IS 305 Information Security Management

• Security Strategy
• Information Security Governance framework
• Integrating security governance into corporate governance
• Security Policies: standards, procedures, and guidelines
• Business cases to support investments
• Internal and external influences on information security strategy
• Management and other stakeholder commitment
• Roles and Responsibilities
• Measuring the effectiveness of the information security strategy

• Information asset classification
• Risk management, assessments, vulnerability assessments and threat analyses
• Risk treatment options
• Manage risk of noncompliance
• Information security controls
• Current and desired risk levels: Gap analysis
• Monitoring risk

5 LiveLab in this lesson — see the labs panel →

• Alignment of IS program with information security strategy
• Information security manager's role and responsibilities in alignment
• Information security frameworks
• Information security architectures
• Evaluating the effectiveness and efficiency of the IS program
• Integrating the IS program with IT processes
• Integrating the IS program into contracts and activities of third parties
• Controls and countermeasures
• Security Program Metrics and Monitoring

34 LiveLab in this lesson — see the labs panel →

• Organizational definition and severity hierarchy for security incidents
• Incident response plan
• Processes for timely identification
• Testing and review
• Investigating and documenting information security incidents
• Integration of incident response plan, disaster recovery plan and business continuity plan

• Introduction
• Information Security Threats, Management, And Protection
• Security Compliance And Strategy
• Business Functions And Policies
• Security Standards, Activities, And Strategy Development
• Information Security Governance Framework
• Regulatory Requirements And Liability Management
• Business Case, Budgetary Reporting Methods And Planning Strategy
• Organizational Drivers And Their Impacts
• Commitment To Info Security
• Management Roles And Responsibilities
• Reporting And Communicating
• Risks Assessment
• Information: Classification, Ownership, And Resource Valuation
• Baseline And BIAs
• Risk: Countermeasures, Mitigation Strategies, And Life Cycle
• Risk: Management And Reporting
• Information Security Strategies And Programs
• Security Technologies, Cryptography, And Access Controls
• Monitoring Tools, Security Programs And Controls
• Business Assurance Function And SLAs
• Resources, Services, And Skills
• Security Architecture, Model, And Deployment
• Info Security: Policies, Awareness And Training Programs
• Documentation
• Organizational Processes
• Contracts, Joint Ventures, Business Partners And Customers
• Third Parties, Suppliers, And Subcontractors
• Info Security Metrics
• Goals And Methods Of Evaluating Info Security Controls
• Vulnerability
• Assessment Tools And Tracking Info Security Awareness Training And Education Programs
• Evaluation And Management Metrics
• Data Collection, Reviews, And Measurement
• Assurance Providers, Line Management, Budgeting, And Staff Management
• Facilities And Program Resources
• Security Policy, Administrative Processes, And Procedures
• Access Control, Access Security Policy Principles, And Identity Management
• Authentication, Remote Access And User Registration
• Procurement And Enforcing Policy Standard and Compliance
• Third Party Relationships
• SLAs, SDLC, And Security Enforcement
• Maintenance, Monitoring, And Configuration Management
• Maintaining Info Security And Due Diligence Activities
• Info Access, Security Advice, Guidance, And Awareness
• Stakeholders
• Testing Info Security Control
• Noncompliance Issues And Security Baselines
• Incident Response And Continuity Of Operations
• Disaster Recovery And Business Continuity Plan
• Incident Management And Response Plan
• Processes, Requirements, And Plans
• Incident Response, Disaster Recovery And Business Continuity Plans
• Forensics Procedures And Incident Review Process
• Conclusion