Protiviti - Guide to the Sarbanes-Oxley Act: Internal Control Reporting Requirements - Third Edition Updated to reflect PCAOB Auditing Standard No. 2 (189 pages)
Protiviti has revised its highly regarded resource guide on Section 404 of the Sarbanes-Oxley Act. The third edition of Protiviti's popular Section 404 publication addresses the effects of changes arising from the SEC's final rules released in June 2003, and as amended by the Commission's extension of these rules released in February 2004. It also includes a wealth of detailed information on PCAOB Auditing Standard No. 2. and its impact on Section 404 compliance efforts. In all, this comprehensive guide contains 88 new questions and well over 100 pages of new or substantially revised material.

IT Examination Handbook - FFIEC
Financial institutions protect their information by instituting a security process that identifies risks, forms a strategy to manage the risks, implements the strategy, tests the implementation, and monitors the environment to control the risks. Examiners may use this booklet when evaluating the financial institution’s risk management process, including the duties, obligations, and responsibilities of the service provider for information security and the oversight exercised by the financial institution.

Continuous Auditing: Implications for Assurance, Monitoring, and Risk Assessment - IIA (44 pages)
This guide focuses on assisting Chief Audit Executives identify what must be done to make effective use of technology in support of continuous auditing and highlights areas that require further attention. It provides continuous audit guidance that will benefit the organization by significantly reducing instances of error and fraud, increasing operational efficiency, and improving bottom-line results through a combination of cost savings and a reduction in overpayments and revenue leakage.

GAO Technology Assessment - Cybersecurity for Critical Infrastructure
The GAO conducted this technology assessment on the use of cybersecurity technologies for CIP in response to a request from congressional committees. This assessment addresses the following questions: (1) What are the key cybersecurity requirements in each of the CIP sectors? (2) What cybersecurity technologies can be applied to CIP? (3) What are the implementation issues associated with using cybersecurity technologies for CIP, including policy issues such as privacy and information sharing?

BITS Financial Institution Shared Assessments Program (FISAP)
The FISAP Program is a groundbreaking new process for financial institutions to evaluate the security controls of their IT service providers.

Risk Management

Risk IT Framework and Best Practice Guidance - ISACA
Risk IT is a framework based on a set of guiding principles for effective management of IT risk. The Risk IT framework explains IT risk, allows the enterprise to make appropriate risk-aware decisions and will enable users to:

· Integrate the management of IT risk into the overall enterprise risk management (ERM) of the organization
· Make well-informed decisions about the extent of the risk, the risk appetite and the risk tolerance of the enterprise
· Understand how to respond to the risk

The Institute of Risk Management: Risk Management Standard (17 pages)
There are many ways of achieving the objectives of risk management and it would be impossible to try to set them all out in a single document. Therefore it was never intended to produce a prescriptive standard which would have led to a box ticking approach nor to establish a certifiable process. By meeting the various component parts of this standard, albeit in different ways, organisations will be in a position to report that they are in compliance.The standard represents best practice against which organisations can measure themselves.

NIST SP 800-30: Risk Management Guide for Information Technology Systems (55 pages)
This guide provides a foundation for the development of an effective risk management program, containing both the definitions and the practical guidance necessary for assessing and mitigating risks identified within IT systems. The ultimate goal is to help organizations to better manage IT-related mission risks.

CERT: OCTAVE^® (Operationally Critical Threat, Asset, and Vulnerability Evaluation^SM)
For an organization that wants to understand its information security needs, OCTAVE is a risk-based strategic assessment and planning technique for security.

CERT: Mission Assurance Analysis Protocol (MAAP): Assessing Risk in Complex Environments (59 pages)
The main focus of MAAP is developing advanced risk analysis techniques for highly complex and distributed work processes. However, we believe that MAAP can also be used to analyze risk in virtually all work processes, from very simple workflows to those that are distributed among multiple organizations.

Microsoft: Security Risk Management Guide
This guide helps customers of all types plan, build, and maintain a successful security risk management program. In a four phase process, depicted below, the guide explains how to conduct each phase of a risk management program and how to build an ongoing process to measure and drive security risks to an acceptable level.

Microsoft: Security Assessment Tool
This application is designed to help organizations with fewer than 1,000 employees assess weaknesses in their current IT security environment. It will help identify processes, resources, and technologies that are designed to promote good security planning and risk mitigation practices within your organization.

FEMA Risk Management Series (RMS) Publications
The RMS is a new FEMA series directed at providing design guidance for mitigating multihazard events. The publications are directed at manmade disasters. The objective of the series is to reduce physical damage to structural and nonstructural components of buildings and related infrastructure, and to reduce resultant casualties during conventional bomb attacks, as well as attacks using chemical, biological, and radiological agents. The underlining issue is that improving security in high occupancy buildings will better protect the nation from potential threats by identifying key actions and design criteria to strengthen our buildings from the forces that might be anticipated in a terrorist assault. The intended audience includes architects and engineers working for private institutions, building owners/operators/managers, and state and local government officials working in the building sciences community.

