Sikkerhetskurs for IT

Sikkerhet omkring informasjons håndtering er viktig og avgjørende for organisasjoner og bedrifter. Med ISO 27001 forsikrer du deg at du håndterer og beskytter deres informasjon på best mulig måte. Samtidig som informasjonen skal beskyttes, er det også kritisk at den er tilgjengelig for de som behøver den. De bedrifter som er sertifisert etter ISO 27001 minimerer virksomhetens risiko   Etter gjennomført kurs er målet at deltakeren skal ha lært seg grunnleggende prinsipper for hvordan din organisasjon kan arbeide med LIS ha lært seg kontinuitetsplanlegging i praksis ha kunnskap om håndtering og styring av risiko ha fått inspirasjon og kunnskap til å utvikle sitt eksisterende ledelsessystem Kursets form og ramme gjennomgang og tolkning av prinsipper i ISO 27001:2013 Gjennomgang av verktøyer for å skape, utvikle, forenkle og tydeliggjøre fordelene med ett enkelt og velfungerende LIS bruk av eksempler og dialog for å skape økt forståelse gruppearbeide og diskusjoner Kurset gjennomføres i moderne lokaler av en av Interteks erfarne revisorer, Per Sundqvist, med over 20 års erfaring med revisjon av ledelsessystemer for kvalitet, miljø og informasjonssikkerhet. Gjennompresentasjoner, eksempler, utdypning, diskusjon og oppgaver involveres deltakerne gjennom hele kurset. Det utleveres kursbevis ved kursavslutning. [-]

The ECSA penetration testing course provides you with a real world hands-on penetration testing experience and is a globally accepted hacking and penetration testing class available that covers the testing of modern infrastructures, operating systems and application environments while teaching the students how to document and write a penetration testing report. The ECSA pentest program takes the tools and techniques you learned in the Certified Ethical Hacker course (CEH) and elevates your ability into full exploitation by teaching you how to apply the skills learned in the CEH by utilizing EC-Council’s published penetration testing methodology: Focuses on pentesting methodology with an emphasis on hands-on learning The exam will now have a prerequisite of submitting a pentesting report The goal of these changes is to make passing ECSA more difficult; therefore making it a more respected certification Instruktør på Security Analyst kurset er Robert PetrunicRobert Petrunic jobber i Infigo IS som senior sikkerhetskonsulent, for det meste på penetrasjonstesting og sikkerhetsrelatert rådgivning. Robert er Microsoft, ECCouncil og VMware sertifisert instruktør, og jobber med Kroatias største utdanningsinstitusjon Algebra som freelance instruktør.Robert er MVP (Microsoft Most Valuable Professional) på Enterprise Security. Han har hatt denne MVP tittelen siden 2008. I tillegg til Security har han sin ekspertise innen System Center Cloud og Datacenter Management samt Windows Azure   Course Outline Security Analysis and Penetration Testing Methodologies TCP IP Packet Analysis Pre-penetration Testing Steps Information Gathering Methodology Vulnerability Analysis External Network Penetration Testing Methodology Internal Network Penetration Testing Methodology Firewall Penetration Testing Methodology IDS Penetration Testing Methodology Web Application Penetration Testing Methodology SQL Penetration Testing Methodology Database Penetration Testing Methodology Wireless Network Penetration Testing Methodology Mobile Devices Penetration Testing Methodology Cloud Penetration Testing Methodology Report Writing and Post Test Actions [-]

This five-day intensive course enables the participants to develop the expertise to support an organization in implementing and managing an Information Security Management System (ISMS) as specified in ISO/IEC 27001:2013. Participants will also master the best practices for implementing information security controls from the eleven areas of ISO/IEC 27002:2013. This training is consistent with the good practices of project management established by the Project Management Institute (PMI) and ISO 10006:2003 (Quality Management Systems - Guidelines for Quality Management in Projects). This training is fully compatible with ISO/IEC 27003:2009 (Guidelines for the Implementation of an ISMS), ISO/IEC 27004:2009 (Measurement of Information Security) and ISO/IEC 27005:2008 (Risk Management in Information Security). Les mer om kurset og agenda [-]

