BCS Certificate in Information Security Management Principles

Information Security Concepts & Definitions

• What is information security?
• Management System (ISMS) concept

The Need For, and Benefits of, Information Security

• Corporate Governance

Information Risk ManagementInformation Security Organisation & Responsibilities

• Legal and regulatory obligations

Policies, Standards & Procedures

• Delivering a balanced ISMS
• Security procedures

Information Security Governance

• Policy reviews
• Security audits

Security Incident Management

• Objectives and stages of incident management

Information Security Implementation

• Getting management buy-in

Legal Framework

• Processing personal data
• Employment issues
• Computer misuse
• Intellectual property rights
• Data Protection Act

Security Standards and Procedures

• ISO/IEC 27002 and ISO/IEC 15408

Threats To, and Vulnerabilities of, Information SystemsPeople Security

• Organisational culture
• Acceptable use policies

Systems Development & Support

• Linking security to whole business process
• Change management process
• Handling security patches

Role of Cryptography

• Common encryption models

Protection from Malicious Software

• Methods of control

User Access Controls

• Authentication and authorisation mechanisms

Networks & Communications

• Partitioning networks
• Role of cryptography
• Controlling 3rd party access
• Intrusion monitoring
• Penetration testing

External Services

• Protection of Web servers and e-commerce applications

IT Infrastructure

• Operating, network, database and file management systems

Testing, Audit & Review

• Strategies for security testing of business systems

Training

• Purpose and role of training
• Approaches to training and promoting awareness

Physical and Environmental Security

• Controlling access and protecting physical sites and assets

Disaster Recovery and Business Continuity Management

• Relationship between risk assessment and impact analysis

Investigations & Forensics

• Common processes, tools and techniques
• Legal and regulatory guidelines