World Bank Technology Risk Checklist
The World Bank Technology Risk Checklist is designed to provide Chief Information Security Officers (CISO), Chief Technology Officers (CTO), Chief Financial Officers (CFO), Directors, Risk Managers and Systems Administrators with a way of measuring and validating the level of security within a particular organization.


Insider Threat

Common Sense Guide to Prevention and Detection of Insider Threats - CERT (88 pages)
This report is written for a diverse audience, outlining practices that should be implemented by organizations to prevent insider threats. Each practice is described briefly in terms of why it should be implemented and one or more case studies illustrate what could happen if it is not implemented, and how the practice could have prevented an attack or facilitated early detection.

Insider Risk Management Guide - Gideon T. Rasmussen
The threat posed by authorized personnel is well documented by research and court cases. According to ACFE, U.S. organizations lose an estimated $652 billion to fraud annually. Unfortunately, insider threat is not limited to fraud. There is also sabotage, negligence, human error and exploitation by outsiders to consider. If you have not taken a hard look at insider threat controls in your organization, now is the time.

DoD Insider Threat Mitigation (67 pages)
This report provides an explicit set of recommendations for action to mitigate the insider threat to DoD information systems. The report results from the actions of an Insider Threat Integrated Process Team (IPT). The Team's charter was "to foster the effective development of interdependent technical and procedural safeguards" to reduce malicious behavior by insiders.

ISACA Segregation of Duties Matrix
The segregation of duties control matrix is not an industry standard, but a guideline indicating which positions should be separated and which require compensating controls when combined. The matrix is illustrative of potential segregation of duties issues and should not be viewed or used as an absolute, rather it should be used to help identify potential conflicts so proper questions may be asked to identify compensating controls.

The Insider Threat to U.S. Government Information Systems - NSTISSC (47 pages)
This NSTISSAM focuses on the insider and the potential damage that such an individual could cause when targeting today's IS. It points out the various weaknesses (vulnerabilities) in today's IS an insider might exploit and highlights approaches to solving these problems. In taking corrective action, it is necessary to consider technical and procedural steps in deterring the insider. Finally, we propose, in priority order, recommendations that mitigate the threat posed by the insider. Our approach is not to provide an exhaustive list, but rather offer recommendations that could have the greatest immediate return against this serious threat.

Insider Threat Study: Computer System Sabotage in Critical Infrastructure Sectors - CERT & U.S. Secret Service (45 pages)
Research for this report found that the majority of the insiders who committed acts of sabotage were former employees who had held technical positions with the targeted organizations. As a result of their involvement in the incidents reviewed for this study, almost all of the insiders were charged with criminal offenses. The majority of these charges were based on violations of federal law.

Insider Threat Study: Illicit Cyber Activity in the Banking and Finance Sector - CERT & U.S. Secret Service (25 pages)
This report reviewed 23 incidents of insider threat in the banking and finance sector. It examines insider incidents across critical infrastructure sectors in which the insider's primary goal was to sabotage some aspect of the organization (for example, business operations, information/data files, system/network, and/or reputation) or direct specific harm toward an individual.

Preliminary System Dynamics Maps of the Insider Cyber-threat Problem - CERT (36 pages)
This paper discusses the preliminary system dynamic maps of the insider cyber-threat.

Trustworthy Refinement Through Intrusion-Aware Design (TRIAD) - CERT (97 pages)
This report proposes an intrusion-aware design model called trustworthy refinement through intrusion-aware design (TRIAD). TRIAD helps information system decision-makers formulate and maintain a coherent, justifiable, and affordable survivability strategy that addresses mission-compromising threats for their organization. The goals of a survivability strategy are to provide a documented response to the primary threats to the mission; to provide a justification for and the limitations of the system design; to support the design and implementation of the desired system behavior across multiple systems and multiple development teams; and to support maintenance and evolution as the system operations and threat environment evolve over time.

Research on Mitigating the Insider Threat to Information Systems - Rand (126 pages)
This report details R&D initiatives to mitigate and thwart the insider threat to critical U.S. defense and infrastructure information systems. The three main focus areas were long-term (2-5 year) research challenges and goals toward mitigating the insider threat; developing insider threat models; and developing near-term solutions using commercial off-the-shelf (COTS) and government off-the-shelf (GOTS) products. The long-term research recommendations stressed the need to develop an underlying system architecture designed explicitly with security and survivability in mind (unlike essentially all operating systems and network architectures in use today). Other topics included R&D needed on differential access controls, means of recording and saving the provenance of a digital document, and dealing with the increasing use of mobile code (e.g., in the form of applets, viruses, worms, or macros) in complex information systems. The report also contains a number of recommendations regarding the purposes and design of models of insider behavior, and near-term recommendations for helping to prevent, discover, and mitigate the threat ofinsider misuse of information systems.

