CYBER SECURITY WORKSHOP

Duration:  3 days

OVERVIEW

This workshop provides a comprehensive introduction to Cyber Security risks and how to address those risks. Based on an analysis of the latest international surveys of Cyber Security risks and solution, this workshops is structured in line with the United Kingdom Government “10 Steps to Cyber Security” and presents information and advice across 10 critical technical and procedural areas. Delegates will receive a comprehensive set of workshop materials as well as a practical assessment tool for Cyber Security management.

What to expect from the course?

Learn about a wide range of Cyber Security topics, including:

• Latest Cyber Security research reports
• Trends in Cyber Security
• Information Risk Management Regime
• Secure configuration
• Network security
• Managing user privileges
• User education and awareness
• Incident management
• Malware Prevention
• Monitoring Cyber Security
• Removable media controls
• Home and mobile working

Who should attend?

• Chief Information Officers
• Chief security Officers
• Cyber Security Officers
• Cyber Security Specialists
• External auditors
• Information Managers
• Information Security Managers
• Internal auditors
• IT Managers
• Security professionals

Course Content

DAY 1

Topic 1: Workshop Introduction

• Welcome and introduction to delegates
• Workshop objectives
• Workshop agenda
• Workshop administrative arrangements and review of materials

Topic 2: Introduction to Cyber Security

• Definition of Cyber Security
• Latest Cyber Security research reports
• Trends in Cyber Security
• Cyber Security Roles and Responsibilities
• Relevance of ISO standards and NIST Cyber Security framework

Topic 3: Information Risk Management Regime

• Risk governance framework
• Role of the Board
• Risk appetite
• Role of policies in risk management

Topic 4: Secure configuration

• Secure configuration risks
• Hardware and software inventories
• Update and patch policies
• Lock down approach
• Vulnerability scans
• Configuration control and management
• Disabling unnecessary input/output devices
• Implementing white-listing
• User ability to change configuration

Topic 5: Network security

• Network security risks
• Policing the network perimeter
• Protecting the internal network
• Segregating network assets
• Securing wireless devices
• Protecting internal Internet Protocol (IP) addresses
• Enabling secure administration
• Configuring the exception handling processes
• Monitoring the network
• Assurance processes

DAY 2

Morning quiz: revision for the previous day

Topic 6: Managing user privileges

• Managing User Privileges Risks
• Personnel screening process
• Account management processes
• User identification and access control
• User privileges
• Use of privileged accounts
• Monitoring users
• Audit system and the system activity logs
• Awareness and user education

Topic 7: User education and awareness

• User education and awareness risks
• User security policy
• Staff induction process
• Maintaining user awareness
• Assessment of Information Assurance (IA) skills
• Effectiveness of security training
• Incident reporting culture
• Formal disciplinary process

Topic 8: Incident management

• Incident management risks
• Senior management approval and backing
• Incident response capability
• Specialist training
• Defining roles and responsibilities
• Data recovery capability
• Incident management plans and testing
• Information sharing rules
• Post-incident evidence
• Lessons learned review
• Reporting criminal incidents

Topic 9: Malware Prevention

• Malware Prevention risks
• Establishing corporate policies
• Establishing anti-malware defences
• Scanning for malware
• Managing data import and export
• Blacklist of malicious websites
• Dedicated media scanning machines
• User education and awareness

DAY 3

Morning quiz: revision for the previous day

Topic 10: Monitoring Cyber Security

• Monitoring Cyber Security risks
• Monitoring strategy and supporting policies
• Monitoring all IT systems
• Monitoring network traffic
• Monitoring all user activity
• Legal compliance
• Fine-tuning monitoring systems
• Centralised collection and analysis capability
• Ensuring sufficient storage
• Resilient and synchronised timing
• Security personnel training
• Aligning incident management policies
• Lessons learned reviews

Topic 11: Removable media controls

• Removable media controls risks
• Corporate policies
• Limiting the use of removable media
• Scanning media for malware
• Auditing media holdings
• Encrypting information on removable media
• Locking down access
• Monitor systems
• Reuse and disposal of removable media
• User education and awareness

Topic 12: Home and mobile working

• Home and mobile working risks
• Mobile working security policy
• User education and awareness
• Secure baseline build
• Protecting data at rest
• Protecting data in transit
• Corporate incident management plans

DAY 3

13: Final assessment

• Assessment preparation – personal revision time
• Individual assessment – 25 Multiple Choice Questions

Topic 14: Workshop closure

• Closing workshop quiz
• Personal action plan
• Workshop feedback
• Recognition of achievements
• Closing ceremony including team and individual photographs

Delegate preparation for the workshop

Delegates will need to bring their laptop PC or tablet computer to the workshop.