IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002

Faced with the compliance requirements of increasingly punitive information and privacy-related regulation, as well as the proliferation of complex threats to information security, there is an urgent need for organizations to adopt IT governance best practice. Alan Calder is responsible for security development lifecycle threat modeling at Microsoft and is one of a handful of threat modeling experts in the world. Now, he is sharing his considerable expertise into this unique book. With pages of specific actionable advice, he details how to build better security into the design of systems, software, or services from the outset. You'll explore various threat modeling approaches, find out how to test your designs against threats, and learn effective ways to address threats that have been validated at Microsoft and other top companies. Systems security managers, you'll find tools and a framework for structured thinking about what can go wrong. Software developers, you'll appreciate the jargon-free and accessible introduction to this essential skill. Security professionals, you'll learn to discern changing threats and discover the easiest ways to adopt a structured approach to threat modeling.

Book contents:

Why is Information Security Necessary?
The Corporate Governance Code, the FRC Risk Guidance and Sarbanes-Oxley
ISO 27001
Organizing Information Security
Information Security Policy and Scope
The Risk Assessment and Statement of Applicability
Mobile Devices
Human Resources Security
Asset Management
Media Handling
Access Control
Use Access Management
System and Application Access Control
Communications Management
Exchanges of Information
System Acquisition, Development and maintenance
Development and Support Processes
Supplier Relationships
Monitoring and Information Security Incident Management
Business and Information Security Continuity Management
Compliance
The ISO 27001 Audit

Have you already read the book "IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002"?

Please let others know what you think about it by publishing a book review.

Books that could interest you:

Effective Physical Security, Fifth Edition is a best-practices compendium that details the essential elements and latest developments in physical security protection. This new edition is completely updated, with new chapters carefully selected from the author's work that set the standard. This book contains important coverage of environmental design, security surveys, locks, lighting, and CCTV, the latest ISO standards for risk assessment and risk management, physical security planning, network systems infrastructure, and environmental design.

Professional Security Management: A Strategic Guide is a guide to meeting those challenges, providing the security manager with the essential skill set and knowledge base to meet the challenges faced in contemporary, international, or tech-oriented businesses. It covers the basics of strategy, risk, and technology from the perspective of the security manager, focussing only on the 'need to know'. The reader will benefit from an understanding of how risk management aligns its functional aims with the strategic goals and operations of the organisation.

Cybersecurity Essentials provides a comprehensive introduction to the field, with expert coverage of essential topics required for entry-level cybersecurity certifications. An effective defense consists of four distinct challenges: securing the infrastructure, securing devices, securing local networks, and securing the perimeter.

Courses that could interest you:

Level 4 Award in Foundations of Security and Risk Management is designed for Team Leaders and Operational managers, who want to have a better understanding of how to do their job in well-structured and professional manner, and also get a first professional qualification. As well as open courses, this programme can be run as an in-house programme for organisations that have scattered operation, and would like to develop a level of excellence in their front-line security management that is equal to any other aspect of their organisational management processes.

Introduction to Cyber Security is the fastest way to get up to speed in information security. Written and taught by battle-scarred security veterans, this entry-level course covers a broad spectrum of security topics and is liberally sprinkled with real life examples. A balanced mix of technical and managerial issues makes this course appealing to attendees who need to understand the salient facets of information security basics and the basics of risk management. Organizations often tap someone who has no information security training and say, "Congratulations, you are now a security officer." If you need to get up to speed fast, Security 301 rocks!

Certificate in Terrorism Studies is 100% online and it aims to provide knowledge that is so essential to understanding and ultimately responding to terrorism and political violence. Discover how and why terrorists plot against civilians, governments, corporations, commercial operations, transport or IT networks and get ready to make an unmistakable difference to an organisation’s security strategies.

Tip! You may be able to find a set of different books and courses in order to build up your own professional development programme. Try, it's easy.

It would be great if you could contribute to the development of this website, this could help other security professionals!

Why is Information Security Necessary?

The Corporate Governance Code, the FRC Risk Guidance and Sarbanes-Oxley

ISO 27001

Organizing Information Security

Information Security Policy and Scope

The Risk Assessment and Statement of Applicability

Mobile Devices

Human Resources Security

Asset Management

Media Handling

Access Control

Use Access Management

System and Application Access Control

Communications Management

Exchanges of Information

System Acquisition, Development and maintenance

Development and Support Processes

Supplier Relationships

Monitoring and Information Security Incident Management

Business and Information Security Continuity Management

Compliance

The ISO 27001 Audit