Author: National Institute of Standards and Technology Publisher: Createspace Independent Publishing Platform ISBN: 9781547179510 Category : Languages : en Pages : 282
Book Description
Federal agencies are concerned about the risks associated with information and communications technology (ICT) products and services that may contain potentially malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the ICT supply chain. These risks are associated with the federal agencies' decreased visibility into, understanding of, and control over how the technology that they acquire is developed, integrated and deployed, as well as the processes, procedures, and practices used to assure the integrity, security, resilience, and quality of the products and services. This publication provides guidance to federal agencies on identifying, assessing, and mitigating ICT supply chain risks at all levels of their organizations. The publication integrates ICT supply chain risk management (SCRM) into federal agency risk management activities by applying a multitiered, SCRM-specific approach, including guidance on assessing supply chain risk and applying mitigation activities. Why buy a book you can download for free? First you gotta find it and make sure it's the latest version, not always easy. Then you gotta print it using a network printer you share with 100 other people - and its outta paper - and the toner is low (take out the toner cartridge, shake it, then put it back). If it's just 10 pages, no problem, but if it's a 250-page book, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. An engineer that's paid $75 an hour has to do this himself (who has assistant's anymore?). If you are paid more than $10 an hour and use an ink jet printer, buying this book will save you money. It's much more cost-effective to just order the latest version from Amazon.com This public domain material is published by 4th Watch Books. We publish tightly-bound, full-size books at 8 1/2 by 11 inches, with glossy covers. 4th Watch Books is a Service Disabled Veteran Owned Small Business (SDVOSB) and is not affiliated with the National Institute of Standards and Technology. For more titles published by 4th Watch, please visit: cybah.webplus.net GSA P-100Facilities Standards for the Public Buildings Service GSA P-120 Cost and Schedule Management Policy Requirements GSA P-140 Child Care Center Design Guide GSA Standard Level Features and Finishes for U.S. Courts Facilities GSA Courtroom Technology Manual NIST SP 500-299NIST Cloud Computing Security Reference Architecture NIST SP 500-291NIST Cloud Computing Standards Roadmap Version 2 NIST SP 500-293US Government Cloud Computing Technology Roadmap Volume 1 & 2 NIST SP 500-293US Government Cloud Computing Technology Roadmap Volume 3 DRAFT NIST SP 1800-8Securing Wireless Infusion Pumps NISTIR 7497Security Architecture Design Process for Health Information Exchanges (HIEs) NIST SP 800-66Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule NIST SP 1800-1 Securing Electronic Health Records on Mobile Devices NIST SP 800-177 Trustworthy Email NIST SP 800-184 Guide for Cybersecurity Event Recovery NIST SP 800-190 Application Container Security Guide NIST SP 800-193 Platform Firmware Resiliency Guidelines NIST SP 1800-1 Securing Electronic Health Records on Mobile Devices NIST SP 1800-2Identity and Access Management for Electric Utilities NIST SP 1800-5IT Asset Management: Financial Services NIST SP 1800-6 Domain Name Systems-Based Electronic Mail Security NIST SP 1800-7 Situational Awareness for Electric Utilities DoD Medical Space Planning Criteria FARsFederal Acquisitions Regulation DFARSDefense Federal Acquisitions Regulations Sup
Author: Richard Kissel Publisher: DIANE Publishing ISBN: 1437980090 Category : Computers Languages : en Pages : 211
Book Description
This glossary provides a central resource of definitions most commonly used in Nat. Institute of Standards and Technology (NIST) information security publications and in the Committee for National Security Systems (CNSS) information assurance publications. Each entry in the glossary points to one or more source NIST publications, and/or CNSSI-4009, and/or supplemental sources where appropriate. This is a print on demand edition of an important, hard-to-find publication.
