Security Risk Management: Building an Information Security Risk Management Program from the Ground Up

Security Risk Management: Building an Information Security Risk Management Program from the Ground Up

Volumn , Issue , 2011, Pages 1-340

  Wheeler, Evan ^a  

^a ARMED FORCES INSTITUTE OF PATHOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 85088870550     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1016/C2010-0-64926-1     Document Type: Book

References (39)

1. Guide for Applying the Risk Management Framework to Federal Information Systems NIST 800-37, (accessed 29.12.09). http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf.
2. Verizon Business, 2010 Data Breach Investigations Report. , 2010 (accessed 21.07.10). http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf.
3. Jones J. An Introduction to Factor Analysis of Information Risk (FAIR) (accessed 06.03.10). http://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf.
4. PCI Security Standards Council, (accessed 02.02.10). http://www.pcisecuritystandards.org.
5. Standardized Information Gathering Questionnaire (SIG) (accessed 16.11.09). http://www.sharedassessments.org.
6. Investopedia (accessed 30.01.10). http://www.investopedia.com/terms/r/returnoninvestment.asp.
7. Parker D., Pols J. The Great Debate: Security spending. ISSA Magazine April 2008.
8. A Complete Guide to the Common Vulnerability Scoring System, Version 2.0 (accessed 30.01.10). http://www.first.org/cvss/cvss-guide.html.
9. Society of Information Risk Analysts (SIRA)., (accessed 05.01.11). http://www.societyinforisk.org.
10. Privacy Rights Clearinghouse (accessed 31.01.10). http://www.privacyrights.org.
11. Building a Risk-Based Security Program in 10 Easy Steps SANS Institute, (accessed 03.10.10). http://www.sans.org/security-training/course_sums/1467.pdf.
12. Computer Crimes Table HTCIA New England Chapter Website, (no longer available). http://www.htcia-ne.org.
13. Data Breach Investigations Report Verizon Business, (accessed 21.07.10). http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf.
14. CSI Computer Crime & Security Survey Computer Security Institute, (access 02.12.10). http://gocsi.com/survey.
15. Trustwave Global Security Report (accessed 19.01.11). https://www.trustwave.com/downloads/Trustwave_WP_Global_Security_Report_2011.pdf.
16. Internet Security Threat Report Symantec, (accessed 01.04.10). http://www.symantec.com/business/theme.jsp?themeid=threatreport.
17. Security Threat Report Sophos, (accessed 01.04.10). http://www.sophos.com/sophos/docs/eng/papers/sophos-security-threat-report-jan-2010-wpna.pdf.
18. Future Threat Report Trend Micro, (accessed 09.12.10). http://us.trendmicro.com/us/trendwatch/research-and-analysis/threat-reports/index.html.
19. Network Infrastructure Security Report Arbor Networks, (accessed 01.02.11). http://www.arbornetworks.com/report.
20. Mailing Lists and Feeds US-CERT Coordination Center, (accessed 30.01.11). http://www.us-cert.gov/cas/signup.html.
21. RSS/XML Data Feeds SANS Internet Storm Center, (accessed 30.01.11). http://isc.sans.edu/xml.html.
22. National Website FBI InfraGard, (accessed 30.01.11). http://www.infragard.net.
23. The Metasploit Project Rapid7, (accessed 30.01.11). http://www.metasploit.com.
24. Hubbard D. The Failure of Risk Management: Why It's Broken and How to Fix It 2009, Wiley, Hoboken, New Jersey.
25. Kienzle D.M., Elder M.C., Tyree D., Edwards-Hewitt J. Security Patterns Repository (accessed 19.06.09). http://www.scrypt.net/~celer/securitypatterns/repository.pdf.
26. Caralli R.A., Stevens J.F., Young L.R., Wilson W.R. Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process 2007, Software Engineering Institute, (accessed 01.02.10). http://www.sei.cmu.edu/reports/07tr012.pdf.
27. Open Source Security Testing Methodology Manual (accessed 01.28.11). http://www.isecom.org/osstmm.
28. Top 100 Network Security Tools SecTools.Org, (accessed 20.01.11). http://sectools.org.
29. Guide for Applying the Risk Management Framework to Federal Information Systems NIST 800-37, (accessed 29.12.09). http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf.
30. Peltier T.R. Information Security Risk Analysis 2005, Auerbach Publications, Boca Raton, FL. second ed.
31. 20 Critical Security Controls for Effective Cyber Defense SANS Institute, (accessed 19.05.10). http://www.sans.org/critical-security-controls.
32. BITS Standardized Information Gathering (SIG) questionnaire (accessed 02.02.11). http://www.sharedassessments.org.
33. Handler's Diary SANS Internet Storm Center, (accessed 30.01.11). http://isc.sans.edu/diary.html.
34. Multi-State Information Sharing and Analysis Center (MS-ISAC), (accessed 20.01.11). http://www.msisac.org.
35. Risk Management Insight Web site, (accessed 06.03.10). http://riskmanagementinsight.com.
36. NIST, (accessed 20.01.11). http://csrc.nist.gov.
37. Guide for Applying the Risk Management Framework to Federal Information Systems NIST 800-37, (accessed 29.12.09). http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf.
38. NIST 800-53, Revision 3. Recommended Security Controls for Federal Information Systems and Organizations. (accessed 21.11.10). http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf.
39. ISACA. The Risk IT Framework Excerpt. (accessed 20.01.11). http://www.isaca.org/Knowledge-Center/Research/Documents/RiskIT-FW-Excerpt-8Jan09.pdf.