Information Security Management Handbook, Volume 6 (6^th Ed.)

Updated annually, the Information Security Management Handbook, Sixth Edition, Volume 6 is the most comprehensive and up-to-date reference available on information security and assurance. Bringing together the knowledge, skills, techniques, and tools required of IT security professionals, it facilitates the up-to-date understanding required to stay one step ahead of evolving threats, standards, and regulations.

Reporting on the latest developments in information security and recent changes to the (ISC)2® CISSP Common Body of Knowledge (CBK®), this volume features new information on advanced persistent threats, HIPAA requirements, social networks, virtualization, and SOA. Its comprehensive coverage touches on all the key areas IT security professionals need to know, including:

• Access Control: Technologies and administration including the requirements of current laws
• Telecommunications and Network Security: Addressing the Internet, intranet, and extranet
• Information Security and Risk Management: Organizational culture, preparing for a security audit, and the risks of social media
• Application Security: Ever-present malware threats and building security into the development process
• Security Architecture and Design: Principles of design including zones of trust
• Cryptography: Elliptic curve cryptosystems, format-preserving encryption
• Operations Security: Event analysis
• Business Continuity and Disaster Recovery Planning: Business continuity in the cloud
• Legal, Regulations, Compliance, and Investigation: Persistent threats and incident response in the virtual realm
• Physical Security: Essential aspects of physical security

The ubiquitous nature of computers and networks will always provide the opportunity and means to do harm. This edition updates its popular predecessors with the information you need to address the vulnerabilities created by recent innovations such as cloud computing, mobile banking, digital wallets, and near-field communications. This handbook is also available on CD.

Access Control. Telecommunications & Network Security. Information Security & Risk Management. Application Security. Cryptography. Security Architecture & Design. Operations Security. Business Continuity Planning & Disaster Recovery Planning. Legal, Regulations, Compliance & Investigation. Physical Security.

About the Editors:

Sadly, Harold F. Tipton passed away on Friday, March 16, 2012. We’re grateful for his many years of friendship and guidance. Hal was instrumental in the creation and development of the information security publishing program at CRC Press.

Hal was an independent consultant and past president of the International Information System Security Certification Consortium (ISC)2. He was the director of Computer Security for Rockwell International Corporation for 15 years. He initiated the Rockwell computer and data security program in 1977 and then continued to administer, develop, enhance, and expand the program to accommodate the control needs produced by technological advances until his retirement from Rockwell in 1994. He was a member of the Information Systems Security Association (ISSA) since 1982, president of the Los Angeles Chapter in 1984, and president of the national organization of ISSA from 1987 to 1989. He was added to the ISSA Hall of Fame and the ISSA Honor Roll in 2000. He received the Computer Security Institute "Lifetime Achievement Award" in 1994 and the (ISC)2 "Hal Tipton Award" in 2001. He was a member of the National Institute for Standards and Technology (NIST) Computer and Telecommunications Security Council and the National Research Council Secure Systems Study Committee (for the National Academy of Science). He received a bachelor of science degree in engineering from the U.S. Naval Academy, a master’s degree in personnel administration from George Washington University, and a certificate in computer science from the University of California, Irvine. He published several papers on information security issues in the Information Security Management Handbook, Data Security Management, Information Systems Security, and the National Academy of Sciences report Computers at Risk.

He was a frequent speaker at all major information security conferences, including the Computer Secu