digitaengage

[digitaengage]

CISM-: INFORMATION SECURITY GOVERNANCE (LESSON ONE PART ONE)

CERTIFIED INFORMATION SECURITY MANAGER (CISM) CERTIFICATION TRAINING

DOMAIN ONE: INFORMATION SECURITY GOVERNANCE

LESSON ONE: PART ONE

DOMAIN DEFINITION

Establish &/or maintain an information security governance framework & supporting processes to ensure that the information security strategy is aligned with organization goals & objectives.

LEARNING OBJECTIVES

· Understand the purpose of information security governance, what it consists of    & how to accomplish it

· Understand the purpose of an information security strategy, its objectives, &        the reasons & steps required to develop one

· Understand the meaning, content, creation & use of policies. Standards,              procedures & guidelines & how they relate to each other

· Develop business cases & gain commitment from senior leadership

· Develop governance metrics requirements, selection & creation

TASK & KNOWLEDGE STATEMENTS

TASK STATEMENTS

· Establish &/or maintain an information security strategy in alignment with            organizational goals & objectives to guide the establishment &/or ongoing            management of the information security program

· Establish &/or maintain an information security governance framework to            guide activities that support the information security strategy

· Integrate information security governance into corporate governance to ensure    that organization goals & objectives are supported by the information security      program

· Establish & maintain information security policies to guide the development of      standards, procedures & guidelines in alignment with enterprise goal &                objectives

· Develop business cases to support investment in information security

· Identify internal & external influences to the organization (e.g. emerging              technology, social media, business environment, risk tolerance, regulatory          requirements, third party considerations. Threat landscape) to ensure that            those factors are continually addressed by the information security strategy

· Gain ongoing commitment from senior leadership & other stakeholders to            support the successful implementation of the information security strategy

· Define, communicate & monitor information security responsibilities throughout    the organization (e.g. data owners, data custodians, end users, privileged or        high-risk users) & lines of authority

· Establish, monitor, evaluate & report key information security metrics to              provide management with accurate & meaningful information regarding the          effectiveness of the information security strategy

KNOWLEDGE STATEMENTS

· Knowledge of techniques used to develop an information security strategy          (e.g. SWOT [strength, weakness, opportunities, threats] analysis, gap                  analysis, threat research)

· Knowledge of the relationship of information security to business goals,                objectives, functions, processes & practices

· Knowledge of available information security governance frameworks

· Knowledge of globally recognized standards, frameworks & industry best            practice related to information security governance & strategy development

· Knowledge of the fundamental concepts of governance & how they relate to        information security

· Knowledge of methods to assess, plan, design, & implement an information        security governance framework

·Knowledge of methods to integrate information security governance into             corporate governance

· Knowledge of contributing factors & parameters (e.g. organizational structure      & culture, tone at the top, regulations) for information security policy                    development knowledge of content in, & techniques to develop business cases

· Knowledge of strategic budgetary planning & reporting methods

· Knowledge of the internal & external influences to the organization (e.g.              emerging technologies, social media, business environment, risk tolerance,        regulatory requirements, third party considerations, threat landscape) & how        they impact the information security strategy

· Knowledge of key information needed to obtain commitment from senior              leadership & support from other stakeholders (e.g. how information security        supports organization goals & objectives, criteria for determining successful        implementation, business impact

· Knowledge of methods & considerations for communicating with senior                leadership & other stakeholders (e.g. organization culture, channels of                communication, highlighting essential aspects of information security

· Knowledge of roles & responsibilities of the information security manager

· Knowledge of organizational structures, lines of authority & escalation points

· Knowledge of information security responsibilities of staff across the                    organization (e.g. data owners, end users, privileged or high-risk users)

· Knowledge of processes to monitor performance of information security              responsibilities

· Knowledge of methods to establish new, or utilize existing, reporting &                communication channels throughout an organization

· Knowledge of methods to select, implement & interpret key information                security metrics (e.g. Key Goal Indicators [KGIs], Key Performance Indicators      [KPIs], Key Risk Indicators [KRIs])

RELATIONSHIP OF TASK TO KNOWLEDGE STATEMENTS

The task statements are what the CISM candidate is expected to know how to perform

The knowledge statements describe each of the areas in which the CISM candidate must have a good understanding to perform the tasks.

