Rothstein Publishing Collection eBook

Is security management changing so fast that you can't keep up? Perhaps it seems like those traditional "best practices" in security no longer work? One answer might be that you need better best practices! In their new book, The Manager's Guide to Enterprise Security Risk Management: Essentials of Risk-Based Security, two experienced professionals introduce ESRM. Their practical, organization-wide, integrated approach redefines the securing of an organization's people and assets from being task-based to being risk-based. In their careers, the authors, Brian Allen and Rachelle Loyear, have been instrumental in successfully reorganizing the way security is handled in major corporations. In this ground-breaking book, the authors begin by defining Enterprise Security Risk Management (ESRM): "Enterprise security risk management is the application of fundamental risk principles to manage all security risks − whether information, cyber, physical security, asset management, or business continuity − in a comprehensive, holistic, all-encompassing approach." In the face of a continually evolving and increasingly risky global security landscape, this book takes you through the steps of putting ESRM into practice enterprise-wide, and helps you to: Differentiate between traditional, task-based management and strategic, risk-based management. See how adopting ESRM can lead to a more successful security program overall and enhance your own career. . Prepare your security organization to adopt an ESRM methodology. . Analyze and communicate risks and their root causes to all appropriate parties. . Identify what elements are necessary for long-term success of your ESRM program. . Ensure the proper governance of the security function in your enterprise. . Explain the value of security and ESRM to executives using useful metrics and reports. . Throughout the book, the authors provide a wealth of real-world case studies from a wide range of businesses and industries to help you overcome any blocks to acceptance as you design and roll out a new ESRM-based security program for your own workplace.

In today's litigious business world, cyber-related matters could land you in court. As a computer security professional, you are protecting your data, but are you protecting your company? While you know industry standards and regulations, you may not be a legal expert. Fortunately, in a few hours of reading, rather than months of classroom study, Tari Schreider's The Manager's Guide to Cybersecurity Law: Essentials for Today's Business, lets you integrate legal issues into your security program. Tari Schreider, a board-certified information security practitioner with a criminal justice administration background, has written a much-needed book that bridges the gap between cybersecurity programs and cybersecurity law. He says, "My nearly 40 years in the fields of cybersecurity, risk management, and disaster recovery have taught me some immutable truths. One of these truths is that failure to consider the law when developing a cybersecurity program results in a protective façade or false sense of security."In a friendly style, offering real-world business examples from his own experience supported by a wealth of court cases, Schreider covers the range of practical information you will need as you explore – and prepare to apply – cybersecurity law. His practical, easy-to-understand explanations help you to: Understand your legal duty to act reasonably and responsibly to protect assets and information. Identify which cybersecurity laws have the potential to impact your cybersecurity program. Upgrade cybersecurity policies to comply with state, federal, and regulatory statutes. Communicate effectively about cybersecurity law with corporate legal department and counsel. Understand the implications of emerging legislation for your cybersecurity program. Know how to avoid losing a cybersecurity court case on procedure – and develop strategies to handle a dispute out of court. Develop an international view of cybersecurity and data privacy – and international legal frameworks. Schreider takes you beyond security standards and regulatory controls to ensure that your current or future cybersecurity program complies with all laws and legal jurisdictions. Hundreds of citations and references allow you to dig deeper as you explore specific topics relevant to your organization or your studies. This book needs to be required reading before your next discussion with your corporate legal department.

As a manager, you can usually handle disruptive employees. But sometimes, their emotional states foster workplace tension, even making them a danger to others. Your own confidence is at risk. In The Manager's Guide to Bullies in the Workplace: Coping with Emotional Terrorists, noted counselor Dr. Vali Hawkins Mitchell gives you sensible advice for keeping the bully from dominating the workgroup and destroying productivity, and maintaining your own healthy emotional balance at the same time. Sometimes the difficult person is an overt physical bully, which makes it easy to simply fire the person. Much of the time, however, the problems are more subtle and build up over periods of time. They undermine your ability to manage your team, and they can spread to the rest of the team, destroying teamwork and productivity. In this short book, Dr. Vali helps you to: * Recognize the types of upsetting work situations that bullies exploit to their own advantage, such as change, grief, and violence. * Understand why emotional terrorists make it so difficult for you, as a manager, to deal with their behavior. * See the symptomatic tools and techniques of the emotional terrorist, such as harassment, lying to supervisors, tampering with documents, etc. * Conduct training to help other managers and team members recognize and handle the signs of impending emotional conflict; you will love the 'Snakes in the Schoolyard' exercise. * Know exactly what to say and not say when you must have a one-on-one interview with someone you consider to be a bully. Be an effective manager in a world of challenges, protecting and preserving the mental health of your employees and yourself. Dr. Vali uses realistic examples and humor to help you handle the challenges you face, and to show the degree to which she really understands your situation. With her guidance, you will be more comfortable with knowing when you can handle the situation through simply being the good manager, when you need to call in an outside mental health professional, and when you need to call 911.

