The information security professional has evolved from computer operator to chief information security officer; from controlling punched cards to negotiating strategic plans, defining policies, documenting processes, managing technology, measuring performance, controlling costs, supporting business recovery and demonstrating regulatory compliance. This publication includes a case study and steps to: Compose an information security program Cement a relationship between an information security program and IT governance Design roles and responsibilities to ensure accountability Identify and allocate resources to achieve information security program objectives Determine if an information security program is achieving objectives

Stepping Through the InfoSec Program

CISA

Jennifer L. Bayuk

CISM

Isaca

The CISM Review Manual 2009 is a comprehensive reference guide designed to assist individuals in preparing for the Certified Information Security Manager® (CISM®) exam and individuals wishing to understand the roles and responsibilities of an IS manager. The manual has evolved extensively over the past five editions and now represents the most current, comprehensive, globally peer-reviewed information security management resource available. In response to the evolving field of information security management, the extensively expanded and revised 2009 version of the CISM Review Manual continues to move away from the subject of technology and closer to the strategic governance and management aspects of security. There is increasing emphasis on the overarching concepts essential for effective information security management in addition to a focus on the critical thinking and sound judgment required for development and management of increasingly massive and complex security systems and related processes. This publication includes a new and expanded approach to the development of effective security management metrics, based on research projects sponsored by the IT Governance Institute. There is a substantial increase in the scope and depth of coverage on risk management. An expanded focus and structural improvement is included for information security program development as well as a greater concentration on architecture and metrics. The improved approach to management metrics has been carried through to the section on information security management, providing processes to improve overall effectiveness. Also included are case studies to assist the candidate in understanding current practices, definitions of terms most commonly found on the exam, practice questions similar in content to the certification exam and references to additional study materials on specific topics. This manual can be used as a stand-alone document for individual study or as a guide or reference for study groups and chapters conducting local review courses. The manual provides a primary reference resource to information security managers seeking global guidance on effective approaches to governance, risk management, program development, management and incident response. The 2009 edition has been developed to help the CISM candidate understand essential concepts and is organized to facilitate study in the following job practice areas: IS governance Information risk management IS program development IS program management Incident management and response

CISM Review Manual 2009

ISACA

The CISM Review Questions, Answers & Explanations Manual 2009 consists of 450 multiple-choice study     questions that have previously appeared in the CISM Review Questions, Answers & Explanations Manual 2008     and the 2008 Supplement. These questions are not actual exam items, but are intended to provide the CISM     candidate with an understanding of the type and structure of questions and content that have previously     appeared on the exam. This publication is ideal to use in conjunction with the CISM Review Manual     2009.    To assist the user in maximizing study efforts, questions are presented in the following two     ways:  Job practice area Questions, answers and explanations are sorted by the current CISM job practice     areas. This allows the CISM candidate to refer to questions that focus on one area at a time as well as     to evaluate comprehension of the topics covered within each practice area.  Sample 200-question exam Two hundred of the 450 questions included in the manual are selected to     represent a full-length CISM exam, with questions chosen in the same percentages as the current CISM job     practice areas. Candidates are urged to use this sample test not only to simulate an actual exam, but     also to determine their strengths and weaknesses and to identify those areas that require further study.     Answer sheets and an answer/reference key for the sample exam are also included. All sample test     questions have been cross-referenced to the questions sorted by practice area, making it convenient for     the user to refer back to the explanations of the correct answers.

CISM Questions, Answers & Explanations Manual 2009

The CISA Review Manual 2009 has been extensively revised and updated with new content to reflect changing principles and practices, and is organized according to the current CISA job practice areas. The manual features detailed descriptions of the tasks performed by IS auditors and the knowledge required to plan, manage and perform IS audits. The new edition also features new content based on the IT Assurance Framework (ITAF™) recently published by ISACA. ITAF is a comprehensive assurance model that incorporates standards and good practices, providing guidance on the design, conduct and reporting of IT audit and assurance assignments; defines terms and concepts specific to IT assurance; and establishes standards that address IT audit and assurance professional roles and responsibilities, knowledge and skills, diligence, conduct and reporting requirements. The CISA Review Manual 2009 includes brief chapter summaries that focus on the main topics that a candidate should keep in mind, and new case studies to assist the candidate in understanding current practices. Also included are definitions of terms most commonly found on the exam, practice questions similar in content to what has previously appeared on the exam and references to additional study materials on specific topics. This manual can be used as a stand-alone document for individual study or as a guide or reference for study groups and chapters conducting local review courses. The 2009 edition has been developed to help the CISA candidate prepare for the exam and the manual is organized for study in the following job practice areas:  IS audit process  IT governance  Systems and infrastructure life cycle management  IT service delivery and support  Protection of information assets  Business continuity and disaster recovery