INTRODUCTION

Governance is broadly defined as the rules that run the organization including policies, standards & procedures that are used to set the direction & control the organization’s activities.

Governance is the process by which government are selected, held accountable, monitored, & replaced. Corporate governance involves a set of relationship among the organization’s management, board, shareholders, & other stakeholders.

Corporate governance also provides the structure through which the objectives of the organization are set & the means of attaining those objectives are met, & the ability to monitor performance levels is determined

Information security governance is the system by which the information security activities of a particular organization are directed & controlled (refence: www.cyber-news.com).

Security governance is supported by such documents as:

· Organization for Economics Co-operation & Development (OECD)

· Institute of Chartered Accountant in England

· ISO/IEC 17799 (ISO 27002)

· British Standard 77 99 (ISO 27001)

· Information Systems Audit & Control Association (ISACA), Control Objectives      for Information & Related Technology (COBIT)

· National Institute of Standards & Technology (NIST) Special Publication (SP)      800-55, 800-26, 800-12

Information security governance needs to be integrated into the overall enterprise governance structure to ensure that the organization goals are supported by the information security program

The governance framework is an outline or skeleton of interlinked items that supports a particular approach to a specific objective as stated in the strategy. Several governance frameworks may be suitable for an organization to implement. Including COBIT 5 (Control Objectives for Information & Related Technology) & ISO/IEC 27000 (International Organization for Standardization [ISO], International Electronic Commission [IEC])

The framework will serve to integrate & guide activities needed to implement the information security strategy. Information security governance is a subset of corporate governance & must be consistent with enterprise’s governance. If enterprise governance is structured using a particular framework, it would make sense to use the same framework for information security governance to facilitate integration.

SECURITY POLICIES

Security policies are designed to mitigate risk & are usually developed in response to an actual or perceived threat.

Policies state management intent & direction at a high level. With the development of an information security strategy, the policies have to be developed or modified to support strategy objectives.

STANDARDS

Standards are developed or modified to set boundaries for people, processes, procedures & technology to maintain compliance with policies & support the achievement of the organization’s goals & objectives.

[digitaengage]

After passing the CISSP exam, (ISC)2 will ask CISSP test taker to supply their endorsement documentation supported by an endorser/sponsor.

For the endorsement, the application must be endorsed & digitally signed by an (ISC)2 certified professional.

The (ISC)2 certified professional is anyone who:

·        Is able to attest to test taker professional experience

·        Is an active (ISC)2 credential holder in good standing.

This will proof that the test taker indeed has the type of experience required to obtain this certification.

The endorser/sponsor must sign the test taker endorsement document vouching for the security experience the test taker is submitting.

The endorsed/sponsor will attest that the test taker assertions regarding professional experience are true to the best of the endorser’s/sponsor’s knowledge, & that the test taker are in good standing within the cybersecurity industry.

So, the test taker has to be sure about his/her endorser/sponsor prior to registering for the exam & providing payment.

The test taker will need the endorser’s member/certification number when filling out the online application.

Group of CISSP test takers are selected as sample at random for auditing after passing the CISSP exam.

The audit consists of individuals from (ISC)2 calling on the candidate endorsers/sponsors & contacts to verify the test taker’s related experience.

Once CISSP test taker endorsement application has been approved, the final step in the process is to pay first Annual Maintenance Fee (AMF).

All candidates who pass an (ISC)2 credential examination must complete the endorsement process within a time period of no longer than 9 months.

[digitaengage]

BEFORE TAKING THE CISSP EXAM

CISSP candidates must have a minimum of 5 years of cumulative paid full-time professional security experience in 2 or more of the 8 CISSP domains.

