Learn the Foundations of CISM

Certified Information Security Manager (CISM®)

• Domain 01: Information Security Governance

  03:47:44

  • Lesson One: Information Security Governance Overview

    00:53

  • Information Security Governance Overview Part One

    01:12

  • Information Security Governance Overview Part Two

    02:00

  • Information Security Governance Overview Part Three

    01:22

  • Information Security Governance Overview Part Four

    01:32

  • Information Security Governance Overview Part Five

    00:29

  • Importance of Information Security Governance Part One

    01:19

  • Importance of Information Security Governance Part Two

    06:20

  • Outcomes of Information Security Governance Part one

    00:33

  • Outcomes of Information Security Governance Part Two

    01:26

  • Outcomes of Information Security Governance Part Three

    02:45

  • Outcomes of Information Security Governance Part Four

    01:27

  • Outcomes of Information Security Governance Part Five

    01:54

  • Outcomes of Information Security Governance Part Six

    01:28

  • Lesson Two: Effective Information Security Governance

    00:31

  • Business Goals and Objectives Part One

    01:31

  • Business Goals and Objectives Part Two

    02:00

  • Roles and Responsibilities of Senior Management Part One

    01:02

  • Roles and Responsibilities of Senior Management Part Two

    00:43

  • Domain Tasks Part One

    01:21

  • Domain Tasks Part Two

    03:16

  • Business Model for Information Security Part One

    00:45

  • Business Model for Information Security Part Two

    01:09

  • Business Model for Information Security Part Three

    03:16

  • Business Model for Information Security Part Four

    01:37

  • Dynamic Interconnections Part One

    00:34

  • Dynamic Interconnections Part Two

    02:55

  • Dynamic Interconnections Part Three

    01:55

  • Dynamic Interconnections Part Four

    00:51

  • Lesson Three: Information Security Concepts and Technologies

    03:26

  • Information Security Concepts and Technologies Part One

    02:58

  • Information Security Concepts and Technologies Part Two

    03:25

  • Information Security Concepts and Technologies Part Three

    01:50

  • Technologies Part One

    01:41

  • Technologies Part Two

    06:12

  • Lesson Four: Information Security Manager

    00:33

  • Responsibilities

    01:48

  • Senior Management Commitment Part One

    00:48

  • Senior Management Commitment Part Two

    02:27

  • Obtaining Senior Management Commitment Part One

    00:24

  • Obtaining Senior Management Commitment Part Two

    00:53

  • Establishing Reporting and Communication Channels Part One

    01:13

  • Establishing Reporting and Communication Channels Part Two

    01:07

  • Lesson Five: Scope and Charter of Information Security Governance

    01:55

  • Assurance Process Integration and Convergence

    02:24

  • Convergence

    02:32

  • Governance and Third-Party Relationships

    02:38

  • Lesson Six: Information Security Governance Metrics

    00:56

  • Metrics

    01:38

  • Effective Security Metrics Part One

    01:46

  • Effective Security Metrics Part Two

    01:01

  • Effective Security Metrics Part Three

    01:51

  • Effective Security Metrics Part Four

    00:39

  • Security Implementation Metrics

    01:17

  • Strategic Alignment Part One

    02:56

  • Strategic Alignment Part Two

    01:10

  • Risk Management

    01:14

  • Value Delivery

    01:02

  • Resource Management Part One

    00:47

  • Resource Management Part Two

    00:41

  • Performance Measurement

    03:06

  • Assurance Process Integration/Convergence

    02:54

  • Lesson Seven: Information Security Strategy Overview

    00:53

  • Another View of Strategy

    00:41

  • Lesson Eight: Creating Information Security Strategy

    00:16

  • Information Security Strategy

    01:22

  • Common Pitfalls Part One

    04:38

  • Common Pitfalls Part Two

    02:19

  • Objectives of the Information Security Strategy

    01:33

  • What is the Goal?

