Main › Business Continuity Planning

Business Continuity Planning

Business Continuity Planning

Main › Information Security Metrics

Information Security Metrics

Information Security Metrics

Main › СЕН| CERTIFIED ETHICAL HACKER V9

СЕН| CERTIFIED ETHICAL HACKER V9

СЕН| CERTIFIED ETHICAL HACKER V9

Main › CHFI| COMPUTER HACKING FORENSIC INVESTIGATOR V9

CHFI| COMPUTER HACKING FORENSIC INVESTIGATOR V9

CHFI| COMPUTER HACKING FORENSIC INVESTIGATOR V9

Main › SECURITY +

SECURITY +

SECURITY +

COURSE DESCRIPTION

CompTIA Security+ (Exam SY0-501) is the primary course you will need to take if your job responsibilities include securing network services, devices, and traffic in your organization. You can also take this course to prepare for the CompTIA Security+ certification examination. In this course, you will build on your knowledge of and professional experience with security fundamentals, networks, and organizational security as you acquire the specific skills required to implement basic security services on any type of computer network.

This course can benefit you in two ways. If you intend to pass the CompTIA Security+ (Exam SY0-501) certification examination, this course can be a significant part of your preparation. But certification is not the only key to professional success in the field of computer security. Today’s job market demands individuals with demonstrable skills, and the information and activities in this course can help you build your computer security skill set so that you can confidently perform your duties in any security-related role.

TARGET AUDITORY:

This course is targeted toward the information technology (IT) professional who has networking and administrative skills in Windows-based Transmission Control Protocol/Internet Protocol (TCP/IP) networks; familiarity with other operating systems, such as mac OS, Unix, or Linux; and who wants to further a career in IT by acquiring foundational knowledge of security topics; preparing for the CompTIA Security+ certification examination; or using Security+ as the foundation for advanced security certifications or career roles.

Main › CISSP| CERTIFIED INFORMATION SYSTEM SECURITY PROFESSIONAL

CISSP| CERTIFIED INFORMATION SYSTEM SECURITY PROFESSIONAL

CISSP| CERTIFIED INFORMATION SYSTEM SECURITY PROFESSIONAL

Domain 1:Security and Risk Management

1.1 Understand and apply concepts of confidentiality, integrity and availability

1.2 Apply security governance principles through:

1.3 Compliance:

– Legislative and regulatory compliance

– Privacy requirements compliance

1.4 Understand legal and regulatory issues that pertain to information security in a global context

1.5 Understand professional ethics

– Exercise (ISC)² Code of Professional Ethics

– Support organization’s code of ethics

1.6 Develop and implement documented security policy, standards, procedures, and guidelines

1.7 Understand business continuity requirements

– Develop and document project scope and plan

– Conduct business impact analysis

– Alignment of security function to strategy, goals, mission, and objectives (e.g., business case, budget and resources)

– Organizational processes (e.g., acquisitions,divestitures, governance committees)

– Security roles and responsibilities

– Control frameworks

– Due care

– Due diligence

– Computer crimes

– Licensing and intellectual property (e.g., copyright, trademark, digital-rights management)

– Import/export controls

– Trans-border data flow

– Privacy

– Data breaches

1.8 Contribute to personnel security policies

1.9 Understand and apply risk management concepts

1.10 Understand and apply threat modeling

1.11 Integrate security risk considerations into acquisition strategy and practice

1.12 Establish and manage information security education, training, and awareness

– Appropriate levels of awareness, training, and education required within organization

– Periodic reviews for content relevancy

– Employment candidate screening (e.g., reference checks, education verification)

– Employment agreements and policies

– Employment termination processes

– Vendor, consultant, and contractor controls

– Compliance

– Privacy

– Identify threats and vulnerabilities

– Risk assessment/analysis (qualitative, quantitative,hybrid)

– Risk assignment/acceptance (e.g., system authorization)

– Countermeasure selection

– Implementation

– Types of controls (preventive, detective, corrective, etc.)