Have you begun to question traditional best practices in business continuity (BC)? Do you seem to be concentrating on documentation rather than preparedness? Compliance rather than recoverability? Do your efforts provide true business value? If you have these concerns, David Lindstedt and Mark Armour offer a solution in Adaptive Business Continuity: A New Approach. This ground-breaking new book provides a streamlined, realistic methodology to change BC dramatically. After years of working with the traditional practices of business continuity (BC) – in project management, higher education, contingency planning, and disaster recovery – David Lindstedt and Mark Armour identified unworkable areas in many core practices of traditional BC. To address these issues, they created nine Adaptive BC principles, the foundation of this book: Deliver continuous value; Document only for mnemonics; Engage at many levels within the organization; Exercise for improvement, not for testing; Learn the business; Measure and benchmark; Obtain incremental direction from leadership; Omit the risk assessment and business impact analysis; Prepare for effects, not causes. Adaptive Business Continuity: A New Approach uses the analogy of rebuilding a house. After the initial design, the first step is to identify and remove all the things not needed in the new house. Thus, the first chapter is "Demolition" – not to get rid of the entire BC enterprise, but to remove certain BC activities and products to provide the space to install something new. The stages continue through foundation, framework, and finishing. Finally, the last chapter is "Dwelling," permitting you a glimpse of what it might be like to live in this new home that has been created. Through a wealth of examples, diagrams, and real-world case studies, Lindstedt and Armour show you how you can execute the Adaptive BC framework in your own organization. You will: Recognize specific practices in traditional BC that may be problematic, outdated, or ineffective. Identify specific activities that you may wish to eliminate from your practice. Learn the capability and constraint model of recoverability. Understand how Adaptive BC can be effective in organizations with vastly different cultures and program maturity levels. See how to take the steps to implement Adaptive BC in your own organization. Think through some typical challenges and opportunities that may arise as you implement an Adaptive BC approach.

You designed your Business Continuity Plan to keep your business in business regardless of the forces of man and nature. But how do you know that the plan really works? Few companies can afford the recommended full-scale exercises several times a year. In The Manager's Guide to Business Continuity Exercises, Jim Burtles, an internationally known expert, details the options for conducting a range of tests and exercises to keep your plan effective and up to date. Your challenge is to maintain a good and effective plan in the face of changing circumstances and limited budgets. If your situation is like that in most companies, you really cannot depend on the results of last year's test or exercise of the plan. People tend to forget, lose confidence, lose interest, or even be replaced by other people who were not involved in your original planning. Jim Burtles explains: "You cannot have any real confidence in your plans and procedures until they have been fully tested…Exercises are the only way we can be sure that the people will be able to interpret the plans and procedures correctly within the requisite timeframe under difficult circumstances." As you do your job in this constantly shifting context, Jim Burtles helps you to: • Differentiate between an "exercise" and a "test" – and see the value of each in your BC program. • Understand the different types of plans and identify the people who need to be involved in exercises and tests for each. • Use the "Five-Stage Growth Path" – from desktop to walkthrough to full-scale exercise -- to conduct gradual testing, educate personnel, foster capability, and build confidence. • Create a variety of unusual scenario plot-lines that will keep up everyone's interest. • Identify the eight main elements in developing and delivering a successful BC exercise. • Select and prepare a "delivery team" and a "response team" for your exercise. • Make sure everyone understands the "rules of engagement." • Use the lessons learned from exercises and tests to audit, update, and maintain the plan. You are well aware that a host of problems may crop up in any kind of company-wide project. These problems can range from basic logistics like time and place, to non-support from executives and managers, to absenteeism, to the weather, to participants forgetting their lines. Throughout the book, Burtles uses his decades of experience working with companies like yours to give you useful examples, case studies, and down-to-earth advice to help you handle the unexpected and work toward the results you are looking for.