Author: Robert F. Dacey Publisher: DIANE Publishing ISBN: 1437914063 Category : Business & Economics Languages : en Pages : 601
Book Description
FISCAM presents a methodology for performing info. system (IS) control audits of governmental entities in accordance with professional standards. FISCAM is designed to be used on financial and performance audits and attestation engagements. The methodology in the FISCAM incorp. the following: (1) A top-down, risk-based approach that considers materiality and significance in determining audit procedures; (2) Evaluation of entitywide controls and their effect on audit risk; (3) Evaluation of general controls and their pervasive impact on bus. process controls; (4) Evaluation of security mgmt. at all levels; (5) Control hierarchy to evaluate IS control weaknesses; (6) Groupings of control categories consistent with the nature of the risk. Illus.
Author: William Stallings Publisher: Addison-Wesley Professional ISBN: 0134772954 Category : Computers Languages : en Pages : 1081
Book Description
The Practical, Comprehensive Guide to Applying Cybersecurity Best Practices and Standards in Real Environments In Effective Cybersecurity, William Stallings introduces the technology, operational procedures, and management practices needed for successful cybersecurity. Stallings makes extensive use of standards and best practices documents that are often used to guide or mandate cybersecurity implementation. Going beyond these, he offers in-depth tutorials on the “how” of implementation, integrated into a unified framework and realistic plan of action. Each chapter contains a clear technical overview, as well as a detailed discussion of action items and appropriate policies. Stallings offers many pedagogical features designed to help readers master the material: clear learning objectives, keyword lists, review questions, and QR codes linking to relevant standards documents and web resources. Effective Cybersecurity aligns with the comprehensive Information Security Forum document “The Standard of Good Practice for Information Security,” extending ISF’s work with extensive insights from ISO, NIST, COBIT, other official standards and guidelines, and modern professional, academic, and industry literature. • Understand the cybersecurity discipline and the role of standards and best practices • Define security governance, assess risks, and manage strategy and tactics • Safeguard information and privacy, and ensure GDPR compliance • Harden systems across the system development life cycle (SDLC) • Protect servers, virtualized systems, and storage • Secure networks and electronic communications, from email to VoIP • Apply the most appropriate methods for user authentication • Mitigate security risks in supply chains and cloud environments This knowledge is indispensable to every cybersecurity professional. Stallings presents it systematically and coherently, making it practical and actionable.
Author: Troy McMillan Publisher: Pearson IT Certification ISBN: 0133448460 Category : Computers Languages : en Pages : 693
Book Description
This is the eBook version of the print title. Note that the eBook does not provide access to the practice test software that accompanies the print book. Learn, prepare, and practice for CISSP exam success with the CISSP Cert Guide from Pearson IT Certification, a leader in IT Certification. Master CISSP exam topics Assess your knowledge with chapter-ending quizzes Review key concepts with exam preparation tasks CISSP Cert Guide is a best-of-breed exam study guide. Leading IT certification experts Troy McMillan and Robin Abernathy share preparation hints and test-taking tips, helping you identify areas of weakness and improve both your conceptual knowledge and hands-on skills. Material is presented in a concise manner, focusing on increasing your understanding and retention of exam topics. You'll get a complete test preparation routine organized around proven series elements and techniques. Exam topic lists make referencing easy. Chapter-ending Exam Preparation Tasks help you drill on key concepts you must know thoroughly. Review questions help you assess your knowledge, and a final preparation chapter guides you through tools and resources to help you craft your final study plan. This study guide helps you master all the topics on the CISSP exam, including Access control Telecommunications and network security Information security governance and risk management Software development security Cryptography Security architecture and design Operation security Business continuity and disaster recovery planning Legal, regulations, investigations, and compliance Physical (environmental) security
Author: National Institute National Institute of Standards and Technology Publisher: ISBN: 9781977774897 Category : Languages : en Pages : 120
Book Description
