Mike Chapple, PhD, CISSP, CISM, CIPP/US, CIPM, and CCSP, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame’s Mendoza College of Business. He is the bestselling author of over 50 technical books. He is also the Faculty Director of the University’s Business/Computer Science program. Joe Shelley, CIPP/US, CIPM, and Security+, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees the information security and privacy programs, IT risk management, business intelligence and analytics, and data governance. James Michael Stewart, CISSP, CEH, CHFI, ECSA, CND, ECIH, CEI, and CFR, has been writing and training for more than 25 years, with a focus on CISSP, internet security and ethical hacking/penetration testing. He is the author of and contributor to more than 80 books on security certification, Microsoft topics, and network administration.

• Introduction xiii1 Security and Privacy Foundations 1Security 101 1Confidentiality, Integrity, and Availability (CIA) 3Disclosure, Alteration, and Destruction (DAD) 4Authentication, Authorization, and Accounting (AAA) 5Privacy in the Modern Era 6Foundational Privacy Principles 8Security and Privacy Frameworks 11Security and Privacy Policies: Creation and Enforcement 14Establishing Security Awareness Programs 16Security Strategies 192 Governance, Risk Management, and Compliance 23The Role of Governance in Security and Privacy 23Key Regulations and Standards 26Regulatory Compliance 29Building and Managing a Risk Management Framework 32Managing Third-Party Risks and Vendor Assessments 353 Security Architecture and Design 39Principles of Secure Design 39Security Operations Foundations 42Ensuring Confidentiality, Integrity, and Availability 44Understanding Security Models 46Implementing Personnel Security 49Applying Protection Mechanisms 52System Resilience and High Availability 544 Identity and Access Management 57IAM Core Concepts and Principles 57Authentication Methods and Multifactor Authentication 60Role-Based Access Control Versus Attribute-Based Access Control 62Identity Federation and Single Sign-On 65Zero Trust Architecture for IAM 68Identity Governance Life Cycle 71Access Control Attacks 735 Data Protection and Privacy Engineering 77Data Classification and Labeling 77Data Masking, Tokenization, and Encryption 80Data Loss Prevention Strategies 82Privacy by Design 85Developing a Privacy Program 87Cross-Border Data Transfers and Legal Implications 90Data Subject Rights and Privacy Request Handling 93Data Retention, Archiving, and Secure Disposal 966 Security and Privacy Incident Management 101Incident Response Planning 101Detection and Triage of Security and Privacy Incidents 104Investigating Incidents 106Communication Plans for Incident Response 110Post-Incident Review and Lessons Learned 113Privacy Breach Notifications and Regulatory Reporting 1177 Network Security and Privacy Protections 121Secure Network Components 121Network Segmentation 125System Hardening 128Firewalls and Intrusion Detection/Prevention Systems 130Virtual Private Networks and Secure Access Service Edge 133Secure Wireless Network Management 136Securing the Cloud 139Network Monitoring 1428 Security Assessment and Testing 145Building a Security Assessment and Testing Program 145Vulnerability Management 147Understanding Security Vulnerabilities 150Penetration Testing 153Testing Software 155Training and Exercises 1589 Endpoint and Device Security 163Endpoint Detection and Response 163Network Device Security 166Mobile Device Management 169Understanding Malware 173Malware Prevention 176Patching and Vulnerability Remediation 17810 Application Security 183Secure Software Development Life Cycle 183DevSecOps and DevOps Integration 187Application Attacks 191Injection Vulnerabilities 192Authorization Vulnerabilities 194Web Application Attacks 196Application Security Controls 198Coding Best Practices 20111 Cryptography Essentials 205Core Cryptography Concepts 205Symmetric Cryptography 208Asymmetric Cryptography 210Hash Functions 213Digital Signatures 216Public Key Infrastructure 218Key Management Best Practices 220Cryptographic Attacks 22212 Physical and Environmental Security 227Security and Facility Design 227Physical Access Controls and Monitoring 229Security in Data Centers and Server Rooms 232Environmental Controls 234Implement and Manage Physical Security 23513 Legal and Ethical Considerations 237Computer Crime 238Intellectual Property Laws 241Software Licensing Laws 243Import/Export Laws 244Privacy Laws 246Compliance 249Ethical Considerations 25014 Threat Intelligence and Cyber Defense 253Threat Actors 253Threat Vectors 256Threat Intelligence 258Threat Feeds 259Threat Hunting 262Assessing Threat Intelligence 263Cyber Kill Chain and the MITRE ATT&CK 26515 Business Continuity and Disaster Recovery 269Project Scope and Planning 270Conducting Business Impact Analysis 273Business Continuity Planning Essentials 277Recovery Planning Essentials 279Disaster Recovery Strategies and Solutions 282Testing and Simulation Exercises 284Index 289

Mike Chapple, PhD, CISSP, CISM, CIPP/US, CIPM, and CCSP, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame’s Mendoza College of Business. He is the bestselling author of over 50 technical books. He is also the Faculty Director of the University’s Business/Computer Science program. Joe Shelley, CIPP/US, CIPM, and Security+, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees the information security and privacy programs, IT risk management, business intelligence and analytics, and data governance. James Michael Stewart, CISSP, CEH, CHFI, ECSA, CND, ECIH, CEI, and CFR, has been writing and training for more than 25 years, with a focus on CISSP, internet security and ethical hacking/penetration testing. He is the author of and contributor to more than 80 books on security certification, Microsoft topics, and network administration.