Avoid being 'blindsided' by an unexpected emergency or crisis in the workplace: violence, natural disaster, or worse! Bruce Blythe's The Manager's Guide to Quick Response in a Crisis: Effective Action in an Emergency offers the time-tested skills that prepare you to act effectively, on behalf of yourself and your co-workers, in the face of threat and chaos. Blythe uses real-world case studies, examples, and checklists to help you be the top-notch leader the situation requires. 'Hope for the best and prepare for the worst' sums up Blythe's philosophy. This short book is the essence of the basic practical counseling that he would give if he were sitting next to you at your desk. To help you figure out what to do next, he offers real-world examples of what has worked (and not worked) in his 30+ years of experience with companies just like yours. With Blythe's advice, you can act fast to: * Find out the accurate facts you need to strategize and implement a response. * Compile a checklist of immediate action items. * Create a crisis command center (CCC). * Select the best people for your action team and determine action steps. * Understand how to make good decisions in a crisis or emergency. * Handle the human side of a traumatic incident. * Set priorities in multiple timeframes. * Establish a 'new normal' as everyone phases back into productive work after the incident. To help you take the actions that will make a difference, the book includes: * Practical forms, checklists, cases studies, and real-life examples. * 'Quick Use Response Guide' at the end of each chapter.

When it's not just a drill, you need to get it right the first time. If an emergency alert sounds, are you ready to take charge and get everyone out of the office, theatre, classroom, or store safely? In Introduction to Emergency Evacuation: Getting Everybody Out When it Counts, Jim Burtles explains the practical basics of understanding your site, planning escape routes, and providing for people with special needs. When minutes count, you will be ready to take action! From 30+ years of working with organizations like yours, Burtles knows the challenges you face. He tells you what you need to know as you plan to evacuate people of all ages and health conditions, whether it's from small offices, skyscrapers, stores, industrial plants, hospitals, college campuses, or other venues. In this short book, Burtles tells you how to: * Analyze the site, identifying escape routes and assembly areas. * Select and train emergency response teams who will be ready to assist when needed. * Calculate the amount of time to allow to evacuate people from different locations, using the author's own proven formula. * Anticipate the personal needs of people who have been suddenly evacuated, from coats to transportation to medical assistance. * Learn the needs and limitations of people with disabilities, creating personal evacuation plans for them. * Create signage that will be effective for anyone who will be in the area, from workers to customers to visitors. * Communicate during the emergency. * Check and double-check to make sure nobody is left behind. Finally, to save you time in your emergency planning, Burtles ends the book ends with a bonus comprehensive 'Emergency Evacuation Checklist' containing the essentials you need to make sure your plan covers everything you need.

You have the knowledge and skill to create a workable Business Continuity Management (BCM) program – but too often, your projects are stalled while you attempt to get the right information from the right person. Rachelle Loyear experienced these struggles for years before she successfully revamped and reinvented her company's BCM program. In The Manager's Guide to Simple, Strategic, Service-Oriented Business Continuity, she takes you through the practical steps to get your program back on track. Rachelle Loyear understands your situation well. Her challenge was to manage BCM in a large enterprise that required hundreds of BC plans to be created and updated. The frustrating reality she faced was that subject matter experts in various departments held the critical information she needed, but few were willing to write their parts of the plan. She tried and failed using all the usual methods to educate and motivate – and even threaten – departments to meet her deadlines. Finally, she decided there had to be a better way. The result was an incredibly successful BCM program that was adopted by BCM managers in other companies. She calls it "The Three S's of BCM Success," which can be summarized as: Simple – Strategic – Service-Oriented. Loyear's approach is easy and intuitive, considering the BCM discipline from the point of view of the people in your organization who are tasked to work with you on building the plans and program. She found that most people prefer: Simple solutions when they are faced with something new and different. Strategic use of their time, making their efforts pay off. Service to be provided, lightening their part of the load while still meeting all the basic requirements. These tactics explain why the 3S program works. It helps you, it helps your program, and it helps your program partners. Loyear says, "If you follow the 'Three S' philosophy, the number of plans you need to document will be fewer, and the plans will be simpler and easier to produce. I've seen this method succeed repeatedly when the traditional method of handing a business leader a form to fill out or a piece of software to use has failed to produce quality plans in a timely manner." In The Manager's Guide to Simple, Strategic, Sevice-Oriented Business Continuity, Loyear shows you how to: Completely change your approach to the problems of "BCM buy-in."Find new ways to engage and support your BCM program partners and subject matter experts. Develop easier-to-use policies, procedures, and plans. Improve your overall relationships with everyone involved in your BCM program. Craft a program that works around the roadblocks rather than running headlong into them.

