Security Controls Evaluation, Testing, and Assessment Handbook, Second Edition, provides a current and well-developed approach to evaluate and test IT security controls to prove they are functioning correctly. This handbook discusses the world of threats and potential breach actions surrounding all industries and systems. Sections cover how to take FISMA, NIST Guidance, and DOD actions, while also providing a detailed, hands-on guide to performing assessment events for information security professionals in US federal agencies. This handbook uses the DOD Knowledge Service and the NIST Families assessment guides as the basis for needs assessment, requirements and evaluation efforts.
1. Introduction - p. ix 2. Section 1 - p. ix 3. Chapter 1. Introduction to assessments - p. 3 4. Chapter 2. Risk, security, and assurance - p. 5 5. Chapter 3. Statutory and regulatory GRC - p. 9 6. Chapter 4. Federal Risk Management Framework requirements - p. 27 7. Chapter 5. Risk Management Framework - p. 31 8. Chapter 6. Roles and responsibilities - p. 43 9. Section 2 Introduction - p. 54 10. Section II Introduction - p. 55 11. Chapter 7. Assessment process - p. 61 12. Chapter 8. Assessment methods - p. 73 13. Chapter 9. Assessment techniques for each kind of control - p. 85 14. Security assessment plan developmental process - p. 85 15. Security assessment actions - p. 86 16. Security controls by family - p. 86 17. Chapter 10. System and network assessments - p. 447 18. Chapter 11. Security component fundamentals for assessment - p. 471 19. Management areas of consideration - p. 471 20. Management controls - p. 473 21. Information security resources - p. 474 22. Measures of performance (SP 800-55) - p. 475 23. Measures of performance - p. 475 24. Metric types - p. 475 25. Metrics development process - p. 475 26. Federal Enterprise Architecture - p. 477 27. Security services life cycle - p. 479 28. General considerations for security services - p. 479 29. Information security and external parties - p. 480 30. Operational areas of consideration - p. 482 31. Operational security controls key concepts - p. 483 32. Awareness and training - p. 483 33. Training Continuum - p. 536 34. A. Seven steps to contingency planning as defined in SP 800-34 - p. 483 35. B. BIA requirements - p. 490 36. C. Numbers that matter—critical recovery numbers - p. 491 37. D. Recovery strategies - p. 492 38. E. SP 800-82 guide to test, training, and exercise programs for IT plans and capabilities - p. 492 39. F. Contingency plan testing - p. 493 40. Federal agency incident categories - p. 497 41. System maintenance - p. 501 42. Encryption standards for use and review in federal systems - p. 501 43. Media protection - p. 503 44. Media sanitation - p. 503 45. Types of media - p. 503 46. Sanitization and disposition decision flow - p. 504 47. Storage encryption technologies - p. 504 48. Physical security - p. 506 49. Personnel security - p. 506 50. Staffing - p. 506 51. Systems integrity - p. 507 52. Malware incident prevention and handling - p. 507 53. Malware categories - p. 507 54. Email security—spam - p. 507 55. Technical areas of consideration - p. 508 56. Access control - p. 509 57. Identification and authentication - p. 512 58. Log-on IDs and passwords - p. 512 59. Management of biometrics - p. 512 60. Single sign-on (SSO) - p. 512 61. Systems and communications protection - p. 513 62. SSL protocol basics - p. 517 63. Transport layer security (TLS) - p. 518 64. Wireless networking - p. 519 65. Secure hash - p. 526 66. Firewalls - p. 530 67. Firewall general features - p. 530 68. Firewall types - p. 531 69. Audit and accounting - p. 535 70. Chapter 12. Cybersecurity framework - p. 537 71. Chapter 13. Controlled unclassified information assessment - p. 549 72. Chapter 14. Evidence of assessment - p. 555 73. Chapter 15. Reporting - p. 565 74. Chapter 16. Conclusion - p. 571 75. Appendix A. Acronym List - p. 573 76. Appendix B. FedRAMP assessment process and templates - p. 575 77. Appendix C. Templates for testing and evaluation reports - p. 667 78. Index - p. 767
Security Controls Evaluation, Testing, and Assessment Handbook, Second Edition, provides a current and well-developed approach to evaluate and test IT security controls to prove they are functioning correctly. This handbook discusses the world of threats and potential breach actions surrounding all industries and systems. Sections cover how to take FISMA, NIST Guidance, and DOD actions, while also providing a detailed, hands-on guide to performing assessment events for information security professionals in US federal agencies. This handbook uses the DOD Knowledge Service and the NIST Families assessment guides as the basis for needs assessment, requirements and evaluation efforts.
