Information Security

By Ross, Ron

Description
Technical Reference Publication

Excerpt
Excerpt: The Need For Security Controls To Protect Information Systems. The selection and employment of appropriate security controls for an information system is an important task that can have major implications on the operations and assets of an organization. Security controls are the management, operational, and technical safeguards or countermeasures prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. There are several important questions that should be answered by organizational officials when addressing the security considerations for their information systems...

Table of Contents
Table of Contents ERRATA.............................................................................................................................................V CHAPTER ONE INTRODUCTION............................................................................................1 1.1 PURPOSE AND APPLICABILITY..................................................................................................2 1.2 TARGET AUDIENCE..................................................................................................................3 1.3 RELATIONSHIP TO OTHER SECURITY CONTROL PUBLICATIONS....................................................3 1.4 ORGANIZATIONAL RESPONSIBILITIES........................................................................................4 1.5 ORGANIZATION OF THIS SPECIAL PUBLICATION..........................................................................5 CHAPTER TWO THE FUNDAMENTALS...................................................................................6 2.1 SECURITY CONTROL ORGANIZATION AND STRUCTURE...............................................................6 2.2 COMMON SECURITY CONTROLS...............................................................................................8 2.3 SECURITY CONTROL BASELINES...............................................................................................9 2.4 SECURITY CONTROL ASSURANCE...........................................................................................10 2.5 REVISIONS AND EXTENSIONS.................................................................................................11 CHAPTER THREE THE PROCESS........................................................................................12 3.1 MANAGING ORGANIZATIONAL RISK.........................................................................................12 3.2 SECURITY CATEGORIZATION AND BASELINE SELECTION...........................................................13 3.3 TAILORING THE INITIAL BASELINE...........................................................................................14 3.4 SUPPLEMENTING THE INITIAL BASELINE..................................................................................17 APPENDIX A REFERENCES................................................................................................18 APPENDIX B GLOSSARY....................................................................................................21 APPENDIX C ACRONYMS...................................................................................................30 APPENDIX D MINIMUM SECURITY CONTROLS ? SUMMARY...................................................31 APPENDIX E MINIMUM ASSURANCE REQUIREMENTS...........................................................37 APPENDIX F SECURITY CONTROL CATALOG.......................................................................39 APPENDIX G SECURITY CONTROL MAPPINGS...................................................................105 PAGE vi