The 8 domains are as follows:

Domain One: Security & Risk Management

Domain Two: Asset Security

Domain Three: Security Architecture & Engineering

Domain Four: Communication & Network Security

Domain Five: Identity & Access Management

Domain Six: Security Assessment & Testing

Domain Seven: Security Operations

Domain Eight: Software Development Security

[digitaengage]

THE CISSP EXAM

The CISSP exam is described as being “AN INCH DEEP & A MILE WIDE”

The CISSP exam covers 8 security domains making up the CISSP CBK (Common Body of Knowledge).

The CISSP exam evaluate expertise across 8 security domains.

Domain means topics you need to master based on your professional experience & education.

Passing the exam proves you have the advanced knowledge & technical skills to effectively design, implement & manage a best-in-class cybersecurity program.

The CISSP exam questions are not very detailed & do not require you to be an expert in every subject, but the questions require you to be familiar with many different security subjects.

The CISSP exam comes in 2 versions depending on the language in which the test is written. As at 18th December 2017, the CISSP exam comes in 2 different versions.

The English version is now Computer Adaptive Test (CAT). The number of questions you are asked ranges from 100 to 150. Do not forget that 25 questions will not count toward your score because they are being evaluated for inclusion in future exams. The CISPP CAT exam is about 3-hours.

The non-English version of the CISSP exam is also Computer-based but not adaptive. The non-English version comprises 250 questions. The non-English version is about 6-hours. Like CAT version, 25 questions are pretest.

Let’s talk about the domains and their exam weight:

Domain

Weight on Exam

Security  & Risk Management

15%

Asset  Security

10%

Security  Architecture & Engineering

13%

Communication  & Network Security

14%

Identity  & Access Management (IAM)

13%

Security  Assessment & Testing

12%

Security  Operations

13%

Software  Development Security

10%

 You have to score 700 points & above out of 1000 points to pass the CISSP exam.

Regardless of which version of the exam you take, you can expect the following question format:

·        Multiple Choice

·        Drag-and-Drop

·        Hotspot

·        Scenario-Based

[digitaengage]

Welcome to our first video lecture on CISSP certification.

CISSP means Certified Information Systems Security Professional

CISSP is an (ISC)2 Certification

(ISC)2 means The International Information System Security Certification Consortium

(ISC)2 said CISSP is THE WORLD PREMIER CYBERSECURITY CERTIFICATION

Jobs that Typically Use or Require CISSP are as follows:

Chief     Information Officer

Chief     Information Security Officer

Director of     Security

IT     Director/Manager

Network     Architect

Security Analyst

Security     Architect

Security Auditor

Security     Consultant

Security Manager

Security Systems     Engineer 

As the Internet continues to change the world, corporations and other organizations are desperate to identify and recruit talented and experienced security professionals.

They do this to protect the resources on which they depend to run their businesses in other to remain competitive.

Some of the main reasons for becoming a CISSP are as follows:

You will be seen     as a security professional who has met a predefined standard of knowledge.

You will be seen     as a security professional who has the experience that is well understood     and respected throughout the industry.

As a CISSP, you will:

·        Have broadened your current knowledge of security concepts and practices

·        Be able to demonstrate your expertise as a seasoned security professional

·        Be able to become more marketable in a competitive workforce

·        Be able to increase your salary and be eligible for more employment opportunities

·        Be able to bring improved security expertise to your current occupation

·        Be able to show a dedication to the security discipline

BENEFITS OF BEING CISSP-CERTIFIED BY (ISC)2

·        Career Advancement --- Raise visibility and credibility, improve job security, and create new opportunities.

·        Versatile Skills --- Vendor-neutral so skills can be applied to different technologies and methodologies.

·        Respect --- Differentiate yourself to employers, clients, and peers.

·        Solid Foundation --- Be better prepared to stem cyber attacks and inspire a safe and secure cyber world.

·        The community of Professionals --- Gain access to a global community of like-minded cybersecurity leaders.

·        Higher Salaries --- On average, (ISC)2 members report earning 35% more than non-members.

·        Expanded Knowledge --- Reach a deeper, better, and broader understanding of the common body of knowledge (CBK) for cybersecurity.

·        Stronger Skill Set --- Expand the skills and knowledge needed to fulfill organization duties.