In this course you will gain foundational knowledge on both broad and global concepts of privacy and data protection laws and practice. You will learn common principles and approaches to privacy as well as understand the major privacy models employed around the globe. An introduction to information security concepts and information security management and governance will be covered including frameworks, controls, and identity and access management. You will also learn about online privacy as it relates to using personal information on websites and other internet-related technologies.   This course delves into the context of European data protection law: origins, institutions and legislative framework; data protection concepts, principles and application, including processing criteria, obligations, data subject rights, confidentiality and security, notification requirements, international data transfers, and supervision and enforcement; and European data protection practices related to employment, surveillance, direct marketing and outsourcing. Day OneModule 1: Fundamentals of Information Privacy Unit 1: Common Principles and Approaches to Privacy This unit includes a brief discussion about the modern history of privacy, an introduction to types of information, an overview of information risk management and a summary of modern privacy principles.   Unit 2: Jurisdiction and Industries This unit introduces the major privacy models employed around the globe and provides an overview of privacy and data protection regulation by jurisdictions and by industry sectors.   Unit 3: Information Security: Safeguarding Personal Information This unit presents introductions to information security, including definitions, elements, standards, and threats/vulnerabilities, as well as introductions to information security management and governance, including frameworks, controls, cryptography, and identity and access management (IAM).   Unit 4: Online Privacy: Using Personal Information on Websites and with Other Internet-related Technologies This unit discusses the web as a platform, as well as privacy considerations for sensitive online information, including policies and notices, access, security, authentication identification and data collection. Additional topics include children’s online privacy, email, searches, online marketing and advertising, social media, online assurance, cloud computing, and mobile devices. 　 Day TwoModule 2: European Privacy Unit 1: Introduction to European Data Protection This unit introduces the origins and historical context for privacy in Europe, the European regulatory institutions and the legislative framework for current EU data protection law at both the EU and state level.   Unit 2: European Data Protection Law and Regulation This unit takes an in-depth look at data protection concepts, application of the law, data protection principles, legitimate processing criteria, information provision obligations, data subject rights, confidentiality and security, notification requirements, international data transfers, and supervision and enforcement.   Unit 3: Compliance with European Data Protection Law and Regulation This unit examines the employment relationship, surveillance activities, marketing activities, internet technology and communications, and outsourcing. [-]

  Studieår: 2013-2014   Gjennomføring: Høst og vår Antall studiepoeng: 5.0 Forutsetninger: Faget «Datakommunikasjon» eller tilsvarende grunnleggende fag. (TCP/IP forutsettes kjent). Faget «Nettverksteknologi» Innleveringer: Øvinger: 8 av 12 må være godkjent. Øvingene må dekke en bred del av pensum. Vurderingsform: Skriftlig, individuell, 3 timer, Ansvarlig: Helge Hafting Eksamensdato: 04.12.13 / 07.05.14         Læremål: KUNNSKAPER:Kandidaten:- kan forklare en del protokollbaserte farer/angrep i kablede og trådløse nett- kan gjøre rede for mottiltak mot angrepene over- kan gjøre rede for andre farer og mottiltak, som fysiske sikringstiltak og «social engineering»- kan gjøre rede for og planlegge bruk av vanlige sikringstiltak som IDS, IPS, VPN og proxyer FERDIGHETER:Kandidaten kan:- sette i drift et VPN- installere brannmur- Observere nettverkstrafikk med pakkesniffer GENERELL KOMPETANSE:Kandidaten:- kan granske sikkerheten i et nettverk, og velge passende tiltak.Innhold:Generell nettverkssikkerhet. Hvordan planlegge, organisere og sette sikkerhet i små og store nettverk. Brannmurer, VPN, IDS/IPS. Sikkerhet rundt epost, trådløse nett og rutere. En del vanlige angrep, og mottiltak.Les mer om faget her Påmeldingsfrist: 25.08.13 / 25.01.14         Velg semester:  Høst 2013    Vår 2014     Fag Nettverkssikkerhet 4980,-         Semesteravgift og eksamenskostnader kommer i tillegg.    [-]

