Duration
5 days
Course Outline
- The need for, and benefits of, Information Security: Corporate Governance
- Information risk management
- Information Security organisation and responsibilities: Legal and regulatory obligations
- Policies, standards & procedures: Delivering a balanced ISMS, security procedures
- Information Security governance: Policy reviews, security audits
- Security incident management: Objectives and stages of incident management
- Information Security implementation: Getting management buy-in
- Legal framework: Processing personal data, employment issues, computer misuse, intellectual property rights, Data Protection Act
- Security standards and procedures: ISO/IEC 27002 and ISO/IEC 15408
- Threats to, and vulnerabilities of, Information Systems
- People security: Organisational culture, acceptable use policies
- Systems development and support: Linking security to the whole business process, change management process, handling security patches
- Role of cryptography: Common encryption models
- Protection from malicious software: Methods of control
- User access controls: Authentication and authorisation mechanisms
- Networks and communications: Partitioning networks, the role of cryptography, controlling third-party access, intrusion monitoring, penetration testing, cloud computing
- External services: Protection of Web servers and e-commerce applications
- IT infrastructure: Operating, network, database, and file management systems
- Testing, audit, and review: Strategies for security testing of business systems
- Training: The purpose and role of training, promoting awareness
- Physical and environmental security: Controlling access and protecting physical sites and assets
- Disaster recovery and business continuity management: Relationship between risk assessment and impact analysis
- Investigations and forensics: Common processes, tools, and techniques, legal and regulatory guidelines
Programme scope, delivery arrangements and suitability are confirmed during enquiry.