Certification
Certification Exams:
Prerequisites:
Course objectives
The Certified Information Systems Security Manager will receive in-depth knowledge in topics that pertain to the following:
Information Security Governance
Information Risk Management & Compliance
Information Security Program Development & Management
Information Security Incident management.
Target Audience:
IS Security Officers
IS Managers
Risk Managers
Auditors
Information Systems Owners
IS Control Assessors
System Managers
Government
The Certified Information Systems Security Manager covers the skills and knowledge to assess threat analysis and risks, Risk & incident management, Security programs and CISO roles, IS security strategy and frameworks, Audit and Risk management creation of policies, compliance and awareness, as well as DR and BCP development, deployment and maintenance.
DETAILED MODULE DESCRIPTION
Module 1 – Introduction
Welcome
Agenda
CISM
CISM Exam Review Course Overview
CISM Qualifications
The Learning Environment
Daily Format
Domain Structure
Course Structure
Logistics
Module 2 – Information Security Governance
Course Agenda
Examination Content
Chapter 1 Learning Objectives
The First Question
Information Security Governance Overview
Selling the Importance of Information Security
The First Priority for the CISM
Business Goals and Objectives
Outcomes of Information Security Governance
Benefits of Information Security Governance
Performance and Governance
Information Security Strategy
Developing Information Security Strategy
Elements of a Strategy
Objectives of Security Strategy
The Goal of Information Security
Defining Security Objectives
Business Linkages
Business Case Development
The Information Security Program
Security Program Priorities
Security versus Business
Security Program Objectives
What is Security?
Security Integration
Security Program
Architecture
Information Security Frameworks
Using an Information Security Framework
The Desired State of Security
The Desired State cont.
The Maturity of the Security Program Using CMM
Using the Balanced Scorecard
The ISO27001:2013 Framework
Examples of Other Security Frameworks
Examples of Other Security Frameworks
Constraints and Considerations for a Security Program
Constraints and Considerations for a Security Program cont.
Elements of Risk and Security
Risk Management
Information Security Concepts
Information Security Concepts cont.
Security Program Elements
Security Program Elements cont.
Third Party Agreements
Roles and Responsibilities of Senior Management
Senior Management Commitment
Steering Committee
CISO Chief Information Security Officer Responsibilities
Business Manager Responsibilities
IT Staff Responsibilities
Centralized versus Decentralized Security
Evaluating the Security Program
Audit and Assurance of Security
Evaluating the Security Program
Effective Security Metrics
Effective Security Metrics cont.
Key Performance Indicators (KPIs)
End to End Security
Correlation Tools
Reporting and Compliance
Regulations and Standards
Effect of Regulations
Reporting and Analysis
Ethics
Ethical Standards
Ethical Responsibility
Practice Questions
Module 3 – Information Risk Management and Compliance
Exam Relevance
Information Asset Classification
Roles and Responsibilities
Roles and Responsibilities
Information Classification Considerations
Regulations and Legislation
Asset Valuation
Valuation Process
Information Protection
Information Asset Protection
Definition of Risk
Why is Risk Important
Risk Management Definition
Risk Management Objective
Risk Management Overview
Risk Management Overview
Defining the Risk Environment
Threats to Information and Information Systems
Threat Analysis
Aggregate Risk
Cascading Risk
Identification of Vulnerabilities
The Effect of Risk
Impact
Impact cont.
Risk Management Process
Risk Assessment Methodology
Annualized Loss Expectancy (ALE)
Qualitative Risk Assessment
Data Gathering Techniques
Results of Risk Assessment
Alignment of Risk Assessment and BIA
Risk Treatment
Risk Treatment
Risk Mitigation and Controls
Control Recommendations
Cost Benefit Analysis of Controls
Cost Benefit Analysis of Controls cont.
Risk Mitigation Schematic
Control Types and Categories
Control Types and Categories cont.
Security Control Baselines
Ongoing Risk Assessment
Measuring Control Effectiveness
Building Risk Management In (Agenda)
Risk Related to Change Control
Controlling Risk in Change Control
Risk Management During SDLC
Ongoing Risk Management Monitoring and Analysis
Audit and Risk Management
Audit and Risk Management cont.
Risk in Business Process Re-Engineering
Risk in Project Management
Risk During Employment Process
New Employee Initiation
Risk During Employment
Risk at Termination of Employment
Risks During Procurement
Risk During Procurement cont.
