Certificate in Information Security Management Principles (CISMP) Certification Online Training

Syllabus of Certificate in Information Security Management Principles (CISMP) Certification Online Training

• What security means
• The core concepts and definitions used in information security
• The key business drivers and how they shape the organization’s approach to governance, risk management and compliance.
• The benefits of information security
• The role information security plays in an organization
• How an organization can make information security an integral part of its business.

• What risk means, how it arises and the likelihood of it impacting an organization.
• The effect big data, the Internet of Things and social media have on the risk landscape.
• Management techniques used by organizations to understand the risks they face
• Risk treatment and risk reduction methods
• The risk management lifecycle, illustrating how risks are identified, analysed, treated and monitored
• Qualitative and quantitative methods of risk analysis
• How assets can be classified to help manage risk

• Where the security function fits within the organizational structure
• The role of the Information Security Officer
• Developing information security policies, standards and procedures
• The principles of information security governance
• How to carry out a security audit
• Implementing an information assurance programme and the importance of stakeholder engagement
• The incident management process and the role of digital forensics
• The legal information security framework
• Information assurance standards and how they should be applied within an organization

• The people threats facing organizations and the importance of a security culture
• Practical people controls, including employment contracts, service contracts, codes of conduct and acceptable use policies
• Access controls, including authentication and authorization, passwords, tokens and biometrics
• The importance of data ownership, privacy; access points, identification and authentication mechanisms, and information classification.
• How organizations can raise security awareness and the different approaches to deliver security-related training.

• The different types of malware and the impact each one can have on an organization’s computer systems
• Methods of accessing networks and how related security risks can be controlled
• The security issues related to networking services, including mobile computing, instant messaging and voice over IP
• Cloud computing deployment models and the security implications of cloud services
• The security requirements of an organization’s IT infrastructure and the documentation required to support this.

• The software development lifecycle
• The role of testing and change control in reducing security related vulnerabilities in a production system
• How the risks introduced by third-party and outsourced developments can be mitigated
• Test strategies and test approaches, including vulnerability testing, penetration testing and code analysis
• The importance of reporting, and how reports should be structured and presented to stakeholders
• The principles of auditing and the role played by digital forensics.

• Physical, technical and procedural controls, including good environment design and premises security
• Clear screen and clear desk policies
• Reducing risks when moving property
• Securely disposing of property
• Maintaining security in delivery areas

• The value of business continuity management to an organization
• The business continuity management process
• The impact of business disruption on an organization and how long disruption should be tolerated
• The business continuity implementation process and implementation planning
• Disaster recovery strategy and the importance of disaster recovery planning
• Different standby systems and how these relate to recovery time
• The importance of robust documentation and testing of the plan.

• What cryptography is
• How cryptography works through symmetric ciphers, hash functions, asymmetric ciphers and digital
• signatures
• Key exchange and management
• Models of protection
• Cryptanalysis