Personvern er mer enn internkontroll. Denne dagen går vi ut fra at deltageren kan de grunnleggende begrepene, og bruker tiden på å gjennomgå de praktiske og kommersielt viktige forretningsmessige aspekter ved personvern og sikkerhet. Vi gjennomgår en generell plan for gjennomføring en GDPR implementasjon i bedriften din, og drøfter praktiske problemstillinger som kommer underveis. Etter dette kurset klarer du å identifisere mer komplekse personvernaspekter, og har fått en verktøykasse som kan brukes til å løse de. Kursinnhold Vi går gjennom følgende tema med praktiske eksempler – og det blir tid til å stille spørsmål underveis.  Generelle forhold:  Konsern – hvem skal være behandlingsansvarlig – deling av informasjon i konsern Betydning av ulik plassering av behandlingsansvar  En plan for analysearbeid og identifikasjon av nødvendige tiltak  En gjennomgang elementer som bør være på plass i internkontrollsystemet, og hvordan du kan imøtekomme Datatilsynets krav. Avvikshåndtering Opplæring  Konserndatabehandleravtaler Lansering av nye tjenester - sjekkpunktliste  Privacy by design DPIA – Data Protection Impact Asessments – teknisk og juridisk  Risikovurderinger Betydningen for it-systemene  Hvordan påvirker dette stordata og statistikk – teknisk databasedesign - i dag lagres typisk brukerid og det slettes ikke, men i teknisk design fremover må man slette identen, men slette annen informasjon – såfremt den da er anonym – det betyr at feltene må frikobles   Cookies – eprivacyforordningen – bruk av nettsider Om GDPR-prosjekt – do’s and dont’s Krav til forkunnskaper: For å kunne delta på dette kurset bør du ha kunnskaper om personvern tilsvarende: Dag 1: Grunnopplæring i personvern og GDPR   Kursinstruktører Eva Jarbekk og Simen Sommerfeldt er landet fremste eksperter på personvern og GDPR. Eva er personvernadvokater og partner i advokatfirmaet Føyen. Simen er rådgiver og teknologisjef i Bouvet. Sammen vil de gå gjennom hvordan man kan gjøre dette i praksis og kombinere de juridiske utgangsspunktene.  [-]

The web is a great software delivery platform, making your software available to users around the world with zero installation and easily deployed updates. Unfortunately, it also exposes you to an army of adversaries - some human, some bot - who have darker goals: to cause loss to your data or reputation, subvert your resources for their own gain or attack your user base. This course helps you to develop a security-oriented mindset. It explores the way the web works, so you have a way to understand how various vulnerabilities arise. Then, with those foundations laid, it covers a range of common and less common vulnerabilities, how an attack based on them would be constructed, and how you can recognize and defend against them.   Day 1Module 1: Developing a security-oriented mindset The economics of security Attack vectors: technical, social, physical Security in depth The issues with security by obscurity Positive vs negative validation Module 2: Analysing HTTP request/response Understanding the HTTP protocol Using a HTTP analyser Request header content Response header content GET vs POST and the implications Assembling and making custom fake requests Tracing an AJAX application's HTTP flow Module 3: Injection vulnerabilities Concept and overall defense strategy SQL injection Path injection HTTP header injection Mail header injection XPATH injection Regex injection Module 4: Attacks from the client side Cross site scripting (XSS) Cross site request forgery (CSRF)   Day 2 Module 5: Authentication and authorization issues Comparing password protection Securing password storage Handling password changes and resets securely Session poisoning and session stealing Direct object reference vulnerabilities Securing static objects Securing AJAX Module 6: Exploiting trust relationships Social engineering basics Phishing Unvalidated re-directs and forwards Weaknesses due to faked referrers Dangers related to shared hosting and shared domains Unicode homograph related issues Module 7: Information leakage The dangers of bad error handling Managing risks in open APIs Timing attacks Module 8: Denial of Service attacks How DoS attacks arise DoS vs DDoS XML poisoning attacks Regex backtracking blow-up attacks   Les mer om Glasspaper as Les mer om kurset: Web Security for Developers [-]

