Security Risk Management: Building an Information Security Risk Management Program from the Ground Up

by Evan Wheeler

Security Risk Management is the definitive guide for building or running an information security risk management program. This book teaches practical techniques that will be used on a daily basis, while also explaining the fundamentals so students understand the rationale behind these practices. It explains how to perform risk assessments for new IT projects, how to efficiently manage daily risk activities, and how to qualify the current risk level for presentation to executive level management. While other books focus entirely on risk analysis methods, this is the first comprehensive text for managing security risks.

This book will help you to break free from the so-called best practices argument by articulating risk exposures in business terms. It includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment. It explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk. It also presents a roadmap for designing and implementing a security risk management program.

This book will be a valuable resource for CISOs, security managers, IT managers, security consultants, IT auditors, security analysts, and students enrolled in information security/assurance college programs.

Named a 2011 Best Governance and ISMS Book by InfoSec Reviews Includes case studies to provide hands-on experience using risk assessment tools to calculate the costs and benefits of any security investment Explores each phase of the risk management lifecycle, focusing on policies and assessment processes that should be used to properly assess and mitigate risk Presents a roadmap for designing and implementing a security risk management program

Genres: Nonfiction, Reference, Technology

582 pages, Kindle Edition

First published May 15, 2011

Reviews

[Diana · Rating 4 out of 5]

Reading for school. Surprisingly still relevant despite being published in 2011. Nice for intro and refreshing takes as I started learning the domain back then from governance and compliance heavy materials using ISO, NIST, and IAPP frameworks. I like how the book is general and does not lean towards specific framework, although it makes some parts harder to understand in terms of practial applications.

[Mamta Naidu · Rating 5 out of 5]

Such a great book. It helped me to build my own information security risk management program in my organisation. Very easy to read with great examples.

[Leon Seagal · Rating 5 out of 5]

If you have an interest about Security and risk management, you should read this lovely book

[Nicholas Koh · Rating 4 out of 5]

Gives a good overview of risk-based approach to security. A good starting point for any security professional.