دانلود کتاب راهنمای ارزیابی ریسک امنیتی

Most organizations have realized the need for a senior position within the organization to be accountable for information security. While the job description and even the placement within the organization will differ in each industry and each organization, a familiar set of responsibilities are typically associated with this role. These responsibilities include: • Establishing information security program strategy: The CISO identifies the business cyber threats, industry and customer requirements, business drivers, information security requirements, framework upon which to build the information security program, and the peo-ple, process, and technology in which to assemble the program. Activities associated with this responsibility include: • Working with executive management to understand and document the organization’s information security risk appetite.1 • Designing information security architecture and selecting appropriate controls to meet the established information security risk appetite. • Keeping current on information security and privacy regulations. • Keeping current on changes to the threats impacting the organization. • Establishing and managing security policies. • Implementing effective security awareness and education; and • Planning effective information security incident and disaster response. • Assessment of the current information security program. The CISO establishes means to measure the effectiveness of the current controls in implementing the information security program. Activities associated with this responsibility include: • Ensuring current access management strategies and implementations appropriately restrict access to authorized individuals. • Establishing information security metrics, collection processes, and monitoring program; and • Managing a security assessment program to include vulnerability assessments, penetration testing, and security risk assessments. • Ensure appropriate governance of the security controls. The CISO creates oversight activ-ities and processes to check on the compliance within (and external to) the organization to be sure that appropriate controls are implemented. • Establishing appropriate oversight controls such as separation of duty, job rotation, peer review, and sanctions for non-compliance with organizational policy; and • Reacting to security incidents and security assessment findings by ensuring appropriate remediation and prioritization of security initiatives.