What this book covers

Chapter 1, ISO27001 – Definitions and Security Concepts, describes in a clear and understandable way the 27k family of standards, confidentiality, integrity and availability, information security concepts and definitions, governance, policies, incident management, and differences within NIST, the National Institute of Standards and Technology.

Chapter 2, Mandatory Requirements, explores iSMS, information security management system, controls, commitment, context, scope policy, and objectives of the ISO 27001 and NIST framework.

Chapter 3, Data Protection, delves into the history of privacy, General Data Protection Regulation (GDPR), and other privacy laws, territorial scope, anonymous, pseudonymous, de-identified, and aggregated data, legal basis (or justification) for data processing, data access privileges, and fines, the six principles of GDPR, and, finally, why we have to deal with data protection.

Chapter 4, Data Processing, discusses the roles involved in data processing, looking at data controllers, data processors, accountability, privacy dashboards, a Data Protection Impact Analysis (DPIA), treatment register, the EU-US Privacy Shield, and Schrems II.

Chapter 5, Security Planning and Risk Management, focuses on risk management. We will understand what the security threats and challenges are, the various security threats, how to implement a risk management program, the differences between traditional risk management and enterprise risk management, and why risk management is so important.

Chapter 6, Define ISO 27001 Mandatory Requirements, dives deep into the ISO 27001 framework and its Annex A controls, with all the clauses within the ISO program.

Chapter 7, Risk Management, Controls and Policies, looks at how risk management interacts with controls and policies. We will be focusing on risk heat maps and risk mitigation techniques. Then, we’ll deep dive data classification and policies.

Chapter 8, Preparing Policies and Procedures to Avoid Internal Risk, discusses how to write policies and procedures in a corporate way.

Chapter 9, Social Engineering, Password Guidance, and Policy, reveals the most important social engineering attempts to steal your credentials and how to avoid them by using complex password management.

Chapter 10, The Cloud, deals with the cloud, from the basics to how it works now, in our quest for frameworks and privacy processes.

Chapter 11, What About the US?, discusses social engineering, password guidance, and privacy policies in the US, including local and national laws and bills. We’ll also be taking a glance at the privacy side of phenomena such as Bring Your Own Device (BYOD) and remote working.

Appendix, explains how security, privacy and pandemic are changing our lives