Reporting to Management
Documentation
Training and Awareness
Training and Awareness
Training for End Users
Practice Questions
Module 4 – Information Security Program Development and Management
Security Strategy and Program Relationship
Information Security Management
Importance of Security Management
Definition
Effective Security Management
Reasons for Security Program Failure
Program Objectives
Security Program Development
Security Program Development cont.
Outcomes of Information Security Program Development
Governance of the Security Program
Role of the Information Security Manager (Agenda)
Strategy
Policy
Creating Effective Policy
Awareness
Implementation
Monitoring
Compliance
Developing an Information Security Road Map
Defining Security Program Objectives
Inventory of Information Systems
Challenges in Developing an Information Security Program
Challenges in Developing an Information Security Program cont.
Elements of a Security Program Road Map
Security Programs and Projects
Security Program and Project Development
Security Project Planning
Selection of Controls
Common Control Practices
Security Program Elements (Agenda)
Policies
Acceptable Use Policy
Acceptable Use Policy cont.
Standards
Procedures
Guidelines
Technology
Personnel Security
Training and Skills Matrix
Organizational Structure
Outsourced Security Providers
Third-party Service Providers
Facilities
Facilities Security
Environmental Security
Information Security Concepts (Agenda)
Information Security Concepts (Agenda)
Access Control
Identification
Authentication
Authorization
Accounting / Auditability
Criticality
Sensitivity
Trust Models
Technology-based Security
Technologies
Security in Technical Components
Operations Security
Technologies – Access Control Lists
Filtering and Content Management
Technologies - SPAM
Technologies – Databases and DBMS
Encryption
Technologies - Cryptography
Technologies – Cryptography cont.
Technologies – Encryption cont.
Technologies – Hashing Algorithms
Technology – Communications OSI Model
Technology – Communications TCP/IP
Technologies – Operating Systems
Technology - Firewalls
Emerging Technologies
Intrusion Detection Policies and Processes
Intrusion Detection Systems
IDS / IPS
Password Cracking
Vulnerability Assessments
Penetration Testing
Penetration Testing cont.
Third Party Security Reviews
Integration into Life Cycle Processes
Security in External Agreements
Security in External Agreements
Security Program Implementation
Phased Approach
Challenges During Implementation
Evaluating the Security Program
Evaluating Security Program cont.
Evaluating the Security Program cont.
Measuring Information Security Risk and Loss
Measuring Effectiveness of Technical Security Program
Measuring Effectiveness of Security Management
Security Project Management
Review of Security Compliance
Practice Questions
Module 5 - Information Security Incident Management
Learning Objectives
Definition
Goals of Incident Management and Response
Goals of Incident Response cont.
What is an Incident - Intentional
What is an Incident - Unintentional
History of Incidents
Developing Response and Recovery Plans
Incident Management and Response
Incident Management and Response cont.
Incident Management and Response cont.
Importance of Incident Management and Response
Incident Response Functions
Incident Response Manager Responsibilities
Incident Response Manager Responsibilities cont.
Requirements for Incident Response Managers
Senior Management Involvement
The Desired State
Strategic Alignment of Incident Response
Detailed Plan of Action for Incident Management
Detailed Plan of Action for Incident Management - Prepare
Detailed Plan of Action for Incident Management – Prepare cont.
Detailed Plan of Action for Incident Management - Protect
Detailed Plan of Action for Incident Management - Detect
Detailed Plan of Action for Incident Management - Triage
Detailed Plan of Action for Incident Management - Response
Elements of an Incident Response Plan
Crisis Communications
Challenges in Developing an Incident Management Plan
Personnel
Personnel cont.
Personnel cont.
Team Member Skills
Skills cont.
Skills cont.
Security Concepts and Technologies
Organizing, Training and Equipping the Response Staff
Value Delivery
Performance Measurement
Reviewing the Current State of Incident Response Capability
Audits
Gap Analysis – Basis for
an Incident Response Plan
When an Incident Occurs
During an Incident
During an Incident cont.
Containment Strategies
The Battle Box
Evidence Identification and Preservation
Post Event Reviews
Disaster Recovery Planning (DRP) and Business Recovery Processes
Development of BCP and DRP
Plan Development
Plan Development cont.
Recovery Strategies
Recovery Strategies
Basis for Recovery Strategy Selections
Disaster Recovery Sites
Disaster Recovery Sites cont.
Recovery of Communications
Notification Requirements
Notification Requirements cont.
Response Teams
Insurance
Testing Response and Recovery Plans
Types of Tests
Test Results
Test Results cont.
Plan Maintenance Activities
BCP and DRP Training
Practice Questions