Understanding the Insider Threat - Rand (137 pages)
The format of this document included four groups: (1) Intelligence Community (IC) System Models, (2) Vulnerabilities and Exploits, (3) Attacker Models and (4) Event Characterization. It brought together members of the IC with specific knowledge of IC document management systems and IC business practices; persons with knowledge of insider attackers, both within and outside the IC; and researchers involved in developing technology to counter insider threats.

A Target-Centric Formal Model For Insider Threat and More - University at Buffalo (17 pages)
In this paper, we propose a target-centric modeling methodology motivated by the fact that insiders typically pursue lucrative targets to cause damage or gain leverage. It is based on a higher level description of an organization's infrastructure and less detail-intensive as compared to the attack graph model.

Analysis and Detection of Malicious Insiders - MITRE (6 pages)
This paper summarizes a collaborative, six month ARDA NRRC challenge workshop to characterize and create analysis methods to counter sophisticated malicious insiders in the United States Intelligence Community. Based upon a careful study of past and projected cases, we report a generic model of malicious insider behaviors, distinguishing motives, (cyber and physical) actions, and associated observables.

Insider Threat Group - Yahoo Groups
The insider threat group provides a forum to discuss resources and techniques to mitigate the threat posed by authorized personnel. Those interested in learning more about insider threat will benefit from the exchange of tips and the opportunity to ask questions. The group is moderated to keep on topic.


Application Security

OWASP Top 10 - Critical Web Application Security Flaws
The OWASP Top Ten represents a broad consensus about what the most critical web application security flaws are. Project members include a variety of security experts from around the world who have shared their expertise to produce this list.

CWE/SANS TOP 25 Most Dangerous Software Errors
Each entry at the Top 25 Software Errors site also includes fairly extensive prevention and remediation steps that developers can take to mitigate or eliminate the weakness.

Building Security In Maturity Model (BSIMM)
BSIMM is designed to help you understand, measure, and plan a software security initiative. It was created by observing and analyzing real-world data from 51 leading software security initiatives.

OWASP Prevention Cheat Sheet Series
The OWASP Prevention Cheat Sheet Series was created to provide a concise collection of high value information on specific web application security topics. These cheat sheets were created by multiple application security experts and provide excellent security guidance in an easy to read format.

OWASP Guide to Building Secure Web Applications
The original OWASP Guide to Building Secure Web Applications has become a staple diet for many web security professionals. Over the last 24 months the initial version has now been downloaded over 2 million times. The Guide forms the basis for corporate web security policies for several Fortune 500 companies and is used in service offerings from many security consulting companies. The Guide is aimed at architects, developers, consultants and auditors and is a comprehensive manual for designing, developing and deploying secure web applications.


Incident Response Programs

NIST SP 800-61: Computer Security Incident Handling Guide (148 pages)
This NIST publication assists organizations in establishing computer security incident response capabilities and handling incidents efficiently and effectively.

Handbook for Computer Security Incident Response Teams (CSIRTs) - CERT/CC (233 pages)
This document provides guidance on forming and operating a computer security incident response team (CSIRT). It details the functions that make up the CSIRT, how to handle sensitive information and the tools, procedures, and roles necessary to implement the program. In addition, operational and technical issues are covered, such as equipment, security, and staffing considerations.

Computer Security Incident Response Team (CSIRT) FAQs - CERT/CC
This frequently asked questions page provides a good primer for those interested in the basics of computer incident response.

6 Phases of Incident Handling - Texas A&M University
Computer security incident handling can be divided into six phases: preparation, identification, containment, eradication, recovery, and follow-up. Understanding these stages, and what can go wrong in each, facilitates responding more methodically and avoids duplication of effort.

CSIRT Case Classification (Example for enterprise CSIRT) - FIRST
This document provides the guidelines needed for CSIRT Incident Managers (IM) to classify the case category, criticality level, and sensitivity level for each CSIRT case. This information will be entered into the Incident Tracking System (ITS) when a case is created. Consistent case classification is required for the CSIRT to provide accurate reporting to management on a regular basis. In addition, the classifications will provide CSIRT IM’s with proper case handling procedures and will form the basis of SLA’s between the CSIRT and other Company departments.

Incident Report Templates

· Gideon T. Rasmussen's Incident Report Template
· SANS Incident Identification Form
· SANS Incident Survey Form
· SANS Incident Containment Form
· SANS Incident Eradication Form
· SANS Incident Communication Log Form
· Melissa Guenther's Incident Report Form
· US-CERT Incident Reporting System
· CERT/CC Incident Reporting Guidelines