Linked e-resources
Details
Table of Contents
Intro
Table of Contents
About the Authors
About the Technical Reviewers
Acknowledgments
Introduction
Please check our GitHub page
Chapter 1: The Cybersecurity Challenge
Types of Threats
Who Are These People?
How Do Cyberattacks Happen?
What Can We Do?
Summary
Chapter 2: International Security Standards
ISO 27001 and ISO 27002
Information Security Policies (Clause A.5)
Organization of Information Security (Clause A.6)
Human Resource Security (Clause A.7)
Before Hiring
Employees
Termination and reassignment
Asset Management (Clause A.8)
Access Control (Clause A.9)
Cryptography (Clause A.10)
Physical and Environmental Security (Clause A.11)
Operations Security (Clause A.12)
Communications Security (Clause A.13)
System Acquisition, Development, and Maintenance (Clause A.14)
Supplier Relationships (Clause A.15)
Incident Management (Clause A.16)
Business Continuity Management (Clause A.17)
Compliance (Clause A.18)
ISO 27002
PCI DSS
Goal 1: Build and Maintain a Secure Network
Goal 2: Protect Cardholder Data
Goal 3: Maintain a Vulnerability Management Program
Goal 4: Implement Strong Access Control Measures
Goal 5: Regularly Monitor and Test Networks
Goal 6: Maintain a Policy That Addresses Information Security
Prioritization
SWIFT: Customer Security Controls Framework
Summary
Chapter 3: Information Security Frameworks
NIST Frameworks
NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations
NIST SP 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems
NIST Cybersecurity Framework
COBIT 5 for Information Security
COBIT 5 Process Goals Applied to Information Security
Other Regulatory Frameworks
CIS Controls
Saudi Arabia Monetary Authority (SAMA) Cybersecurity Framework
Reserve Bank of India
FIFA World Cup Qatar 2022
Monetary Authority of Singapore
BDDK
Others
Summary
Chapter 4: IT Security Technical Controls
Off-Premises Unmanaged Devices
MDM: Mobile Device Management
MAM: Mobile Application Management
NAC: Network Access Control
Multi-Factor Authentication
RASP for Mobile Applications
Secure Connections
OSI Model
TCP/IP Model
IPsec, SSH, and TLS
IPsec
SSH
TLS
Clean Pipes
DDoS Mitigation
Managed Devices
Directory Service Integration
Centralized Endpoint Management
TPM: Trusted Platform Module
VPN Client
NAC: Network Access Control
Data Classification
UAM: User Activity Monitoring
Endpoint Protection
Phishing Reporting Tool
Host IPS or EDR
Desktop Firewall
Antivirus
Antispyware
Full-Disk Encryption
Application Control and Application Whitelisting
Perimeter Security
Firewalls
Intrusion Detection and Intrusion Protection Systems
Proxy and Content (URL) Filtering
Table of Contents
About the Authors
About the Technical Reviewers
Acknowledgments
Introduction
Please check our GitHub page
Chapter 1: The Cybersecurity Challenge
Types of Threats
Who Are These People?
How Do Cyberattacks Happen?
What Can We Do?
Summary
Chapter 2: International Security Standards
ISO 27001 and ISO 27002
Information Security Policies (Clause A.5)
Organization of Information Security (Clause A.6)
Human Resource Security (Clause A.7)
Before Hiring
Employees
Termination and reassignment
Asset Management (Clause A.8)
Access Control (Clause A.9)
Cryptography (Clause A.10)
Physical and Environmental Security (Clause A.11)
Operations Security (Clause A.12)
Communications Security (Clause A.13)
System Acquisition, Development, and Maintenance (Clause A.14)
Supplier Relationships (Clause A.15)
Incident Management (Clause A.16)
Business Continuity Management (Clause A.17)
Compliance (Clause A.18)
ISO 27002
PCI DSS
Goal 1: Build and Maintain a Secure Network
Goal 2: Protect Cardholder Data
Goal 3: Maintain a Vulnerability Management Program
Goal 4: Implement Strong Access Control Measures
Goal 5: Regularly Monitor and Test Networks
Goal 6: Maintain a Policy That Addresses Information Security
Prioritization
SWIFT: Customer Security Controls Framework
Summary
Chapter 3: Information Security Frameworks
NIST Frameworks
NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations
NIST SP 800-37: Guide for Applying the Risk Management Framework to Federal Information Systems
NIST Cybersecurity Framework
COBIT 5 for Information Security
COBIT 5 Process Goals Applied to Information Security
Other Regulatory Frameworks
CIS Controls
Saudi Arabia Monetary Authority (SAMA) Cybersecurity Framework
Reserve Bank of India
FIFA World Cup Qatar 2022
Monetary Authority of Singapore
BDDK
Others
Summary
Chapter 4: IT Security Technical Controls
Off-Premises Unmanaged Devices
MDM: Mobile Device Management
MAM: Mobile Application Management
NAC: Network Access Control
Multi-Factor Authentication
RASP for Mobile Applications
Secure Connections
OSI Model
TCP/IP Model
IPsec, SSH, and TLS
IPsec
SSH
TLS
Clean Pipes
DDoS Mitigation
Managed Devices
Directory Service Integration
Centralized Endpoint Management
TPM: Trusted Platform Module
VPN Client
NAC: Network Access Control
Data Classification
UAM: User Activity Monitoring
Endpoint Protection
Phishing Reporting Tool
Host IPS or EDR
Desktop Firewall
Antivirus
Antispyware
Full-Disk Encryption
Application Control and Application Whitelisting
Perimeter Security
Firewalls
Intrusion Detection and Intrusion Protection Systems
Proxy and Content (URL) Filtering