Book Image

Certified Information Security Manager Exam Prep Guide - Second Edition

By : Hemang Doshi
Book Image

Certified Information Security Manager Exam Prep Guide - Second Edition

By: Hemang Doshi

Overview of this book

CISM is a globally recognized and much sought-after certification in the field of IT security. This second edition of the Certified Information Security Manager Exam Prep Guide is up to date with complete coverage of the exam content through comprehensive and exam-oriented explanations of core concepts. Written in a clear, succinct manner, this book covers all four domains of the CISM Review Manual. With this book, you’ll unlock access to a powerful exam-prep platform which includes interactive practice questions, exam tips, and flashcards. The platform perfectly complements the book and even lets you bring your questions directly to the author. This mixed learning approach of exploring key concepts through the book and applying them to answer practice questions online is designed to help build your confidence in acing the CISM certification. By the end of this book, you'll have everything you need to succeed in your information security career and pass the CISM certification exam with this handy, on-the-job desktop reference guide.

Related Content you might be interested in

Current Title:

Small book image
Certified Information Security Manager Exam Prep Guide - Second Edition
Hemang Doshi
Dec, 2022 | 718 pages
Small book image
CISA – Certified Information Systems Auditor Study Guide
Hemang Doshi
Aug, 2020 | 590 pages
Small book image
CISA – Certified Information Systems Auditor Study Guide
Hemang Doshi
Jun, 2023 | 330 pages
Small book image
ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide
Shobhit Mehta
Sep, 2023 | 316 pages
Table of Contents (12 chapters)
Preface
Preface
Online Exam-Prep Tools
Download a free PDF copy of this book
Free Chapter
1
Enterprise Governance
Enterprise Governance
Importance of Information Security Governance
Organizational Culture
Legal, Regulatory, and Contractual Requirements
Retention of Business Records
Organizational Structure
Maturity Model
Governance of Third-Party Relationships
Information Security Governance Metrics
Summary
Revision Questions
2
Information Security Strategy
Information Security Strategy
Information Security Strategy and Plan
Information Governance Frameworks and Standards
The IT Balanced Scorecard
Information Security Programs
Enterprise Information Security Architecture
Awareness and Education
Governance, Risk Management, and Compliance
Senior Management Commitment
Business Case and Feasibility Study
Summary
Revision Questions
3
Information Risk Assessment
Information Risk Assessment
Understanding Risk
Differentiating Risk Identification, Risk Analysis, and Risk Evaluation
Differentiating Risk Capacity, Risk Appetite, and Risk Tolerance
Inherent Risk and Residual Risk
Phases of Risk Management
Risk Awareness
Risk Assessment
Risk Identification
Risk Analysis
Risk Evaluation
Risk Register
Emerging Risk and the Threat Landscape
Vulnerability and Control Deficiency
Security Baselines
Summary
4
Information Risk Response
Information Risk Response
Risk Treatment/Risk Response Options
Risk Ownership and Accountability
Risk Monitoring and Communication
Implementing Risk Management
Change Management
Patch Management
Operational Risk Management
Risk Management Integration with Life Cycle
Summary
Revision Questions
5
Information Security Program Development
Information Security Program Development
Information Security Program Overview
Information Security Program Resources
Information Asset Identification and Classification
Information Asset Valuation
Industry Standards and Frameworks for Information Security
Information Security Policies, Procedures, and Guidelines
Defining an Information Security Program Roadmap
Information Security Program Metrics
Summary
Revision Questions
6
Information Security Program Management
Information Security Program Management
Information Security Control Design and Selection
Security Baseline Controls
Information Security Awareness and Training
Management of External Services and Relationships
Documentation
Information Security Program Objectives
Security Budget
Security Program Management and Administrative Activities
Privacy Laws
Cloud Computing
Summary
Revision Questions
7
Information Security Infrastructure and Architecture
Information Security Infrastructure and Architecture
Information Security Architecture
Architecture Implementation
Access Control
Virtual Private Networks
Biometrics
Factors of Authentication
Wireless Networks
Different Attack Methods for Information Security
Summary
Revision Questions
8
Information Security Monitoring Tools and Techniques
Information Security Monitoring Tools and Techniques
Firewall Types and Implementations
Intrusion Detection Systems and Intrusion Prevention Systems
Digital Signatures
Public Key Infrastructure
Cryptography
Penetration Testing
Summary
Revision Questions
9
Incident Management Readiness
Incident Management Readiness
Incident Management and Incident Response Overview
Incident Management and Incident Response Plans
Business Continuity and Disaster Recovery Procedures
Insurance
Incident Classification/Categorization
Testing Incident Response, BCP, and DRP
Summary
Revision Questions
10
Incident Management Operations
Incident Management Operations
Incident Management Tools and Technologies
Executing Response and Recovery Plans
Incident Containment Methods
Incident Response Communications
Incident Eradication
Recovery
Post-Incident Activities and Investigations
Incident Response Procedures
Incident Management Metrics and Indicators
The Current State of Incident Response Capabilities
Summary
Revision Questions
11
Answers to Practice Questions
Chapter 1: Enterprise Governance
Chapter 2: Information Security Strategy
Chapter 3: Information Risk Assessment
Chapter 4: Information Risk Response
Chapter 5: Information Security Program Development
Chapter 6: Information Security Program Management
Chapter 7: Information Security Infrastructure and Architecture
Chapter 8: Information Security Monitoring Tools and Techniques
Chapter 9: Incident Management Readiness
Chapter 10: Incident Management Operations

Enterprise Governance

Accessing the Online Content

With this book, you get unlimited access to web-based CISM exam prep tools which include practice questions, flashcards, exam tips, and more. To unlock the content, you'll need to create an account using your unique sign-up code provided with this book. Refer to the Instructions for Unlocking the Online Content section in the Preface on how to do that.

If you've already created your account using those instructions, visit this link http://packt.link/cismexamguidewebsite or scan the following QR code to quickly open the website. Once there, click the Login link in the top-right corner of the page to access the content using your credentials.

Barcode 2

Governance is an important aspect of the certified information security manager (CISM) exam. In simple terms, governance means a set of policies, procedures, and standards used to monitor and control an activity. Enterprise governance refers to policies, procedures, and standards put in place to monitor an entire organization. Information security governance is a subset of overall enterprise governance, and its objective is to monitor and control activities related to information security.

In this chapter, you will gain an overview of information security governance and understand the impact of good governance on the effectiveness of information security projects.

You will learn about how organizational structure and culture impact information security governance and details about the various roles and responsibilities of the security function. You will also be introduced to the best practices for implementing information security governance.

This chapter will cover the following topics:

  • Importance of Information Security Governance
  • Organizational Culture
  • Legal, Regulatory, and Contractual Requirements
  • Retention of Business Records
  • Organizational Structure
  • Maturity Model
  • Governance of Third-Party Relationships
  • Information Security Governance Metrics
Previous Section
End of Section 1
Next Section