Session 1: Definitions

• Governance

• Privacy

• Compliance

• Risk Management

• Security Roles & Responsibilities

• Security Management & Operations

• Security Standards, Guidelines & Frameworks

• Business Resilience

• Risk Management

• Training & Awareness

• Technical Security Architecture

• Security Metrics & Reporting

• Asset Classification & Management

• Information Security Governance

• Information Security Compliance

• Broadly Applicable Laws and Regulations

• Key State Regulations

• Industry-Specific Regulations and Guidelines

• International Laws

• Data Breach Disclosure Laws

• International Privacy Laws

• Security Breach Notification Law Components

Session 5: Design, Deploy, and Manage Security Controls in Alignment with Business Goals, Risk Tolerance,  and Policies and Standards

• Information Security Risk Management

• Context Establishment

• Risk Identification

• Risk Evaluation

• Risk Analysis

• Risk Modification

• Risk Avoidance

• Risk Retention

• Risk Sharing

• Risk Communication and Consultation

• Risk Monitoring and Review

• COBIT 4.1 PO1.2 Business IT-Alignment

• COBIT 5.0 AP002 Manage Strategy

Management Controls, Technical Controls, Policy and Procedural Controls, Organization Controls, and more

• Introduction

• Reliance upon controls

• What the control does

• Choosing controls

• How the control is performed

• Common Types of Controls on controls.

• Domain

• Goals and Metrics

• Process Description

• RACI Chart

• Process Purpose Statement

• Process Practices, Inputs/Outputs, and Activities

• Change Management

• Let’s begin by defining what an audit is.

• Audit management standards and best practices (COBIT, etc.)

• Risk Assessment of Ineffective or Missing Controls

• Analysis and Interpretation of Audit Reports

• Monitor Effectiveness of Remediation Efforts

• Formulation of Remediation Plans

• Reporting Process to Business Stakeholders

Session 24: The Role of the CISO

• Assessing

• Designing

• Planning

• Executing

• Metrics and Reporting

• Alignment with Business Goals

• Alignment with Risk Tolerance

• Identification of Project Stakeholders

• Infosec Project Execution Best Practices

• Staff Functions and Skills

• Vendor Management

• Communication Planning

• Accountability

• Integration of Security Requirements into Other Operational Processes

Session 27: Access Control

• Access Control Design

• Authentication Principles

• Types of Access Control

• Authorization Principles

• Access Administration

• Physical Risk Analysis

• Physical Security Audits

• Facility Design Considerations

• Monitoring of Physical Security Controls

• Guards

• Physical Mobile Security

• Personnel Security

• Disaster Recovery vs. Business Continuity

• Business Impact Analysis

• Risk Appetite

• Disaster Recovery Facilities

• Project Charters, Scope, Work Plans

• Disaster Recovery Testing

• Data Backup and Recovery Solutions

• Crisis Management

• Plans, Standards, and Best Practices

• Wireless Network Security

• Network Planning

• Securing the Network

• Network Intrusion Detection and Intrusion Prevention

• Voice-over-IP (VoIP) Security

• Network Access Control (NAC)

• Network Architecture Models

• Virtual Private Networks (VPN)

• Network Standards and Protocols

• Human Threats

• Vulnerability Scanning

• Environmental/Physical Threats

• Penetration Testing

• Technical Threats

• Social Engineering

• Natural Threats

• Human Social Engineering

• Vulnerability Management

• Computer-based Social Engineering

• Monitoring and Alerting

• Social Media Countermeasures

• Patch Management

• Systems Development Life Cycle (SDLC) Practices

• Dynamic and Static Application Security Testing

• Phases of the Systems Development Life Cycle (SDLC)

• Change Management

• Top-10 Application Vulnerabilities

• Other SDLC Considerations

• Separation of Production, Development, and Test Environments

• Plans

• Vulnerability Assessment

• Best Practices

• Configuration Management

• OS Hardening

• Asset Management

• Application Hardening

• Change Control

• Database Hardening

• Logging

• Encryption Algorithms

• Secure Sockets Layer/Transport Layer Security

• Digital Signatures

• Security Protocols

• Public Key Infrastructure

• Development of Incident Response Procedures

• Computer Forensics Process

• Responsibilities and Escalation Processes

• Chain of Custody

• Testing Incident Response Procedures

• Collecting and Preserving Digital Evidence

• Coordination with Law Enforcement and Other External Entities

Session 36: Alignment with Business Goals and Risk Tolerance

• Compliance as Security

• Ethics

• Visibility & Accessibility

• How Are Teams Most Effective?

• Intimacy

• Effective Team Characteristics

• Responsibility

• Common Misconceptions about Teams

• Accountability

• Dysfunctional Teams

• Education, Mentoring, and Guidance

• Key Elements of High Performance Teams

• Team Building

• EISA Goals

• Cap Gemini’s Integrated Architecture Framework

• EISA Methodology

• UK Ministry of Defense (MOD) Architecture Framework (MODAF)

• SABSA

• Zachman Framework

• US Department of Defense (DoD) Architecture Framework (DoDAF)

• The Open Group Architecture Framework (TOGAF)

• Federal Enterprise Architecture

• Inevitability of Breach

• Philosophy Clash

• Getting Integrated

• Big Data, Big Threats

• Control Systems

• Cloud Computing Security

• Consumerization

• Social Media

• Mobile Devices in the Enterprise

• Hacktivism

• Ransomware

• Advanced Persistent Threat

• The Need to Protect Data and Information

• Technology Controls to Protect Data and Information

• How Data Leaks Occur

• The DRM –DLP Conundrum

• How to Protect Against Data Leaks

• Reducing the Risk of Data Loss

• Key Performance Indicators (KPI)

• PHASE 1:PRECERTIFICATION

• PHASE 4: SECURITY ACCREDITATION

• PHASE 2: INITIATION

• PHASE 5: MAINTENANCE

• PHASE 3: SECURITY CERTIFICATION

• PHASE 6: DISPOSITION

• Full-time Employees

• Consulting Firms

• Operationalize Security Resources

• Outsourcing

• Staff Augmentation

• How to proceed?

• Development of Business Cases for Security

• Analyze, forecast and Develop Operating Expense Budget

• Long Term Planning –Road Map

• Return on Investment (ROI) and Cost-Benefit Analysis

• Analyze, Forecast And Develop Capital Expense Budget

• Solution Selection

• Technology acquisition lifecycle

• Pre Sales

• Vendor Management Office

• Post Sales

• Competitive Environment

• Demonstrate the Importance of the Transition Period

• Accentuate the Positive Aspects of the Deal

• Clearly Define the Solution Being Procured

• Tell the Vendors What You Hope to Achieve

• Enable the Objective Evaluation of Vendor Responses

• Provide Opportunity for the Vendors to Differentiate Themselves

• Achieve the Optimal Terms, Conditions, and Pricing in the Competitive Environment

• Ensure the Vendors Understand The Overall Environment

• Develop a Robust RFP

• Section 1 –Definitions

• Section 6 – Return or Destruction of Personal Information

• Section 2 – Standard of Care

• Section 7 – Equitable Relief

• Section 3 – Restrictions on Disclosure to Third Parties

• Section 8 Material Breach

• Section 4 – Security Breach Procedures

• Section 9 Indemnification

• Section 5 – Oversight of Security Compliance

• Why are SLAs needed?

• Verification of Service Levels

• Who Provides the SLA?

• Monitoring of Metrics

• What’s in an SLA?

• Metrics Selection

• What Are Key Components of an SLA?

• When Should We Review our SLAs

• Indemnification

• Is an SLA Transferable?