Cyber security policy guidebook

Cyber Security Policy Guidebook......Page 5
Contents......Page 7
Foreword......Page 11
Preface......Page 13
Acknowledgments......Page 17
1.1 What Is Cyber Security?......Page 19
1.2 What Is Cyber Security Policy?......Page 21
1.3.1 Laws and Regulations......Page 25
1.3.2 Enterprise Policy......Page 27
1.3.4 Technology Configuration......Page 28
1.4 Strategy versus Policy......Page 29
2.1 Productivity......Page 33
2.2 Internet......Page 39
2.3 e-Commerce......Page 46
2.4 Countermeasures......Page 52
2.5 Challenges......Page 55
3: Cyber Security Objectives......Page 57
3.1 Cyber Security Metrics......Page 58
3.2 Security Management Goals......Page 63
3.3 Counting Vulnerabilities......Page 67
3.4 Security Frameworks......Page 69
3.4.1 e-Commerce Systems......Page 70
3.4.2 Industrial Control Systems......Page 75
3.4.3 Personal Mobile Devices......Page 80
3.5 Security Policy Objectives......Page 85
4.1 Tone at the Top......Page 87
4.2 Policy as a Project......Page 89
4.3 Cyber Security Management......Page 91
4.3.1 Arriving at Goals......Page 92
4.3.2 Cyber Security Documentation......Page 95
4.4 Using the Catalog......Page 97
5: The Catalog Approach......Page 101
5.1 Catalog Format......Page 105
5.2 Cyber Security Policy Taxonomy......Page 107
6: Cyber Security Policy Catalog......Page 111
6.1 Cyber Governance Issues......Page 112
6.1.1 Net Neutrality......Page 113
6.1.2 Internet Names and Numbers......Page 114
6.1.3 Copyrights and Trademarks......Page 121
6.1.4 Email and Messaging......Page 125
6.2 Cyber User Issues......Page 130
6.2.1 Malvertising......Page 134
6.2.2 Impersonation......Page 135
6.2.3 Appropriate Use......Page 139
6.2.4 Cyber Crime......Page 143
6.2.5 Geolocation......Page 154
6.2.6 Privacy......Page 156
6.3 Cyber Conflict Issues......Page 158
6.3.1 Intellectual Property Theft......Page 162
6.3.2 Cyber Espionage......Page 163
6.3.4 Cyber Warfare......Page 168
6.4 Cyber Management Issues......Page 173
6.4.1 Fiduciary Responsibility......Page 180
6.4.2 Risk Management......Page 181
6.4.3 Professional Certification......Page 189
6.4.4 Supply Chain......Page 190
6.4.5 Security Principles......Page 193
6.4.6 Research and Development......Page 203
6.5 Cyber Infrastructure Issues......Page 204
6.5.1 Banking and Finance......Page 208
6.5.2 Health Care......Page 212
6.5.3 Industrial Control Systems......Page 215
7.1 U.S. Federal Cyber Security Strategy......Page 229
7.2.1 The Bombing of New York’s World Trade Center on February 26, 1993......Page 230
7.2.2 Cyber Attacks against the United States Air Force, March–May 1994: Targeting the Pentagon......Page 231
7.2.3 The Citibank Caper, June–October, 1994: How to Catch a Hacker......Page 232
7.2.4 Murrah Federal Building, Oklahoma City—April 19, 1995: Major Terrorism Events and Their U.S. Outcomes......Page 233
7.2.5 President’s Commission on Critical Infrastructure Protection—1996......Page 234
7.2.6 Presidential Decision Directive 63—1998......Page 236
7.2.8 Eligible Receiver—1997......Page 237
7.2.9 Solar Sunrise—1998......Page 238
7.2.10 Joint Task Force—Computer Network Defense (JTF-CND)—1998......Page 239
7.2.11 Terrorist Attacks against the United States—September 11, 2001 Effects of Catastrophic Events on Transportation System Management and Operations......Page 240
7.2.12 U.S. Government Response to the September 11, 2001 Terrorist Attacks......Page 242
7.2.13 Homeland Security Presidential Directives......Page 244
7.2.14 National Strategies......Page 245
7.3 The Rise of Cyber Crime......Page 248
7.4 Espionage and Nation-State Actions......Page 250
7.5 Policy Response to Growing Espionage Threats: U.S. Cyber Command......Page 251
7.6 Congressional Action......Page 253
7.7 Summary......Page 254
8: Conclusion......Page 257
Glossary......Page 261
References......Page 273
Index......Page 285