    01:40

  • Defining Objectives

    01:23

  • Business Linkages

    01:48

  • Business Case Development Part One

    01:44

  • Business Case Development Part Two

    02:36

  • Business Case Development Part Three

    00:45

  • Business Case Objectives

    00:57

  • The Desired State

    01:48

  • COBIT

    01:08

  • COBIT Controls

    01:09

  • COBIT Framework

    00:48

  • Capability Maturity Model

    01:38

  • Balanced Scorecard

    01:22

  • Architectural Approaches

    01:03

  • ISO/IEC 27001 and 27002

    01:00

  • Risk Objectives Part One

    01:39

  • Risk Objectives Part Two

    03:11

  • Lesson Nine: Determining Current State Of Security

    00:45

  • Current Risk Part One

    02:37

  • Current Risk Part Two

    01:11

  • BIA

    01:11

  • Lesson Ten: Information Security Strategy Development

    01:52

  • The Roadmap

    01:01

  • Elements of a Strategy

    03:27

  • Strategy Resources and Constraints

    02:45

  • Lesson Eleven: Strategy Resources

    00:32

  • Policies and Standards

    01:00

  • Definitions

    05:48

  • Enterprise Information Security Architectures

    01:30

  • Controls

    03:00

  • Countermeasures

    00:55

  • Technologies

    01:50

  • Personnel

    01:54

  • Organizational Structure

    03:47

  • Employee Roles and Responsibilities

    00:28

  • Skills

    01:16

  • Audits

    01:41

  • Compliance Enforcement

    02:24

  • Threat Assessment

    01:41

  • Vulnerability Assessment

    02:21

  • Risk Assessment

    02:19

  • Insurance

    02:04

  • Business Impact Assessment

    02:32

  • Outsourced Security Providers

    02:57

  • Lesson twelve: Strategy Constraints

    00:23

  • Legal and Regulatory Requirements

    01:43

  • Physical Constraints

    02:56

  • The Security Strategy

    01:36

  • Lesson Thirteen: Action Plan to Implement Strategy

    01:13

  • Gap Analysis Part One

    01:35

  • Gap Analysis Part two

    00:52

  • Gap Analysis Part Three

    03:01

  • Policy Development Part One

    01:41

  • Policy Development Part Two

    01:00

  • Standards Development

    02:44

  • Training and Awareness

    00:35

  • Action Plan Metrics

    01:23

  • General Metric Considerations Part One

    00:23

  • General Metric Considerations Part Two

    00:35

  • General Metric Considerations Part Three

    00:43

  • General Metric Considerations Part Four

    00:23

  • CMMFour Statements

    02:00

  • Objectives for CMMFour

    00:47

  • Section Review

    00:44

• Knowledge Check

  • Knowledge Check One

• Domain 02: Information Risk Management and Compliance

  02:22:21

  • Lesson One: Risk Management Overview

    00:59

  • Risk Management Overview

    01:51

  • Types of Risk Analysis

    07:08

  • The Importance of Risk Management

    02:14

  • Risk Management Outcomes

    01:35

  • Risk Management Strategy

    01:49

  • Lesson Two: Good Information Security Risk Management

    04:14

  • Context and Purpose

    03:08

  • Scope and Charter

    00:39

  • Assets

    02:31

  • Other Risk Management Goals

    02:02

  • Roles and Responsibilities

    02:51

  • Lesson Three: Information Security Risk Management Concepts

    06:06

  • Technologies

    06:39

  • Lesson Four: Implementing Risk Management

    02:08

  • The Risk Management Framework

    02:00

  • The External Environment

    01:48

  • The Internal Environment

    02:06

  • The Risk Management Context

    00:47

  • Gap Analysis

    02:21

  • Other Organizational Support

    04:09

  • Lesson Five: Risk Assessment

    01:19

  • NIST Risk Assessment Methodology

    03:49

  • Aggregated or Cascading Risk

    02:54

  • Other Risk Assessment Approaches

    01:18

  • Identification of Risks

    01:49

  • Threats

    01:08

  • Vulnerabilities Part One

    02:11

  • Vulnerabilities Part Two

    04:10

  • Risks

    01:36

  • Analysis of Relevant Risks

    01:48

  • Risk Analysis

    02:29

  • Semi -Quantitative Analysis

    01:52

  • Quantitative Analysis Example

    04:14

  • Evaluation of Risks

    00:46

  • Risk Treatment Options

    04:39

  • Impact

    02:59

  • Lesson Six: Controls Countermeasures

    00:25

  • Controls

    04:43

  • Residual Risk

    03:38

  • Information Resource Valuation

    01:33

  • Methods of Valuing Assets

    01:36

  • Information Asset Classification

    03:32

  • Determining Classification

    02:05

  • Impact Part One

    03:53

  • Impact Part Two

    01:03

  • Lesson Seven: Recovery Time Objectives

    00:49

  • Recovery Point Objectives

    04:18

  • Service Delivery Objectives

    01:58

  • Third-Party Service Providers

    01:44

  • Working with Lifecycle Processes

