Auditing a Cybersecurity Programme

Course Introduction

Today, security risks requiring audits are increasing dramatically. To prevent the data breaches that executives fear, auditors must be able to assess the effectiveness of a company's cybersecurity program.

This involves understanding the necessary controls, how to implement them, and how to evaluate their effectiveness.

Participants in this Auditing a Cybersecurity Programme training course will engage in various exercises designed to solidify their knowledge of creating and executing effective security solutions.

This Auditing a Cybersecurity Programme training course will equip them with the skills needed to perform cyber assessments, making them valuable assets to their organization's cyber defense team.

This training course will feature:

• Simulations of real cybersecurity program audits
• Tips for effective cybersecurity auditing
• Cyber risk assessments
• Threat analysis
• Case studies of cybersecurity breaches and their consequences

Training Objectives

By the end of this training course, delegates will be able to:

• Perform risk analysis of IT security breaches
• Get acquainted with ISO 27001 and COBIT5
• Acquire the knowledge of Information Security Management
• Understand the approach for incident response, Crisis Management and Disaster Recovery

Who should Attend?

This training course is suitable for many professionals but will greatly benefit:

• Auditors
• IT professionals who are interested in conducting cybersecurity audits, risk assessments, vulnerability and threat analysis or control self-assessments

Day One: Introduction to Cybersecurity

• Vulnerability assessment
• Threat analysis 
• Cybersecurity risk assessment
• Cybersecurity program
• Cybersecurity risk auditing

Day Two: Inventory Security Management

• Inventory authorized and unauthorized devices
• Inventory authorized and unauthorized software
• Secure configurations
• Continuous vulnerability assessment and remediation
• Control use of administrative privileges
• Maintenance, monitoring and analysis of audit logs

Day Three: Network Security Management

• Email and web browser protection
• Malware defenses
• Security configurations for network devices 
• Wireless access control
• Limitation and control of network ports, protocols and services

Day Four: Data Security Management

• Data protection
• Controlled data access based on need to know
• Data recovery capability
• Boundary defenses
• Account monitoring and control
• Security skills assessment and training

Day Five: Security Incident Management

• Application software security
• Cybersecurity Incidents
• Incident response management
• Penetration tests
• Red team exercises