CISM Certified Information Security Manager Study Guide

ABOUT THE AUTHOR MIKE CHAPPLE, PhD, CISM, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dames Mendoza College of Business. He is a bestselling author of over 25 books and serves as the Academic Director of the Universitys Master of Science in Business Analytics program. He holds multiple additional certifications, including the CISSP (Certified Information Systems Security Professional), CySA+ (CompTIA Cybersecurity Analyst), CIPP/US (Certified Information Privacy Professional), CompTIA PenTest+, and CompTIA Security+. Mike provides cybersecurity certification resources at his website, CertMike.com

Introduction Assessment Test xxi Chapter 1 Todays Information Security Manager 1 Information Security Objectives 2 Role of the Information Security Manager 3 Chief Information Security Officer 4 Lines of Authority 4 Organizing the Security Team 5 Roles and Responsibilities 7 Information Security Risks 8 The DAD Triad 8 Incident Impact 9 Building an Information Security Strategy 12 Threat Research 12 SWOT Analysis 13 Gap Analysis 13 Creating SMART Goals 16 Alignment with Business Strategy 16 Leadership Support 17 Internal and External Influences 17 Cybersecurity Responsibilities 18 Communication 19 Action Plans 19 Implementing Security Controls 20 Security Control Categories 21 Security Control Types 21 Data Protection 23 Summary 25 Exam Essentials 25 Review Questions 27 Chapter 2 Information Security Governance and Compliance 31 Governance 33 Corporate Governance 33 Governance, Risk, and Compliance Programs 35 Information Security Governance 35 Developing Business Cases 36 Third- Party Relationships 37 Understanding Policy Documents 38 Policies 38 Standards 40 Procedures 42 Guidelines 43 Exceptions and Compensating Controls 44 Developing Policies 45 Complying with Laws and Regulations 46 Adopting Standard Frameworks 47 Cobit 47 NIST Cybersecurity Framework 49 NIST Risk Management Framework 52 ISO Standards 53 Benchmarks and Secure Configuration Guides 54 Security Control Verification and Quality Control 56 Summary 57 Exam Essentials 57 Review Questions 59 Chapter 3 Information Risk Management 63 Analyzing Risk 65 Risk Identification 66 Risk Calculation 67 Risk Assessment 68 Risk Treatment and Response 72 Risk Mitigation 73 Risk Avoidance 74 Risk Transference 74 Risk Acceptance 75 Risk Analysis 75 Disaster Recovery Planning 78 Disaster Types 78 Business Impact Analysis 79 Privacy 79 Sensitive Information Inventory 80 Information Classification 80 Data Roles and Responsibilities 82 Information Lifecycle 83 Privacy- Enhancing Technologies 83 Privacy and Data Breach Notification 84 Summary 84 Exam Essentials 85 Review Questions 86 Chapter 4 Cybersecurity Threats 91 Chapter 5 Exploring Cybersecurity Threats 92 Classifying Cybersecurity Threats 92 Threat Actors 94 Threat Vectors 99 Threat Data and Intelligence 101 Open Source Intelligence 101 Proprietary and Closed Source Intelligence 104 Assessing Threat Intelligence 105 Threat Indicator Management and Exchange 107 Public and Private Information Sharing Centers 108 Conducting Your Own Research 108 Summary 109 Exam Essentials 109 Review Questions 111 Information Security Program Development and Management 115 Information Security Programs 117 Establishing a New Program 117 Maintaining an Existing Program 121 Security Awareness and Training 123 User Training 123 Role- Based Training 124 Ongoing Awareness Efforts 124 Managing the Information Security Team 125 Hiring Team Members 126 Developing the Security Team 126 Managing the Security Budget 127 Organizational Budgeting 127 Fiscal Years 127 Expense Types 128 Budget Monitoring 129 Integrating Security with Other Business Functions 130 Procurement 130 Accounting 133 Human Resources 133 Information Technology 135 Audit 138 Summary 139 Exam Essentials 139 Review Questions 141 Chapter 6 Security Assessment and Testing 145 Vulnerability Management 146 Identifying Scan Targets 146 Determining Scan Frequency 148 Configuring Vulnerability Scans 149 Scanner Maintenance 154 Vulnerability Scanning Tools 155 Reviewing and Interpreting Scan Reports 159 Validating Scan Results 160 Security Vulnerabilities 161 Patch Management 162 Legacy Platforms 163 Weak Configurations 164 Error Messages 164 Insecure Protocols 165 Weak Encryption 166 Penetration Testing 167 Adopting the Hacker