Paper 12

(E2) INFORMATION SYSTEMS SECURITY

This paper is intended to equip the candidate with the knowledge, skills and attitude that will enable him/her to manage the information security in an organization

On completion, a candidate should be able to

Develop Information Systems (IS) security policies for any organization
Conduct penetration testing to monitor vulnerabilities and threats in IS systems
Develop suitable countermeasures to protect organization IS
Design and implement disaster recovery and business continuity planning systems

Content

1
Overview Information Systems Security
1. 1.1
  Objectives of IS security
2. 1.2
  Organizational information assets and classifications
3. 1.3
  Threats, vulnerabilities and risks
4. 1.4
  Scope of IS security in an organization
5. 1.5
  IS security metrics
2
IS Security Standards and Frameworks
1. 2.1
  IS Security Frameworks
2. 2.2
  IS security laws and regulations
3. 2.3
  IS security governance
3
Network and Computer Security
1. 3.1
  Intrusion detection systems
2. 3.2
  Intrusion prevention
3. 3.3
  Recovery from failures
4
Data Protection
1. 4.1
  Identifying critical IS assets
2. 4.2
  Data loss prevention
3. 4.3
  Data privacy
4. 4.4
  Local and international laws & regulations
5
IS Security Controls
1. 5.1
  Management controls
2. 5.2
  Operational controls
3. 5.3
  Technological controls
6
IS Security Policies
1. 6.1
  Organizational security policies
2. 6.2
  IS security and organizational strategy
3. 6.3
  IS security roles and responsibilities
4. 6.4
  Evaluation of org IS security
5. 6.5
  Developing and implementing an IS security policy (40)
7
Penetration Testing
1. 7.1
  Penetration testing tools
2. 7.2
  Process of penetration testing
3. 7.3
  Reporting and communication of results
8
Designing & Building Secure Systems
1. 8.1
  Architectural risk analysis
2. 8.2
  Security requirements
3. 8.3
  Embedding an IS security culture in an organization
9
Business Continuity & Disaster Recovery
1. 9.1
  Incident management
2. 9.2
  Business impact analysis
3. 9.3
  Business Continuity Planning
4. 9.4
  Disaster recovery planning
10
IS Security Audit
1. 10.1
  Overview of IS security audit
2. 10.2
  IS audit tools and techniques
3. 10.3
  IS audit process
4. 10.4
  IS audit reporting