حاکمیت فناوری اطلاعات: راهنمای بین‌المللی امنیت داده و استانداردهای ISO 27001/ISO 27002 ۲۰۱۹
IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 2019

1. Cover

2. Half-title Page

3. Title Page

4. Contents

5. About the author

6. Introduction

7. The information economy

8. What is IT governance?

9. Information security

01 Why is information security necessary?

11. The nature of information security threats

12. Information insecurity

13. Impacts of information security threats

14. Cybercrime

15. Cyberwar

16. Advanced persistent threat

17. Future risks

18. Legislation

19. Benefits of an information security management system

02 The Corporate Governance Code, the FRC Risk Guidance and Sarbanes–Oxley

21. The Combined Code

22. The Turnbull Report

23. The Corporate Governance Code

24. Sarbanes–Oxley

25. Enterprise risk management

26. Regulatory compliance

27. IT governance

03 ISO27001

29. Benefits of certification

30. The history of ISO27001 and ISO27002

31. The ISO/IEC 27000 series of standards

32. Use of the standard

33. ISO/IEC 27002

34. Continual improvement, Plan–Do–Check–Act, and process approach

35. Structured approach to implementation

36. Management system integration

37. Documentation

38. Continual improvement and metrics

04 Organizing information security

40. Internal organization

41. Management review

42. The information security manager

43. The cross-functional management forum

44. The ISO27001 project group

45. Specialist information security advice

46. Segregation of duties

47. Contact with special interest groups

48. Contact with authorities

49. Information security in project management

50. Independent review of information security

51. Summary

05 Information security policy and scope

53. Context of the organization

54. Information security policy

55. A policy statement

56. Costs and the monitoring of progress

06 The risk assessment and Statement of Applicability

58. Establishing security requirements

59. Risks, impacts and risk management

60. Cyber Essentials

61. Selection of controls and Statement of Applicability

62. Statement of Applicability Example

63. Gap analysis

64. Risk assessment tools

65. Risk treatment plan

66. Measures of effectiveness

07 Mobile devices

68. Mobile devices and teleworking

69. Teleworking

08 Human resources security

71. Job descriptions and competency requirements

72. Screening

73. Terms and conditions of employment

74. During employment

75. Disciplinary process

76. Termination or change of employment

09 Asset management

78. Asset owners

79. Inventory

80. Acceptable use of assets

81. Information classification

82. Unified classification markings

83. Government classification markings

84. Information lifecycle

85. Information labelling and handling

86. Non-disclosure agreements and trusted partners

10 Media handling

88. Physical media in transit

11 Access control

90. Hackers

91. Hacker techniques

92. System configuration

93. Access control policy

94. Network Access Control

12 User access management

96. User access provisioning

13 System and application access control

98. Secure log-on procedures

99. Password management system

100. Use of privileged utility programs

101. Access control to program source code

14 Cryptography

103. Encryption

104. Public key infrastructure

105. Digital signatures

106. Non-repudiation services

107. Key management

15 Physical and environmental security

109. Secure areas

110. Delivery and loading areas

16 Equipment security

112. Equipment siting and protection

113. Supporting utilities

114. Cabling security

115. Equipment maintenance

116. Removal of assets

117. Security of equipment and assets off-premises

118. Secure disposal or reuse of equipment

119. Clear desk and clear screen policy

17 Operations security

121. Documented operating procedures

122. Change management

123. Separation of development, testing and operational environments

124. Back-up

18 Controls against malicious software (malware)

126. Viruses, worms, Trojans and rootkits

127. Spyware

128. Anti-malware software

129. Hoax messages and Ransomware

130. Phishing and pharming

131. Anti-malware controls

132. Airborne viruses

133. Technical vulnerability management

134. Information Systems Audits

19 Communications management

136. Network security management

20 Exchanges of information

138. Information transfer policies and procedures

139. Agreements on information transfers

140. E-mail and social media

141. Security risks in e-mail

142. Spam

143. Misuse of the internet

144. Internet acceptable use policy

145. Social media

21 System acquisition, development and maintenance

147. Security requirements analysis and specification

148. Securing application services on public networks

149. E-commerce issues

150. Security technologies

151. Server security

152. Server virtualization

153. Protecting application services transactions

22 Development and support processes

155. Secure development policy

156. Secure systems engineering principles

157. Secure development environment

158. Security and acceptance testing

23 Supplier relationships

160. Information security policy for supplier relationships

161. Addressing security within supplier agreements

162. ICT supply chain

163. Monitoring and review of supplier services

164. Managing changes to supplier services

24 Monitoring and information security incident management

166. Logging and monitoring

167. Information security events and incidents

168. Incident management – responsibilities and procedures

169. Reporting information security events

170. Reporting software malfunctions

171. Assessment of and decision on information security events

172. Response to information security incidents

173. Legal admissibility

25 Business and information security continuity management

175. ISO22301

176. The business continuity management process

177. Business continuity and risk assessment

178. Developing and implementing continuity plans

179. Business continuity planning framework

180. Testing, maintaining and reassessing business continuity plans

181. Information security continuity

26 Compliance

183. Identification of applicable legislation

184. Intellectual property rights

185. Protection of organizational records

186. Privacy and protection of personally identifiable information

187. Regulation of cryptographic controls

188. Compliance with security policies and standards

189. Information systems audit considerations

27 The ISO27001 audit

191. Selection of auditors

192. Initial audit

193. Preparation for audit

194. Terminology

195. Appendix 1: Useful websites

196. IT Governance Ltd

197. ISO27001 certification-related organizations

198. Microsoft

199. Information security

200. Appendix 2: Further reading

201. ISO27000 family of standards includes:

202. Books

203. Toolkits

204. Index

205. Copyright