Introduction
Welcome
()
What you need to know
()
1. Controls and Risks
Security controls
()
Security policy framework
()
Security policies
()
Risk assessment
()
Quantitative risk assessment
()
Risk management
()
Risk visibility and reporting
()
2. Supply Chain Risk
Managing vendor relationships
()
Vendor agreements
()
Vendor information management
()
3. Personnel Management
Need to know and least privilege
()
Separation of duties and responsibilities
()
Security in the hiring process
()
Employee termination process
()
4. Awareness and Training
Security education
()
Information classification
()
Compliance training
()
User habits
()
User-based threats
()
Measuring security education
()
5. Business Continuity and Disaster Recovery
Business continuity planning
()
Business continuity controls
()
High availability and fault tolerance
()
Disaster recovery
()
Backups
()
Disaster recovery sites
()
Geographic disaster recovery considerations
()
Testing BC/DR plans
()
After action reports
()
6. Incident Response
Security incidents
()
Preparing for incident response
()
Incident identification and containment
()
Escalation and notification
()
Incident mitigation
()
Eradication and recovery
()
Lessons learned and reporting
()
7. Forensics
Conducting investigations
()
Evidence types
()
Introduction to forensics
()
System and file forensics
()
Network forensics
()
Software forensics
()
Embedded device forensics
()
Chain of custody
()
Electronic discovery (ediscovery)
()
8. Data Security and Privacy
Understanding data security
()
Data security policies
()
Data security roles
()
Data privacy
()
Limiting data collection
()
Privacy assessments
()