Infosec Training

Introduction

Information Assets

Information Security objectives (CIA)

Governance and Organization objectives levels

COBIT Framework

ISO/IEC 27001 and ISO/IEC 27002 standards

ITIL library

CMMI Reference Model

Principle of Due care and Due Diligence

Documentation hierarchy

Security Policy development

ITSG-33 standard

NIST SP 800-53 standard

NIST Cyber Security Framework 1.1

NIST Cyber Security Framework 2.0

PCI-DSS standard

CIS v8 Critical Security Controls

CSA Cloud Controls Matrix

OWASP Top 10

Conclusion

Knowledge assessment

Introduction

Enterprise Architecture: TOGAF framework

Information Security Architecture

Quiz

Asset Identification

Asset Categorization

Data privacy (PII, PHI, SPI)

Information Classification: Reference framework

Information Classification: Practical example

Information Classification: Process

Roles and Responsibilities

Conclusion

Knowledge Assessment

Introduction

Types of security controls

Physical Security

Identity and Access Management (IAM): Concepts

Identity and Access Management (IAM): Components

Firewall, DMZ and WAF

Network segmentation

Intrusion Prevention System (IPS)

Encryption: Symmetric and Asymmetric methods

Encryption: Hybrid method

Encryption: Digital signature and Hashing

Encryption: Illustrative scenario

Encryption: Virtual Private Network (VPN)

Encryption: HTTPS/SSL

Encryption: Data at rest

Encryption: Keys and Certificates Management (PKI, HSM,...)

Security Training and Awareness

Hardening

Data Loss Prevention (DLP)

Intrusion Detection System (IDS)

Security Information and Event Management (SIEM)

Vulnerability Assessment

Application security

Security audits and Penetration Testing

Configuration Management

Incident Response

Patch Management

Anti-malware and Endpoint security

Recovery controls

Governance controls: Security policies

Asset management Lifecycle

Knowledge Assessment

Introduction

Definition of risks

Threat Agent

Threat Identification and Modeling: STRIDE

Threat Identification and Modeling: STRIDE-LM

CAPEC - Common Attack Pattern Enumeration and Classification

DEMO: Threat Modeling

Quiz

Vulnerability: Definition

Vulnerability: Identification and Detection

Practical Example: Integrated use of CWE, CPE, CVE, CVSS

Vulnerability Management (DARC)

DEMO: Vulnerability Assessment & Penetration Testing (OpenVAS, Metasploit)

Quiz

Risk Assessment: Qualitative Analysis

Risk Assessment: Quantitative Analysis

Risk Assessment: Impact and Likelihood

Risk Appetite and Prioritization

Qualitative analysis VS Quantitative analysis

Risk Response Strategies

Practical Example: Risk Prioritization

Cost-Benefit Analysis (CBA)

Risk Management Process

Conclusion

Knowledge Assessment

Introduction

Definition of Incident Management

Incident Response Plan development

Incident Response: Roles and Responsibilities

Incident Response: Communication protocol

Incident Response: Detection, Alert, and Classification

Incident Response Process

Incident Response: Measuring the performance

Practical example: Incident handling

Incident Response Tools (SIEM solutions)

Cyber Kill Chain Model

MITRE ATT&CK Framework

Digital Forensic

Conclusion

Knowledge Assessment