# Security Planning & Disaster Recovery **URL:** \ **Category:** Tutorials & Methods\ **Tags:** tips-tricks\ **Created:** [November 5, 2021, 7:33am UTC](https://onehack.st/t/security-planning-disaster-recovery/206026 "2021-11-05T07:33:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Hannah](https://onehack.st/user_avatar/onehack.st/hannah/32/174875_2.png) [@Hannah](https://onehack.st/u/Hannah)\ **Post date:** [November 5, 2021, 7:33am UTC](https://onehack.st/t/security-planning-disaster-recovery/206026/1 "2021-11-05T07:33:39Z")
**Introduction** In this e-centric day and age organizations have come to rely on IT infrastructures not just as an aid to business, but for some, as the core of their business. Safe, secure, and reliable computing and telecommunications are essential to these organizations. As these organizations begin to understand the importance of information security, they are developing security programs that are often under the direction of the CIO. An information security program includes more than just people and technology. The programs involve policies, procedures, audits, monitoring, and an investment of time and money. This book is meant to provide organizations with a broad overview of the security program, what it should be, who it should include, what it entails, and how it should fit into the overall organization. This book is for the security professional who must answer to management about the security of the organization. In today’s economy, many organizations do not have the ability to hire a person and dedicate that person to security. Often the person who is given this job is an IT professional with no specific security training. This book will provide the road map for such individuals. **The book is divided into four main parts plus some good information in appendices:** **Part I: Guiding Principles in Plan Development Part** I is intended to provide guidance on fundamental issues with security planning. In this part we cover the basic concepts of the role of information security, laws and regulations, and risk identification. • Chapter 1: The Role of the Information Security Program Chapter 1 discusses the overall importance of the information security program. It describes where it fits into the organization and who should establish its charter, mission, responsibilities, and authority. It further talks about the relationship of the information security manager (and the department) to the rest of the organization. It is impossible to build a program in a vacuum or with bad relationships throughout the organization. • Chapter 2: Laws and Regulations Many industries have federal or state regulations that must be followed. Some of these regulations may affect the security program. It is therefore important for the security department to understand the regulation requirements. In some cases the existence of the information security program is clearly dictated by laws and regulations. • Chapter 3: Assessments This chapter focuses on how organizations go about identifying the state of their information security efforts. It includes information on various types of assessments and when they should and should not be used. **Part II:** Plan Implementation Part II discusses the basics of risk management and mitigation. Once risk has been identified, the mitigation steps must be taken. While the exact plan will vary for each organization, this part of the book provides the basics. • Chapter 4: Establishing Policies and Procedures This chapter discusses the importance of policies and procedures and describes policies and procedures that need to be created for the organization. The primary focus of this chapter is the order that they should be created and the approach to use in getting the organization to buy into what is created. • Chapter 5: Implementing the Security Plan Policies are nice documents but if they are not implemented, they do no good. This chapter talks about general guidelines for implementing good policies. • Chapter 6: Deploying New Projects and Technologies No organization can afford to develop everything internally. Security is no different in this regard. Since it is likely that products will be purchased for the organization and new projects will be developed internally, this chapter covers how to manage the risk to the organization through the development process. • Chapter 7: Security Training and Awareness This chapter discusses the programs and classes that must be established to make the organization aware of security issues. Security awareness is one of the most cost-effective components of the information security program. In a recent speech, Richard Clark, the President’s cyber-security advisor, noted that the awareness of employees was critical to an organization’s security program. He also noted that he and the federal government would be stressing this topic to industry in the coming months. • Chapter 8: Monitoring Security The security program is in place. How do you know that it is working? The only way to know is to monitor it. This chapter discusses the more useful methods for monitoring. **Part III:** Plan Administration Security programs are no different than any other program within an organization. Once they are set up and working properly, they must be managed and administered properly. This part talks about these tasks. • Chapter 9: Budgeting for Security Just about every organization has a budget process. The security department must go through it with every other department. Therefore, it is important for the security department to do it well. • Chapter 10: The Security Staff Not every security program has a staff but many do. Choosing the correct individuals for the staff and the correct mix of skills can make or break the program. This chapter talks about the mix of the team and how to find good people. • Chapter 11: Reporting Finally, there is reporting. Without some type of reporting there is no way for the organization to gauge the effectiveness of the security department. There is rarely an ROI for security (but this is changing) and thus there must be other metrics to use to measure the performance of the department. **Part IV:** How to Respond to Incidents All of the planning, risk identification, risk mitigation, and administration tasks can help an organization to manage risk. However, no one can ever completely remove risk. This part of the book discusses how to deal with incidents and disasters when they occur. • Chapter 12: Incident Response Bad things happen. The security program works diligently to try to prevent them but they happen anyway. When they do, the security department must be ready to take the lead in the response. • Chapter 13: Developing Contingency Plans Disasters of all shapes and sizes occur to businesses. Because organizations have become so dependent on their IT infrastructures it is essential that they develop an IT Disaster Recovery Plan and keep it up to date. This plan will provide policies, procedures, roles, and responsibilities for preparing for, responding to, and recovering from a variety of disasters. This chapter explains the key steps in developing an IT DRP. • Chapter 14: Responding to Disasters How an organization responds to a disaster is just as important as how an organization plans for a disaster. Often, the response to a disaster deviates from the plan due to unforeseen circumstances. This chapter discusses the proper response during a serious disaster. **Part V: Appendixes Part V** provides three sections that complement the purpose of the book. These sections are intended to assist the reader in answering particular questions about security and implementing a strong program. • Appendix A: Handling Audits Audits are a fact of life. Every organization goes through them. They may be internal audits or external. The security team must be a part of these audits and the organization’s response. • Appendix B: Outsourcing Security The outsourcing of security has become a lively topic recently. Many new security firms exist that sell some type of service. This may impact the security of the organization or it may be a cost-effective way to fulfill the responsibilities of the security department. • Appendix C: Managing New Security Projects This appendix is a continuation of Chapter 6 that talks specifically about building new security projects as opposed to security in new business projects. [Download PDF](https://mega.nz/file/vLgRjIqZ#MT0_XciObG5LfqrURRD_lpC-lwobhiyEKQkY5jqR4kg) **Happy learning!** ---
**Author:** ![AARKOUB\_Ismail](https://onehack.st/user_avatar/onehack.st/aarkoub_ismail/32/16961_2.png) [@AARKOUB\_Ismail](https://onehack.st/u/AARKOUB_Ismail)\ **Post date:** [November 5, 2021, 10:25pm UTC](https://onehack.st/t/security-planning-disaster-recovery/206026/2 "2021-11-05T22:25:18Z")
Hey, Can you please re-upload it. The file is no longer available ---
**Author:** ![Exc\_Labs](https://onehack.st/user_avatar/onehack.st/exc_labs/32/29438_2.png) [@Exc\_Labs](https://onehack.st/u/Exc_Labs)\ **Post date:** [November 6, 2021, 2:33am UTC](https://onehack.st/t/security-planning-disaster-recovery/206026/3 "2021-11-06T02:33:00Z")
Not available.