Security Risk Management Body of Knowledge


Book Description

A framework for formalizing risk management thinking in today¿s complex business environment Security Risk Management Body of Knowledge details the security risk management process in a format that can easily be applied by executive managers and security risk management practitioners. Integrating knowledge, competencies, methodologies, and applications, it demonstrates how to document and incorporate best-practice concepts from a range of complementary disciplines. Developed to align with International Standards for Risk Management such as ISO 31000 it enables professionals to apply security risk management (SRM) principles to specific areas of practice. Guidelines are provided for: Access Management; Business Continuity and Resilience; Command, Control, and Communications; Consequence Management and Business Continuity Management; Counter-Terrorism; Crime Prevention through Environmental Design; Crisis Management; Environmental Security; Events and Mass Gatherings; Executive Protection; Explosives and Bomb Threats; Home-Based Work; Human Rights and Security; Implementing Security Risk Management; Intellectual Property Protection; Intelligence Approach to SRM; Investigations and Root Cause Analysis; Maritime Security and Piracy; Mass Transport Security; Organizational Structure; Pandemics; Personal Protective Practices; Psych-ology of Security; Red Teaming and Scenario Modeling; Resilience and Critical Infrastructure Protection; Asset-, Function-, Project-, and Enterprise-Based Security Risk Assessment; Security Specifications and Postures; Security Training; Supply Chain Security; Transnational Security; and Travel Security.




Risk and Security Management


Book Description

Learn to measure risk and develop a plan to protect employees and company interests by applying the advice and tools in Risk and Security Management: Protecting People and Sites Worldwide. In a world concerned with global terrorism, instability of emerging markets, and hazardous commercial operations, this book shines as a relevant and timely text with a plan you can easily apply to your organization. Find a series of strategic to granular level policies, systems, and concepts which identify and address risk, enabling business to occur in a manner which best protects you and your company.




A Practical Introduction to Security and Risk Management


Book Description

This is the first book to introduce the full spectrum of security and risks and their management. Author and field expert Bruce Newsome helps readers learn how to understand, analyze, assess, control, and generally manage security and risks from the personal to the operational. They will develop the practical knowledge and skills they need, including analytical skills, basic mathematical methods for calculating risk in different ways, and more artistic skills in making judgments and decisions about which risks to control and how to control them. Organized into 16 brief chapters, the book shows readers how to: analyze security and risk; identify the sources of risk (including hazards, threats, and contributors); analyze exposure and vulnerability; assess uncertainty and probability; develop an organization’s culture, structure, and processes congruent with better security and risk management; choose different strategies for managing risks; communicate and review; and manage security in the key domains of operations, logistics, physical sites, information, communications, cyberspace, transport, and personal levels.




Security Risk Management Aide-Mémoire


Book Description

"All models are wrong. Some are useful." - George BoxThe Security Risk Management Aide-Mémoire is a book full of models and tools to help security professionals to brief clients, conduct security risk assessments, facilitate workshops, draft reports, and more. Much of it is from the Security Risk Management Body of Knowledge with some new material reflecting updates such as ISO31000:2018 Risk Management Standard.The book addresses all domains of security risk management but assumes you are already familiar with the contents and the specifics of your profession. The tools and models are complementary. Pick the ones that work best for you and ignore the rest or keep them in your back pocket for another day. You can read selected chapters and download the graphics and models for free from www.srmam.com




Security Risk Management


Book Description

Security Risk Management is the definitive guide for building or running an information security risk management program. This book teaches practical techniques that will be used on a daily basis, while also explaining the fundamentals so students understand the rationale behind these practices. It explains how to perform risk assessments for new IT projects, how to efficiently manage daily risk activities, and how to qualify the current risk level for presentation to executive level management. While other books focus entirely on risk analysis methods, this is the first comprehensive text for managing security risks. This book will help you to break free from the so-called best practices argument by articulating risk exposures in business terms. It includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment. It explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk. It also presents a roadmap for designing and implementing a security risk management program. This book will be a valuable resource for CISOs, security managers, IT managers, security consultants, IT auditors, security analysts, and students enrolled in information security/assurance college programs. Named a 2011 Best Governance and ISMS Book by InfoSec Reviews Includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment Explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk Presents a roadmap for designing and implementing a security risk management program




Security Science


Book Description

Security Science integrates the multi-disciplined practice areas of security into a single structured body of knowledge, where each chapter takes an evidence-based approach to one of the core knowledge categories. The authors give practitioners and students the underlying scientific perspective based on robust underlying theories, principles, models or frameworks. Demonstrating the relationships and underlying concepts, they present an approach to each core security function within the context of both organizational security and homeland security. The book is unique in its application of the scientific method to the increasingly challenging tasks of preventing crime and foiling terrorist attacks. Incorporating the latest security theories and principles, it considers security from both a national and corporate perspective, applied at a strategic and tactical level. It provides a rational basis for complex decisions and begins the process of defining the emerging discipline of security science. A fresh and provocative approach to the key facets of security Presentation of theories and models for a reasoned approach to decision making Strategic and tactical support for corporate leaders handling security challenges Methodologies for protecting national assets in government and private sectors Exploration of security’s emerging body of knowledge across domains




