Mission-Critical Security Planner: When Hackers Won’t Take No For an Amswer

Eric Greenberg9780471211655, 0471211656

Security expert Greenberg has developed a security planning process that uses a series of worksheets to define policies regarding employee authentication and access control, intrusion detection, encryption, the security stack, life cycle management, and corporate privacy. In the resulting book, he also explains how the public key infrastructure (PKI) works and predicts the methods of attack hackers will use in the future.

---

Table of contents :
@Team LiB……Page 1
Acknowledgments……Page 5
Contents……Page 7
Introduction……Page 13
About the Author……Page 18
CHAPTER 1 Setting the Stage for
Successful Security Planning……Page 19
A Way of Thinking……Page 20
The Ultra-Planner……Page 21
The Shock-Advisor……Page 22
Identifying Risk……Page 23
The Attention Seeker……Page 24
The Curious……Page 25
Negotiating with Hackers……Page 26
Selling Security……Page 28
Authentication, Tokens, Smart Cards,
and Biometrics: An Overview……Page 29
Making the Security Sale: An Example……Page 30
Doing the Math……Page 33
Understanding Impact Analysis……Page 34
Performing Security Impact Analysis: An Example……Page 35
Counting the Cost of Security……Page 37
Establishing Maximum Impact, Cost,
and the Security Budget……Page 38
Estimating the Value of Security……Page 39
Laying the Security Foundation……Page 40
Improving Security as Part of the Business Process……Page 41
Conclusions……Page 42
Forming a Security Planning Team……Page 43
At the First Meeting……Page 45
Information……Page 47
People……Page 48
Security Life Cycle……Page 52
Choosing Technology……Page 53
Keeping a Lookout: Operations……Page 55
Activities……Page 56
Notifying Authorities……Page 62
Creating Order from Chaos: The Security Stack……Page 63
Preparing to Work with the Security Elements……Page 65
Introducing the Security Elements……Page 67
The Fundamentals……Page 68
The Wrap-up Elements……Page 86
Conclusions……Page 95
From Here to Security……Page 97
Organization of the Worksheets……Page 98
Summary……Page 108
Security Stack……Page 110
Life-Cycle Management……Page 115
Business……Page 119
Selling Security……Page 123
Summary……Page 125
Security Stack……Page 129
Life-Cycle Management……Page 134
Business……Page 137
Selling Security……Page 141
Summary……Page 144
Security Stack……Page 145
Life-Cycle Management……Page 152
Business……Page 155
Selling Security……Page 159
Summary……Page 161
Security Stack……Page 162
Life-Cycle Management……Page 165
Business……Page 168
Selling Security……Page 172
Summary……Page 174
Security Stack……Page 175
Life-Cycle Management……Page 179
Business……Page 182
Selling Security……Page 185
Summary……Page 187
Security Stack……Page 189
Life-Cycle Management……Page 193
Business……Page 196
Selling Security……Page 200
Conclusions……Page 203
CHAPTER 4 Using the Security Plan
Worksheets: The Remaining
Core and Wrap-up Elements……Page 205
Organization of the Worksheets……Page 206
Summary……Page 207
Security Stack……Page 208
Life-Cycle Management……Page 215
Business……Page 219
Selling Security……Page 222
Summary……Page 224
Security Stack……Page 226
Life-Cycle Management……Page 229
Business……Page 232
Selling Security……Page 235
Summary……Page 236
Security Stack……Page 240
Life-Cycle Management……Page 244
Business……Page 247
Selling Security……Page 251
Security Stack……Page 254
Life Cycle Management……Page 259
Business……Page 263
Selling Security……Page 266
Summary……Page 268
DRI: An Example……Page 269
Security Stack……Page 271
Life-Cycle Management……Page 274
Business……Page 277
Selling Security……Page 280
Summary……Page 282
Security Stack……Page 283
Life-Cycle Management……Page 288
Business……Page 292
Selling Security……Page 294
Summary……Page 297
Security Stack……Page 298
Life Cycle Management……Page 306
Business……Page 309
Selling Security……Page 313
Summary……Page 315
Security Stack……Page 316
Life-Cycle Management……Page 319
Business……Page 322
Selling Security……Page 325
Security Stack……Page 327
Life-Cycle Management……Page 331
Business……Page 333
Selling Security……Page 336
Interoperability and Standards……Page 339
Laws and Regulations……Page 341
Lockdown……Page 342
Lost or Stolen Items……Page 343
Managed (Outsourced) Security……Page 344
Performance……Page 345
Physical Security……Page 346
Support Interface……Page 348
Testing, Integration, and Staging……Page 350
Training……Page 351
Recovery……Page 352
Conclusions……Page 353
CHAPTER 5 Strategic Security Planning
with PKI……Page 355
PKI Primer……Page 356
Authentication and Nonrepudiation
with Digital Signatures……Page 357
Making a Business Case for PKI……Page 358
Benefits of Virtual Private Networks……Page 359
PKI Services……Page 360
Collaboration, Workflow, and Business Processes……Page 361
Software Distribution Methods……Page 362
Legislation……Page 363
Financial Services……Page 364
Legal……Page 365
Retail and Manufacturing……Page 366
Business Justification……Page 367
Scalability……Page 368
Complexity……Page 369
Physical Security……Page 370
Legislation……Page 371
Components of the Solution……Page 372
Roles and Responsibilities……Page 374
Educating Users on Internet and Digital Certificate Technologies……Page 375
Developing Digital Certificate Policies and Procedures……Page 376
OASIS Today……Page 377
Conclusions……Page 378
Practice Makes Perfect—Or at Least More Secure……Page 379
Into the Future: The Top 10 Methods of Attack……Page 382
In Closing……Page 390
For Further Reading……Page 393
Glossary……Page 397
Index……Page 419