Security Training
Security Certification
Internet Storm Center
Cyber Security Graduate School
Security Awareness Training
Penetration Testing
Industrial Control Systems
Cyber Defense Foundations
IT Audit
Computer Forensics
Software SecurityMGT411: SANS 27000 Implementation & Management
- G2700 Certification
- 36 CPE/CMU
- Laptop Recommended
The International Standards Organization (ISO) has recently revised what has become the de facto document for creating and maintaining a secure enterprise, today known as the ISO/IEC 27000 standard.
The strength of this document is derived from the meticulous attention to detail provided by the many contributing authors and organizations as well as the applicability of the standard to the realities of doing business today. The standard seeks to offer best practice guidance regarding all manner of security issues and can assist any organization that chooses to adopt it to develop a truly security minded corporate culture. Using our tested method for developing and applying controls using the ISO 27000 standard, you will learn to implement the guidance contained in ISO-27000 with step-by-step pragmatic examples to move quickly into compliance with the specification.
This track is designed for information security officers or other management professionals who are looking for a how-to guide for implementing ISO-27000 effectively and quickly. While the standard is very well written, anyone who has actually tried to shift to an ISO-27000 structured security organization knows that there can be some significant hurdles to overcome. This track will give you the information you need to go back to your organization with a plan of action to get the job done! This course has proven especially valuable for organizations whose 27000 implementation is currently "stuck in the mud" or is simply taking longer than management would like.
| Course Contents |
|---|
| MGT411.1: Introduction to ISO/IEC 27000: Policy, ISMS & Awareness |
OverviewDay one begins with a general introduction and overview of ISO 27000 series of standards. How to apply this standard and reconcile it with other comparable standards is also discussed today and throughout the week. From the very beginning, the class is focused on "How To". Examine a twelve step process (that works!) to implementing 27000 or almost any other standard. See how to Plan, Do, Check and Act. Explore SANS' own version of PDCA which actually extends the ISO 27000 methodology, giving you a strategy for attacking the rollout issues that you will face under ISO 27000. Learn how to create, administer and manage an effective awareness program and how to design the Information Security Management System. CPE/CMU Credits: 6 Topics
|
| MGT411.2: SANS 27000 Controls & Process Improvement I |
OverviewThis day deals with a variety of personnel and issue-specific security topics. The object of the material covered is to apply the policy creation techniques from day one to specific areas of the organization as they apply to employees and co-sourced individuals. On this day we'll also spend time covering business impact analysis methodology in relation to risk mitigation through policy and education while simultaneously examining possible process improvements and how they can be applied to the ISO 27000 controls. CPE/CMU Credits: 6 Topics
|
| MGT411.3: SANS 27000 Controls & Process Improvement II |
OverviewDay three of the ISO 27000 implementation track covers access controls, user access management, remote access controls and network device security from the point of view of incident planning and handling.Time will be spent explaining how to measure the core competencies within the organization and identifying the best ways to handle security incidents in terms of fully defining the incident handling policy and staffing the incident-handler teams.This topic leads naturally to the discussion of business continuity planning and business continuity management.To better define the actual controls that are put into place operationally, much of the day will be spent covering a variety of technical topics. CPE/CMU Credits: 6 Topics
|
| MGT411.4: SANS 27000 Controls & Process Improvement III |
OverviewDay four will complete the three day discussion of each individual control in the audit criteria for 27000, continuing to describe key controls, explain them, discuss implementations and possible process improvements. We will address the issues surrounding continuous improvement of the methods used to develop security competency at both the organizational and personal level. CPE/CMU Credits: 6 Topics
|
| MGT411.5: Risk Management, Security Compliance & Audit Controls |
OverviewThis portion of the course focuses exclusively on risk analysis and risk management and relates them to compliance and audit controls. A variety of risk analysis strategies will be evaluated and compared, including basic methods, detailed methods, paper methods, and software-based approaches.We will analyze risk trees and relate all of these to the creation of strong preventative controls.The control measures used in class come directly from the ISO 27001 criteria. CPE/CMU Credits: 6 Topics
|
| MGT411.6: ISO 27000 Implementation |
OverviewThis last day is devoted to the hands-on construction of an ISMS. The instructor acts as the CEO and the ISO, organizing the class into various committees. After the steering committee generates some initial control statements, the individual committees will work to create simple high-level policies that will be reviewed periodically throughout the day. Exercises in risk analysis and mitigation will be presented as problems are discovered during the course of development. CPE/CMU Credits: 6 Topics
|
| Additional Information |
| Laptop Recommended |
|
While a laptop will be useful, it is not required. We will still be providing a CD of useful follow-on materials and tools that are mentioned during the week, but the hands-on exercises for this course revolve more specifically around how to perform useful risk assessments, how to create an ISMS charter, how to draft an effective policy under your ISMS, etc. If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org. |
