LibGuides: TIM-8330 V4: Week 3 Resources

Week 3 Resources

Reminder: Please complete the O’Reilly login steps (See the Accessing O’Reilly link in the Week 1 Resources area) where you get an email that will allow your browser to keep your password, solving future access limitations.

Cybersecurity and Third-Party Risk
Rasner, G. (2021). Cybersecurity and third-party risk. Wiley.
Read Chapter 7 – On-Site Due Diligence.
This chapter explains how to perform an on-site security assessment to accomplish due diligence with vendors.
Read Chapter 11 – Cybersecurity and Legal Protections.
This chapter explains how to use clear contract language to manage cybersecurity third-party risk.
Read Chapter 12 – Software Due Diligence.
This chapter discusses The Secure Software Development Lifecycle (SSDLC), which is a process that places security directly into the development of the software or hardware. Lessons learned from the Solarwinds case and Critical Software are discussed.
Read Chapter 15 – Transform to Predictive.
This chapter discusses the use of data to manage third-party due diligence in risk management.

The resources below are highly suggested, optional readings that will help you with this week’s assignments.

IT Security Risk Control Management – An Audit Preparation Plan
Pompon, R. (2016). IT security risk control management – an audit preparation plan. Apress.
Read Section 1 – Getting A Handle on Things.
This section provides the rationale for the audit process and how to perform different types of risk analysis.
Read Section 3 – Managing Risk with Controls.
This section describes how to manage risk with controls. Various types of controls are explained.
Read Section 4 – Being Audited.
This section describes the audit process, from preparation to post-audit improvement planning.

<< Previous: Week 2 Resources
Next: Week 4 Resources >>