• Introduction xiii1 Security and Privacy Foundations 1Security 101 1Confidentiality, Integrity, and Availability (CIA) 3Disclosure, Alteration, and Destruction (DAD) 4Authentication, Authorization, and Accounting (AAA) 5Privacy in the Modern Era 6Foundational Privacy Principles 8Security and Privacy Frameworks 11Security and Privacy Policies: Creation and Enforcement 14Establishing Security Awareness Programs 16Security Strategies 192 Governance, Risk Management, and Compliance 23The Role of Governance in Security and Privacy 23Key Regulations and Standards 26Regulatory Compliance 29Building and Managing a Risk Management Framework 32Managing Third-Party Risks and Vendor Assessments 353 Security Architecture and Design 39Principles of Secure Design 39Security Operations Foundations 42Ensuring Confidentiality, Integrity, and Availability 44Understanding Security Models 46Implementing Personnel Security 49Applying Protection Mechanisms 52System Resilience and High Availability 544 Identity and Access Management 57IAM Core Concepts and Principles 57Authentication Methods and Multifactor Authentication 60Role-Based Access Control Versus Attribute-Based Access Control 62Identity Federation and Single Sign-On 65Zero Trust Architecture for IAM 68Identity Governance Life Cycle 71Access Control Attacks 735 Data Protection and Privacy Engineering 77Data Classification and Labeling 77Data Masking, Tokenization, and Encryption 80Data Loss Prevention Strategies 82Privacy by Design 85Developing a Privacy Program 87Cross-Border Data Transfers and Legal Implications 90Data Subject Rights and Privacy Request Handling 93Data Retention, Archiving, and Secure Disposal 966 Security and Privacy Incident Management 101Incident Response Planning 101Detection and Triage of Security and Privacy Incidents 104Investigating Incidents 106Communication Plans for Incident Response 110Post-Incident Review and Lessons Learned 113Privacy Breach Notifications and Regulatory Reporting 1177 Network Security and Privacy Protections 121Secure Network Components 121Network Segmentation 125System Hardening 128Firewalls and Intrusion Detection/Prevention Systems 130Virtual Private Networks and Secure Access Service Edge 133Secure Wireless Network Management 136Securing the Cloud 139Network Monitoring 1428 Security Assessment and Testing 145Building a Security Assessment and Testing Program 145Vulnerability Management 147Understanding Security Vulnerabilities 150Penetration Testing 153Testing Software 155Training and Exercises 1589 Endpoint and Device Security 163Endpoint Detection and Response 163Network Device Security 166Mobile Device Management 169Understanding Malware 173Malware Prevention 176Patching and Vulnerability Remediation 17810 Application Security 183Secure Software Development Life Cycle 183DevSecOps and DevOps Integration 187Application Attacks 191Injection Vulnerabilities 192Authorization Vulnerabilities 194Web Application Attacks 196Application Security Controls 198Coding Best Practices 20111 Cryptography Essentials 205Core Cryptography Concepts 205Symmetric Cryptography 208Asymmetric Cryptography 210Hash Functions 213Digital Signatures 216Public Key Infrastructure 218Key Management Best Practices 220Cryptographic Attacks 22212 Physical and Environmental Security 227Security and Facility Design 227Physical Access Controls and Monitoring 229Security in Data Centers and Server Rooms 232Environmental Controls 234Implement and Manage Physical Security 23513 Legal and Ethical Considerations 237Computer Crime 238Intellectual Property Laws 241Software Licensing Laws 243Import/Export Laws 244Privacy Laws 246Compliance 249Ethical Considerations 25014 Threat Intelligence and Cyber Defense 253Threat Actors 253Threat Vectors 256Threat Intelligence 258Threat Feeds 259Threat Hunting 262Assessing Threat Intelligence 263Cyber Kill Chain and the MITRE ATT&CK 26515 Business Continuity and Disaster Recovery 269Project Scope and Planning 270Conducting Business Impact Analysis 273Business Continuity Planning Essentials 277Recovery Planning Essentials 279Disaster Recovery Strategies and Solutions 282Testing and Simulation Exercises 284Index 289