Managing Risk in Information Systems


Book Description

This second edition provides a comprehensive overview of the SSCP Risk, Response, and Recovery Domain in addition to providing a thorough overview of risk management and its implications on IT infrastructures and compliance. Written by industry experts, and using a wealth of examples and exercises, this book incorporates hands-on activities to walk the reader through the fundamentals of risk management, strategies and approaches for mitigating risk, and the anatomy of how to create a plan that reduces risk. It provides a modern and comprehensive view of information security policies and frameworks; examines the technical knowledge and software skills required for policy implementation; explores the creation of an effective IT security policy framework; discusses the latest governance, regulatory mandates, business drives, legal considerations, and much more. --




The Complete Guide to Business Risk Management


Book Description

Risk management and contingency planning has really come to the fore since the first edition of this book was originally published. Computer failure, fire, fraud, robbery, accident, environmental damage, new regulations - business is constantly under threat. But how do you determine which are the most important dangers for your business? What can you do to lessen the chances of their happening - and minimize the impact if they do happen? In this comprehensive volume Kit Sadgrove shows how you can identify - and control - the relevant threats and ensure that your company will survive. He begins by asking 'What is risk?', 'How do we assess it?' and 'How can it be managed?' He goes on to examine in detail the key danger areas including finance, product quality, health and safety, security and the environment. With case studies, self-assessment exercises and checklists, each chapter looks systematically at what is involved and enables you to draw up action plans that could, for example, provide a defence in law or reduce your insurance premium. The new edition reflects the changes in the global environment, the new risks that have emerged and the effect of macroeconomic factors on business profitability and success. The author has also included a set of case studies to illustrate his ideas in practice.




Security Risk Management


Book Description

Security Risk Management is the definitive guide for building or running an information security risk management program. This book teaches practical techniques that will be used on a daily basis, while also explaining the fundamentals so students understand the rationale behind these practices. It explains how to perform risk assessments for new IT projects, how to efficiently manage daily risk activities, and how to qualify the current risk level for presentation to executive level management. While other books focus entirely on risk analysis methods, this is the first comprehensive text for managing security risks. This book will help you to break free from the so-called best practices argument by articulating risk exposures in business terms. It includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment. It explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk. It also presents a roadmap for designing and implementing a security risk management program. This book will be a valuable resource for CISOs, security managers, IT managers, security consultants, IT auditors, security analysts, and students enrolled in information security/assurance college programs. - Named a 2011 Best Governance and ISMS Book by InfoSec Reviews - Includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment - Explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk - Presents a roadmap for designing and implementing a security risk management program




A Risk Professionals Survival Guide


Book Description

Balanced, practical risk management for post – financial crisis institutions A Risk Professional's Survival Guide fills a critical gap left by existing risk management texts. Instead of focusing only on quantitative risk analysis or only on institutional risk management, this book takes a comprehensive approach. The disasters of the recent financial crisis taught us that managing risk is both an art and a science, and it is critical for practitioners to understand how individual risks are integrated at the enterprise level. This book is the only resource of its kind to introduce all of the key risk management concepts in a cohesive case study spanning each chapter. A hypothetical bank drawn from elements of several real world institutions serves as a backdrop for topics from credit risk and operational risk to understanding big-picture risk exposure. You will be able to see exactly how each rigorous concept is applied in actual risk management contexts. This book includes: Supplemental Excel-based Visual Basic (VBA) modules, so you can interact directly with risk models Clear explanations of the importance of risk management in preventing financial disasters Real world examples and lessons learned from past crises Risk policies, infrastructure, and activities that balance limited quantitative models This book provides the element of hands-on application necessary to put enterprise risk management into effective practice. The very best risk managers rely on a balanced approach that leverages every aspect of financial operations for an integrative risk management strategy. With this book, you can identify and control risk at an expert level.




Measuring and Managing Information Risk


Book Description

Using the factor analysis of information risk (FAIR) methodology developed over ten years and adopted by corporations worldwide, Measuring and Managing Information Risk provides a proven and credible framework for understanding, measuring, and analyzing information risk of any size or complexity. Intended for organizations that need to either build a risk management program from the ground up or strengthen an existing one, this book provides a unique and fresh perspective on how to do a basic quantitative risk analysis. Covering such key areas as risk theory, risk calculation, scenario modeling, and communicating risk within the organization, Measuring and Managing Information Risk helps managers make better business decisions by understanding their organizational risk. - Uses factor analysis of information risk (FAIR) as a methodology for measuring and managing risk in any organization. - Carefully balances theory with practical applicability and relevant stories of successful implementation. - Includes examples from a wide variety of businesses and situations presented in an accessible writing style.




