ISO 27001 Cybersecurity manager. Guidelines.
4.3 (655 ratings)
Course Ratings are calculated from individual students’ ratings and a variety of other signals, like age of rating and reliability, to ensure that they reflect course quality fairly and accurately.
2,478 students enrolled

ISO 27001 Cybersecurity manager. Guidelines.

Application of ISO/IEC 27001 for cybersecurity. Understand and apply the requirements for a cybersecurity program.
4.3 (655 ratings)
Course Ratings are calculated from individual students’ ratings and a variety of other signals, like age of rating and reliability, to ensure that they reflect course quality fairly and accurately.
2,478 students enrolled
Last updated 4/2020
Current price: $27.99 Original price: $39.99 Discount: 30% off
5 hours left at this price!
30-Day Money-Back Guarantee
This course includes
  • 4 hours on-demand video
  • 49 downloadable resources
  • Full lifetime access
  • Access on mobile and TV
  • Certificate of Completion
Training 5 or more people?

Get your team access to 4,000+ top Udemy courses anytime, anywhere.

Try Udemy for Business
What you'll learn
  • Principles and concepts in cybersecurity
  • Threats and vulnerabilities
  • Risks and controls
  • Best practices for a succesful cybersecurity program
  • How ISO/IEC 27001 requirements apply to cybersecurity
  • Common attacks, how they work and how they can be prevented
  • Familiarity with information security concepts
  • A general understanding of IT

The purpose of this course is to provide cybersecurity guidelines for the application of ISO 27001 (the popular standard for information security management systems).

After going through the lessons you will have a good understanding of the concepts, principles and requirements for an organization to design a cybersecurity system.

You will understand what are the typical security threats for different activities and processes and the recommended controls that an organization can implement in order to respond and protect itself.

The structure of the course includes:

- introductory aspects including definitions for the Cyberspace and Cybersecurity.

- the concepts of Confidentiality, Integrity, Authentication and Non-Repudiation as critical elements for any security system;

- information classification - schemes, levels and labeling aspects

- Threats, vulnerability, risk assessment (quantiative and qualitative methods) and the options for an organization to treat security risks.

- Internal organization requirements including support from top management and segregation of duties;

- aspect on mobile devices - like BYOD (Bring Your Own Device) and COPE (Company Owned Personally Enabled)

- human resources security - from screening to employment, the contractual requirements and disciplinary process plus the termination and change of employment

- requirements for the use of removable media

- access controls and authentication aspects plus how to manage privileges so they won't generate security breaches

- cryptography - including basic elements and definitions, digital signature and the public key infrastructure

- a short description of most popular cryptograhpic attacks (brute force, rainbow tables or birthday attacks) and recommended controls

- controls that refer to physical security and equipment

- malware aspects (viruses, logic bombs, worms, trojans, spyware, adware and a detailed presentation of ransomware)

- denial of service attacks

- social engineering and phishing

- password management aspects including common password attacks and controls

- backup aspects

- requirements for the change management process in an organization so that security is not affected

- network security aspects - principles and controls + wireless attacks and how to prevent them

- requirements for email security

- security in development processes

- supplier relationships and risks associated to suppliers' access to information assets of the organization

- capacity management

- managing cybersecurity incidents - from detection to closure and root cause analysis

- business continuity aspects and how an organization should prepare for and respond to crisis situations

- compliance requirements that any organization must repsect.

The course uses easy to follow explanations and examples with a few case studies along the way (about the Barings bank collapse, the Target security breach or Edward Snowden) to illustrate the concepts described.

At the end of the course there is a quiz  - with questions from the subject matter.

Get the information you need to design, coordinate and improve a cybersecurity system or audit organizations as per ISO 27001.

Who this course is for:
  • Cybersecurity managers
  • Information security officers
  • ISO/IEC 27001 auditors and consultants
  • Security professionals
  • Professionals tasked with implementing or administrating a management system as per ISO 27001
  • Security practitioners interested in the ISO 27001 framework
  • People looking for a career in cyber security
  • IT professionals looking to enhance their knowledge
Course content
Expand 48 lectures 04:04:50
+ Introduction
48 lectures 04:04:50

Definitions for the cyberspace. Stakeholders in the cyberspace. Changes brought by the digital world.

The Cyberspace

What is cybercrime and what are the costs of cybercrime to the global economy. What is the purpose of cybersecurity - protecting the confidentiality, integrity and availability of information. The three directions of cybersecurity: prevention, detection and response. Return of investment for cybersecurity. About Software as a Service, Platform as a Service and Infrastructure as a Service. About ISO 27001 and ISO 27017. Is there a difference between information security and cybersecurity?

Preview 05:18

Different positions in cybersecurity and a brief descriptions of the main responsibilities and authorities. CISO, cybersecurity manager, cybersecurity architect, security auditor ...

Positions in cybersecurity

The three elements of the C-I-A triad - Confidentiality, Integrity, Availability and their definitions. Plus another important concept - Non-repudiation.

Preview 05:16

The purpose of information classification. Common classification schemes in military/ government organizations and the business environment. Information labeling.

