...436_XSS_FM.qxd 4/20/07 1:18 PM Page ii 443_Disaster_Rec_FM.qxd 5/25/07 3:07 PM Page i Visit us at w w w. s y n g r e s s . c o m Syngress is committed to publishing high-quality books for IT Professionals and delivering those books in media and formats that fit the demands of our customers. We are also committed to extending the utility of the book you purchase via additional materials available from our Web site. SOLUTIONS WEB SITE To register your book, visit www.syngress.com/solutions. Once registered, you can access our solutions@syngress.com Web pages. There you may find an assortment of valueadded features such as free e-books related to the topic of this book, URLs of related Web sites, FAQs from the book, corrections, and any updates from the author(s). ULTIMATE CDs Our Ultimate CD product line offers our readers budget-conscious compilations of some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect way to extend your reference library on key topics pertaining to your area of expertise, including Cisco Engineering, Microsoft Windows System Administration, CyberCrime Investigation, Open Source Security, and Firewall Configuration, to name a few. DOWNLOADABLE E-BOOKS For readers who can’t wait for hard copy, we offer most of our titles in downloadable Adobe PDF form. These e-books are often available weeks before hard copies, and are priced affordably. SYNGRESS OUTLET Our outlet store at syngress...
Words: 189146 - Pages: 757
...testing substantiates the integrity of actual processing, such as balances on financial statements. The development of substantive tests is often dependent on the outcome of compliance tests. If compliance tests indicate that there are adequate internal controls, then substantive tests can be minimized. Stop-or-go sampling allows a test to be stopped as early as possible and is not appropriate for checking whether procedures have been followed. 2. The decisions and actions of an IS auditor are MOST likely to affect which of the following risks? A. Inherent B. Detection C. Control D. Business The correct answer is: B. Detection Explanation: Detection risks are directly affected by the auditor's selection of audit procedures and techniques. Inherent risks usually are not affected by the IS auditor. Control risks are controlled by the actions of the company's management. Business risks are not affected by the IS auditor. 3. Senior management has requested that an IS auditor assist the departmental management in the implementation of necessary controls. The IS auditor should: A. refuse the assignment since it is not the role of the IS auditor. B. inform management of his/her inability to conduct future audits. C. perform the assignment and future audits...
Words: 97238 - Pages: 389
...Management of Information Security Third Edition This page intentionally left blank Management of Information Security Third Edition Michael Whitman, Ph.D., CISM, CISSP Herbert Mattord, M.B.A., CISM, CISSP Kennesaw State University ———————————————————————— Australia • Brazil • Japan • Korea • Mexico • Singapore • Spain • United Kingdom • United States Management of Information Security, Third Edition Michael E. Whitman and Herbert J. Mattord Vice President, Career and Professional Editorial: Dave Garza Executive Editor: Stephen Helba Managing Editor: Marah Bellegarde Product Manager: Natalie Pashoukos Developmental Editor: Lynne Raughley Editorial Assistant: Meghan Orvis Vice President, Career and Professional Marketing: Jennifer McAvey Marketing Director: Deborah S. Yarnell Senior Marketing Manager: Erin Coffin Marketing Coordinator: Shanna Gibbs Production Director: Carolyn Miller Production Manager: Andrew Crouth Senior Content Project Manager: Andrea Majot Senior Art Director: Jack Pendleton Cover illustration: Image copyright 2009. Used under license from Shutterstock.com Production Technology Analyst: Tom Stover © 2010 Course Technology, Cengage Learning ALL RIGHTS RESERVED. No part of this work covered by the copyright herein may be reproduced, transmitted, stored, or used in any form or by any means graphic, electronic, or mechanical, including but not limited to photocopying, recording, scanning, digitizing, taping, Web distribution, information...
