strategy and Policy Management
      1. Example of Separate Ownership of Service and Data
    16. To Summarise:
      1. Figure 14-1
      2. Figure 14-2
      3. Figure 14-3
      4. Figure 14-4
      5. Figure 14-5
      6. Figure 14-6
  24. Chapter 15: Operational Risk Management
    1. Introduction to Operational Risk Management
    2. Regulatory Drivers for Operational Risk Management
      1. Corporate Governance
      2. Sarbanes-Oxley (USA)
      3. Patriot Act (USA)
      4. Basel II (Banking Industry)
      5. Gramm-Leach-Bliley Act (USA)
      6. HIPAA (USA)
      7. CAD3 (EU)
      8. Combined Code, Turnbull, Smith and Higgs (UK)
      9. Integrated Prudential Sourcebook (UK)
      10. 21 CFR Part 11 (Pharmaceuticals Industry, USA)
      11. FAA, CAA and Others (Civil Aviation Industry)
      12. Data Protection Legislation (EU)
    3. The Complexity of Operational Risk Management
      1. A Case Study: The Banking Industry
      2. Case Study: Operational Risk Management in the Banking Industry
      3. Variations in Mathematical Complexity
      4. Statistical Modelling
      5. Limits of Statistical Models
      6. Complex Interactions between Risk Silos
    4. Approaches to Risk Assessment
      1. Quantitative Methods
      2. Case Study: The Cost of Computer Virus Control
      3. Qualitative Methods
      4. Assessing Criticality – Business Impact
      5. Assessing Likelihood – Probability
    5. Managing Operational Risk
      1. Risk Management Strategies
      2. Risk Management and Corporate Governance
      3. Enterprise Risk Management Framework
      4. Risk Management Standards
      5. The Risk Register
      6. Benefits of Good Risk Management
    6. Risk Mitigation
      1. Types of Control
      2. Levels of Control
    7. Risk-Based Security Reviews
      1. Case Study: The Brief
      2. Case Study Step 1: Develop the Business Attributes Profile
      3. Case Study Step 2: Map the Business Processes
      4. Case Study Step 3: Analyse the Business Processes
      5. Case Study Step 4: Associate the Business Attributes
      6. Case Study Step 5: Describe the Business Impacts
      7. Case Study Step 6: Assess Current Vulnerabilities
      8. Case Study Step 7: Assess Overall Risk Rating
      9. Case Study Step 8: Map Risk-High Ratings to Business Attributes Profile
      10. Case Study Step 9: Map Proportional-Risk Ratings to Business Attributes Profile
      11. Case Study Step 10: Risk Mitigation
      12. Case Study Step 11: Map Mitigated Risks to Business Attributes Profile
    8. Risk Financing
      1. Risk Acceptance
      2. Risk Transfer: The Concept of Insurance
      3. Types of Insurance
      4. Self-Insurance
      5. Problems with Insurance
    9. The Risk Management Dashboard
      1. Monitoring and Reporting Key Risk Indicators
      2. Risk Reporting using XBRL
    10. To Summarise:
      1. Figure 15-1
      2. Figure 15-2
      3. Figure 15-3
      4. Figure 15-4
      5. Figure 15-5
      6. Figure 15-6
      7. Figure 15-7
      8. Figure 15-8
      9. Figure 15-9
      10. Figure 15-10
      11. Figure 15-11
      12. Figure 15-12
      13. Figure 15-13
      14. Figure 15-14
      15. Figure 15-15
      16. Figure 15-16
      17. Figure 15-17
      18. Figure 15-18
      1. Table 15-1
      2. Table 15-2
      3. Table 15-3
      4. Table 15-4
      5. Table 15-5
  25. Chapter 16: Assurance Management
    1. Assurance of Operational Continuity
    2. Organisational Security Audits
      1. The Audit Programme
      2. CobiT<span xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" class="cSuperscript">&#174;</span> as an Audit Framework as an Audit Framework
      3. ISO/IEC 17799:2000 and BS7799-2:2002 as an Audit Framework
      4. Qualified Auditor Status
    3. System Security Audits
      1. Security Auditing
      2. Standards for Security Auditing
      3. Case Study: The Network Engineers
    4. System Assurance Strategy
      1. Development Controls
      2. Production Controls
      3. Software Integrity and Anti-Virus Strategy
      4. Acceptable Use
    5. Functional Testing
      1. Principles of Functional Testing
      2. Testing Strategy
      3. Unit Testing (or Module Testing)
      4. Integration Testing
      5. System Validation Testing
      6. User Acceptance Testing (UAT)
      7. Operational Acceptance Testing (OAT)
      8. Software Quality Assurance
    6. Penetration Testing
      1. Case Study: Penetration Testing of a Web Casino
    7. To Summarise:
      1. Figure 16-1
      2. Figure 16-2
      3. Figure 16-3
  26. Chapter 17: Security Administration and Operations
    1. Introduction to Security Management and Administration
      1. The Operational Prevention Process
      2. The International Standard: ISO/IEC 17799:2000
    2. Managing the People
      1. Security Responsibilities
      2. Personnel Management
      3. Segregating Duties
      4. Enforced Annual Leave
    3. Managing Physical and Environmental Security
    4. Managing ICT Operations and Support
      1. Operating Procedures
      2. Change Control
      3. Change Management
      4. Incident Handling
      5. Segregating System Development from Operational Production
      6. Capacity Planning
      7. Case Study: Not Counting on the Capacity of Census Interest
      8. System Acceptance and Release Management
      9. Protecting Against Malicious Software
      10. Data Backup and Recovery
      11. Case Study: The Phantom Backups
      12. Case Study: Time Travelling
      13. Operational Logging
      14. Media Handling
      15. Case Study: Banking on the Backups
      16. Network Operations
      17. Software Licence Management
      18. Information Exchange
      19. Outsourcing Contractor Management: Ancillary Services
      20. Outsourcing Contractor Management: ICT Operations
      21. Asset and Configuration Management
      22. Service Level Agreement (SLA) Management
      23. Business Relationship Management
      24. Operations Staff Training and Awareness Development
      25. Service Monitoring and Reporting
      26. Event Log and Audit Trail Management
      27. Forensic Investigations
      28. Problem Tracking and Management
      29. Help Desk and User Support
      30. Provisioning
      31. Financial Management
    5. Access Control Management
      1. Access Control Policy
      2. User Access Management
      3. Case Study: Default Accounts Give Default Access
      4. Managing System-Level Privileges
      5. Password Management
      6. Third-Party Access Management
    6. Compliance Management
      1. Compliance in the Realm of Information Security Management
      2. Cryptographic Regulations
    7. Security-Specific Operations
      1. Security Service Management
      2. Security Mechanism Management
      3. Security Component Management
      4. User Management
    8. Managed Security Services
    9. Product Evaluation and Selection
      1. Case Study: Vendor Selection for a Secure Banking System
    10. Business Continuity Management
      1. Business Process Based Approach to BCM
      2. Step 1: Business Process Impact Assessment
      3. Step 2: Functional Analysis of Business Processes
      4. Step 3: Resource Analysis of Functions
      5. Step 4: Threat Scenario Synthesis
      6. Step 5: Resilience Analysis
      7. Step 6: Business Continuity Planning
      8. Step 7: Risk Financing for Cost of Recovery
      9. Checklist of BCM Activities
    11. To Summarise:
      1. Figure 17-1
      2. Figure 17-2
      3. Figure 17-3
      4. Figure 17-4
      5. Figure 17-5
      6. Figure 17-6
  27. Appendix A: List of Acronyms