ISACA CISM – Domain 03 – Information Security Program Development Part 7

50. Controls as Strategy Implementation Resources Part4 Now do these controls operate in the principle of least privilege, meaning that we can adjust the access, we can adjust the things that you’re allowed to do to a level that gives you just enough privileges to do the job and nothing more. In some cases we… Read More »

ISACA CISM – Domain 03 – Information Security Program Development Part 6

44. Enterprise Architecture Part1 Now the term enterprise architecture is something we’ve kind of discussed a little bit earlier where we said there are many architectural approaches that we can use for security. Often we talked about this as being a framework that we can use to help us in designing the overall security. Now,… Read More »

ISACA CISM – Domain 03 – Information Security Program Development Part 5

35. Lesson 6: Information Security Framework Components So, in this lesson, we’re going to take a look at the information security framework components. That means we’ll take a look at the operational, management and administrative components, as well as the educational and informational components that we need to look at in our frameworks. 36. Operational… Read More »

ISACA CISM – Domain 03 – Information Security Program Development Part 4

28. Elements of the Roadmap Part4 So as I mentioned, a general control has kind of a wider scope. The general controls are just activities that support your entire organization in a centralized fashion. If part of my security solution or my security program might be the use of ID badges and magnetic key locks… Read More »

ISACA CISM – Domain 03 – Information Security Program Development Part 3

19. Pitfalls Now, there are some other pitfalls. The implementation of your security program, as I said, can come into some resistance. Again, it just could be people with resistance to the changes. And that’s not an unusual thing. You might be taking away responsibilities from people that are used to having a little bit… Read More »

ISACA CISM – Domain 03 – Information Security Program Development Part 2

11. Defining Objectives Part2 So after the objectives have been defined and that we’ve done this work to close the gap, as I was just mentioning before, our goal is to get to that what do we call it, before the desired state. And that’s really what one of the big objectives is going to… Read More »

ISACA CISM – Domain 03 – Information Security Program Development Part 1

1. Introduction Now this domain is about the Information Security program development and what we’re going to do is we’re going to look at the diverse areas of knowledge that we need to be able to plan to design and implement an information Security policy. Remember that that Information Security policy is kind of a… Read More »

ISACA CISM – Domain 04 – Information Security Incident Management Part 13

77. Other Recovery Operations Now, some of the other operations we look at in the recovery, of course, is documentation. Now, documentation is important because, number one, we can learn from previous events. It’s a great way of being able to review the entire process. Not only does it let us learn, but it lets… Read More »

ISACA CISM – Domain 04 – Information Security Incident Management Part 12

69. Analyzing Test Results Part1 Now, as the Information Security Manager, you need to be certain that your technology and architecture are a part of the recovery plan that’s going to be tested. It’s important because in today’s world, the It infrastructure is a large part of most of the organizations. You might not have… Read More »

ISACA CISM – Domain 04 – Information Security Incident Management Part 11

62. Incident Management Response Teams Now, when we look at the Incident Management Response Teams, there are responsibilities we have to assign. They are categorized. We have the emergency action team. These are the people that are going to pretty much be responsible for making sure everything is getting done. The evacuations kind of like… Read More »