CISA Review Manual 2009

The CISM Review Manual 2010 is a comprehensive reference guide designed to assist individuals in preparing for the CISM exam and individuals who wish to understand the roles and responsibilities of an information security manager. The manual has evolved over the past six editions and now represents the most current, comprehensive, globally peer-reviewed information security management resource available. The CISM Review Manual 2010 features a new format. Each of the five chapters has been divided into two sections for focused study. The first section contains the definitions and objectives for the five areas, with the corresponding tasks and knowledge statements that are tested on the exam. Section One is an overview that provides: <ul>
<li>Definitions for the five areas</li> <li>Objectives for each area</li> <li>Descriptions of the tasks</li> <li>A map of the relationship of each task to the knowledge statements</li> <li>A reference guide for the knowledge statements, including the relevant concepts and explanations</li> <li>References to specific content in Section Two for each knowledge statement</li> <li>Sample practice questions and explanations of the answers</li> <li>Suggested resources for further study</li>
</ul>
Section Two consists of reference material and content that supports the knowledge statements. Material included is pertinent for CISM candidates knowledge and/or understanding when preparing for the CISM certification exam. Also included are definitions of terms most commonly found on the exam. This manual can be used as a stand-alone document for individual study or as a guide or reference for study groups and chapters conducting local review courses. It is a primary reference resource for information security managers seeking global guidance on effective approaches to governance, risk management, program development, management and incident response. The 2010 edition has been developed and is organized to assist candidates in understanding essential concepts and studying the following job practice areas: <ul>
<li>Information security governance</li> <li>Information risk management</li> <li>Information security program development</li> <li>Information security program management</li> <li>Incident management and response</li>
</ul>

CISM Review Manual 2010

This updated edition of one of ISACA's most popular guides reflects the many changes that the business environment and Oracle ERP application have undergone since the second edition was published. In response to customer needs and an increased market awareness of governance, risk and compliance (GRC), Oracle Corporation has continued to boost its GRC offerings and released the updated and improved Oracle E-Business Suite (EBS) R12.1 in 2009. Security, Audit and Control Features OracleÃ‚Â® E-Business Suite, 3rd Edition reflects these new developments to provide a current view regarding:
<ul>
<li>How business processes impact ERP implementation and operation</li>
<li>Application functionality</li>
<li>Strategic business risk</li>
<li>Technical system architecture</li>
<li>Security and control criteria/drivers for key functional areas, including</li>
<ul>
<li>Financial account</li>
<li>Expenditures</li>
<li>Web-enabled security</li>
</ul>
<li>IT resource requirements</li>
<li>IT management requirements</li>
<li>Professional services and support</li>
<li>IT integration with other enterprise systems</li>
<li>Organizational and audit department challenges with Oracle E-Business Suite</li>
<li>Oracle E-Business audit programs</li>
<li>Using Oracle to assist with the regulatory requirements of financial reporting and other compliance issues</li>
<li>How Oracle's GRC offering integrates with Oracle E-Business Suite</li>
</ul>
 This in-demand guide also provides an update on current industry standards and identifies future trends in Oracle EBS risk and control. It enables audit, assurance, risk and security professionals (IT and non-IT) to evaluate risks and controls in existing ERP implementations, and facilitate the design and implementation of better practice controls into system upgrades and enhancements. This book also aims to assist system architects, business analysts and business process owners who are implementing Oracle EBS, as well as people responsible for managing it in live production to maintain the appropriate level of control and security according to business needs and industry standards.