Risk assessment is required for just about all business plans or decisions. As a responsible manager, you need to consider threats to your organization's resilience. But to determine probability and impact – and reduce your risk – can be a daunting task. Guided by Douglas M. Henderson's The Manager's Guide to Risk Assessment: Getting It Right, you will confidently follow a clearly explained, step-by-step process to conduct a risk assessment. As you embark on the risk assessment process, you could not find a better and more uniquely qualified guide than Douglas M. Henderson. His 20+ years of experience with major consulting firms includes certification as a professional actuary and business continuity planner. His actuarial knowledge makes him an expert in applying mathematical and statistical methods to help organizations to assess and manage risks. He has applied this real-world knowledge of risk to helping businesses prepare for emergencies and business interruptions of all types. Henderson offers samples and checklists, including case studies using a fictional company in which he conducts a complete qualitative risk assessment and then a complete quantitative risk assessment, then arrives at a set of comparable actions. His explanations and sample problems will help you to: Define risk management terms, such as threat, event, and risk control. Identify threats and determine the worst-case situation your organization could face. Collect information on probability for natural and non-natural threats. Understand the difference between qualitative and quantitative risk assessment. Describe probability and impact levels. Identify exposures and examine specific risk controls. Estimate a financial value for implementing a risk control. Determine when outside professional help is needed. As an added bonus, Henderson explores the topic of risk controls with you, helping you to evaluate what risk controls will best reduce the probability of disruptive events and reduce their impact should they occur. To insure the best investment of time and money, you will perform a cost-benefit analysis for each possible risk control to make the best choice for your organization.

Attracting media attention is surprisingly easy -- you just want it to be the right kind! If an event causes the phone to ring and TV cameras to appear in your lobby, you need confidence that the people who happen to be at your worksite that day are prepared. That's easy if everyone - executives, PR, managers, and employees - is familiar with Jim Lukaszewski's sure-fire methods for handling the media. James (Jim) Lukaszewski, America's Crisis Guru ™, is one of the most visible corporate go-to people for companies when there is trouble in the room or on the horizon. The Manager's Guide to Handling the Media in a Crisis: Doing and Saying the Right Thing When it Matters Most, shares with you the skills he has developed in 30+ years of helping companies in crisis management, employee communications, ethics, media relations, public affairs, reputation preservation, leadership restoration, and recovery. Jim speaks annually before a wide variety of local, statewide, national and international organizations and associations heard by thousands of each year - and in this book, he is speaking directly to you. With this book as a guide, you will be able to: Create and deliver the message that best represents your organization. Understand what it takes to be an effective spokesperson. Make sure everyone is aware of company policies and procedures relating to the press. Be aware of the needs, deadlines, and priorities of reporters. Prepare to give good answers to all sorts of questions. Monitor social media, assess its impact. Identify the ways social media could be used to attack your company. Preserve company reputation amid a flurry of conflicting publicity. Reading this book, you will see why, wherever there is or can be trouble and crisis, affected audiences and troubled leaders are waiting to learn the way out of their problems from Jim. The book is practical, easy to read, filled with real-world case studies, checklists, anecdotes, discussion questions, and easy-to-remember tips for success.

As a manager, you're aware of terrorist acts, are considering the risks, but sense that you need more background. How might terrorism occur? How is it part of risk and threat planning? What insurance strategies might protect your company from financial loss? In a few short chapters, The Manager's Guide to Terrorism, Risk, and Insurance: Essentials for Today's Business fills in the blanks for you. What does it take to weigh the likelihood of a terrorism exposure and protect all the assets of your company? The answer to this question involves understanding the nature of terrorists and their behavior, evaluating the risk of potential damage and business interruption, and exploring ways to use insurance - such as programs covered by the US Terrorism Risk Insurance Act - to protect against severe financial harm. Authors of this book, David J. Smith and Mark D. Silinsky, give you the benefit of their decades of professional experience in risk management, insurance, physical and cyber security, and anti-terrorism. Topics covered will help you to better understand: Characteristics that could make your company the target of terrorism. The most costly terrorist acts that have brought about fatalities and insured property loss. . How to anticipate the probability of maximum loss and foreseeable loss from terrorism. The psychological picture of the typical terrorist - the warning signs and pre-attack indicators. Tactics used by terrorists, such as bombings, assassination, and kidnapping. Safety measures to be used by employees in the office and as they travel. Practical steps for loss reduction from a variety of terrorist-related threats. Insurance options to protect against financial loss from destructive terrorist acts, kidnap and ransom, and cyber attack and exposure. Case studies and discussion questions are provided to speed your understanding of the material. Importantly, since the book has been extensively researched, the authors provide a wealth of resources that you can consult as you dig deeper into this complex topic.