ISACA CISM Training Boot Camp

Lesson 1

1. Information Security Governance
   1. Information security concepts
   2. Relationship between information security and business operations
   3. Techniques used to secure senior management commitment and support of information security management
   4. Methods of integrating information security governance into the overall enterprise governance framework
   5. Practices associated with an overall policy directive that captures senior management
   6. Level direction and expectations for information security in laying the foundation for information security management within an organization
   7. An information security steering group function
   8. Information security management roles, responsibilities and organizational structure
   9. Areas of governance (e.g., risk management, data classification management, network security, system access)
   10. Centralized and decentralized approaches to coordinating information security
   11. Legal and regulatory issues associated with internet businesses, global transmissions and transborder data flows (e.g., privacy, tax laws and tariffs, data import/export restrictions, restrictions on cryptography, warranties, patents, copyrights, trade secrets, national security)
   12. Common insurance policies and imposed conditions (e.g., crime or fidelity insurance, business interruption)
   13. Requirements for the content and retention of business records and compliance
   14. Process for linking policies to enterprise business objectives
   15. Function and content of essential elements of CISM details
   16. Techniques for developing an information security process improvement model for sustainable and repeatable information security policies and procedures
   17. Information security process improvement and its relationship to traditional process management, security architecture development and modeling, and security infrastructure
   18. Generally accepted international standards for information security management and related process improvement models
   19. The key components of cost benefit analysis and enterprise transformation/ migration plans (e.g., architectural alignment, organizational positioning, change management, benchmarking, market/competitive analysis)
   20. Methodology for business case development and computing enterprise value propositions
2. Risk Management
   1. Information resources used in support of business processes
   2. Information resource valuation methodologies
   3. Information classification
   4. The principles of development of baselines and their relationship to risk-based assessments of control requirements
   5. Life-cycle-based risk management principles and practices
   6. Threats, vulnerabilities and exposures associated with confidentiality, integrity and availability of information resources
   7. Quantitative and qualitative methods used to determine sensitivity and criticality of information resources and the impact of adverse events
   8. Use of gap analysis to assess generally accepted standards of good practice for information security management against current state
   9. Recovery time objectives (RTO) for information resources and how to determine RTO
   10. RTO and how it relates to business continuity and contingency planning objectives and processes
   11. Risk mitigation strategies used in defining security requirements for information resources supporting business applications
   12. Cost benefit analysis techniques in assessing options for mitigating risks threats and exposures to acceptable levels
   13. Managing and reporting status of identified risks
3. Information Security Program Development & Management
   1. Methods to develop an implementation plan that meets security requirements identified in risk analyses
   2. Project management methods and techniques
   3. The components of an information security governance framework for integrating security principles, practices, management and awareness into all aspects and all levels of the enterprise
   4. Security baselines and configuration management in the design and management of business applications and the infrastructure
   5. Information security architectures (e.g., single sign-on, rules-based as opposed to list-based system access control for systems, limited points of systems administration)
   6. Information security technologies (e.g., cryptographic techniques and digital signatures, enabling management to select appropriate controls)
   7. Security procedures and guidelines for business processes and infrastructure activities
   8. Systems development life cycle methodologies (e.g., traditional SDLC, prototyping)
   9. Planning, conducting, reporting and follow-up of security testing
   10. Assessing and authorizing the compliance of business applications and infrastructure to the enterprise's information security governance framework
   11. Types, benefits and costs of physical, administrative and technical controls
   12. Planning, designing, developing, testing and implementing information security requirements into an enterprise's business processes
   13. Security metrics design, development, and implementation
   14. Acquisition management methods and techniques (e.g., evaluation of vendor service level agreements, preparation of contracts)
   15. How to interpret information security policies into operational use
   16. Information security administration process and procedures
   17. Methods for managing the implementation of the enterprise's information security program through third parties, including trading partners and security services providers
   18. Continuous monitoring of security activities in the enterprise's infrastructure and business applications
   19. Methods used to manage success/failure in information security investments through data collection and periodic review of key performance indicators
   20. Change and configuration management activities
   21. Information security management due diligence activities and reviews of the infrastructure
   22. Liaison activities with internal/external assurance providers performing information security reviews
   23. Due diligence activities, reviews and related standards for managing and controlling access to information resources
   24. External vulnerability reporting sources, which provide information that may require changes to the information security in applications and infrastructure
   25. Events affecting security baselines that may require risk reassessments and changes to information security requirements in security plans, test plans and reperformance
   26. Information security problem management practices
   27. Information security manager facilitative roles as change agents, educators and consultants
   28. Ways in which cultural and socially acceptable differences affect the behavior of staff
   29. Activities that can change cultural and socially acceptable behavior of staff
   30. Methods and techniques for security awareness training and education
4. Information Security Incident Management
   1. Components of an incident response capability
   2. Information security emergency management practices (e.g., production change control activities, development of computer emergency response team)
   3. Disaster recovery planning and business recovery processes
   4. Disaster recovery testing for infrastructure and critical business applications
   5. Escalation processes for effective security management
   6. Intrusion detection policies and processes
   7. Help desk processes for identifying security incidents reported by users and distinguishing them from other issues dealt with the help desks
   8. Notification process in managing security incidents and recovery (e.g., automated notice and recovery mechanisms in response to virus alerts in a real-time fashion)
   9. Requirements for collecting and presenting evidence: rules for evidence, admissibility of evidence, quality and completeness of evidence
   10. Post-incident reviews and follow-up procedures