K-tech er et kompetansesenter på Kongsberg som startet opp i 2008 med Kongsberg Defence & Aerospace, Technip FMC og GKN Aerospace som våre eiere. Vi er en kursleverandør som tilbyr kvalitetssikrede kurs innenfor en rekke sentrale områder som er etterspurt av industrien i Norge. Beskrivelse: Are you ready? The General Data Protection Regulation (GDPR) is the European Union’s new legislation to protect the personal data of EU citizens. The GDPR has been born of a need to regulate data protection, amongst other data concerns, throughout the European member states by updating the now archaic 1995 Data Protection Directive (DPD); a set of laws created at the onset of the internet era and long before the digital age. Organizations have been given a two-year lead in period to become compliant, ending 25th May 2018. This Masterclass not only prepares you to meet the challenges of this new far reaching regulation. But will provide you with the knowledge in order to prepare for compliance testing in 2018. This intense 2 day workshop will provide you with real world tangible skills that you will be able to use today. Organisational Benefits: Non-compliance of the GDPR can result in fines of up to 4% of global turnover or €20m, as well as significant reputational damage and a loss of market and customer confidence that can negatively impact sales. Your organisation will benefit from a senior manager who is well-placed to implement technical and organisational measures required under the GDPR as well as comply with other legal requirements ahead of 2018. In many cases there will also be a requirement to appoint a suitably qualified and trained data protection officer (DPO) that will report to the board.  Innhold: Masterclass Objectives: Informing and advising the controller and staff about who is processing personal data and their obligations which are pursuant to this Regulation; Monitoring and complying with this Regulation which includes the assignment of responsibilities and awareness Providing advice to staff when requested, regarding the data protection impact assessment and how to monitor its performance pursuant to Article 35 of the GDPR. Cooperating with the ICO Taking responsibility as the main point of contact on issues related to the processing of personal data Masterclass Day 1 Outline: Introductions & Welcome Essential GDPR Background and Terminology Structure of the regulations Principles of GDPR Key differences between The EU Data Protection Act and The EU GDPR GDPR Privacy Principles Preparing for Compliance Data Subjects and Their Rights Day 1 Review Masterclass Day 2 Outline: Developing a Risk Management Framework Demonstrating Compliance GDPR Privacy Principles Key Roles of a DPO (Data Protection Officer) Subject Access Requests Dealing with third parties and data in the Cloud International Data Transfers & Safe Harbour regulatory, and compensatory aspects of the GDPR Practical Implications of GDPR Demonstrating compliance with GDPR Data breach reporting requirements Course Review & Next Steps QandA For mere informasjon: http://www.glasspaper.no/kurs/3260.GDPR-The-Preparation-Masterclass---with-Andy-Malone/ [-]

Etter å ha deltatt på vårt grunnkurs skal du ha god oversikt over basisbegrepene i lovverket, og hvordan disse får betydning for din bedrift. Du vil være rustet til å håndtere personvernmessige aspekter i jobben din og delta i diskusjoner. Kursinnhold Vi går gjennom følgende tema med praktiske eksempler – og det blir tid til å stille spørsmål underveis Det store why - økonomisk risiko og fare for gruppesøksmål – solidaransvar gjennom leverandørkjeder – og fordi personvern er viktig  Når gjelder personvernreglene – hva er en personopplysning Når er en personopplysning anonymisert slik at reglene ikke gjelder  Plassering av hvem som har behandlingsansvar og databehandleransvar  Grunnprinsipper i de nye reglene Krav til internkontroll, dokumentasjonsplikt Hvordan håndtere innsynsbegjæringer – hva kan unntas  Hva betyr dataportabilitet og hvordan kan det håndteres Hvor lenge kan data oppbevares – når må de slettes? Hva gjør man med logger og backup Informasjonsplikten til de registrerte Innhenting av samtykke – hva kan man gjøre uten samtykke Personvernombud – hvem skal ha rollen og hva må vedkommende gjøre Hvordan bruke skytjenester på en lovlig måte Hva må databehandleravtaler inneholde – og hva gjør man med erstatningsbestemmelsene Krav til opplæring i bedrifter Håndtering av avvik Betydningen for it-systemene  Hvordan påvirker dette stordata og statistikk. Hva ePrivacyreguleringen innebærer for de som har kontakt med kunder via nett Kursinstruktører Eva Jarbekk og Simen Sommerfeldt er landet fremste eksperter på personvern og GDPR. Eva er personvernadvokater og partner i advokatfirmaet Føyen. Simen er rådgiver og teknologisjef i Bouvet. Sammen vil de gå gjennom hvordan man kan gjøre dette i praksis og kombinere de juridiske utgangsspunktene.  [-]