– Control assessment

– Monitoring and measurement

– Asset valuation

– Reporting

– Continuous improvement

– Risk frameworks

– Identifying threats (e.g., adversaries, contractors, employees, trusted partners)

– Determining and diagramming potential attacks (e.g., social engineering, spoofing)

– Performing reduction analysis

– Technologies and processes to remediate threats (e.g., software architecture and operations)

– Hardware, software, and services

– Third-party assessment and monitoring (e.g., onsite assessment, document exchange and review, process/policy review)

– Minimum security requirements

– Service-level requirements

Domain 2:Asset Security

2.1 Classify information and supporting assets (e.g., sensitivity, criticality)

2.2 Determine and maintain ownership (e.g., data owners, system owners, business/mission owners)

2.3 Protect privacy

2.4 Ensure appropriate retention (e.g., media, hardware, personnel)

2.5 Determine data security controls (e.g., data at rest, data in transit)

2.6 Establish handling requirements (markings, labels, storage, destruction of sensitive information)

– Data owners

– Data processers

– Data remanence

– Collection limitation

– Baselines

– Scoping and tailoring

– Standards selection

– Cryptography

Domain 3:Security Engineering

3.1 Implement and manage engineering processes using secure design principles

3.2 Understand the fundamental concepts of security models (e.g., Confidentiality, Integrity, and Multi-level Models)

3.3 Select controls and countermeasures based upon systems security evaluation models 3.4 Understand security capabilities of information systems (e.g., memory protection, virtualization, trusted platform module, interfaces, fault tolerance)

3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

3.6 Assess and mitigate vulnerabilities in web-based systems (e.g., XML, OWASP)

3.7 Assess and mitigate vulnerabilities in mobile systems

3.8 Assess and mitigate vulnerabilities in embedded devices and cyber-physical systems (e.g., network-enabled devices, Internet of things (loT))

3.9 Apply cryptography

– Client-based (e.g., applets, local caches)

– Server-based (e.g., data flow control)

– Database security (e.g., inference, aggregation, data mining, data analytics, warehousing)

– Large-scale parallel data systems

– Distributed systems (e.g., cloud computing, grid computing, peer to peer)

– Cryptographic systems

– Industrial control systems (e.g., SCADA)

– Cryptographic life cycle (e.g., cryptographic limitations, algorithm/protocol governance)

– Cryptographic types (e.g., symmetric, asymmetric, elliptic curves)

– Public Key Infrastructure (PKI)

– Key management practices

– Digital signatures

– Digital rights management

– Non-repudiation

– Integrity (hashing and salting)

– Methods of cryptanalytic attacks (e.g., brute force, cipher-text only, known plaintext)

3.10 Apply secure principles to site and facility design

3.11 Design and implement physical security

– Wiring closets

– Server rooms

– Media storage facilities

– Evidence storage

– Restricted and work area security (e.g., operations centers)

– Data center security

– Utilities and HVAC considerations

– Water issues (e.g., leakage, flooding)

– Fire prevention, detection and suppression

Domain 4:Communications and Network Security

4.1 Apply secure design principles to network architecture (e.g., IP & non-IP protocols, segmentation)

4.2 Secure network components

4.3 Design and establish secure communication channels

4.4 Prevent or mitigate network attacks

– OSI and TCP/IP models

– IP networking

– Implications of multilayer protocols (e.g., DNP3)

– Converged protocols (e.g., FCoE, MPLS, VoIP, iSCSI)

– Software-defined networks

– Wireless networks

– Cryptography used to maintain communication security

– Operation of hardware (e.g., modems, switches, routers, wireless access points, mobile devices)

– Transmission media (e.g., wired, wireless, fiber)

– Network access control devices (e.g., firewalls, proxies)

– Endpoint security

– Content-distribution networks

– Physical devices

– Voice

– Multimedia collaboration (e.g., remote meeting technology, instant messaging)

– Remote access (e.g., VPN, screen scraper, virtual application/desktop, telecommuting)

– Data communications (e.g., VLAN, TLS/SSL)

– Virtualized networks (e.g., SDN, virtual SAN, guest operating systems, port isolation)

Domain 5:Identity and Access Management

5.1 Control physical and logical access to assets

– Information

– Systems

– Devices

– Facilities

5.2 Manage identification and authentication of people and devices

5.3 Integrate identity as a service (e.g., cloud identity)

5.4 Integrate third-party identity services (e.g., on-premise)

5.5 Implement and manage authorization mechanisms

– Role-Based Access Control (RBAC) methods

– Rule-based access control methods

– Mandatory Access Control (MAC)

– Discretionary Access Control (DAC)