Companies need individuals who have the ability, knowledge, and experience necessary to implement the following:

·        Solid security practices

·        Perform risk management

·        Identify necessary countermeasures

·        Help the organization as a whole to protect its facility, network, systems, and data

CISSP certification helps companies identify individuals who have all the above-mentioned professional skills.

The demand for skilled security professionals will continue to grow in the future because of the increased importance placed on security in corporate success and this will lead to even greater demands for highly skilled security professionals like CISSP-Certified.

With a CISSP designation, you can put yourself head and shoulder above other individuals in this regard.

This is the end of this video.

I hope this video explains everything we need to know as to why become CISSP certified.

Thank you for watching it.

Our next video will on the ‘THE CISSP EXAM”

[digitaengage]

DON’T EXPOSE YOUR MONEY AND DATA. HOW TO SHOP ONLINE SECURELY PART TWO

Look For 3rd Party Seals of Approval

Third parties that look out for the interests of consumers often give their seal of approval to companies that have lived up to or abided by their standards. These seals of approval show that these companies have a good online reputation. The seals are usually given in the form of website badges. When looking for these badges on a website, make sure you click on them and that the link takes you to the organization’s webpage, as some companies steal the image in order to come across as legitimate. Organizations with seals that are often used and can be trusted include The Better Business Bureau (BBB), VeriSign, Truste and BizRate.

Use Strong Passwords

We like to beat this dead horse about making sure to utilize uncrackable passwords, but it's never more important than when banking and shopping online. Look out for our post for creating a unique password can which can come in handy during a time of year when shopping around probably means creating new accounts on all sorts of e-commerce sites.

If your passwords aren’t well designed, a hacker can guess them and use saved account information to order products. Try to use different passwords for each website and avoid common words.

Refrain from using common words as passwords or information that has personal significance a hacker could figure out, including a birthplaces or anniversaries.

This also applies to start up passwords for your computer and cellphone. If your information is saved on your hardware, someone who takes your phone or computer can use them to make purchases. Be sure that all your hardware is password protected and will go to a security screen if left unattended for a few minutes.

Think Mobile.

There's no real need to be any more nervous about shopping on a mobile device than online. The trick is to use apps provided directly by the retailers, like Amazon, Target, etc. Use the apps to find what you want and then make the purchase directly, without going to the store or the website. (For more complete information, look for our tips for shopping safely on a mobile device.)

Check Out Online Reviews.

Looking over reviews from well-known third party review sites can give you a good indication of the type of experience you will receive if you order from them. The overall score is important, but also look at specific reviews, both good and bad. A good company can still get some negative reviews – mistakes happen - but if you see a large number of negative reviews that use words like scam or rip-off you should exercise caution. When reading negative reviews, look to see if the company has gotten in touch to rectify or explain the problem. If something does go wrong with your order, you’ll want to know they will clear up the issue quickly.

Research the company's ranking through the Better Business Bureau. Look online for reviews of the website, but be suspicious if the reviews are too glowing; some frauds promote fake reviews to lure in unsuspecting victims.

Find Their Social Media Pages.

Social media sites like Facebook and Twitter are increasingly being used by retailers as a way to easily reach out to their customers. Check and see if the company you’re thinking of buying from has an account and if they do, poke around and see what people are saying about them. Often customers post feedback about their experiences, both good and the bad.

Make Sure The Company Is Easy To Contact.

A good rule of thumb when trying to find out if a company is legitimate is to see if they reveal their physical location, with a real address – either retail locations or a head office location. The company should be easy to contact by email and preferably also with a telephone number. Be aware that if you choose a live chat option for customer assistance, you may be chatting with a robot, so make sure that your questions are fully answered and it’s best to document the chat. Be wary of companies that can only be reached via contact form.

Review The Company’s Privacy Policy.

A privacy policy is a document that states how a company manages the information and data they have about their customers. Some companies sell their information to third parties, which can sometimes cause security issues. Also check when filling in your customer information that you have not been automatically signed up to receive emails from third parties, as this leads to a lot of spam in your email.

