EXIN Information Security Management ISO/IEC 27001 Foundation (2022) – ISFS

Curriculum

What you will learn

• Duration:24 hours
• 23 modules
• Knowledge test per module
• Official PeopleCert aligned

• 00 Module 1 – Introduction 12 lessons

  • About the Official Course
  • About the Training
  • About the General Syllabus
  • About the Exam
  • Change in the Standard’s Name
  • Size of the Standard
  • Control Themes
  • New Control Attributes
  • Examples of New Control Attributes
  • Does a Standard Mean Quality?
  • Related Standards
  • Importance of ISO/IEC 27001:2022
• 01 Module 2 - Concepts and Principles 19 lessons

  • How Security is Managed
  • Starting from the Beginning
  • Information Architecture
  • TOGAF
  • Definitions for Information Architecture
  • Information Security Overview
  • Availability, Integrity, and Confidentiality
  • Confidentiality
  • Example of Confidentiality Measures
  • Integrity
  • Example of Integrity Measures
  • Availability
  • Characteristics of Availability
  • Example of Availability Measures
  • Accountability and Auditability
  • NIST Beyond CIA
  • Measures in the Incident Lifecycle
  • Control Attributes
  • Exercises
• 02 Module 3 - Risk Management 31 lessons

  • Risk Assessment Mathematics
  • Risk Assessment
  • Risk Management
  • Risk
  • Examples of Risks
  • Threat
  • Vulnerability
  • Exposure
  • Relationship Between Threat and Risk
  • Security Measures
  • Risk Analysis
  • Objectives and Purpose of Risk Analysis
  • Types of Risk Analysis
  • Risk Analysis Type: Quantitative
  • Risk Analysis Type: Qualitative
  • Combined Analysis
  • SLE, ALE, EF, and ARO
  • Measures in the Incident Lifecycle
  • Measures to Reduce Incidents
  • Prevention
  • Detection
  • Avoidance
  • Insurance
  • Acceptance
  • Repression (Suppression)
  • Correction
  • Human Threats
  • Non-Human Threats
  • Types of Damage
  • Types of Risk Strategies
  • Exercises
• 03 Module 4 - Context of the Organization 25 lessons

  • Information Security Focus
  • The Information Security Organization
  • Context of the Organization
  • Information Security Management System (ISMS)
  • ISO 27001 Domains
  • Information Security Policy
  • Hierarchical Content of a Policy
  • Information Security Policy Assessment
  • PDCA Model for the ISMS
  • PDCA for the ISMS
  • PDCA Cycle
  • Ownership or Control
  • Authenticity
  • Utility
  • Diligence and Due Care
  • Value of Data and Information
  • Information Analysis
  • Information System
  • Information Management
  • Interdisciplinary Field of Information Management
  • Distributed Computing
  • Management Type
  • Operational Processes and Information
  • Information Security Process
  • Exercises
• 04 Module 5 - Organizational Controls 9 lessons

  • About Information Security Policy
  • Information Security Roles and Responsibilities
  • Roles
  • Segregation of Duties
  • Management Responsibilities
  • Contact with Authorities
  • Threat Intelligence
  • Information Security in Project Management
  • Exercises
• 05 Module 6 - Information and Assets 11 lessons

  • Information Asset
  • Inventory
  • Inventory of Information Assets
  • Acceptable Use of Information and Other Assets
  • Return of Assets
  • Information Classification
  • Classification
  • Labeling
  • Examples of Classification and Labels
  • Information Transfer
  • Exercises
• 06 Module 7 - Access Control 9 lessons

  • Access Control
  • Logical Access Control
  • Activities in Access Management
  • Identity Management
  • Authentication Information
  • Access Rights
  • Type of Access Control
  • Security at Access Points
  • Exercises
• 07 Module 8 - Supplier Security 6 lessons

  • Supplier Relationships
  • ICT Supply Chains
  • Examples of ICT Supply Chains
  • Monitoring, Review, and Change Management of Supplier Services
  • Information Security for Use of Cloud Services
  • Exercises
• 08 Module 9 - Security Incidents 13 lessons

  • Planning and Preparation for Information Security Incident Management
  • Assessment and Decision on Information Security Events
  • Considerations in the Assessment and Decision on IS Events
  • Example of IS Incidents
  • Example of Procedure in Case of IS Incidents
  • Severity Level
  • Information Security Incident Response
  • Learning from Information Security Incidents
  • Evidence Collection
  • Information Security During Disruption
  • Business Continuity Management Principles
  • ICT Readiness for Business Continuity
  • Exercises
• 09 Module 10 - Compliance 16 lessons

  • Legal, Statutory, Regulatory, and Contractual Requirements
  • Intellectual Property Rights
  • Considerations on Intellectual Property Rights
  • Protection of Records
  • Definition of Personal Data
  • Privacy and Protection of Personal Data
  • Territorial Scope
  • Restrictions on Data Use
  • Additional Duties for Companies
  • Increased Fines
  • Information Security Review
  • Rules for Information Security Review
  • Compliance with Information Security Policies and Standards
  • Information Security Organizations and Standards
  • Documented Operating Procedures
  • Exercises
• 10 Module 11 - People Controls 12 lessons

