Information Assurance Book

	Foreword
	Preface
	Acknowledgments
I	The Organizational IA Program: The Practical and Conceptual Foundation	1
1	IA and the Organization: The Challenges	3
2	Basic Security Concepts, Principles, and Strategy	13
II	Defining the Organization's Current IA Posture	37
3	Determining the Organization's IA Baseline	39
4	Determining IT Security Priorities	53
5	The Organization's IA Posture	67
III	Establishing and Managing an IA Defense in Depth Strategy Within an Organization	85
6	Layer 1: IA Policies	87
7	Layer 2: IA Management	95
8	Layer 3: IA Architecture	113
9	Layer 4: Operational Security Administration	145
10	Layer 5: Configuration Management	153
11	Layer 6: Life-Cycle Security	163
12	Layer 7: Contingency Planning	171
13	Layer 8: IA Education, Training, and Awareness	175
14	Layer 9: IA Policy Compliance Oversight	181
15	Layer 10: IA Incident Response	189
16	Layer 11: IA Reporting	197
	Appendices	201
App. A	Listing of IA Threats	203
App. B	Listing of Threat Statuses	209
App. C	Listing of Major Sources of Vulnerability Information	211
App. D	IA Policy Web Sites	213
App. E	IA Policy Basic Structure and Major Policy Subjects	215
App. F	Sample IA Manager Appointment Letter	221
App. G	Sample Outline for IA Master Plan	223
App. H	Things to Do to Improve Organizational IA Posture	225
App. I	Information Assurance Self-Inspection Checklist	229
App. J	Sample Outline for a Disaster Recovery Plan (DRP)	251
App. K	Sample Threat Response Matrix	253
	About the Authors	255
	Index	257