Risk Management for Project Driven Organizations


Book Description

Organizations invest a lot of time, money, and energy into developing and utilizing risk management practices as part of their project management disciplines. Yet, when you move beyond the project to the program, portfolio, PMO and even organizational level, that same level of risk command and control rarely exists. With this in mind, well-known subject matter expert and author Andy Jordan starts where most leave off. He explores risk management in detail at the portfolio, program, and PMO levels. Using an engaging and easy-to-read writing style, Mr. Jordan takes readers from concepts to a process model, and then to the application of that customizable model in the user’s unique environment, helping dramatically improve their risk command and control at the organizational level. He also provides a detailed discussion of some of the challenges involved in this process. Risk Management for Project Driven Organizations is designed to aid strategic C-level decision makers and those involved in the project, program, portfolio, and PMO levels of an organization. J. Ross Publishing offers an add-on for a nominal fee -- Downloadable tools and templates for easy customization and implementation.




The Risk Management Handbook


Book Description

The Risk Management Handbook offers readers knowledge of current best practice and cutting-edge insights into new developments within risk management. Risk management is dynamic, with new risks continually being identified and risk techniques being adapted to new challenges. Drawing together leading voices from the major risk management application areas, such as political, supply chain, cybersecurity, ESG and climate change risk, this edited collection showcases best practice in each discipline and provides a comprehensive survey of the field as a whole. This second edition has been updated throughout to reflect the latest developments in the industry. It incorporates content on updated and new standards such as ISO 31000, MOR and ISO 14000. It also offers brand new chapters on ESG risk management, legal risk management, cyber risk management, climate change risk management and financial risk management. Whether you are a risk professional wanting to stay abreast of your field, a student seeking a broad and up-to-date introduction to risk, or a business leader wanting to get to grips with the risks that face your business, this book will provide expert guidance.




The Complete Guide for CISA Examination Preparation


Book Description

The Complete Guide for CISA Examination Preparation delivers complete coverage of every topic on the latest release of the Certified Information Systems Auditor (CISA) exam. The author is an IT security and auditing expert and the book covers all five exam domains. This effective self-study system features chapter learning objectives, in-depth explanations of each topic, and accurate practice questions. Each chapter includes exam tips that highlight key exam information, hands-on exercises, a summary that serves as a quick review, and end-of-chapter questions that simulate those on the actual exam. Designed to help candidates pass the CISA exam easily, it also serves as an ideal on-the-job reference. Richard E. Cascarino, MBA, CIA, CISM, CFE, CRMA, is well known in international auditing. Richard is a principal of Richard Cascarino & Associates. He has over 31 years’ experience in audit training and consulting. He is a regular speaker at national and international conferences and has presented courses throughout Africa, Europe, the Middle East and the USA. Richard is a Past President of the Institute of Internal Auditors in South Africa, was the founding Regional Director of the Southern African Region of the IIA-Inc. and is a member of ISACA, and the Association of Certified Fraud Examiners, where he is a member of the Board of Regents for Higher Education. Richard was Chairman of the Audit Committee of Gauteng cluster 2 (Premier's office, Shared Services and Health) in Johannesburg and is currently the Chairman of the Audit and Risk Committee of the Department of Public Enterprises in South Africa. Richard is also a visiting Lecturer at the University of the Witwatersrand, author of the book Internal Auditing: An Integrated Approach, now in its third edition. This book is extensively used as a university textbook worldwide. In addition, he is the author of the Auditor's Guide to IT Auditing, Second Edition and the book Corporate Fraud and Internal Control: A Framework for Prevention. He is also a contributor to all four editions of QFINANCE, the Ultimate Resource.




The Digital Practitioner Foundation Study Guide


Book Description

This is the Digital Practitioner Foundation Study Guide for the DPBoK Part 1 Examination. It gives an overview of every learning objective included in the Digital Practitioner Foundation syllabus, and provides in-depth coverage on preparing and taking the DPBoK Part 1 Examination. It is specifically designed to help individuals prepare for certification. This Study Guide is excellent material for: • Senior digital business professionals who need an increased awareness of digital practices • Mid-career IT professionals who need to stay relevant and validate their digital Subject Matter Expert (SME) status in specific domain areas • Entry-level computing and digital business professionals • College-level students and computing and digital business majors It covers the following topics: • An introduction to DPBoK Foundation certification, including the DPBoK Part 1 Examination • Key terminology, key concepts, and the structure of the Body of Knowledge • Basic concepts employed by the Digital Practitioner • The capabilities of digital infrastructure and initial concerns for its effective, efficient, and secure operation • The objectives and activities of application development • Why product management is formalized as a company or team grows, and the differences between product and project management • The key concerns and practices of work management as a team increases in size • The basic concepts and practices of operations management in a digital/IT context • How to coordinate as the organization grows into multiple teams and multiple products • IT investment and portfolio management • Organizational structure, human resources, and cultural factors • Governance, risk, security, and compliance • Information and data management on a large scale • Practices and methods for managing complexity using Enterprise Architecture




Proceedings on 18th International Conference on Industrial Systems – IS’20


Book Description

This book proposes theoretically developed and practically tested solutions for manufacturing and business improvements achieved in the period between two conferences. It enables presentation of new knowledge and exchange of practical experience in industrial systems engineering and management. It brings together prominent researchers and practitioners from faculties, scientific institutes, and different enterprises or other organizations .This is the 18th edition of the conference. The Department of Industrial Engineering and Management at the Faculty of Technical Sciences in Novi Sad organizes a scientific conference on industrial systems engineering and management field of science and practice, once in three years.