ISO 27001 Cybersecurity manager guidelines
What you'll learn
- Principles and concepts in cybersecurity
- Threats and vulnerabilities
- Risks and controls
- Best practices for a succesful cybersecurity program
- How ISO/IEC 27001 requirements apply to cybersecurity
- Common attacks, how they work and how they can be prevented
- Familiarity with information security concepts
- A general understanding of IT
The purpose of this course is to provide cybersecurity guidelines for the application of ISO 27001 (the popular standard for information security management systems).
After going through the lessons you will have a good understanding of the concepts, principles and requirements for an organization to design a cybersecurity system.
You will understand what are the typical security threats for different activities and processes and the recommended controls that an organization can implement in order to respond and protect itself.
The structure of the course includes:
- introductory aspects including definitions for the Cyberspace and Cybersecurity.
- the concepts of Confidentiality, Integrity, Authentication and Non-Repudiation as critical elements for any security system;
- information classification - schemes, levels and labeling aspects
- Threats, vulnerability, risk assessment (quantiative and qualitative methods) and the options for an organization to treat security risks.
- Internal organization requirements including support from top management and segregation of duties;
- aspect on mobile devices - like BYOD (Bring Your Own Device) and COPE (Company Owned Personally Enabled)
- human resources security - from screening to employment, the contractual requirements and disciplinary process plus the termination and change of employment
- requirements for the use of removable media
- access controls and authentication aspects plus how to manage privileges so they won't generate security breaches
- cryptography - including basic elements and definitions, digital signature and the public key infrastructure
- a short description of most popular cryptograhpic attacks (brute force, rainbow tables or birthday attacks) and recommended controls
- controls that refer to physical security and equipment
- malware aspects (viruses, logic bombs, worms, trojans, spyware, adware and a detailed presentation of ransomware)
- denial of service attacks
- social engineering and phishing
- password management aspects including common password attacks and controls
- backup aspects
- requirements for the change management process in an organization so that security is not affected
- network security aspects - principles and controls + wireless attacks and how to prevent them
- requirements for email security
- security in development processes
- supplier relationships and risks associated to suppliers' access to information assets of the organization
- capacity management
- managing cybersecurity incidents - from detection to closure and root cause analysis
- business continuity aspects and how an organization should prepare for and respond to crisis situations
- compliance requirements that any organization must repsect.
The course uses easy to follow explanations and examples with a few case studies along the way (about the Barings bank collapse, the Target security breach or Edward Snowden) to illustrate the concepts described.
At the end of the course there is a quiz - with questions from the subject matter.
Get the information you need to design, coordinate and improve a cybersecurity system or audit organizations as per ISO 27001.
Who this course is for:
- Cybersecurity managers
- Information security officers
- ISO/IEC 27001 auditors and consultants
- Security professionals
- Professionals tasked with implementing or administrating a management system as per ISO 27001
- Security practitioners interested in the ISO 27001 framework
- People looking for a career in cyber security
- IT professionals looking to enhance their knowledge
What I do ?
I translate the knowledge and best practices of international standards into common language, to help people and organizations improve.
What I am interested in ?
My interests cover multipled disciplines including quality management, information security, business continuity, compliance management, occupational health & safety, environmental management, social responsibility, project management, food safety or risk management.
Who am I ?
I have started working in the field of standards, auditing and certification in the early 2000s and since then I have participated in hunderds of projects in multiple sectors and disciplines. Today I work for RIGCERT, an accredited certification body operating in Europe.
How I do things ?
Since my first course, in 2016, my focus has been to extract the key ideas and concepts from standards and to give you all important information in a concentrated form. For some of the subjects I teach, I collaborate with experts who help me offer value in every course that I create.