NIST SP 800-37 Revision 2 - Discussion Draft - Released 28 Sept 2017 This publication provides guidelines for applying the Risk Management Framework (RMF) to information systems and organizations. The RMF includes a disciplined, structured, and flexible process for organizational asset valuation; security and privacy control selection, implementation, and assessment; system and control authorizations; and continuous monitoring. It also includes enterprise-level activities to help better prepare organizations to execute the RMF at the system level. The RMF promotes the concept of near real-time risk management and ongoing system authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make cost-effective, risk management decisions about the systems supporting their missions and business functions; and integrates security and privacy controls into the system development life cycle. Why buy a book you can download for free? First you gotta find a good clean (legible) copy and make sure it's the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it's all there - including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it's just a 10-page document, no problem, but if it's 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour. It's much more cost-effective to just order the latest version from Amazon.com This book is published by 4th Watch Books and includes copyright material. We publish compact, tightly-bound, full-size books (8 � by 11 inches), with glossy covers. 4th Watch Books is a Service Disabled Veteran-Owned Small Business (SDVOSB). If you like the service we provide, please leave positive review on Amazon.com. NIST SP 800-12 An Introduction to Information Security NIST SP 800-18 Developing Security Plans for Federal Information Systems NIST SP 800-31 Intrusion Detection Systems NIST SP 800-34 Contingency Planning Guide for Federal Information Systems NIST SP 800-35 Guide to Information Technology Security Services NIST SP 800-39 Managing Information Security Risk NIST SP 800-40 Guide to Enterprise Patch Management Technologies NIST SP 800-41 Guidelines on Firewalls and Firewall Policy NIST SP 800-44 Guidelines on Securing Public Web Servers NIST SP 800-47 Security Guide for Interconnecting Information Technology Systems NIST SP 800-48 Guide to Securing Legacy IEEE 802.11 Wireless Networks NIST SP 800-53A Assessing Security and Privacy Controls
Author: Mark A. RUSSO CISSP-ISSAP ITILv3 Publisher: ISBN: Category : Languages : en Pages : 223
Book Description
A GUIDE FOR 2021 AND BEYOND SUPPLY CHAIN RISK MANAGEMENT (SCRM) APPLICATION IN THE REAL WORLD...In this 2021 re-release of the SCRM 2.0, there has been added clarification of control implementation. NIST SP 800-161 controls are critical to a successful Supply Chain Risk Management process, vital to ensuring that hardware, software, and services are equally vetted to ensure that supply chain elements are free from defect, counterfeit, or fraud. This update is designed to provide greater clarity needed to ensure an active defensive posture by public and private sector organizations. Welcome to the next iteration of SCRM. Based on a detailed explanation of current threats and application of NIST SP 800-161. From the internationally acclaimed cybersecurity leader, Dr. Russo provides two distinct NIST 800-161, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations," approaches to resolve the modern-day challenges of SCRM. The solutions, while similar, provide a 21st Century resolution to a better approach in a systematic way to prevent compromises to the US and global IT supply chains. The use of varied supply chain attacks by cyber attackers to access, for example, software development infrastructures, have been major vectors of concern for governments and the private sector. These attacks typically include targeting publicly connected software "build, test, update servers," and other portions of a software development environment. Nation-state agents can then inject malware into software updates, and subsequent releases have far-ranging impacts on the IT supply chain; the challenge continues to grow.SCRM 1.0 is a concept for establishing an effective and repeatable process that can be applied against standard supply chain components such as hardware, firmware, software, etc. The author introduces SCRM 2.0. Much like SCRM 1.0 (Product-based approach), the need is to turn to a much more precarious aspect of SCRM. We must consider the service piece of SCRM that includes the people, companies, and organizations along the supply chain that may also be compromised within the global marketing of IT equipment and capabilities. This is the next most significant issue facing the field of cybersecurity protection in the 21st Century. This updated version updates content for the reader and adds more clarity on the topic of SCRM in 2020.
Author: Don Snyder Publisher: ISBN: 9781977404374 Category : Computers Languages : en Pages : 0
Book Description
This report presents a framework for the development of metrics-and a method for scoring them-that indicates how well a U.S. Air Force mission or system is expected to perform in a cyber-contested environment. There are two types of cyber metrics: working-level metrics to counter an adversary's cyber operations and institutional-level metrics to capture any cyber-related organizational deficiencies.
Author: National Institute of Standards and Technology
Author: Richard Kissel
Author: Keith Stouffer
Author: Robert F. Dacey
Author: William Stallings
Author: Troy McMillan
Author: Jon Boyens
Author: National Institute National Institute of Standards and Technology
Author: Mark A. RUSSO CISSP-ISSAP ITILv3
Author: Don Snyder