BCS CISMP Certification

This course provides you with in-depth knowledge of various advanced Information Security Management concepts and its fundamental principles. This course helps you to gain a comprehensive knowledge of the various techniques and methodologies used for identifying threats and weaknesses in your security system. You will also learn about eliminating the various risks and threats.

This course consists of the following topics:

Course Outline

Domain 1: Information Security Management Principles

• Information Security Management Principles

• Information Security
• Cyber Security
• Asset and Asset Types (Information, Physical, Software)
• Asset Value and Asset Valuation
• Threat, Vulnerability, Impact and Risk
• Organisational Risk Appetite and Risk Tolerance
• Information Security Policy Concepts
• Types, Uses and Purposes of Controls
• Defence in Depth and Breadth
• Identity, Authentication and Authorisation
• Accountability, Audit and Compliance
• Information Security Professionalism and Ethics
• Information Security Management System (ISMS)
• Information Assurance and Information Governance

• Need for, and Benefits of, Information Security

• Importance of Information Security as Part of a Business Model
• Different Business Models and their Impact on Security
• Effects of Rapidly Changing Information and Business Environment
• Balancing Cost and Impact of Security with the Reduction in Risk
• Information Security as Part of Overall Company Security Policy
• Need for a Security Policy and Supporting Standards, Guidelines and Procedures
• Security as an Enabler; Delivering Value Rather Than Cost

Domain 2: Information Risk

• Threats to, and Vulnerabilities of, Information Systems

• Threat intelligence and Sharing
• Threat Categorisation (Accidental and Disasters, Internal and External)
• Types of Accidental Threats
• Types of Deliberate Threats
• Threats from the Dark Web and Vulnerabilities of Big Data and IoT
• Sources of Accidental Threat
• Vulnerability Categorisation (General and Information- Specific Vulnerabilities
• Vulnerabilities of Specific Information System Types
• Contribution of Threats, Vulnerabilities and Asset Value to Overall Risk
• Impact Assessment of Realised Threats

• Risk Management

• Risk Management Process
• Strategic Options for Dealing with Risks and Residual Risk
• Principles of Information Classification Strategies
• Need to Assess the Risks to the Business in Business Terms
• Balancing the Cost of Information Security Against the Cost of Potential Losses

Domain 3: Information Security Framework

• Organisation and Responsibility
• Organisational Policy, Standards, and Procedures
• Information Security Governance
• Information Security Implementation
• Security Incident Management
• Legal Framework
• Security Standards and Procedures

Domain 4: Security Lifecycle

• Information Lifecycle
• Identify the Stages of the Information Lifecycle
• Concepts of Design Process Lifecycle Including Essential and Non-Functional Requirements
• Testing, Audit and Review
• System Development and Support

Domain 5: Procedural/People Security Controls

• Risks to Information Security Involving People

• Security Awareness
• Security Clearance and Vetting
• Role of Contracts of Employment
• Rights, Responsibilities, Authorities and Duties of Individuals - Codes of Conduct
• Role of Segregation of Duties/Avoiding Dependence on Key Individuals

• User Access Controls

• Authentication and Authorisation Mechanisms
• Approaches to Use of Controls on Access to Information
• Administration of Controls
• Access Points – Remote, Local, Web-based, Email, etc.
• Information Classification and Protection Processes, Techniques and Approaches

• Training and Awareness

• Purpose and Role of Security Training
• Approaches to Training and Promoting Awareness
• Sources of Information for Training Material
• Developing Positive Security Behaviour
• Continual Professional Development and Training Refreshment

Domain 6: Technical Security Controls

• Technical Security
• Networks and Communications Systems
• External Services
• Cloud Computing
• IT Infrastructure

Domain 7: Physical and Environmental Security

• Physical Security
• Protection of Equipment
• Managing Intruder
• Clear Screen and Desk Policy
• Moving Property on and Off-Site
• Procedures for Secure Disposal
• Security Requirements in Delivery and Loading Areas

Domain 8: Disaster Recovery and Business Continuity Management

• Relationship Between Dr/BCP, Risk Assessment and Impact Analysis
• Resilience of Systems and Infrastructure
• Approaches to Writing Plans and Implementing Plans
• Need for Documentation, Maintenance and Testing
• Need for Links to Managed Service Provision and Outsourcing
• Need for Secure Off-site Storage of Vital Material
• Need to Involve Personnel, Suppliers, IT Systems Providers, etc.
• Relationship with Security Incident Management

Domain 9: Other Technical Aspects

• Investigations and Forensics

• Standard Processes, Tools and Techniques for Conducting Investigations
• Legal and Regulatory Guidelines
• Need for Relations with Law Enforcement
• Security Issues when Procuring Forensic Services and Support from Third Parties

• Role of Cryptography

• Basic Cryptographic Theory, Techniques and Algorithm Types
• Policies for Cryptographic Use
• Key Management
• Requirements for Cryptographic Control
• Common Encryption Models
• Common Public Key Infrastructures and Trust Models
•  Typical Practical Applications of Cryptography
• Use by individuals of encryption facilities within applications