Information classification

Definitions and examples for threats and vulnerabilities.

Threats and vulnerabilities

Ingredients of risk - probability and impact. Quantitative and qualitative methods for risk assessment - details, examples and advantages for each category.

Preview 05:28

Common options for treating risk and their definitions. The concept of residual risk. Categories of controls - technical, procedural (administrative) and physical.

Treating risk

Why support from senior management is important. The cybersecurity policy.

Support from top management

Common internal organization for cybersecurity. The position of a Chief Information Security Officer (CISO).

Internal organization

The principle of duties segregation or separation. Why is it important and examples. Job rotation principle and mandatory vacations.

Segregation of duties

The story of the Barings bank collapse and how duties segregation can be a critical aspect.

The Barings Bank collapse

What is BYOD. Benefits and risks that come along with BYOD. Aspects to be addressed in the BYOD policy. COPE - Company Owned Personally Enabled.

Bring your own device (BYOD)

Rules for mobile devices. MDM (Mobile Device Management) and MAM (Mobile Application Management).

Mobile devices

Security requirements and responsibilities for each position. Screening candidates. Contractual agreements (NDAs - Non Disclosure Agreements and NCA - Non-Compete Agreements). The disciplinary process. Security requirements for the termination or change of employment.

Human resources security

Security awareness - why it is important and methods. Cybersecurity training for company staff.

Awareness and training

The asset inventory. Assigning owners to assets - why and how. Acceptable use policies.

Asset management

Security risks associated to the use of removable media. Security controls for removable media.

Removable media

A short presentation of Edward Snowden's story and the huge security breach he created by revealing NSA classified information to the public. The importance of removable media.

The interesting story of Edward Snowden

What does access control involve. Solutions for access controls. Common authentication factors - type 1, type 2 and type 3 authentication + multi-factor authentication. Disabling access rights of terminated employees.

Access control

The principle of least privileges. Guidelines for preventing security breaches due to special privileges

Privileged access rights

Definition and guidelines for logging. Protection of logs; log retention. Monitoring as the process of reviewing logs.

Logging and monitoring

Brief history of cryptography. Concepts like the cipher and the algorithm. The Kerckhoffs principle. General aspects about symmetric and asymmetric cryptography.

Preview 05:44

The hash function. Requirements for the hash function. Definition of the digital signature.

Digital signature

Definition for a Public Key Infrastructure. Certification and registration authorities. About digital certificates.

Public key infrastructure

Examples and short description of common cryptographic attacks: brute force, rainbow tables, birthday, man in the middle.

Cryptographic attacks

Multiple layers for physical security in a building. Fire protection. Public areas. Secure areas.

Physical security

Security controls for company equipment. Controls for unattended equipment. Requirements for taking equipment off premises. Wiring closets. Server rooms. Cabling security. Electromagnetic emanation and TEMPEST.   


Malware definition. Common types of malware: viruses, logic bombs, worms, trojan horses, worms, spyware, adware, ransomware


Ransomware - encrypting and blocking ransomware. How they work and factors that make certain organizations attractive for ransomware. Recommendation to protect against ransomware. Pay the ransom or not? Leakware or doxware.


Definition of phishing. Types of phishing: deceptive phishing, spear phishing, whaling, pharming. Controls against phishing.


Denial of service attacks - definition and how they work. Distributed Denial of Service (DDoS). DDoS mitigation.

Denial of service (DOS and DDOS)

What is social engineering and how it works. Training and awareness against social engineering.

Social engineering

Common password attacks: password guessing, dictionary attacks, keyloggers. Guidelines for password management.

Password management

The contents of a backup policy. Differential and incremental backups.


The change process in an organization. The steps for implementing changes in a controlled manner.

Change management

Principles and key elements for network security management - networks segregation, firewalls. Wireless networks and common wireless attacks: man in the middle, packet sniffing, evil twin attacks Guidelines for protecting wireless networks.

Network security management

Contents for an email security policy. Controls for protecting data in emails.

Email security

The development lifecycle. The contents of the secure development policy. Outsourcing software development.

Security in development processes

Screening suppliers. Security requirements in supplier contracts. Security of the supply chain. Monitoring supplier performance.

Supplier relationships

The security breach that hit the Target corporation in 2013. How it happened and why.

The Target security breach

Capacity management definition. The contents of the capacity plan.

Capacity management

The stages of incident management -  detection, response, communication, recovery, root cause analysis for corrective and preventive actions, learning from incidents.

Incident management

The story of the Uber security breach of 2016. Dealing with the hackers.

The case of Uber

The most relevant business continuity activities - business impact analysis; risk assessment; the emergency team; business continuity strategy and business continuity plans. Testing and improving business continuity arrangements.

Business continuity management

Security legal compliance. Privacy and the GDPR most relevant requirements. Compliance with other requirements.

Preview 04:47

The future of cybersecurity. Big data will grow bigger. The Internet of Things.

Looking to the future
ISO 27001. Cybersecurity manager
18 questions