Cybersecurity Management with ISO/IEC 27001

This course teaches the foundations of cybersecurity management through the lens of ISO/IEC 27001, the leading international standard for information security. You will learn the concepts, principles and controls an organization needs to design and run a cybersecurity program: the typical security threats facing different activities and processes, and the recommended controls to protect against them.

Course structure

• Foundations — cyberspace and cybersecurity defined; confidentiality, integrity, authentication and non-repudiation as critical elements of any security system

• Information classification — schemes, levels and labelling

• Risk management — threats, vulnerabilities, risk assessment (quantitative and qualitative methods), and the options for treating security risks

• Organizing security — top management support, segregation of duties, and human resources security from screening and contractual requirements through the disciplinary process to termination and change of employment

• Devices and media — mobile device policies including BYOD (bring your own device) and COPE (company owned, personally enabled), and the rules for removable media

• Access control and authentication — managing access rights and privileges so they don't become security breaches; password management, common password attacks and their controls

• Cryptography — core concepts, digital signatures and public key infrastructure (PKI), plus the most common cryptographic attacks (brute force, rainbow tables, birthday attacks) and how to defend against them

• Attacks and malware — viruses, worms, trojans, logic bombs, spyware and adware, with a detailed presentation of ransomware; denial-of-service attacks; social engineering and phishing

• Operational security — physical and equipment security, backups, change management, capacity management, email security, network security principles and controls, wireless attacks and their prevention, and security in development processes

• Suppliers and third parties — the risks associated with suppliers' access to your information assets

• Incident management and continuity — managing cybersecurity incidents from detection to closure and root cause analysis; business continuity and preparing for crisis situations

• Compliance — the compliance requirements every organization must respect

Learning from real cases

The concepts are illustrated with easy-to-follow explanations, examples and case studies — including the Barings Bank collapse, the Target security breach and Edward Snowden — plus a quiz at the end to test what you've learned.

Who this course is for

• IT professionals moving into cybersecurity or security management roles

• Managers and business owners who need to understand how to protect their organization

• Professionals supporting an ISO/IEC 27001 information security management system from the technical side

• Students and career-changers building cybersecurity fundamentals

• Anyone who wants to understand threats — from ransomware to phishing — and the controls that stop them

Get the knowledge you need to design, coordinate and improve a cybersecurity program — or to understand security the way ISO/IEC 27001 approaches it.