5.6 Prevent or mitigate access control attacks

5.7 Manage the identity and access provisioning lifecycle (e.g., provisioning, review)

– Identity management implementation (e.g., SSO, LDAP)

– Single/multi-factor authentication (e.g., factors, strength, errors)

– Accountability

– Session management (e.g., timeouts, screensavers)

– Registration and proofing of identity

– Federated identity management (e.g., SAML)

– Credential management systems

Domain 6:Security Assessment and Testing

6.1 Design and validate assessment and test strategies

6.2 Conduct security control testing

6.3 Collect security process data (e.g., management and operational controls)

6.4 Analyze and report test outputs (e.g., automated, manual)

6.5 Conduct or facilitate internal and third party audits

– Vulnerability assessment

– Penetration testing

– Log reviews

– Synthetic transactions

– Code review and testing (e.g., manual, dynamic, static, fuzz)

– Misuse case testing

– Test coverage analysis

– Interface testing (e.g., API, UI, physical)

– Account management (e.g., escalation, revocation)

– Management review

– Key performance and risk indicators

– Backup verification data

– Training and awareness

– Disaster recovery and business continuity

Domain 7:Security Operations

7.1 Understand and support investigations

7.2 Understand requirements for investigation types

7.3 Conduct logging and monitoring activities

7.4 Secure the provisioning of resources

7.5 Understand and apply foundational security operations concepts

7.6 Employ resource protection techniques

– Media management

– Hardware and software asset management

– Evidence collection and handling (e.g., chain of custody, interviewing)

– Reporting and documenting

– Investigative techniques (e.g., root-cause analysis, incident handling)

– Digital forensics (e.g., media, network, software, and embedded devices)

– Intrusion detection and prevention

– Security information and event management

– Continuous monitoring

– Egress monitoring (e.g., data loss prevention, steganography, watermarking)

– Asset inventory (e.g., hardware, software)

– Configuration management

– Physical assets

– Virtual assets (e.g., software-defined network, virtual SAN, guest operating systems)

– Cloud assets (e.g., services, VMs, storage, networks)

– Applications (e.g., workloads or private clouds, web services, software as a service)

– Need-to-know/least privilege (e.g., entitlement, aggregation, transitive trust)

– Separation of duties and responsibilities

– Monitor special privileges (e.g., operators, administrators)

– Job rotation

– Information lifecycle

– Service-level agreements

– Operational

– Criminal

– Civil

– Regulatory

– Electronic discovery (eDiscovery)

7.7 Conduct incident management

7.8 Operate and maintain preventative measures

7.9 Implement and support patch and vulnerability management

7.10 Participate in and understand change management processes (e.g., versioning, baselining, security impact analysis)

7.11 Implement recovery strategies

7.12 Implement disaster recovery processes

7.13 Test disaster recovery plans

7.14 Participate in business continuity planning and exercises

7.15 Implement and manage physical security

– Perimeter (e.g., access control and monitoring)

– Internal security (e.g., escort requirements/visitor control, keys and locks)

7.16 Participate in addressing personnel safety concerns (e.g., duress, travel, monitoring)

– Detection

– Response

– Mitigation

– Reporting

– Recovery

– Remediation

– Lessons learned

– Firewalls

– Intrusion detection and prevention systems

– Whitelisting/Blacklisting

– Third-party security services

– Sandboxing

– Honeypots/Honeynets

– Anti-malware

– Backup storage strategies (e.g., offsite storage, electronic vaulting, tape rotation)

– Recovery site strategies

– Multiple processing sites (e.g., operationally redundant systems)

– System resilience, high availability, quality of service, and fault tolerance

– Response

– Personnel

– Communications

– Assessment

– Restoration

– Training and awareness

– Read-through

– Walkthrough

– Simulation

– Parallel

– Full interruption

Domain 8:Software Development Security

8.1 Understand and apply security in the software development lifecycle

8.2 Enforce security controls in development environments

8.3 Assess the effectiveness of software security

– Auditing and logging of changes

– Risk analysis and mitigation

– Acceptance testing

8.4 Assess security impact of acquired software

Main › CISRM) Certified Information System Risk Management

CISRM) Certified Information System Risk Management

CISRM) Certified Information System Risk Management

Prerequisites: 

A minimum of 1 year of Information Systems

Student Materials:
  • Student Workbook
  • Student Reference Manual
  • Key Security Concepts & Definitions Book
Certification Exam:
  • Mile2 C)ISRM
  • Covers ISACA CRISC®
CPEs: 24
According to this course, you’ll have:
  • Certified by Mile2 Trainer, International Cyber Security Professional and practitioner
  • Authorized training materials
  • Friendly Placement Classroom
  • High Quality Classroom Equipment
  • The Best Catering
  • EXAM Voucher

WHO SHOULD ATTEND?