Security, Audit and Control Features Oracle E-Business Suite, 3rd Edition

Deloitte Touche Tohmatsu Research Team and ISACA

Monitoring Internal Control Systems and IT provides useful guidance and tools for enterprises interested in applying information technology to support and sustain the monitoring of internal control. Guidance is provided for the design and operation of monitoring activities over existing IT controls; however, customization of the provided approaches reflecting the specific circumstances of each enterprise are required.The main goal/aims of this publication are to:Complement and expand on the 2009 COSO Guidance of Monitoring of Internal ControlsEmphasize the monitoring of application and IT general controlsDiscuss the use of automation (tools) for increased efficiency and effectiveness of monitoring processesThe shift from conceptual elaboration on the concepts and applications for monitoring provides the following help for the professional and the enterprise to implement monitoring:Diverse examplesCase studiesPractical toolsThis publication will be helpful for:Executives/senior management by providing an executive overview and suggested questions to determine whether the monitoring of internal controls is adequately addressedBusiness process owners by describing how to monitor key IT application controls and how to automate monitoring processesIT professionals by supplying templates and tools that can be leveraged when developing and implementing a monitoring project

Monitoring Internal Control Systems and IT

Computers & Technology

Hardware & DIY

Security, Audit and Control Features SAPÃ‚Â® ERP, 3rd Edition, part of the Technical and Risk Management Reference Series, enables assurance, security and risk professionals to evaluate risks and controls in existing ERP implementations and facilitates the design and building of controls into system upgrades and enhancements. The publication is based on SAP ERP [also known as SAP ERP Central Component (ECC)], the latest version of which is SAP ECC 6.0. This in-demand new edition has been updated to reflect: 
<ul>
<li>New/modified SAP transaction codes and reports</li> <li>SAP ERP based on a service oriented architecture (SOA). SOA combines SAP ERP with an open technology platform that can integrate SAP and non-SAP systems using the SAP Netweaver platform.</li> <li>SAP GRC suite of tools, including Access Control and Process Control, which offers corporate governance and risk management solutions</li> </ul>

Security, Audit and Control Features SAP ERP, 3rd Edition

SharePoint has quickly become one of Microsoft s most successful products and the de facto collaboration standard. But deployment is often accompanied by chaos and a wave of frustration called the SharePoint Effect as organizations become overwhelmed by their own success, a lack of planning or insufficient governance. While many bloggers and self-appointed experts have offered best practice guidelines, SharePoint Deployment and Governance Using COBIT 4.1 contains a comprehensive, step-by-step guide on how to practically deploy and govern SharePoint 2007 and 2010 using COBIT 4.1, the leading internationally accepted governance framework. This practical guide blends the needs of the deployment staff and audit teams with a comprehensive blueprint that puts business in charge. The book is filled with authoritative tips, techniques and advice on: How to use COBIT 4.1 for SharePoint deployment and governance on premises or in the cloud Specific considerations when using SharePoint 2007 or SharePoint 2010 Which third-party tools to consider to govern your SharePoint farm How to apply appropriate COBIT processes at each stage of the SharePoint deployment

SharePoint Deployment and Governance Using COBIT 4.1: A Practical Approach

Dave Chennault

Chuck Strain

Protecting information assets is challenging for every enterprise, regardless of size and industry, and it has become an even more complex task for enterprises adopting distributed computing environments. Security, Audit and Control Features OracleDatabase, 3rd Edition, provides a new perspective of security and controls over Oracle. This updated edition includes a background and review of security controls and addresses the risks associated with protecting information in a distributed computing environment of various platforms, versions, interfaces and tools. The goal of this popular book is to guide the assessor through a comprehensive evaluation of security for an Oracle database based on business objectives and risks. It examines several different frameworks that can be used to assess security risks and covers technical topics, including an overview of Oracle Database s architecture, operating system controls, auditing and logging, network security, and new features in Oracle 11g (differences from previous versions of Oracle Database are noted, as well as differences that may exist based on the host operating system of the database). Topics in the book include: New security features in Oracle 10g and 11g Enterprise resource planning (ERP) and customer relationship management (CRM) architectures Access controls, application controls and IT general controls Database management and assessment tools Impact of interfaces with legacy systems Developing a strategy to plan the audit Understanding the IT environment Reviewing policies and standards Security, Audit and Control Features Oracle Database, 3rd Edition helps simplify a daunting task, giving readers the approach, knowledge and tools to effectively plan and execute an Oracle Database security assessment.

Security, Audit and Control Features Oracle Database, 3rd Edition

See the best price to sell, buy or rent books by the Isaca publisher. BookScouter helps to compare book prices from 25+ online bookstores and 30+ buyback vendors with a single search.

Books by Isaca