Words: 229697 - Pages: 919
...CompTIA Security+: Get Certified Get Ahead SY0-401 Study Guide Darril Gibson Dedication To my wife, who even after 22 years of marriage continues to remind me how wonderful life can be if you’re in a loving relationship. Thanks for sharing your life with me. Acknowledgments Books of this size and depth can’t be done by a single person, and I’m grateful for the many people who helped me put this book together. First, thanks to my wife. She has provided me immeasurable support throughout this project. The technical editor, Steve Johnson, provided some good feedback throughout the project. If you have the paperback copy of the book in your hand, you’re enjoying some excellent composite editing work done by Susan Veach. I’m extremely grateful for all the effort Karen Annett put into this project. She’s an awesome copy editor and proofer and the book is tremendously better due to all the work she’s put into it. While I certainly appreciate all the feedback everyone gave me, I want to stress that any technical errors that may have snuck into this book are entirely my fault and no reflection on anyone who helped. I always strive to identify and remove every error, but they still seem to sneak in. About the Author Darril Gibson is the CEO of YCDA, LLC (short for You Can Do Anything). He has contributed to more than 35 books as the sole author, a coauthor, or a technical editor. Darril regularly writes, consults, and teaches on a wide variety of technical...
Words: 125224 - Pages: 501
...SC Response to Terrorism Project MIT Center for Transportation and Logistics “Supply Chain Response to Terrorism: Creating Resilient and Secure Supply Chains” Supply Chain Response to Terrorism Project Interim Report of Progress and Learnings August 8, 2003 This report was pre pared by James B. Rice, Jr. of the MIT Center for Transportation and Logistics (CTL) and Federico Caniato of Politecnico di Milano for the Supply Chain Response to Terrorism Project team with contributions from team members Jonathan Fleck, Deena Disraelly, Don Lowtan, Reshma Lensing and Chris Pickett. This work was conducted under the direction of Professor Yossi Sheffi, CTL Director. Please contact James B. Rice, Jr. of CTL (jrice@mit.edu or 617.258.8584) if you have any questions or if you would like to discuss this report. 08/12/2003 1 SC Response to Terrorism Project Supply Chain Response to Terrorism Project: Interim Report of Progress and Learnings 1 2 Executive summary........................................................................................................... 4 Research introduction and background ............................................................................. 6 2.1 Introduction................................................................................................................ 6 2.2 Background Research ................................................................................................ 6 2.3 Project...
Words: 28274 - Pages: 114
...information systems. * What is the difference between transaction processing systems, management information systems, and decision support systems? Transaction processing systems - document financial activities Management information systems - used to collect qualitative as well as quantitative information for decision making within organizations Decision support systems - help the developers of an AIS identify what information they need for their planning, decision making, and control functions * How is a flowchart used? A document flowchart traces the physical flow of documents through an organization—that is, the flow of documents from the departments, groups, or individuals who first created them to their final destinations. * How is the accounting information system documented? An accounting information system is a collection of data and processing procedures that creates needed information for its users. An information system's components: Data or information is input, processed, and output as information for planning, decision-making, and control purposes. Nine reasons to document an AIS are (1) to explain how the system works, (2) to train others, (3) to help developers design new systems, (4) to control system development and maintenance costs, (5) to standardize communications among system designers, (6) to provide information to auditors, (7) to document a business’s processes, (8) to help a company comply with the Sarbanes-Oxley Act of 2002 and AS5, and (9)...
Words: 12321 - Pages: 50
...difference between transaction processing systems, management information systems, and decision support systems? 2. Transaction processing systems - document financial activities 3. Management information systems - used to collect qualitative as well as quantitative information for decision making within organizations 4. Decision support systems - help the developers of an AIS identify what information they need for their planning, decision making, and control functions * How is a flowchart used? 5. A document flowchart traces the physical flow of documents through an organization—that is, the flow of documents from the departments, groups, or individuals who first created them to their final destinations. * How is the accounting information system documented? 6. An accounting information system is a collection of data and processing procedures that creates needed information for its users. An information system's components: Data or information is input, processed, and output as information for planning, decision-making, and control purposes. 1. Data flow diagrams provide both a physical and a logical view of a system, but concentrate more on the flow and transformation of data than on the physical devices or timing of inputs, processing, or outputs. 2. A document flowchart describes the physical flow of documents through an AIS, for example, by providing an overview of where documents are created, sent, reviewed, and stored, and what...
