Information Security Governance Simplified: From the Boardroom to the Keyboard

by Todd Fitzgerald

Overview

Security practitioners must be able to build a cost-effective security program while at the same time meet the requirements of government regulations. This book lays out these regulations in simple terms and explains how to use the control frameworks to build an effective information security program and governance structure. It discusses how organizations can best ensure that the information is protected and examines all positions from the board of directors to the end user, delineating the role each plays in protecting the security of the organization.

Product Details

ISBN-13:	9781466551282
Publisher:	CRC Press
Publication date:	04/19/2016
Sold by:	Barnes & Noble
Format:	eBook
Pages:	431
Sales rank:	993,837
File size:	5 MB

About the Author

Todd Fitzgerald, CISSP, CISA, CISM, ISO27000, CGEIT, PMP, HITRUST, and ITILV3 certified, is responsible for external audit technical compliance for National Government Services (NGS), Milwaukee, WI, one of the largest processors of Medicare claims and a subsidiary of WellPoint, Inc., the nation's leading health benefits company, serving 1 out of 9 Americans. Fitzgerald has initiated, developed, and led information security programs as the Information Security Officer for several companies. Fitzgerald served as the chair/co-chair for the 2011/2010 ISACA North America and Europe Information Security & Risk Management conferences.

Fitzgerald coauthored, with Micki Krause, the 2008 (ISC)2 Press book titled CISO Leadership: Essential Principles for Success. Fitzgerald has authored articles on information security for the 2007 Official (ISC)2 Guide to the CISSP Exam, The Information Security Handbook Series (2003-2012), The HIPAA Program Reference Book, Managing an Information Security and Privacy Awareness and Training Program, CISM Review Manual, and several other security-related publications. He is also a member of the editorial board for (ISC)2 Journal/Information Systems Security Magazine. Fitzgerald is frequently called upon to present at international, national, and local conferences for Information Systems Audit and Control Association (ISACA), Computer Security Institute (CSI), Information Systems Security Association (ISSA), Management Information Systems Training Institute (MISTI), COSAC, and the Centers for Medicare & Medicaid Services (CMS) systems security officer community. He also serves on the board of directors for the HIPAA Collaborative of Wisconsin and several other industry groups. Fitzgerald has received several awards including a Midwest Information Security Executive of the Year Award Finalist award and Health Ethics Trust HIPAA Implementation Awa

Table of Contents

Getting Information Security Right - Top to Bottom. Developing Information Strategy. Defining the Security Management Organization. Interacting with the C-Suite. Managing Risk to an Acceptable Level. Creating Effective Information Security Policies. Security Compliance Using Control Frameworks. Managerial Controls - Practical Security Considerations. Technical Controls - Practical Security Considerations. Operational Controls - Practical Security Considerations. The Auditors Have Arrived - Now What? Effective Security Communications. The Law and Information Security. Learning From Information Security Incidents. 17 Ways to Dismantle Information Security Efforts.

Editorial Reviews

Todd Fitzgerald’s new book, Information Security Governance Simplified: From the Boardroom to the Keyboard, presents 15 chapters of advice and real-world experience on how to handle the roll out of an effective program …. Todd has taken the time to include for the reader some practical security considerations for managerial, technical, and operational controls. This is followed up with a discussion on how legal issues are impacting the information security program.
—Tom Peltier, CISSP

 

Todd Fitzgerald’s new book, Information Security Governance Simplified: From the Boardroom to the Keyboard, presents 15 chapters of advice and real-world experience on how to handle the roll out of an effective program …. Todd has taken the time to include for the reader some practical security considerations for managerial, technical, and operational controls. This is followed up with a discussion on how legal issues are impacting the information security program.
—Tom Peltier, CISSP

From the Publisher