Book Image

Infosec Strategies and Best Practices

By : Joseph MacMillan
Book Image

Infosec Strategies and Best Practices

By: Joseph MacMillan

Overview of this book

Information security and risk management best practices enable professionals to plan, implement, measure, and test their organization's systems and ensure that they're adequately protected against threats. The book starts by helping you to understand the core principles of information security, why risk management is important, and how you can drive information security governance. You'll then explore methods for implementing security controls to achieve the organization's information security goals. As you make progress, you'll get to grips with design principles that can be utilized along with methods to assess and mitigate architectural vulnerabilities. The book will also help you to discover best practices for designing secure network architectures and controlling and managing third-party identity services. Finally, you will learn about designing and managing security testing processes, along with ways in which you can improve software security. By the end of this infosec book, you'll have learned how to make your organization less vulnerable to threats and reduce the likelihood and impact of exploitation. As a result, you will be able to make an impactful change in your organization toward a higher level of information security.
Table of Contents (13 chapters)
Section 1: Information Security Risk Management and Governance
Section 2: Closing the Gap: How to Protect the Organization
Section 3: Operationalizing Information Security

Chapter 2: Protecting the Security of Assets

Originally, the concept for the start of this chapter was to ask you "How can you protect an organization if you don't know what assets they have?". We both know the answer to that question is "You can't," and we've probably been asked this question a thousand times between the two of us, so I'm not going to ask it. Instead, I'm going to show you how you might structure the appropriate processes at your organization in order to discover and protect its assets.

These various processes combine to create what is known as an Information Security Management System (ISMS). We covered various key concepts in Chapter 1, InfoSec and Risk Management, but overall, there was much less structure than most organizations would require. What we want to be able to achieve with the ISMS is to appropriately identify and classify our organization's assets, and ensure the security of those assets is adequately...