Bow Ties in Risk Management


Book Description

AN AUTHORITATIVE GUIDE THAT EXPLAINS THE EFFECTIVENESS AND IMPLEMENTATION OF BOW TIE ANALYSIS, A QUALITATIVE RISK ASSESSMENT AND BARRIER MANAGEMENT METHODOLOGY From a collaborative effort of the Center for Chemical Process Safety (CCPS) and the Energy Institute (EI) comes an invaluable book that puts the focus on a specific qualitative risk management methodology – bow tie barrier analysis. The book contains practical advice for conducting an effective bow tie analysis and offers guidance for creating bow tie diagrams for process safety and risk management. Bow Ties in Risk Management clearly shows how bow tie analysis and diagrams fit into an overall process safety and risk management framework. Implementing the methods outlined in this book will improve the quality of bow tie analysis and bow tie diagrams across an organization and the industry. This important guide: Explains the proven concept of bow tie barrier analysis for the preventing and mitigation of incident pathways, especially related to major accidents Shows how to avoid common pitfalls and is filled with real-world examples Explains the practical application of the bow tie method throughout an organization Reveals how to treat human and organizational factors in a sound and practical manner Includes additional material available online Although this book is written primarily for anyone involved with or responsible for managing process safety risks, this book is applicable to anyone using bow tie risk management practices in other safety and environmental or Enterprise Risk Management applications. It is designed for a wide audience, from beginners with little to no background in barrier management, to experienced professionals who may already be familiar with bow ties, their elements, the methodology, and their relation to risk management. The missions of both the CCPS and EI include developing and disseminating knowledge, skills, and good practices to protect people, property and the environment by bringing the best knowledge and practices to industry, academia, governments and the public around the world through collective wisdom, tools, training and expertise. The CCPS has been at the forefront of documenting and sharing important process safety risk assessment methodologies for more than 30 years. The EI's Technical Work Program addresses the depth and breadth of the energy sector, from fuels and fuels distribution to health and safety, sustainability and the environment. The EI program provides cost-effective, value-adding knowledge on key current and future international issues affecting those in the energy sector.




Official (ISC)2 Guide to the CISSP CBK


Book Description

As a result of a rigorous, methodical process that (ISC) follows to routinely update its credential exams, it has announced that enhancements will be made to both the Certified Information Systems Security Professional (CISSP) credential, beginning April 15, 2015. (ISC) conducts this process on a regular basis to ensure that the examinations and




The Complete Guide to Cybersecurity Risks and Controls


Book Description

The Complete Guide to Cybersecurity Risks and Controls presents the fundamental concepts of information and communication technology (ICT) governance and control. In this book, you will learn how to create a working, practical control structure that will ensure the ongoing, day-to-day trustworthiness of ICT systems and data. The book explains how to establish systematic control functions and timely reporting procedures within a standard organizational framework and how to build auditable trust into the routine assurance of ICT operations. The book is based on the belief that ICT operation is a strategic governance issue rather than a technical concern. With the exponential growth of security breaches and the increasing dependency on external business partners to achieve organizational success, the effective use of ICT governance and enterprise-wide frameworks to guide the implementation of integrated security controls are critical in order to mitigate data theft. Surprisingly, many organizations do not have formal processes or policies to protect their assets from internal or external threats. The ICT governance and control process establishes a complete and correct set of managerial and technical control behaviors that ensures reliable monitoring and control of ICT operations. The body of knowledge for doing that is explained in this text. This body of knowledge process applies to all operational aspects of ICT responsibilities ranging from upper management policy making and planning, all the way down to basic technology operation.




Countering Cyber Sabotage


Book Description

Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE) introduces a new methodology to help critical infrastructure owners, operators and their security practitioners make demonstrable improvements in securing their most important functions and processes. Current best practice approaches to cyber defense struggle to stop targeted attackers from creating potentially catastrophic results. From a national security perspective, it is not just the damage to the military, the economy, or essential critical infrastructure companies that is a concern. It is the cumulative, downstream effects from potential regional blackouts, military mission kills, transportation stoppages, water delivery or treatment issues, and so on. CCE is a validation that engineering first principles can be applied to the most important cybersecurity challenges and in so doing, protect organizations in ways current approaches do not. The most pressing threat is cyber-enabled sabotage, and CCE begins with the assumption that well-resourced, adaptive adversaries are already in and have been for some time, undetected and perhaps undetectable. Chapter 1 recaps the current and near-future states of digital technologies in critical infrastructure and the implications of our near-total dependence on them. Chapters 2 and 3 describe the origins of the methodology and set the stage for the more in-depth examination that follows. Chapter 4 describes how to prepare for an engagement, and chapters 5-8 address each of the four phases. The CCE phase chapters take the reader on a more granular walkthrough of the methodology with examples from the field, phase objectives, and the steps to take in each phase. Concluding chapter 9 covers training options and looks towards a future where these concepts are scaled more broadly.