All organisations use information systems today and they are usually connected to other systems via internal networks and/or the Internet. The risks from unauthorised access, unauthorised use of information, incorrectly configured systems, as well as inadequate
security monitoring and reports can cause the organisation's system to fail altogether and ruin the reputation and business of the enterprise.

Course Outline

Part One - IT Security & Controls:

IT Security Management

Generic security concepts and principles
Current security trends
Information classification
Information risk assessment
Establishing security policies and procedures
Defense in depth mechanism
Security monitoring
Security awareness programmes
Security training

Operations Security

Threats, vulnerabilities and risks
Controls and protections
Problem Management
Change Management
Segregation of duties
Least Privilege
Physical security

Technical Security

Access control system
Overview of cryptographic techniques
Security tools for vulnerability assessment
Generic hacking process & tools
Intrusion detection

Unix & Database Security

O/S and server hardening
Unix vulnerabilities
Database store procedure
Trigger
View
Database vulnerabilities

Network Security

Implementing perimeter controls using:
Firewall
Router
VPN
Sniffer

Disaster Recovery & Business Continuity

Planning
Crisis management team
Disaster recovery planning - DRP
Business continuity planning - BCP
DRP & BCP events
Identification of key business functions and assets
Business Impact Analysis
Containment strategy
Defensive network, storage and back-up strategies
DRP and BCP drills & testing

Major Security Exploits

People and passwords
Operating systems
Configuration issues
Applications
Services
Lock-down strategy
Switches

Part 2 - Information Technology & Information

Systems Auditing:

IT/IS audit principles and concepts
Auditing strategies and processes
Auditing business applications
Auditing perimeter defenses
Network audit tools