  • Information System Security Officers
  • Risk Managers
  • Information Systems Owners
  • Info Security Control Assessors
  • System Managers
  • State & Local Government Risk Managers
COURSE CONTENT
  1. The Big Picture
  2. Domain 1 Risk Identification Assessment and Evaluation
  3. Domain 2 – Risk Response
  4. Domain 3 – Risk Monitoring
  5. Domain 4 – IS Control Design and Implementation
DETAILED MODULE DESCRIPTION

C)ISRM Part 1: The Big Picture

  • About the C)ISRM Exam
  • Exam Relevance
  • About the C)ISRM Exam
  • Section Overview
  • Part 1 Learning Objectives
  • Section Topics
  • Overview of Risk Management
  • Risk
  • Risk and Opportunity Management
  • Responsibility vs. Accountability
  • Risk Management
  • Roles and Responsibilities
  • Relevance of Risk Management Frameworks, Standards and Practices
  • Frameworks
  • Standards
  • Practices
  • Relevance of Risk Governance
  • Overview of Risk Governance
  • Objectives of Risk Governance
  • Foundation of Risk Governance
  • Risk Appetite and Risk Tolerance
  • Risk Awareness and Communication
  • Key Concepts of
  • Risk Governance
  • Risk Culture
  • Case Study
  • Practice Question 1
  • Practice Question 2
  • Practice Question 3
  • Practice Question 4
  • Practice Question 5
  • Acronym Review
  • Definition Review
C)ISRM Part II – Domain 1 Risk Identification Assessment and Evaluation
  • Section Overview
  • Exam Relevance
  • Domain 1 Learning Objectives
  • Task Statements
  • Knowledge Statements
  • The Process
  • Describing the Business Impact of IT Risk
  • IT Risk in the Risk Hierarchy
  • IT Risk Categories
  • High Level Process Phases
  • Risk Scenarios
  • Definition of Risk Scenario
  • Purpose of Risk Scenarios
  • Event Types
  • Risk Scenario Development
  • Risk Registry & Risk Profile
  • Risk Scenario Development
  • Risk Scenario Components
  • Risk Scenario Development
  • Risk Scenario Development Enablers
  • Systemic, Contagious or Obscure Risk
  • Generic IT Risk Scenarios
  • Definition of Risk Factor
  • Examples of Risk Factors
  • Risk Factors— External Environment
  • Risk Factors— Risk Management Capability
  • Risk Factors— IT Capability
  • Risk Factors— IT Related Business Capabilities
  • Methods for Analyzing IT Risk
  • Likelihood and Impact
  • Risk Analysis Output
  • Risk Analysis Methods
  • Risk Analysis Methods—Quantitative
  • Risk Analysis Methods—Qualitative
  • Risk Analysis Methods—for HIGH impact risk types
  • Risk Analysis Methods
  • Risk Analysis Methods—Business Impact Analysis (BIA)
  • Methods for Assessing IT Risk
  • Identifying  and Assessing IT Risk
  • Definitions
  • Adverse Impact of Risk Event
  • Business Impacts From IT Risk
  • Business Related IT Risk Types
  • IT Project-Related Risk
  • Risk Components—Inherent Risk
  • Risk Components—Residual Risk
  • Risk Components—Control Risk
  • Risk Components—Detection Risk
  • Business Risk and Threats
  • Addressed By IT Resources
  • Identifying  and Assessing IT Risk
  • Methods For Describing
  • IT Risk In Business Terms
  • Case Study
  • Acronym Review
  • Definition Review
  • Domain 1 – Exercises
C)ISRM Part II Domain 2 – Risk Response 
  • Section Overview
  • Exam Relevance
  • Domain 2 Learning Objectives
  • Task Statements
  • Knowledge Statements
  • Risk Response Objectives
  • The Risk Response Process
  • Risk Response Options
  • Risk Response Parameters
  • Risk Tolerance and Risk Response Options
  • Risk Response Prioritization Options
  • Risk Mitigation Control Types
  • Risk Response Prioritization Factors
  • Risk Response Tracking, Integration and Implementation
  • Process Phases
  • Phase 1—Articulate Risk
  • Phase 2—Manage Risk
  • Phase 3—React To Risk Events
  • Sample Case Study
  • Domain 2 – Exercise 1
C)ISRM Part II – Domain 3 – Risk Monitoring 
  • Course Agenda
  • Exam Relevance
  • Learning Objectives
  • Task Statements