Dette intensive fem dagers kurset gir deg muligheten til å utvikle den nødvendige ekspertisen til å demonstrere kunnskap, ferdigheter og kompetanse, for å implementere, håndtere og endre et personvernrammeverk basert på General Data Protection Regulation (GDPR). Du vil kunne forstå gapet mellom GDPR and nåværende organisatoriske prosesser inkludert personvernpolicyer, prosedyrer, arbeidsinstrukser, samtykkeskjemaer, personvernkonsekvensutredning (Data Protection Impact Assessment), etc. for å bistå organisasjoner med sitt compliance-arbeid. Dette kurset er basert på teoretiske presentasjoner etterfulgt av praktiske oppgaver. Kurset går over 5 dager med avsluttende eksamen siste dag. Inkludert i prisen er dokumentasjon, kursbevis, eksamensavgift, lunsj og kaffe/te. [-]

Kurset tar for seg de mest sentrale problemstillingene knyttet til sikkerhet rundt bruken av datautstyr som datamaskiner, smarttelefoner og nettbrett.    Kurset vil gi brukeren kunnskap om ulike «feller» man kan gå i samt nyttige og praktiske tips og veiledninger til hvordan man unngår at data kommer på avveie eller ødelegges permanent.   Kurset inneholder 50 opplæringsvideoer. Mens andre  kurs fokuserer på å bruke IT-verktøy effektivt, vil dette kurset gi deg innsikt i å bruke IT trygt og sikkert.   Kurset passer for databrukere i alle typer bedrifter og organisasjoner.   Innhold i kurset • Datamaskinen • Passord • Ute av kontoret • Minnepinner • Sikkerhetskopi • E-post • Internett • Ettertest Krav til forkunnskaper Grunnleggende datakunnskaper Kursbevis Etter endt opplæring vil man kunne ta en ettertest for å måle sin nye kunnskap. Ved bestått test så vil man få tilgang til et kursbevis   Nettbasert  Timetall: 6  Kursstart Info: Når som helst - Hele året !  Klokkeslett: 00:00 - 24:00  Påmeldingsfrist:  Pris: kr 1.175,- inkl. mva.  Nettbasert - Web     Kontaktperson: Frode Ingebrigtsen    Status: Åpent for påmelding Gå til påmelding [-]

Kurset gir deg:   Innsikt i de ulike sikkerhetsutfordringene, og de mest vanlige og alvorlige sårbarhetene en webapplikasjon kan ha.   Forståelse av hvorfor disse feilene oppstår, hvordan man oppdager dem og hvordan man skal beskytte seg.   Oppgaver hvor en selv angripe en web-basert nettbutikk i et Lab-miljø, og lære hvordan du skal se etter sårbarheter som SQL-Injection, Cross-Site Scripting (XSS), autorisasjonsfeil med flere.   Gjennomføring Kurset er basert på forelesninger og ulike øvelser. Det legges vekt på aktiv deltagelse. Egen bærbar PC må tas med på kurset. Kravene til Laptop ‘en er at den har mulighet for å benytte Wi-Fi og har en ethernet tilkobling slik at man kan koble seg til vårt web-baserte testsystem og internett. Datamaskinene trenger en nyere versjon av Java for å kunne kjøre BurpSuite (portswigger.net/) og Mozilla Firefox installert. En liste med anbefalte plugins til Mozilla Firefox vil bli gitt til kursdeltakeren i forkant av kurset.t for å kunne benyttes i kurset.   Kursholder:Kursholder er rådgiver hos Watchcom og arbeider daglig med temaene det undervises i, noe som gjør kurset dagsaktuelt med god forankring i virkeligheten. Kurset holdes på norsk.       [-]

