Defense in Depth: Foundation for Secure and Resilient IT Enterprises

Abstract : The Defense-in-Depth Foundational Curriculum is designed for students ranging from system administrators to CIOs who have some technical understanding of information systems and want to delve into how technical assurance issues affect their entire organizations. The course material takes a big-picture view while also reinforcing concepts presented with some details about implementation. Therefore, this course can be a useful pursuit for system administrators and IT security personnel who would like to step up to the management level. It also can provide a refresher for IT managers and executives who want to stay up to date on the latest technological threats facing their enterprises. The curriculum consists of eight main modules: (1) Compliance Management, (2) Risk Management, (3) Identity Management, (4) Authorization Management, (5) Accountability Management, (6) Availability Management, (7) Configuration Management, and (8) Incident Management. The document also contains an introduction, "Foundations of Information Assurance," which focuses on how the overarching concepts of confidentiality, integrity, and availability can lead to a comprehensive security strategy.

[1]  Kenneth E. Nawyn.  A Security Analysis of System Event Logging with Syslog , 2003 .

[2]  杨岩,et al.  Windows Server Update Services , 2005 .

[3]  Michael G Maihofer,et al.  Reinvent the wheel. , 2005, The Journal of the Michigan Dental Association.

[4]  K. Fernow.  New York , 1896, American Potato Journal.

[5]  John Lane,et al.  IEEE Standard Computer Dictionary: Compilation of IEEE Standard Computer Glossaries , 1991 .

[6]  M. J. Kenning.  Security Management Standard — ISO 17799/BS 7799 , 2001 .

[7]  Felicia Nicastro.  Zero-Day Attack , 2005 .

[8]  Wietse Z. Venema,et al.  TCP Wrapper: Network Monitoring, Access Control, and Booby Traps , 1992, USENIX Summer.

[9]  Julia H. Allen,et al.  Outsourcing Managed Security Services , 2003 .

[10]  Tobias Oetiker,et al.  MRTG: The Multi Router Traffic Grapher , 1998, LISA.

[11]  Rita C. Summers.  Secure Computing: Threats and Safeguards , 1996 .

[12]  John T. Kohl,et al.  The Kerberos Network Authentication Service (V5 , 2004 .

[13]  G. T. Gangemi,et al.  Computer Security Basics , 2006 .

[14]  Christopher J. Alberts,et al.  Defining Incident Management Processes for CSIRTs: A Work in Progress , 2004 .

[15]  Pamela Paulsen,et al.  May , 1890, The Hospital.

[16]  Harry Newton.  Newton's Telecom Dictionary: 22nd Edition (Newton's Telecom Dictionary) (Newton's Telecom Dictionary) , 2006 .

[17]  Julia Allen.  CERT ®1 System and Network Security Practices i , 2001 .

[18]  I. Moosa.  Operational risk management , 2007 .

[19]  G. G. Stokes.  "J." , 1890, The New Yale Book of Quotations.

[20]  Ronald L. Rivest,et al.  The MD5 Message-Digest Algorithm , 1992, RFC.

[21]  Ravi S. Sandhu,et al.  Identity management , 2003, IEEE Internet Computing.