ISEB Certificate in Information Security Management Principles — A 5-Day Course

 Open Public Course Closed In-House Course

Course Synopsis

This intensive and highly practical 5 day course has been accredited by the Information Systems Examination Board (ISEB) of the British Computer Society (BCS).

As IT architectures and Information Systems generally become more pervasive, complex and available so the security risks increase. Information Security is both concerned with achieving external legislation and regulations as well as addressing the organisation's concerns about threats and vulnerabilities.

The course has been designed to provide the necessary information and guidance in order for delegates to be able to fulfil their roles as information security officers or information risk decision takers.

The course will enable delegates to confidently sit the 2 hour multiple choice BCS/ISEB Certificate in Information Security Management Principles (CISMP) exam which is taken on the final afternoon of the course.

Course Objectives

This course will also enable delegates to:

• Specify the business case for information security
• Understand the challenges posed in managing information risk
• Address the business issues relating to legislation, regulation and corporate governance as it affects information security
• Understand the issues and risks relating to information and have a clear insight into the controls needed to manage them
• Understand how the different concepts of information security interrelate with each other
• Confidently sit the CISMP exam

Intended Audience

The course will benefit: members of information security management team, IT managers, security/systems administrators and coordinaters, internal auditors, staff with a local security co-ordination role, staff responsible for legal and corporate governance, staff responsibile for information assets and systems.

Pre-Requisites

• A detailed technical knowledge is not required although ISEB recommend that you should have a minimum of twelve months IT experience before attending.

Examinations

The course fee includes ISEB Examination fees for the Certificate in Information Security Management Principles. At the end of the course delegates will be able to sit a 2 hour examination set by BCS ISEB. The examination comprises of 100 multiple choice questions

Students will need to obtain a pass mark of at least 65% to pass the examination and distinctions are awarded to candidates achieving a score of 80% or higher.

Residential courses

This course is available with a residential option of 4 nights accommodation for an extra £495 + VAT on top of the course fee - £2310 + VAT in total.

Publicly scheduled dates, locations, and prices

Outline Course Contents

Information security concepts & definitions

• What is information security?
• Management System (ISMS) concept

The need for and benefits of information security

• Corporate Governance

Information risk management

• Risk management process Approaches to risk assessment

Information security organisation & responsibilities

• Legal and regulatory obligations

Policies, standards & procedures

• Delivering a balanced ISMS
• Security procedures

Information security governance

• Policy reviews
• Security audits

Security incident management

• Objectives and stages of incident management

Information security implementation

• Getting management buy-in

Legal framework

• Processing personal data
• Employment issues
• Computer misuse
• Intellectual property rights
• Data Protection Act

Security standards and Procedures

• ISO/IEC 27002 and ISO/IEC 13335

Threats to, and vulnerabilities of, information systems

People security

• Organisational culture
• Acceptable use policies

Systems development & support

• Linking security to whole business process
• Change management process
• Handling security patches

Role of cryptography

• Common encryption models

Protection from malicious software

• Methods of control

User access controls

• Authentication and authorisation mechanisms

Networks & communications

• Partitioning networks
• Role of cryptography
• Controlling 3rd party access
• Intrusion monitoring
• Penetration testing

External services

• Protection of Web servers and e-commerce applications

IT infrastructure

• Operating, network, database and file management systems

Testing, audit & review

• Strategies for security testing of business systems

Training

• Purpose and role of training
• Approaches to training and promoting awareness

Physical and environmental security

• Controlling access and protecting physical sites and assets

Disaster recovery and business continuity management (BCM)

• Relationship between risk assessment and impact analysis

Investigations & forensics

• Common processes, tools and techniques
• Legal and regulatory guidelines