|
Information Security Governance
|
|
Topics
|
- Information security concepts.
- The relationship between information security and business operations techniques used to secure senior management commitment and support of information security management.
- Methods of integrating information security governance into the overall enterprise governance framework.
- Practices associated with an overall policy directive that captures senior management.
- Level direction and expectations for information security in laying the foundation for information security management within an organization.
- An information security steering group function.
- Information security management roles, responsibilities and organizational structure.
- Areas of governance (for example, risk management, data classification management, network security, system access).
- Centralized and decentralized approaches to coordinating information security.
- Legal and regulatory issues associated with Internet businesses, global transmissions and transborder data flows (for example, privacy, tax laws and tariffs, data import/export restrictions, restrictions on cryptography, warranties, patents, copyrights, trade secrets, national security).
- Common insurance policies and imposed conditions (for example, crime or fidelity insurance, business interruptions).
- The requirements for the content and retention of business records and compliance.
- The process for linking policies to enterprise business objectives.
- The function and content of essential elements of an information security program (for example, policy statements, procedures and guidelines).
- Techniques for developing an information security process improvement model for sustainable and repeatable information security policies and procedures.
- Information security process improvement and its relationship to traditional process management.
- Information security process improvement and its relationship to security architecture development and modeling.
- Information security process improvement and its relationship to security infrastructure.
- Generally accepted international standards for information security management and related process improvement models.
- The key components of cost benefit analysis and enterprise transformation/migration plans (for example, architectural alignment, organizational positioning, change management, benchmarking, market/competitive analysis).
- Methodology for business case development and computing enterprise value proposition.
|
|
Risk Management
|
|
Topics
|
- Information resources used in support of business processes.
- Information resource valuation methodologies.
- Information classification.
- The principles of development of baselines and their relationship to risk-based assessments of control requirements.
- Life-cycle-based risk management principles and practices.
- Threats, vulnerabilities and exposures associated with confidentiality, integrity and availability of information resources.
- Quantitative and qualitative methods used to determine sensitivity and criticality of information resources and the impact of adverse events.
- Use of gap analysis to assess generally accepted standards of good practice for information security management against current state.
- Recovery time objectives (RTO) for information resources and how to determine RTO.
- RTO and how it relates to business continuity and contingency planning objectives and processes.
- Risk mitigation strategies used in defining security requirements for information resources supporting business applications.
- Cost benefit analysis techniques in assessing options for mitigating risks threats and exposures to acceptable levels.
- Managing and reporting status of identified risks.
|
|
Information Security Program Management
|
|
Topics
|
- Methods to develop an implementation plan that meets security requirements identified in risk analyses.
- Project management methods and techniques.
- The components of an information security governance framework for integrating security principles, practices, management and awareness into all aspects and all levels of the enterprise.
- Security baselines and configuration management in the design and management of business applications and the infrastructure.
- Information security architectures: (for example, single sign-on, rules-based as opposed to list-based system access control for systems, limited points of systems administration).
- Information security technologies (for example, cryptographic techniques and digital signatures, to enable management to select appropriate controls).
- Security procedures and guidelines for business processes and infrastructure activities. The systems development life cycle methodologies (for example, traditional SDLC, prototyping).
- Planning, conducting, reporting and follow-up of security testing.
- Certifying and accrediting the compliance of business applications and infrastructure to the enterprise's information security governance framework.
- Types, benefits and costs of physical, administrative and technical controls.
- Planning, designing, developing, testing and implementing information security requirements into an enterprise's business processes.
- Security metrics design, development and implementation.
- Acquisition management methods and techniques (for example, evaluation of vendor service level agreements, preparation of contracts).
|
|
Information Security Management
|
|
Topics
|
- How to interpret information security policies into operational use.
- Information security administration process and procedures.
- Methods for managing the implementation of the enterprise's information security program through third parties including trading partners and security services providers.
- Continuous monitoring of security activities in the enterprise's infrastructure and business applications.
- Methods used to manage success/failure in information security investments through data collection and periodic review of key performance indicators.
- Change and configuration management activities.
- Information security management due diligence activities and reviews of the infrastructure.
- Liaison activities with internal/external assurance providers performing information security reviews.
- Due diligence activities, reviews and related standards for managing and controlling access to information resources.
- External vulnerability reporting sources, which provide information that may require changes to the information security in applications and infrastructure.
- Events affecting security baselines that may require risk reassessments and changes to information security requirements in security plans, test plans and performance.
- Information security problem management practices.
- Information security manager facilitative roles as change agents, educators and consultants.
- The ways in which culture and cultural differences affect the behavior of staff.
- The activities that can change culture and behavior of staff.
- Methods and techniques for security awareness training and education.
|
|
Response Management
|
|
Topics
|
- The components of an incident response capability.
- Information security emergency management practices (for example, production change control activities, development of computer emergency response team).
- Disaster recovery planning and business recovery processes.
- Disaster recovery testing for infrastructure and critical business applications.
- Escalation processes for effective security management.
- Intrusion detection policies and processes.
- Help desk processes for identifying security incidents reported by users and distinguishing them from other issues dealt with the help desks.
- The notification process in managing security incidents and recovery: (for example, automated notice and recovery mechanisms for example in response to virus alerts in a real-time fashion).
- The requirements for collecting and presenting evidence; rules for evidence, admissibility of evidence, quality and completeness of evidence.
- Post-incident reviews and follow-up procedures.
|