EncartaLabs

Information Security Risk Management and Business Continuity Planning

( Duration: 3 Days )

In Information Security Risk Management and Business Continuity Planning training course, IT professionals and security officers learn to assess and manage risk in their organization and plan for the unexpected.

By attending Information Security Risk Management and Business Continuity Planning workshop, Participants will learn to:

Describe generalized risk management lifecycle as starting point in organizational discussions and how processes fit together

  • Identify models/frameworks related to Risk Management and Business Continuity Planning/Disaster Recovery Planning
  • Paraphrase the process for business impact analysis interviews and calculating values
  • Paraphrase the process for assessing and analyzing risk scenarios quantitatively and qualitatively
  • Outline the contents expected in a Risk Treatment Plan and BCP/DRP documents
  • Participate in risk management implementation audit

Describe the role of governance in managing risk and compliance

  • Describe management support and identify team responsibilities
  • Scope the current situation in terms of documents to gather and questions to ask

Describe the management requirements to implement risk and resiliency strategy

  • Recognize the scope of potential risk response and BCP/DRP strategies appropriate to level of risk
  • Categorize investment requirements

Discuss requirements and proposals with security professional

Begin to prepare for various security-related certification exams or a security lead position

  • New System or Network Administrators who want to understand how to determine and manage risk, including an appropriate business continuity strategy
  • IT Professionals who need an overview of risk management and BCP/DR concepts and techniques
  • Individuals working towards (or considering) an information security or risk management-focused certification
  • Professionals who want to know more about risk management because it’s important for their job as a security practitioner
  • Professionals who want to know more about business continuity strategies because everybody needs to be ready for the unexpected!

COURSE AGENDA

1

Mapping Risk Management and Continuity Planning to Your Business

  • Describe risk management
  • Discuss the relationship between security, business continuity management and risk management
  • Define risk terms
  • Describe the risk equation
  • Define the key words relating to BCP/DRP
  • Position resiliency in your management strategy
  • Describe the types of response strategies
  • Describe the role of governance in managing risk and compliance
2

Making the Case for Risk Management and Business Continuity Planning

  • Discuss the importance of risk management and the need for BCP/DRP in any environment
  • List business considerations and drivers for risk management and business continuity planning
  • Determine which drivers apply to your environment
3

Managing Risk as a Process

  • Describe the purpose of frameworks, reference models, standards
  • List possible risk management models or frameworks as your guide
  • Compare BCP/DRP frameworks for your environment
  • Describe the lifecycle of risk management
  • Distinguish between risk assessment, risk analysis, and business impact analysis
  • Promote the ongoing need for training and plan updates
  • Define the activities involved in managing risk
  • List responsibilities and potential members for a risk management team
  • Define the activities involved in developing and maintaining a BCP/DRP
  • List responsibilities and potential members for a BCP team
  • Describe elements of a proposal for board approval
  • Identify stakeholders and their concerns
4

Analyzing Business Impact: Where to Focus

  • List detailed steps to conduct a business impact analysis project
  • Describe steps to conduct interviews to gather data
  • Describe how to increase success with BIA interviewing
  • Define analytical terms for business impact and recovery requirements
  • Explain the process to calculate and document recovery requirements for your critical business functions
5

Assessing Risk: What Threats and Vulnerabilities Exist

  • List the requirements of a risk assessment team
  • Describe how to select assessment targets based on BIA
  • Outline the steps in a risk assessment project
  • Define the scope of an assessment
  • Identify what goes into a plan for examination activities (interviews and vulnerability scanning)
  • Compare data gathering methods
  • Compare risk assessment methods and tools
  • List expectations for documenting assessment results
  • List steps to mitigate risks of being a risk assessor
6

Analyzing Risks: How Much It’s Worth

  • Compare quantitative and qualitative risk analysis
  • Describe methods to calculate quantitative risk
  • Define probability classes
7

Documenting Risk Treatment Plans: How to Protect Assets

  • Define risk management strategies
  • Describe how to select risk treatment plans (physical, technical, social) appropriate to analysis results
  • Describe the importance of documenting a policy to review risk management needs
8

Planning for Resiliency: How to Continue Your Business

  • List the sections of a Business Continuity Plan document
  • Describe the BCP’s underlying plans
  • List other BC-related plans and their contents
  • Position the Disaster Recovery Plan with respect to the BCP
  • List key elements for a Disaster Recovery plan
  • Compare Disaster Recovery strategies for your company
  • Compare levels of redundancy and retention
  • Identify roles and responsibilities for recovery teams
  • Optimize distribution and utility of documents
9

Implement Risk Treatment Plan

  • Integrate the project requirements across risk, BCP, and DRP plans
  • Follow project management best practices to implement plans for risk treatment across the organization
  • Describe the steps to take during a security incident
  • List the elements of a security incident report
  • Identify what constitutes an incident
  • Describe the process to collect evidence related to an incident
10

Failing Back

  • Discuss what happens when you’re ready to go back
  • Evaluate the opportunity to upgrade business effectiveness and/or resiliency
  • Describe the steps
11

Auditing Risk Management Implementation and Testing BCP Procedures

  • Differentiate between an audit and an assessment
  • Define the characteristics of an audit
  • Describe when an audit may be applicable
  • Predict evidence requested during an audit process
  • Compare risk management audit, compliance audit, and BCP testing
  • Describe the levels of testing for BCP/DRP plans
12

Summary and Case Study

  • Test your knowledge
  • Given sufficient detail, design an appropriate risk strategy
13

Business Continuity Planning – Next Steps

  • Ask the right questions to determine where your company currently stands
  • Champion the need for Business Continuity Planning with your management
  • Determine how much help you need and get it

Encarta Labs Advantage

  • One Stop Corporate Training Solution Providers for over 3,500 Modules on a variety of subjects
  • All courses are delivered by Industry Veterans
  • Get jumpstarted from newbie to production ready in a matter of few days
  • Trained more than 20,000 corporate candidates across india and abroad
  • All our trainings are conducted in workshop mode with more focus on hands On

View our other course offerings by visiting www.encartalabs.com/course-catalogue

Contact us for delivering this course as a public/open-house workshop for a group of 10+ candidates at our venue

Top