Words: 12288 - Pages: 50
...Chapter 1 Analyzing Business Goals and Constraints This chapter serves as an introduction to the rest of the book by describing top-down network design. The first section explains how to use a systematic, top-down process when designing computer networks for your customers. Depending on your job, your customers might consist of other departments within your company, those to whom you are trying to sell products, or clients of your consulting business. After describing the methodology, this chapter focuses on the first step in top-down network design: analyzing your customer’s business goals. Business goals include the capability to run network applications to meet corporate business objectives, and the need to work within business constraints, such as budgets, limited networking personnel, and tight timeframes. This chapter also covers an important business constraint that some people call the eighth layer of the Open System Interconnection (OSI) reference model: workplace politics. To ensure the success of your network design project, you should gain an understanding of any corporate politics and policies at your customer’s site that could affect your project. The chapter concludes with a checklist to help you determine if you have addressed the business issues in a network design project. Using a Top-Down Network Design Methodology According to Albert Einstein: 000200010270745975 “The world we’ve made as a result of the level of thinking we have...
Words: 8812 - Pages: 36
...rain_c03_070-121hr.qxd 28-09-2009 11:25 Page 70 CHAPTER 3 1. Describe the major ethical issues related to information technology and identify situations in which they occur. 2. Identify the many threats to information security. 3. Understand the various defense mechanisms used to protect information systems. 4. Explain IT auditing and planning for disaster recovery. Ethics, Privacy, and Information Security LEARNING OBJECTIVES rain_c03_070-121hr.qxd 28-09-2009 11:25 Page 71 WEB RESOURCES Student Web site www.wiley.com/college/rainer • Web quizzes • Lecture slides in PowerPoint • Author podcasts • Interactive Case: Ruby’s Club assignments WileyPLUS • All of the above and... • E-book • Manager Videos • Vocabulary flash cards • Pre- and post-lecture quizzes • Microsoft Office 2007 lab manual and projects • How-to animations for Microsoft Office • Additional cases CHAPTER OUTLINE 3.1 Ethical Issues 3.2 Threats to Information Security 3.3 Protecting Information Resources What’s in IT for me? ACC FIN MKT OM HRM MIS rain_c03_070-121hr.qxd 28-09-2009 11:25 Page 72 72 Chapter 3 Ethics, Privacy, and Information Security Opening Case NASA Loses Secret Information for Years The Business Problem Over the past decade, U.S. government agencies have been the victims of an unprecedented number of cyber-attacks. One government official noted, “It is espionage on a massive scale.” Government agencies reported almost 13,000 security incidents...
Words: 25389 - Pages: 102
...4.1 Framework Control Objectives Management Guidelines Maturity Models COBIT 4.1 The IT Governance Institute® The IT Governance Institute (ITGITM) (www.itgi.org) was established in 1998 to advance international thinking and standards in directing and controlling an enterprise’s information technology. Effective IT governance helps ensure that IT supports business goals, optimises business investment in IT, and appropriately manages IT-related risks and opportunities. ITGI offers original research, electronic resources and case studies to assist enterprise leaders and boards of directors in their IT governance responsibilities. Disclaimer ITGI (the “Owner”) has designed and created this publication, titled COBIT® 4.1 (the “Work”), primarily as an educational resource for chief information officers (CIOs), senior management, IT management and control professionals. The Owner makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of any proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, CIOs, senior management, IT management and control professionals should apply their own professional judgement to the specific circumstances presented by the particular systems or IT environment. Disclosure Copyright © 2007 by the IT Governance...
Words: 85189 - Pages: 341
...4.1 Framework Control Objectives Management Guidelines Maturity Models COBIT 4.1 The IT Governance Institute® The IT Governance Institute (ITGITM) (www.itgi.org) was established in 1998 to advance international thinking and standards in directing and controlling an enterprise’s information technology. Effective IT governance helps ensure that IT supports business goals, optimises business investment in IT, and appropriately manages IT-related risks and opportunities. ITGI offers original research, electronic resources and case studies to assist enterprise leaders and boards of directors in their IT governance responsibilities. Disclaimer ITGI (the “Owner”) has designed and created this publication, titled COBIT® 4.1 (the “Work”), primarily as an educational resource for chief information officers (CIOs), senior management, IT management and control professionals. The Owner makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of any proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, CIOs, senior management, IT management and control professionals should apply their own professional judgement to the specific circumstances presented by the particular systems or IT environment. Disclosure Copyright © 2007 by...