Explicitly Stated Return Policy, Shipping Fees etc.

Reputable online retailers should make it easy for you to find information on their return policy. Make sure the policy terms are clearly started and that you find them acceptable. The company should also clearly state the shipping charges and any other extra fees (like taxes, handling fees etc.) before your purchased is complete. The price shown before you click confirm should match the price on your order confirmation page.

Use credit cards and secure payment services instead of debit cards.

Credit cards are the safest way to pay for online transactions. Paying by this method leaves a record with the credit card company and protects you against unauthorized charges on your account. Make sure to check your credit card statements regularly to ensure there are no odd charges on your account. Consider getting a credit card that you use only for online purchases; this will make it easier to spot fraudulent charges.

Conclusion.

Congratulations, if you have being reading this post from part one to this level. You have now harm yourself with tangible information you need to keep yourselves secure while shopping or using your credit card to pay online.

[digitaengage]

DON’T EXPOSE YOUR MONEY AND DATA. HOW TO SHOP ONLINE SECURELY PART ONE

Look for the “https” URL and the padlock symbol

If you are going to be sharing private, personal information such as your address and credit card number with a company, make sure that your information is protected by only shopping from secure websites. How do you know a site is secure? When entering in your credit card information, there are two signs to look for. The first thing to look for is an address that has an https: prefix in the URL (Uniform Resource Locator) bar.

The ‘s’ in the https: signifies that the website is secure and your information will remain private. Many websites also have a closed lock symbol in their address bar to show that their website is secure.

HTTPS, which was developed by Netscape, is an online safety protocol that encrypts information so that data can be kept private and protected. In most cases, the text in the URL is preceded by a padlock symbol (if this is missing, the website should be treated with caution).

The ‘S’ in HTTPS, incidentally, stands for secure. Websites that use HTTPS cause data sent between the site and your web browser to be encrypted through the use of TLS (Transport Layer Security). That means that any information, such as your credit card details, can’t be intercepted in plaintext form by an external attacker. Note that using HTTPS does not say anything about the reputability of the site receiving the data, however!

Avoid Public Computer Infrastructures

Hopefully we don't have to tell you it's a bad idea to use a public computer to make purchases, but we still will. If you do, just remember to log out every time you use a public terminal, even if you were just checking email.

What about using your own laptop to shop while you're out? It's one thing to hand over a credit card to get swiped at the checkout, but when you must enter the number and expiration date on a website while sitting in a public cafe, you're giving an over-the-shoulder snooper plenty of time to see the goods. At the very least, think like a gangster: Sit in the back, facing the door.

Use Public Wi-Fi Securely

If you do decide to go out with the laptop to shop, you'll need a Wi-Fi connection. Only use the wireless if you access the Web over a virtual private network (VPN) connection. If you don't get one from your employer, you can set up a free one with AnchorFree Hotspot Shield, (In Our next post, we will teach you “How to use AnchorFree Hotspot Shield).

By the way, now is not a good time to try out a hotspot you're unfamiliar with. Stick to known networks, even if they're free, like those found at public stores and restaurants.

Avoid making purchases in public. 

Do not buy anything on public computers, including those available at libraries. If you do, your private information will be saved where others can access it. You should even be careful about making a purchase with your own laptop in a public place. Someone might see you input your data or be able to get information from a shared Wi-Fi connection.

If you must make a purchase in public, using cellphone data is more secure than a public Wi-Fi connection. Consider downloading the retailers’ app to make the purchase.

Scan for malware and ransomware.

Malware programs that are downloaded online can monitor your keystrokes and pick up your account information even from secure websites. Download programs like Ad-Aware to scan for malware. Don’t download information from sites you aren’t familiar with. Be wary about clicking on links in viral emails.

Also, update your operating system frequently. Sometimes operating system updates will provide important protection from security threats.

Watch out for our post on “How to prevent malware and ransomware attack.”

Read more:  DON’T EXPOSE YOUR MONEY AND DATA. HOW TO SHOP ONLINE SECURELY PART TWO