1. Introduction - p. ix 2. Section 1 - p. ix 3. Chapter 1. Introduction to assessments - p. 3 4. Chapter 2. Risk, security, and assurance - p. 5 5. Chapter 3. Statutory and regulatory GRC - p. 9 6. Chapter 4. Federal Risk Management Framework requirements - p. 27 7. Chapter 5. Risk Management Framework - p. 31 8. Chapter 6. Roles and responsibilities - p. 43 9. Section 2 Introduction - p. 54 10. Section II Introduction - p. 55 11. Chapter 7. Assessment process - p. 61 12. Chapter 8. Assessment methods - p. 73 13. Chapter 9. Assessment techniques for each kind of control - p. 85 14. Security assessment plan developmental process - p. 85 15. Security assessment actions - p. 86 16. Security controls by family - p. 86 17. Chapter 10. System and network assessments - p. 447 18. Chapter 11. Security component fundamentals for assessment - p. 471 19. Management areas of consideration - p. 471 20. Management controls - p. 473 21. Information security resources - p. 474 22. Measures of performance (SP 800-55) - p. 475 23. Measures of performance - p. 475 24. Metric types - p. 475 25. Metrics development process - p. 475 26. Federal Enterprise Architecture - p. 477 27. Security services life cycle - p. 479 28. General considerations for security services - p. 479 29. Information security and external parties - p. 480 30. Operational areas of consideration - p. 482 31. Operational security controls key concepts - p. 483 32. Awareness and training - p. 483 33. Training Continuum - p. 536 34. A. Seven steps to contingency planning as defined in SP 800-34 - p. 483 35. B. BIA requirements - p. 490 36. C. Numbers that matter—critical recovery numbers - p. 491 37. D. Recovery strategies - p. 492 38. E. SP 800-82 guide to test, training, and exercise programs for IT plans and capabilities - p. 492 39. F. Contingency plan testing - p. 493 40. Federal agency incident categories - p. 497 41. System maintenance - p. 501 42. Encryption standards for use and review in federal systems - p. 501 43. Media protection - p. 503 44. Media sanitation - p. 503 45. Types of media - p. 503 46. Sanitization and disposition decision flow - p. 504 47. Storage encryption technologies - p. 504 48. Physical security - p. 506 49. Personnel security - p. 506 50. Staffing - p. 506 51. Systems integrity - p. 507 52. Malware incident prevention and handling - p. 507 53. Malware categories - p. 507 54. Email security—spam - p. 507 55. Technical areas of consideration - p. 508 56. Access control - p. 509 57. Identification and authentication - p. 512 58. Log-on IDs and passwords - p. 512 59. Management of biometrics - p. 512 60. Single sign-on (SSO) - p. 512 61. Systems and communications protection - p. 513 62. SSL protocol basics - p. 517 63. Transport layer security (TLS) - p. 518 64. Wireless networking - p. 519 65. Secure hash - p. 526 66. Firewalls - p. 530 67. Firewall general features - p. 530 68. Firewall types - p. 531 69. Audit and accounting - p. 535 70. Chapter 12. Cybersecurity framework - p. 537 71. Chapter 13. Controlled unclassified information assessment - p. 549 72. Chapter 14. Evidence of assessment - p. 555 73. Chapter 15. Reporting - p. 565 74. Chapter 16. Conclusion - p. 571 75. Appendix A. Acronym List - p. 573 76. Appendix B. FedRAMP assessment process and templates - p. 575 77. Appendix C. Templates for testing and evaluation reports - p. 667 78. Index - p. 767
