دانلود کتاب گام در مدیریت ریسک امنیت سایبری

Throughout my career, I have been challenged to find ways to present the computer security, then the information security, and now the cybersecurity landscape to those outside the profession. Newcomers to the field of cybersecurity generally start in low-level positions where it is hard for them to see the ubiquitous reach of a cybersecurity program within the larger enterprise. One of my first attempts to explain this in a formal setting is illustrated in Figure 1 (Bayuk 1996). The outer circle of the figure depicts components that would be applicable to a variety of management domains holistically at the business process level, with the inner circle of cybersecurity operations support nested firmly within it. This diagram was adopted by the Information Systems Audit and Control Association (ISACA) when it developed the Certified Information Security Manager (CISM) program, and some form of it has been in ISACA CISM training materials ever since (Bayuk 2004). As in any risk management discipline (credit risk, for example), a cybersecurity program composition starts with strategy. In consultation with business objectives, roles and responsibilities for accomplishing cybersecurity risk reduction will be assigned, and business leadership in those areas will formulate a strategy for making it happen. That strategy is communicated to stakeholders to formally enlist their cooperation, and, just as with any other risk management discipline, this ends up as management mandates in a cybersecurity policy. That policy is then supplemented with awareness activities (e.g., training) so that people who need to implement the policy, both cybersecurity staff and others, understand what they need to do to comply with the policy. Following the implementation of a policy, operations processes are developed to support the business with standards, automation, and procedures that accomplish risk reduction. Activities are monitored to make sure the cybersecurity operations have the desired effect of accomplishing cybersecurity policy and reducing cybersecurity risk. If policies are monitored for gaps, such as blatant violations of policy and/or successful cybersecurity attacks, when gaps are discovered, the cybersecurity team should fall into a compliance mode or a remediation process. A remediation might entail a simple fix of broken software to ensure the enterprise is in compliance with policy and at lower risk for a security breach. In more serious cases, it may be that the policy adopted at the executive level did not result in a strategy that worked. So we may have to go back and look at our strategy. This iterative cycle is the same in any business operations, articulated by the familiar Drucker and Deming strategy taught in business schools, namely, plan-do- check- act management by observation, process, and controls. Cybersecurity uses all the same strategies common to any type of management activity. It is unique in that the domain is technically challenging and constantly changing, and the goal is to maintain cybersecurity and internet safety.