  • Knowledge Statements
  • Essentials
  • Risk Indicators
  • Risk Indicator Selection Criteria
  • Key Risk Indicators
  • Risk Monitoring
  • Risk Indicator Types and Parameters
  • Risk Indicator Considerations
  • Criteria for KRI Selection
  • Benefits of Selecting Right KRIs
  • Disadvantages of Wrong KRIs
  • Changing KRIs
  • Gathering KRI Data
  • Steps to Data Gathering
  • Gathering Requirements
  • Data Access
  • Data Preparation
  • Data Validating Considerations
  • Data Analysis
  • Reporting and Corrective Actions
  • Optimizing KRIs
  • Use of Maturity Level Assessment
  • Assessing Risk Maturity Levels
  • Risk Management Capability Maturity Levels
  • Changing Threat Levels
  • Monitoring Changes in Threat Levels
  • Measuring Changes in Threat Levels
  • Responding to Changes in Threat Levels
  • Threat Level Review
  • Changes in Asset Value
  • Maintain Asset Inventory
  • Risk Reporting
  • Reporting Content
  • Effective Reports
  • Report Recommendations
  • Possible Risk Report Recipients
  • Periodic Reporting
  • Reporting Topics
  • Risk Reporting Techniques
  • Sample Case Study
  • Practice Question 1
  • Practice Question 2
  • Practice Question 3
  • Practice Question 4
  • Acronym Review
  • Definition Review
  • Domain 3 – Exercises
C)ISRM Part II Domain 4 – IS Control Design and Implementation 
  • Section Overview
  • Exam Relevance
  • Domain 4 Learning Objectives
  • Task Statements
  • Knowledge Statements
  • C)ISRM Involvement
  • Control Definition
  • Control Categories
  • Control Types and Effects
  • Control Methods
  • Control Design Considerations
  • Control Strength
  • Control Strength
  • Control Costs and Benefits
  • Potential Loss Measures
  • Total Cost of Ownership For Controls
  • Role of the C)ISRM in SDLC
  • The SDLC Process
  • The Systems
  • Development Life Cycle (SDLC)
  • ‘Meets and Continues to Meet’
  • SDLC
  • SDLC Phases
  • Addressing Risk Within the SDLC
  • Business Risk versus Project Risk
  • Understanding Project Risk
  • Addressing Business Risk
  • Understanding Business
  • and Risk Requirements
  • Understand Business Risk
  • High Level SDLC Phases
  • Project Initiation
  • Phase 1 – Project Initiation
  • Phase 1 Tasks
  • Task 1—Feasibility Study
  • Feasibility Study Components
  • Determining Feasibility
  • Outcomes of the Feasibility Study
  • Task 1—Define Requirement
  • Requirement Progression
  • Business Information Requirements (COBIT)
  • Requirements Success Factors
  • Task 3—Acquire Software “Options”
  • Software Selection Criteria
  • Software Acquisition
  • Software Acquisition Process
  • Leading Principles for Design and Implementation
  • C)ISRM Responsibilities
  • Key System Design Activities:
  • Steps to Perform Phase 2
  • Phase 2 – Project Design and Development
  • System Testing
  • Test Plans
  • Project Testing
  • Types of Tests
  • UAT Requirements
  • Certification and Accreditation
  • Project Status Reports
  • Phase 3 – Project Testing
  • Testing Techniques
  • Verification and Validation
  • Phase 4 – Project Implementation
  • Project Implementation
  • Implementation Phases
  • Phase 4 – Project Implementation
  • End User Training Plans & Techniques
  • Training Strategy
  • Data Migration/Conversion Considerations
  • Risks During Data Migration
  • Data Conversion Steps
  • Implementation Rollback
  • Data Conversion Project Key Considerations
  • Changeover Techniques
  • Post-Implementation Review
  • Performing Post-Implementation Review
  • Measurements of Critical Success Factors
  • Closing a Project
  • Project Management and Controlling
  • Project Management Tools and Techniques
  • Project Management Elements
  • Project Management Practices
  • PERT chart and critical path
  • PERT Attribute
  • Sample Case Study
  • Practice Question 1
  • Practice Question 2
  • Practice Question 3
  • Practice Question 4
  • Practice Question 5

