ISO 27001 Cybersecurity manager guidelines

The purpose of this course is to provide cybersecurity guidelines for the application of ISO 27001 (the popular standard for information security management systems).

After going through the lessons you will have a good understanding of the concepts, principles and requirements for an organization to design a cybersecurity system.

You will understand what are the typical security threats for different activities and processes and the recommended controls that an organization can implement in order to respond and protect itself.

The structure of the course includes:

- introductory aspects including definitions for the Cyberspace and Cybersecurity.

- the concepts of Confidentiality, Integrity, Authentication and Non-Repudiation as critical elements for any security system;

- information classification - schemes, levels and labeling aspects

- Threats, vulnerability, risk assessment (quantiative and qualitative methods) and the options for an organization to treat security risks.

- Internal organization requirements including support from top management and segregation of duties;

- aspect on mobile devices - like BYOD (Bring Your Own Device) and COPE (Company Owned Personally Enabled)

- human resources security - from screening to employment, the contractual requirements and disciplinary process plus the termination and change of employment

- requirements for the use of removable media

- access controls and authentication aspects plus how to manage privileges so they won't generate security breaches

- cryptography - including basic elements and definitions, digital signature and the public key infrastructure

- a short description of most popular cryptograhpic attacks (brute force, rainbow tables or birthday attacks) and recommended controls

- controls that refer to physical security and equipment

- malware aspects (viruses, logic bombs, worms, trojans, spyware, adware and a detailed presentation of ransomware)

- denial of service attacks

- social engineering and phishing

- password management aspects including common password attacks and controls

- backup aspects

- requirements for the change management process in an organization so that security is not affected

- network security aspects - principles and controls + wireless attacks and how to prevent them

- requirements for email security

- security in development processes

- supplier relationships and risks associated to suppliers' access to information assets of the organization

- capacity management

- managing cybersecurity incidents - from detection to closure and root cause analysis

- business continuity aspects and how an organization should prepare for and respond to crisis situations

- compliance requirements that any organization must repsect.

The course uses easy to follow explanations and examples with a few case studies along the way (about the Barings bank collapse, the Target security breach or Edward Snowden) to illustrate the concepts described.

At the end of the course there is a quiz  - with questions from the subject matter.

Get the information you need to design, coordinate and improve a cybersecurity system or audit organizations as per ISO 27001.