  • People Controls
  • Control: Screening
  • Terms and Conditions of Employment
  • Awareness, Education, and Training
  • Information Security Awareness, Education, and Training
  • Disciplinary Process
  • Responsibilities After Termination or Change of Employment
  • Confidentiality or Non-Disclosure Agreements
  • Remote Working
  • Elements Considered in Remote Working
  • Information Security Event Reporting
  • Exercises
• 11 Module 12 - Physical Security Controls of Perimeters 15 lessons

  • Physical Security Measures
  • Protection Rings
  • Outer Ring
  • Building
  • Rooms and Vaults
  • Physical Security Perimeters
  • Physical Access Controls
  • Access Management
  • Electronic Access Management
  • Other Physical Security Measures
  • Securing Offices, Rooms, and Facilities
  • Physical Security Monitoring
  • Protection Against Physical and Environmental Threats
  • Working in Secure Areas
  • Exercises
• 12 Module 13 - Physical Equipment Controls 19 lessons

  • Clear Desk and Clear Screen
  • Equipment Siting and Protection
  • Special Rooms
  • Protection of Special Rooms
  • Fire-Resistant Cabinets and Security Cabinets
  • Protection Against Moisture
  • Fire Protection
  • Signage
  • Fire Extinguishing Agents
  • Security of Assets Off-Premises
  • Storage Media
  • Secure Disposal
  • Secure Disposal or Reuse of Equipment
  • Secure Transport
  • Emergency Power
  • Cooling
  • Cabling Security
  • Equipment Maintenance
  • Exercises
• 13 Module 14 - Endpoint Devices 9 lessons

  • Endpoint Devices
  • User Endpoint Devices
  • Considerations for User Endpoint Devices
  • Remote Working Policy
  • Software Installation on Operating Systems
  • Utility Programs
  • Utility Program Tasks
  • Use of Privileged Utility Programs
  • Exercises
• 14 Module 15 - Identity and Access Management 7 lessons

  • Special Access Privileges
  • Restriction of Access to Information
  • Access to Source Code
  • Secure Authentication
  • Secure Password Tips
  • Password Manager
  • Exercises
• 15 Module 16 - Protection Against Malware 26 lessons

  • Malware: Malicious Software
  • Phishing
  • Protection Against Phishing
  • Ransomware
  • Example: Clop Ransomware
  • Example: Hidden Ransomware
  • Example: Zeus Gameover
  • Example: News
  • Example: IoT Devices
  • Spam
  • Virus
  • Measures Against Viruses
  • Worm
  • Measures Against Worms
  • Trojan Horse
  • Measures Against Trojan Horses
  • Hoax
  • Measures Against Hoaxes
  • Logic Bomb
  • Spyware
  • Measures Against Spyware
  • Botnet
  • Measures Against Botnets
  • Rootkit
  • Measures Against Rootkits
  • Exercises
• 16 Module 17 - Network and Communications Security 8 lessons

  • Network Security
  • Network Security Controls
  • Network Services
  • Security of Network Services
  • Network Segregation
  • Types of Networks
  • Web Filtering
  • Exercises
• 17 Module 18 - Cryptography 13 lessons

  • Cryptography
  • Use of Cryptography
  • Cryptography Policy
  • Key Management
  • Examples of Cryptographic Systems
  • Symmetric Cryptography
  • Asymmetric System
  • Asymmetric Cryptography
  • Public Key Infrastructure (PKI)
  • Components of PKI Solutions
  • Digital Signatures
  • One-Way Cryptography (Hash)
  • Exercises
• 18 Module 19 - Handling Data and Information 8 lessons

  • Information Deletion
  • Data Masking (Obfuscation)
  • Data Masking Techniques
  • Anonymization or Pseudonymization
  • Data Leakage Prevention (DLP)
  • Data Leakage
  • Preventing Data Leakage
  • Exercises
• 19 Module 20 - Logging and Monitoring 8 lessons

  • Logging
  • Use of Logging
  • Log Content
  • Log Considerations
  • Activity Monitoring
  • Monitoring
  • Clock Synchronization
  • Exercises
• 20 Module 21 - Backup and Redundancy 7 lessons

  • Information Backup
  • Redundancies
  • Types of Redundancies
  • Redundant Site
  • On-Demand Emergency Site
  • Personnel Measures
  • Exercises
• 21 Module 22 - Management Processes 9 lessons

  • Capacity Management
  • Vulnerability
  • Technical Vulnerability Management
  • Configuration
  • Managing Configuration
  • Configuration Management
  • Change Management
  • Protection of Information Systems During Audit Testing
  • Exercises
• 22 Module 23 - Secure Development 15 lessons

  • Secure Development Lifecycle
  • Systems Development Life Cycle (SDLC)
  • Security by Design (SbD)
  • Benefits of Integrating Security into SDLC
  • Application Security Requirements
  • E-commerce Services
  • Publicly Available Information
  • Security Architecture
  • Secure Systems Architecture and Engineering Principles
  • Secure Coding
  • Security Testing in Development and Acceptance
  • Outsourced Development
  • Separation of Development, Testing, and Production Environments
  • Test Information
  • Exercises