Main › CISSM) Certified Information System Security Manager

CISSM) Certified Information System Security Manager

CISSM) Certified Information System Security Manager

PREREQUISITES: 

A minimum of 1 year in Information Systems

STUDENT MATERIALS:

Student Workbook

CERTIFICATION EXAMS:
  • Mile2 C)ISSM – Certified Information Systems Security Manager
  • Covers ISACA® CISM exam objectives
CPES: 32 HOURS
WHO SHOULD ATTEND?
  • IS Security Officers
  • IS Managers
  • Risk Managers
  • Auditors
  • Information Systems Owners
  • IS Control Assessors
  • System Managers
  • Government

The Certified Information Systems Security Manager covers the skills and knowledge to assess threat analysis and risks, Risk & incident management, Security programs and CISO roles, IS security strategy and frameworks, Audit and Risk management creation of policies, compliance and awareness, as well as DR and BCP development, deployment and maintenance.

THE CERTIFIED INFORMATION SYSTEMS SECURITY MANAGER WILL RECEIVE IN-DEPTH KNOWLEDGE IN TOPICS THAT PERTAIN TO THE FOLLOWING:  
  • Information Security Governance
  • Information Risk Management & Compliance
  • Information Security Program Development & Management
  • Information Security Incident management.
COURSE CONTENT
MODULE 1 – INTRODUCTION
MODULE 2 – INFORMATION SECURITY GOVERNANCE
MODULE 3 – INFORMATION RISK MANAGEMENT AND COMPLIANCE
MODULE 4 – INFORMATION SECURITY PROGRAM DEVELOPMENT AND MANAGEMENT
MODULE 5 –  INFORMATION SECURITY INCIDENT MANAGEMENT
DETAILED MODULE DESCRIPTION
MODULE 1 – INTRODUCTION
  • Welcome
  • Agenda
  • CISM
  • CISM Exam Review Course Overview
  • CISM Qualifications
  • The Learning Environment
  • Daily Format
  • Domain Structure
  • Course Structure
  • Logistics
MODULE 2 – INFORMATION SECURITY GOVERNANCE
  • Course Agenda
  • Examination Content
  • Chapter 1 Learning Objectives
  • The First Question
  • Information Security Governance Overview
  • Selling the Importance of Information Security
  • The First Priority for the CISM
  •  Business Goals and Objectives
  • Outcomes of Information Security Governance
  • Benefits of Information Security Governance
  • Performance and Governance
  • Information Security Strategy
  • Developing Information Security Strategy
  • Elements of a Strategy
  • Objectives of Security Strategy
  • The Goal of Information Security
  • Defining Security Objectives
  • Business Linkages
  • Business Case Development
  • The Information Security Program
  • Security Program Priorities
  • Security versus Business
  • Security Program Objectives
  • What is Security?
  • Security Integration
  • Security Program
  • Architecture
  • Information Security Frameworks
  • Using an Information Security Framework
  • The Desired State of Security
  • The Desired State cont.
  • The Maturity of the Security Program Using CMM
  • Using the Balanced Scorecard
  • The ISO27001:2013 Framework
  • Examples of Other Security Frameworks
  • Examples of Other Security Frameworks
  • Constraints and Considerations for a Security Program
  • Constraints and Considerations for a Security Program cont.
  • Elements of Risk and Security
  • Risk Management
  • Information Security Concepts
  • Information Security Concepts cont.
  • Security Program Elements
  • Security Program Elements cont.
  • Third Party Agreements
  • Roles and Responsibilities of Senior Management
  • Senior Management Commitment
  • Steering Committee
  • CISO Chief Information Security Officer Responsibilities
  • Business Manager Responsibilities
  • IT Staff Responsibilities
  • Centralized versus Decentralized Security
  • Evaluating the Security Program
  • Audit and Assurance of Security
  • Evaluating the Security Program
  • Effective Security Metrics
  • Effective Security Metrics cont.
  • Key Performance Indicators (KPIs)
  • End to End Security
  • Correlation Tools
  • Reporting and Compliance
  • Regulations and Standards
  • Effect of Regulations
  • Reporting and Analysis
  • Ethics
  • Ethical Standards
  • Ethical Responsibility
  • Practice Questions
