دانلود کتاب راهنمای ضروریات CISO

The profile of the CISO has evolved over the years. It is not just about protecting information systems but about protecting the future of the organization. In today’s world, a CISO has to wear multiple hats – that of a strategist, business enabler, communicator, crisis leader, advisor to the management executives, and more. Boards of organizations are increasingly paying attention and even demanding more from the role of a CISO. This book outlines this complex role in a practical handbook with clear frameworks, actionable strategies, and lessons from real-world scenarios. These approaches are designed to help a CISO lead with confidence, align the security program to business objectives, and help overcome future threats while being razor sharp on the business acumen and effective communication. From seasoned CISOs to first timers, this book promises to be a quick reference guide to navigate challenges, make informed decisions, and make your organization’s security program an advantage to the business. The book is divided broadly into three aspects: a) Functional and domain-related skills b) Acquiring and applying business acumen to security programs and c) Communicating them effectively to the various layers in the organization, including the board Chapter 1: Explains the commonly used terms and concepts in information security, i.e, the triad of security – CIA. These concepts form the building blocks for many of the topics covered in subsequent chapters, and thus, a common understanding will enable you to relate to the topics better. Chapter 2: Explores cyber / information security risk, including its identification, classification, articulation, and mitigation. Using a lifecycle approach to risk management, the chapter provides you with guidance on how to think about risk in security decisions and, more importantly, who should own them. Chapter 3: Is focused on the role of standards and controls. As a CISO, you will be required to define and implement organizational policies for the chosen sets of controls and often demonstrate conformance to the applicable/chosen standard(s). Chapter 4: Covers the principles of privacy and explains their linkages to security controls. The cost of non-conformance is often steep and irreparably damages the reputation of the organization. Chapter 5: Explores the principles of security and privacy to be applied when designing an application or a process. We examine the similarities between the two and the ways these requirements can be commonly understood. Chapter 6: Discusses how the information security team understands the technology, its architecture, and thinks through the controls. The CISO and his/her team would frequently encounter some of the common security terminologies and technologies. Chapter 7: Focuses on the user identities, principles of need-to-know and need-to-have at depth, the common protocols in use, understanding the risks to identities, and how to manage them. These concepts will help the reader protect their information assets against attack techniques. Chapter 8: Covers the foundations of the cloud, its types, and how to secure the cloud environment. We explore how some of the traditional technologies have evolved in the cloud and how organizations have adapted to the cloud. Chapter 9: Focuses on the foundations of Zero Trust, its characteristics, and the differences from traditional security models or layered defense. It offers some practical aspects of how the challenges of Zero Trust can be dealt with and the concepts implemented. Chapter 10: Covers the advancements in technology that have made it easier for cybercriminals to cause harm to organizations and even individuals, especially high-net-worth celebrities. Driven by motives such as financial gains, espionage, mischief, or even simply proving a point, cybercriminals continue to innovate. In recent times, cybercriminals have even operated as organized groups with a specific modus operandi. The CISO and his/her team are required to be aware of these evolving developments and adequately protect their organization from such exposures. Chapter 11: Is focused on incident management. Several organizations continue to be targets of successful attacks by the adversary. It becomes pertinent for organizations to gain visibility around access and use of their information assets and have mechanisms to detect, contain, and respond to any anomaly as fast as possible. In this chapter, we will explore the concepts of logging and monitoring and their relevance to incident response. Chapter 12: Focuses on cyber resilience and the importance of having means and measures to bounce back quickly from adverse situations. The aspects of resilience go beyond business continuity and disaster recovery. Chapter 13: Covers a human centric approach to driving a security-focused culture using some awareness of how the human mind thinks and reacts to an external stimulus. It is an interesting dimension in protecting an information asset. Chapter 14: Focuses on managing security talent, using a competency framework for upskilling, and some other related aspects. Talent shortage and its management are key dimensions of a CISO’s role because not only does the team have to manage current operational program outcomes, but also continually stay abreast and adapt to the changing attack scenarios. Chapter 15: Brings together the concepts such as the technical controls, principles of security and privacy, Zero Trust, cyber resilience, Threat Intelligence, and security culture, and weaves them into a measurable and the impact of the budget on the program. Chapter 16: Covers the meaning, purpose, and relevance of business strategy and uses it to derive a possible security strategy for the organization. This approach helps the security programs to be relevant and effective, enabling the security of the organization. Chapter 17: Focuses on the importance of communication, the mindset of various stakeholders, and the methods of communicating with them. The success of a security program at various stages would require the CISO and the team to use these methods to be effective. The primary stakeholders of the CISO are the CxOs in the organization. We will examine how a CISO can engage with those stakeholders and be successful. Security leaders are often required to present to the board. Chapter 18: Focuses on providing insights for a CISO to create a compelling narrative of the security program from a board’s point of view. It will help to prepare from a board’s perspective and bring to bear the things that matter at that level of strategic focus.