Certified Information Systems Security Professional (CISSP) is an independent information security certification governed by the not-for-profit International Information Systems Security Certification The certification itself is seen as the world’s premier certification for information security professionals. The CISSP Bootcamp includes in-depth & intense coverage of all ten domains plus tips and advice to prepare yourself for the exam. CISSP certification is not only an objective measure of excellence, but a globally recognized standard of achievement.    Andy Malone is a world class technology instructor and consultant. He is Microsoft MVP (Microsoft Most Valuable Professional) in Enterprise Security for 8 years, and instructor on a broad range of Security areas (CISSP, Comptia Security +, Cyber-Security & Awareness Training, Computer Forensics Training). Andy is a veteran conference speaker at prestigious events as Microsoft TechEd North America, Europe, Middle East & Africa, NIC, Windows Connections and Cybercrime. Andy`s passionate style of delivery, combined with a sense of fun has become his trademark and has won him great acclaim. Attending Andy`s classes you will learn about Microsoft’s Technologies and get hands on experience, but you will also get a wealth of knowledge, skills and additional “extras” which include whitepapers, tips, tricks, tools and a whole lot more! Follow Andy on Twitter @AndyMalone   The CISSP draws from a comprehensive, up-to-date, global common body of knowledge that ensures security leaders have a deep knowledge and understanding of new threats, technologies, regulations, standards, and practices. The CISSP exam tests ones competence in the 8 domains of the CISSP CBK, which cover:  Domain 1: Security and Risk Management (Security, Risk, Compliance, Law, Regulations, Business Continuity) Domain 2: Asset Security (Protecting Security of Assets) Domain 3: Security Engineering (Engineering and Management of Security) Domain 4: Communications and Network Security (Designing and Protecting Network Security) Domain 5: Identity and Access Management (Controlling Access and Managing Identity) Domain 6: Security Assessment and Testing (Designing, Performing, and Analyzing Security Testing) Domain 7: Security Operations (Foundational Concepts, Investigations, Incident Management, DisasterRecovery) Domain 8: Software Development Security (Understanding, Applying, and Enforcing Software Security) Module 9: CISSP Test Review Module 10: CISSP Exam Preparation & Review Questions Learning Objectives Understand and apply the concepts of risk assessment, risk analysis, data classification, and security awareness and Implement risk management and the principles used to support it(Risk avoidance, Risk acceptance, Risk mitigation, Risk transference) Apply a comprehensive and rigorous method for describing a current and/or future structure and behavior for an organizations security processes, information security systems, personnel, and organizational sub-units so that these practices and processes align with the organizations core goals and strategic direction and address the frameworks and policies, concepts, principles, structures, and standards used to establish criteria for the protection of information assets, as well as to assess the effectiveness of that protection and establish the foundation of a comprehensive and proactive security program to ensure the protection of an organizations information assets Apply a comprehensive and rigorous method for describing a current and/or future structure and behavior for an organizations security processes, information security systems, personne, and organizational sub-units so that these practices and processes align with the organizations core goals and strategic direction and examine the principles, means, and methods of applying mathematical algorithms and data transformations to information to ensure its integrity, confidentiality, and authenticity Understand the structures, transmission methods, transport formats, and security measures used to provide confidentiality, integrity, and availability for transmissions over private and Public communications networks and media and identify risks that can be quantitatively and qualitatively measured to support the building of business cases to drive proactive security in the enterprise. Offer greater visibility into determining who or what may have altered data or system information, potentially affecting the integrity of those asset and match an entity, such as a person or a computer system, with the actions that entity takes against valuable assets, allowing organizations to have a better understanding of the state of their security posture. Plan for technology development, including risk, and evaluate the system design against mission requirements, and identify where competitive prototyping and other evaluation techniques fit in the process Protect and control information processing assets in centralized and distributed environments and execute the daily tasks required to keep security services operating reliably and efficiently. Understand the Software Development Life Cycle (SDLC) and how to apply security to it, and identify which security control(s) are appropriate for the development environment, and assess the effectiveness of software security. [-]