Words: 84132 - Pages: 337
.... Chapter Failure prevention and recovery 19 Eurotunnel response team during one of their regular patrols in the tunnel Source: Eurotunnel Introduction One obvious way of improving operations performance is by preventing failure. Failure is rarely unimportant, but in some operations it is vital that processes do not fail. Failure in aircraft in flight, for example, or electricity supplies to hospitals, or car seat belts, or the emergency services can be literally fatal. For these operations dependability is not just desirable, it is essential. Even in less critical situations, having dependable processes can give a competitive advantage. But no process is perfect and failures will occur. So it is important that we learn from all failures and have plans in place which help them recover and minimize their effects. Figure 19.1 shows how this chapter fits into the operation’s improvement activities. Operations strategy Failure prevention and recovery Operations process improvement makes processes better Design Operations management Improvement Total quality management organizes process improvement Planning and control Failure prevention and recovery stops processes becoming worse Topic covered in this chapter Figure 19.1 This chapter covers failure prevention and recovery . 618 Part Four Improvement Key questions I I I I I ??? Why do operations fail? How is failure measured? How can failure and potential failure be...
Words: 25060 - Pages: 101
...Fundamentals of Network Security John E. Canavan Artech House Boston • London http://www.artechhouse.com Library of Congress Cataloging-in-Publication Data Canavan, John E. Fundamentals of network security / John E. Canavan. p. cm.—(Artech House telecommunications library) Includes bibliographical references and index. ISBN 1-58053-176-8 (alk. paper) 1. Computer security. 2. Computer networks—Security measures. I. Title. II. Series. QA76.9.A25 C364 2000 005.8—dc21 00-050810 CIP British Library Cataloguing in Publication Data Canavan, John E. Fundamentals of network security.—(Artech House telecommunications library) 1. Computer networks—Security measures I. Title 005.8 1-58053-176-8 Cover design by Yekaterina Ratner Microsoft ® screen shots reprinted by permission from Microsoft Corporation. Netscape Communicator browser window © 1999 Netscape Communications Corporation. Used with permission. Netscape Communications has not authorized, sponsored, endorsed, or approved this publication and is not responsible for its content. Permission to reproduce screen shots from the PGP and Sniffer products has been provided by Network Associates, Inc. Network Associates, PGP, Pretty Good Privacy Sniffer, and Distributed Sniffer System are registered trademarks of Network Associates, Inc. and/or its affiliates in the U.S. and/or other countries. MIT screen shots used with permission. Qualcomm's Eudora screen shots used with permission. Copyright © 2001 ARTECH HOUSE, INC. 685 Canton Street...
Words: 95027 - Pages: 381
...Butterworth-Heinemann is an imprint of Elsevier Linacre House, Jordan Hill, Oxford OX2 8DP, UK 30 Corporate Drive, Suite 400, Burlington, MA 01803, USA First edition 2009 Copyright © 2009 Elsevier Ltd. All rights reserved No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means electronic, mechanical, photocopying, recording or otherwise without the prior written permission of the publisher Permissions may be sought directly from Elsevier’s Science & Technology Rights Department in Oxford, UK: phone (144) (0) 1865 843830; fax (144) (0) 1865 853333; email: permissions@elsevier.com. Alternatively you can submit your request online by visiting the Elsevier web site at http://elsevier.com/locate/permissions, and selecting Obtaining permission to use Elsevier material Notice No responsibility is assumed by the publisher for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. Because of rapid advances in the medical sciences, in particular, independent verification of diagnoses and drug dosages should be made. British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library Library of Congress Cataloguing in Publication Data A catalog record for this book is available from the Library of Congress ISBN–13:...
Words: 89973 - Pages: 360
...The Optimal Reference Book: Project Management Success Factors Extraordinary insight™ into today’s education information topics Table of Contents Why 70% of Government IT Projects Fail, Quality Project Management for Education Agencies .............................................................................................. 5 About the Author.................................................................................................... 8 Foreword................................................................................................................. 9 Selecting the Right Vendor to Manage Your Project .............................................. 11 Project Governance........................................................................................... 13 Project Risk ....................................................................................................... 14 Issue Management............................................................................................ 14 Education Agency Uniqueness .......................................................................... 14 Unfunded Mandates and Local Control............................................................. 15 ESP’s Quality Project Management (QPM) for Education Agencies ......................... 16 QPM Overview.................................................................................................. 16 QPM Principles...............................................
Words: 28042 - Pages: 113
