Description

Get the detailed information you need to tackle the Information Security Program Development and Management domain on the Certified Information Security Manager (CISM) exam.

Tags

Syllabus

Syllabus IntroductionInformation security program development and managementWhat you need to knowStudy resources1. Information Security Program DevelopmentScope and charterAlignment of security and business objectivesBuilding a security teamConducting a gap analysis2. Personnel SecurityImproving personnel securitySecurity in the hiring processEmployee termination processEmployee privacySocial networking3. Data Security ControlsFile permissionsData encryption4. Cloud Computing and VirtualizationVirtualizationCloud computing modelsPublic cloud tiersCloud storage security5. Host SecurityOperating system securityMalware preventionApplication managementHost-based network security controlsHardware security6. Mobile SecurityMobile device securityMobile device managementMobile device trackingMobile application securityBring your own device (BYOD) policy7. CryptographyUnderstanding encryptionSymmetric and asymmetric cryptographyGoals of cryptographyChoosing encryption algorithmsThe cryptographic life cycleKey exchangeDiffie–HellmanKey escrowKey stretchingTrust modelsPKI and digital certificatesHash functionsDigital signaturesTLS and SSLIPsecSecuring common protocols8. Physical SecurityPhysical security control typesPhysical access controlVisitor management9. Network SecurityRouters and switchesFirewallsVPNs and VPN concentratorsNetwork intrusion detection and preventionUnified threat managementVLANs and network segmentationNetwork access controlRemote network access10. Identity and Access ManagementIdentity and access managementIdentification, authentication, and authorizationUsernames and access cardsAuthentication factorsBiometricsMultifactor authenticationSomething you have11. Asset ManagementPhysical asset managementChange and configuration management12. Personnel SafetyEmployee safetyEmergency management13. Software SecurityApplication securityDevelopment methodologiesMaturity modelsOperation, maintenance, and change managementRisk analysis and mitigationSoftware testingAcquired softwareConclusionWhat's next? Read more