Programma Information Security & Risk Management

Course Leader: Ermete Meda
Hours: 28

Prerequisites:

  • Information Security Management and Legals module or equivalent knowledge

Syllabus:

Standards and Best Practices

  • The need for standards and best practices in the industrial revolution
  • International standard production: BSI and ISO bodies
  • International ISO standardization
  • ISO 9001 standard and its extension to other management systems
  • International standards and best practices in Information & Cyber Security
  • Third-party voluntary certification process

ISO/IEC 27000 Family

  • Introduction to ISO/IEC 27001 and ISO/IEC 27002 standards
  • ISMS compliance with the ISO/IEC 27001 standard
  • Procedures and management methods for first- and second-party internal audits
  • Reference international standards

Technology Management and Operational Security

  • Technology management: a suggested path
  • Content filtering: antivirus, EDR, EPP
  • Benefits of machine learning and artificial intelligence
  • Overview of Bayesian probability for anomaly evaluation
  • Information Security Incident Management: SOC, CSIRT, SIEM

Business Continuity

  • High availability
  • Fault tolerance
  • Business continuity
  • Disaster recovery

Risk Management

  • Scope definition
  • Assets and information classification
  • Risk assessment, gap analysis, risk treatment, and risk reduction
  • Risk calculation examples using proprietary methods and commercial software tools (Magerit/Pilar use cases)
  • Risk assessment and treatment for firewall traffic policy tables
  • Risk analysis according to ISO 31000 and ISO/IEC 27005 standards

Vulnerability and Governance

  • Organization of Vulnerability Assessment and Penetration Testing activities
  • Definition of an Information Security Governance model
  • Countermeasures inspired by Defense in Depth and Maturity Models
  • Information security requirements and policies

Tools and Ethical Aspects

  • Software tools supporting legal compliance
  • Vulnerability management, exposure, and virtual patching
  • Computer ethics
  • Dangers of techno-mediation
  • Code of ethics
  • New questions posed by autonomous and robotic systems

Key Skills Acquired:

  • In-depth knowledge of the nature of an ISMS aligned with international standards and best practices
  • Ability to implement and manage an ISMS within an organization
Last update