Chief Information Security Officer Training - United Kingdom

Chief Information Security Officer Training​ Course Outline

Module 1: Governance and Risk Management

• Governance
• Information Security Management Structure
• Principles of Information Security
• Risk Management
• Management and Technical Information Security Elements
• Compliance
• Privacy
  • Privacy Impact Assessment
  • Privacy and Security
• Laws and Regulatory Drivers
• Standards and Frameworks
  • ISO/IEC 27000 Series
  • ISO/IEC 27001
  • NIST Cybersecurity Framework
  • Federal Information Processing Standards
  • NIST Special Publications
  • Privacy Shield
  • COBIT
• Information Security Trends and Best Practices
  • Open Web Application Security Project
  • Cloud Security Alliance
  • Centre for Internet Security
• Information Security Training and Certifications
• Ethics

Module 2: Information Security Controls, Compliance, and Audit Management

• Information Security Controls
  • Control Fundamentals
  • Control Frameworks
• Information Security Control Life Cycle Frameworks
  • NIST Risk Management Framework
  • NIST Cybersecurity Framework
  • ISO/IEC 27000
• Information Security Control Life Cycle
  • Risk Assessment
  • Design
  • Implementation
  • Assessment
  • Monitoring
• Exploring Information Security Control Frameworks
• Auditing for the CISO
  • Audit Management
  • Audit Process
  • Control Self-Assessments
  • Continuous Auditing
  • Specific Types of Audits and Assessments

Module 3: Security Programme Management and Operations

• Security Programme Management
  • Security Areas of Focus
  • Security Streams of Work
  • Asset Security Management
  • Security Projects
• Security Programme Budgets, Finance, and Cost Control
  • Establishing the Budget
  • Managing and Monitoring Spending
• Security Programme Resource Management: Building the Security Team
  • Project Management
  • Project Management Fundamentals
• Project Management
  • Phases of Project Management
  • Initiating
  • Planning
  • Executing
  • Monitoring and Controlling
  • Closing

Module 4: Information Security Core Competencies

• Malicious Software and Attacks
  • Malware
  • Scripting and Vulnerability – Specific Attacks
• Social Engineering
  • Types of Social Engineering Attacks
  • Why Employees Are Susceptible to Social Engineering
  • Social Engineering Defences
• Asset Security
  • Asset Inventory and Configuration
  • Management
  • Secure Configuration Baselines
  • Vulnerability Management
  • Asset Security Techniques
• Data Security
  • Data at Rest
  • Data in Transit
  • Data in Use
  • Data Life Cycle
• Identity and Access Management
  • Identity and Access Management Fundamentals
  • Identity Management Technologies
  • Authentication Factors and Mechanisms
  • Access Control Principles
  • Access Control Models
  • Access Control Administration
  • Identity and Access Management Life Cycle
• Communication and Network Security
  • WANs and LANs
  • IP Addressing
  • Network Address Translation
  • Network Protocols and Communications
  • Wireless
  • Network Technologies and Defences
• Cryptography
  • Cryptographic Definitions
  • Cryptographic Services
  • Symmetric, Asymmetric, and Hybrid Cryptosystems
  • Hash Algorithm s
  • Message Authentication Codes
  • Digital Signatures
  • Public Key Infrastructure
• Cloud Security
  • Cloud Computing Characteristics
  • Cloud Deployment Models
  • Cloud Service Models
  • Cloud Security Risks and Assurance Levels
  • Cloud Security Resources
• Physical Security
  • Physical Security Threats
  • Physical Security Programme Planning
  • Physical Security Resources
  • Physical Security Controls
  • Physical Security Auditing and Measurement
• Personnel Security
  • Software Development Security
  • Integrating Security into the SDLC
  • Security SDLC Roles and Responsibilities
  • Software Vulnerabilities
  • Secure Coding Practices
  • Software Vulnerability Analysis and Assessments
• Forensics, Incident Handling, and Investigations
  • Relevant Law
  • Logging and Monitoring
  • Incident Response and Investigations
  • Forensics and Digital Evidence
• Security Assessment and Testing
  • Vulnerability Assessments
  • Penetration Testing
  • Regulatory Compliance Assessments
  • Security Programme Assessments
• Business Continuity and Disaster Recovery
  • Continuity Planning Initiation
  • Business Impact Analysis
  • Identify Preventive Controls
  • Develop Recovery Strategies and Solutions
  • Develop the Plan
  • Test the Plan
  • Maintain the Plan

Module 5: Strategic Planning, Finance, Procurement, and Vendor Management

• Strategic Planning
  • Organisational Strategic Planning
  • Organisational Strategic Planning Teams
  • Strategic Planning Process
  • Security Strategic Plan
• Making Security Decisions
• Financial Management
  • Accounting and Finance Basics
  • Information Security Annual Budget
• Procurement and Vendor Management
  • Procurement Core Principles and Processes
  • Types of Contracts
  • Scope Agreements
  • Third-Party Vendor Risk Management