Building an Effective Security Program () von Chris Williams

FOREWORD – 1 page

ABOUT THE AUTHORS – 1 page

ACKNOWLEDGMENTS – 1 page

INTRODUCTION – 2 pages

• What is this book about?
• Who should read this book?
• Why did the authors write this book?
• Organization of the book

CHAPTERS

• Chapter 1—Business Case (~15 pages)

This chapter presents the business case for setting up an enduring IT security awareness and training program for use in training the employees of the company—from IT users to career IT security professionals. This chapter introduces fundamental concepts and terms used throughout the book.

• Chapter 2—IT Security Mind Set (~15 pages)

This chapter presents thinking like an IT security professional to establish and maintain common security protections.

• Chapter 3—IT Security Risk Management (~15 pages)

This chapter presents a risk management process that involves asset management, security vulnerabilities, security threats, risk identification, risk mitigation, and security controls.

• Chapter 4—IT Security Process (~15 pages)

This chapter presents how to establish security scopes and select corresponding controls to protect the confidentiality, availability, and integrity of company information.

• Chapter 5—IT Security Scenarios and Perspectives (~40 pages)

This chapter presents how the Chapter 4 IT security process is applied to various scenarios. Each scenario will walk through a number of common security controls and apply the IT security process to identify how to protect company information.

1. IT security at home
2. IT security while traveling
3. IT security at work
4. IT security as an executive
5. International IT security

• Chapter 6—Planning IT Security Awareness and Training (~15 pages)

This chapter presents practical guidance on how to write an IT Awareness and Training implementation plan.

• Chapter 7—Implementing IT Security Awareness and Training Program(~15 pages)

This chapter presents human issues related to bringing about enterprise-wide cultural change due to implementation of an IT Awareness and Training Program.

• Chapter 8—Measuring IT Security Awareness and Training Program Implementation (~15 pages)

This chapter presents practical guidance for measuring program implementation success and how to use the measurements to achieve awareness and training goals.

• Chapter 9—Managing Continual Program Improvement (~15 pages)

This chapter presents practical guidance for monitoring compliance, evaluating feedback and improving the program.

• Chapter 10—Looking to the Future (~15 pages)

This chapter presents a view of the evolving cybersecurity attacks as they become more capable and sophisticated.

APPENDICES – 10 pages

GLOSSARY – 3 pages

BIBLIOGRAPHY – 3 pages

INDEX – 4 pages

Building an Effective Security Program provides readers with a comprehensive approach to securing the IT systems in use at their organizations. This book provides information on how to structure and operate an effective cybersecurity program that includes people, processes, technologies, security awareness, and training. This program will establish and maintain effective security protections for the confidentiality, availability, and integrity of organization information. In this book, the authors take a pragmatic approach to building organization cyberdefenses that are effective while also remaining affordable.

This book is intended for business leaders, IT professionals, cybersecurity personnel, educators, and students interested in deploying real-world cyberdefenses against today’s persistent and sometimes devastating cyberattacks. It includes detailed explanation of the following IT security topics:

• IT Security Mindset—Think like an IT security professional, and consider how your IT environment can be defended against potential cyberattacks.
• Risk Management—Identify the assets, vulnerabilities and threats that drive IT risk, along with the controls that can be used to mitigate such risk.
• Effective Cyberdefense—Consider the components of an effective organization cyberdefense to successfully protect computers, devices, networks, accounts, applications and data.
• Cyber Operations—Operate cyberdefense capabilities and controls so that assets are protected, and intruders can be detected and repelled before significant damage can be done.
• IT Security Awareness and Training—Promote effective cybersecurity practices at work, on travel, and at home, among your organization’s business leaders, IT professionals, and staff.
• Resilient IT Security—Implement, operate, monitor, assess, and improve your cybersecurity program on an ongoing basis to defend against the cyber threats of today and the future.