MODULE 3 – INFORMATION RISK MANAGEMENT AND COMPLIANCE
  • Exam Relevance
  • Information Asset Classification
  • Roles and Responsibilities
  • Roles and Responsibilities
  • Information Classification Considerations
  • Regulations and Legislation
  • Asset Valuation
  • Valuation Process
  • Information Protection
  • Information Asset Protection
  • Definition of Risk
  • Why is Risk Important
  • Risk Management Definition
  • Risk Management Objective
  • Risk Management Overview
  • Risk Management Overview
  • Defining the Risk Environment
  • Threats to Information and Information Systems
  • Threat Analysis
  • Aggregate Risk
  • Cascading Risk
  • Identification of Vulnerabilities
  • The Effect of Risk
  • Impact
  • Impact cont.
  • Risk Management Process
  • Risk Assessment Methodology
  • Annualized Loss Expectancy (ALE)
  • Qualitative Risk Assessment
  • Data Gathering Techniques
  • Results of Risk Assessment
  • Alignment of Risk Assessment and BIA
  • Risk Treatment
  • Risk Treatment
  • Risk Mitigation and Controls
  • Control Recommendations
  • Cost Benefit Analysis of Controls
  • Cost Benefit Analysis of Controls cont.
  • Risk Mitigation Schematic
  • Control Types and Categories
  • Control Types and Categories cont.
  • Security Control Baselines
  • Ongoing Risk Assessment
  • Measuring Control Effectiveness
  • Building Risk Management In (Agenda)
  • Risk Related to Change Control
  • Controlling Risk in Change Control
  • Risk Management During SDLC
  • Ongoing Risk Management Monitoring and Analysis
  • Audit and Risk Management
  • Audit and Risk Management cont.
  • Risk in Business Process Re-Engineering
  • Risk in Project Management
  • Risk During Employment Process
  • New Employee Initiation
  • Risk During Employment
  • Risk at Termination of Employment
  • Risks During Procurement
  • Risk During Procurement cont.
  • Reporting to Management
  • Documentation
  • Training and Awareness
  • Training and Awareness
  • Training for End Users
  • Practice Questions
MODULE 4 – INFORMATION SECURITY PROGRAM DEVELOPMENT AND MANAGEMENT
  • Security Strategy and Program Relationship
  • Information Security Management
  • Importance of Security Management
  • Definition
  • Effective Security Management
  • Reasons for Security Program Failure
  • Program Objectives
  • Security Program Development
  • Security Program Development cont.
  • Outcomes of Information Security Program Development
  • Governance of the Security Program
  • Role of the Information Security Manager (Agenda)
  • Strategy
  • Policy
  • Creating Effective Policy
  • Awareness
  • Implementation
  • Monitoring
  • Compliance
  • Developing an Information Security Road Map
  • Defining Security Program Objectives
  • Inventory of Information Systems
  • Challenges in Developing an Information Security Program
  • Challenges in Developing an Information Security Program cont.
  • Elements of a Security Program Road Map
  • Security Programs and Projects
  • Security Program and Project Development
  • Security Project Planning
  • Selection of Controls
  • Common Control Practices
  • Security Program Elements (Agenda)
  • Policies
  • Acceptable Use Policy
  • Acceptable Use Policy cont.
  • Standards
  • Procedures
  • Guidelines
  • Technology
  • Personnel Security
  • Training and Skills Matrix
  • Organizational Structure
  • Outsourced Security Providers
  • Third-party Service Providers
  • Facilities
  • Facilities Security
  • Environmental Security
  • Information Security Concepts (Agenda)
  • Information Security Concepts (Agenda)
  • Access Control
  • Identification
  • Authentication
  • Authorization
  • Accounting / Auditability
  • Criticality
  • Sensitivity
  • Trust Models
  • Technology-based Security
  • Technologies
  • Security in Technical Components
  • Operations Security
  • Technologies – Access Control Lists
  • Filtering and Content Management
  • Technologies – SPAM
  • Technologies – Databases and DBMS
  • Encryption
  • Technologies – Cryptography