K-tech er et kompetansesenter på Kongsberg som startet opp i 2008 med Kongsberg Defence & Aerospace, Technip FMC og GKN Aerospace som våre eiere. Vi er en kursleverandør som tilbyr kvalitetssikrede kurs innenfor en rekke sentrale områder som er etterspurt av industrien i Norge. Beskrivelse: GDPR Foundation training enables you to learn the basic elements to implement, manage and align a privacy framework with and based on the General Data Protection Regulation. During this training course, you will be able to understand the fundamental privacy principles and become familiar with the role of the Data Protection Officer. After completing this course, you can sit for the exam and apply for a “PECB GDPR Foundation” credential. A PECB Foundation Certificate shows that you have understood the fundamental methodologies, requirements, framework and management approach. Learning objectives: Understand the General Data Protection Regulation requirements and the fundamental principles of privacy/li> Understand the obligations, roles and responsibilities of the Data Protection Officer Understand the concepts, approaches, methods and techniques to effectively align a privacy framework with the General Data Protection Regulation Innhold: Course Agenda Day 1: Introduction to the General Data Protection Regulation and its concepts Day 2: The General Data Protection Regulation requirements and Certification Exam Exam and all necessary course material are included in the course  Education approach Lecture sessions are illustrated with examples based on real case scenarios Practical exercises include real case scenarios, examples and discussions Practice tests are similar to the Certification Exam [-]

This course enables the participants develop the competence to master the basic Risk Management elements related to all the assets of relevance for Information Security using the ISO/IEC 27005 standard as a reference framework. Based on practical exercises and case studies, participants acquire the necessary knowledge and skills to perform an optimal Information Security Risk Assessment and manage risks in time by being familiar with their life cycle. This training fits perfectly in the framework of an ISO/IEC 27001 standard implementation process. Learning Objectives: To understand the concepts, approaches, methods and techniques that allow effective Risk Management according to ISO 27005 To interpret the requirements of ISO 27005 on Information Security Risk Management To understand the relationship between the Information Security Risk Management, the security controls and the compliance with all the other requirements) Day 1: Introduction, risk management program, risk identification and assessment according to ISO 27005 Concepts and definitions related to risk management Risk management standards, frameworks and methodologies Implementation of an information security risk management program Risk identification and risk assessment Day 2: Risk evaluation, treatment, acceptance, communication and surveillance according to ISO 27005 Risk evaluation and treatment Acceptance of information security risks and management of residual risks Information security risk monitoring and review Certified ISO/IEC 27005 ANSI Accredited Exam Sertifisering: About the Examination: The “Certified ISO 27005 Risk Manager” exam fully meets the requirements of the PECB Examination and Certification Program (ECP). The “Certified ISO 27005 Risk Manager exam covers the following competence domains: Domain 1: Fundamental concepts, approaches, methods and techniques of information security risk management Domain 2: Implementation of an information security risk management program Domain 3: Information security risk assessment based on ISO 27005 The exam is available in different languages, including English, French, Spanish and Portuguese The exam consists of 5 essay-type questions Open book: Participants may use all PECB provided documentation plus their own course notes, but will not be permitted to use any computer, laptop or any other electronic device Paper-based exam A minimum score of 70% is required to pass the exam The exam lasts 90 minutes Certification: A certificate of “ISO/IEC 27005 Risk Manager” will be issued to those participants who successfully pass the exam and comply with all the other requirements related to this credential: Professional experience: Two years, one year of Risk Management related work experience Risk assessment experience: Risk Management activities totaling 200 hours [-]