  • Technologies – Cryptography cont.
  • Technologies – Encryption cont.
  • Technologies – Hashing Algorithms
  • Technology – Communications OSI Model
  • Technology – Communications TCP/IP
  • Technologies – Operating Systems
  • Technology – Firewalls
  • Emerging Technologies
  • Intrusion Detection Policies and Processes
  • Intrusion Detection Systems
  • IDS / IPS
  • Password Cracking
  • Vulnerability Assessments
  • Penetration Testing
  • Penetration Testing cont.
  • Third Party Security Reviews
  • Integration into Life Cycle Processes
  • Security in External Agreements
  • Security in External Agreements
  • Security Program Implementation
  • Phased Approach
  • Challenges During Implementation
  • Evaluating the Security Program
  • Evaluating Security Program cont.
  • Evaluating the Security Program cont.
  • Measuring Information Security Risk and Loss
  • Measuring Effectiveness of Technical Security Program
  • Measuring Effectiveness of Security Management
  • Security Project Management
  • Review of Security Compliance
  • Practice Questions
MODULE 5 –  INFORMATION SECURITY INCIDENT MANAGEMENT
  • Learning Objectives
  • Definition
  • Goals of Incident Management and Response
  • Goals of Incident Response cont.
  • What is an Incident – Intentional
  • What is an Incident – Unintentional
  • History of Incidents
  • Developing Response and Recovery Plans
  • Incident Management and Response
  • Incident Management and Response cont.
  • Incident Management and Response cont.
  • Importance of Incident Management and Response
  • Incident Response Functions
  • Incident Response Manager Responsibilities
  • Incident Response Manager Responsibilities cont.
  • Requirements for Incident Response Managers
  • Senior Management Involvement
  • The Desired State
  • Strategic Alignment of Incident Response
  • Detailed Plan of Action for Incident Management
  • Detailed Plan of Action for Incident Management – Prepare
  • Detailed Plan of Action for Incident Management – Prepare cont.
  • Detailed Plan of Action for Incident Management – Protect
  • Detailed Plan of Action for Incident Management – Detect
  • Detailed Plan of Action for Incident Management – Triage
  • Detailed Plan of Action for Incident Management – Response
  • Elements of an Incident Response Plan
  • Crisis Communications
  • Challenges in Developing an Incident Management Plan
  • Personnel
  • Personnel cont.
  • Personnel cont.
  • Team Member Skills
  • Skills cont.
  • Skills cont.
  • Security Concepts and Technologies
  • Organizing, Training and Equipping the Response Staff
  • Value Delivery
  • Performance Measurement
  • Reviewing the Current State of Incident Response Capability
  • Audits
  • Gap Analysis – Basis for
  • an Incident Response Plan
  • When an Incident Occurs
  • During an Incident
  • During an Incident cont.
  • Containment Strategies
  • The Battle Box
  • Evidence Identification and Preservation
  • Post Event Reviews
  • Disaster Recovery Planning (DRP) and Business Recovery Processes
  • Development of BCP and DRP
  • Plan Development
  • Plan Development cont.
  • Recovery Strategies
  • Recovery Strategies
  • Basis for Recovery Strategy Selections
  • Disaster Recovery Sites
  • Disaster Recovery Sites cont.
  • Recovery of Communications
  • Notification Requirements
  • Notification Requirements cont.
  • Response Teams
  • Insurance
  • Testing Response and Recovery Plans
  • Types of Tests
  • Test Results
  • Test Results cont.
  • Plan Maintenance Activities
  • BCP and DRP Training
  • Practice Questions

Main › C)ISSA. Certified Information System Security Auditor

C)ISSA. Certified Information System Security Auditor

C)ISSA. Certified Information System Security Auditor

PREREQUISITES:

A minimum of 1 year of Information Systems

STUDENT MATERIALS:

Student Workbook Certification

EXAMS:

Mile2 C)ISSA – Certified Information Systems Security Auditor

Covers ISACA® CISA exam objectives

Main › CCISO | EC-Council Certified CISO

CCISO | EC-Council Certified CISO

CCISO | EC-Council Certified CISO