    02:08

  • IT System Development

    02:11

  • Project Management Part One

    00:46

  • Project Management Part Two

    02:10

  • Lesson Eight: Risk Monitoring and Communication

    01:17

  • Risk Monitoring and Communication

    00:38

  • Other Communications

    01:25

  • Section Review

    01:01

• Knowledge Check

  • Knowledge Check Two

• Domain 03: Information Security Program Development and Management

  04:07:00

  • Introduction

    00:30

  • Lesson One: Development of Information Security Program

    02:50

  • Importance of the Program

    00:52

  • Outcomes of Security Program Development

    01:47

  • Effective Information Security Program Development

    04:59

  • Lesson Two: Information Security Program Objectives

    01:55

  • Cross Organizational Responsibilities

    00:10

  • Program Objectives Part One

    02:23

  • Program Objectives Part Two

    01:18

  • Defining Objectives Part One

    02:11

  • Defining Objectives Part Two

    01:08

  • Lesson 3: Information Security Program Development Concepts Part One

    04:02

  • Information Security Program Development Concepts Part Two

    05:39

  • Technology Resources

    02:44

  • Information Security Manager

    01:25

  • Lesson Four: Scope and Charter of Information Security Program Development

    00:30

  • Assurance Function Integration

    01:35

  • Challenges in Developing Information Security Program

    01:54

  • Pitfalls

    02:48

  • Objectives of the Security Program

    02:06

  • Program Goals

    02:52

  • The Steps of the Security Program

    01:46

  • Defining the Roadmap Part One

    01:38

  • Defining the Roadmap Part Two

    00:58

  • Elements of the Roadmap Part One

    01:18

  • Elements of the Roadmap Part Two

    00:34

  • Elements of the Roadmap Part Three

    01:57

  • Elements of the Roadmap Part Four

    01:17

  • Elements of the Roadmap Part Five

    00:18

  • Gap Analysis

    00:44

  • Lesson Five: Information Security Management Framework

    00:15

  • Security Management Framework

    04:55

  • COBIT Five

    05:59

  • ISO/IEC 27001

    04:30

  • Lesson Six: Information Security Framework Components

    00:13

  • Operational Components Part One

    01:56

  • Operational Components Part Two

    03:11

  • Management Components

    01:31

  • Administrative Components

    03:29

  • Educational and Informational Components

    01:25

  • Lesson Seven: Information Security Program Resources

    01:32

  • Resources

    03:27

  • Documentation

    00:54

  • Enterprise Architecture Part One

    04:29

  • Enterprise Architecture Part Two

    01:54

  • Enterprise Architecture Part Three

    01:11

  • Controls as Strategy Implementation Resources Part One

    03:42

  • Controls as Strategy Implementation Resources Part Two

    02:19

  • Controls as Strategy Implementation Resources Part Three

    04:35

  • Controls as Strategy Implementation Resources Part Four

    02:19

  • Common Control Practices

    01:41

  • Countermeasures

    00:37

  • Technologies Part One

    01:13

  • Technologies Part Two

    01:52

  • Technologies Part Three

    01:39

  • Technologies Part Four

    05:38

  • Personnel Part One

    02:00

  • Personnel Part Two

    02:56

  • Security Awareness

    01:28

  • Awareness Topics

    05:18

  • Formal Audits

    01:16

  • Compliance Enforcement

    01:03

  • Project Risk Analysis

    03:09

  • Other Actions

    02:58

  • Other Organizational Support

    01:21

  • Program Budgeting Part One

    01:03

  • Program Budgeting Part Two

    02:19

  • Lesson Eight: Implementing an Information Security Program

    00:13

  • Policy Compliance

    02:38

  • Standards Compliance

    02:44

  • Training and Education

    01:43

  • ISACA Control Objectives

    03:52

  • Third-party Service Providers Part One

    01:08

  • Third-party Service Providers Part Two

    04:22

  • Integration into Lifecycle Processes

    02:14

  • Monitoring and Communication

    03:33

  • Documentation

    01:33

  • The Plan of Action Part One

    01:17

  • The Plan of Action Part Two

    01:36

  • Lesson Nine: Information Infrastructure and Architecture

    00:53

  • Managing Complexity Part One

    04:42

  • Managing Complexity Part Two

    01:45

  • Objectives of Information Security Architectures Part One

    01:30

  • Objectives of Information Security Architectures Part Two

    01:15

  • Physical and Environmental Controls

    03:32

  • Lesson Ten: Information Security Program

    03:03

  • Information Security Program Deployment Metrics

    02:27

  • Metrics

    02:02

  • Strategic Alignment

    00:53

  • Risk Management

    01:41

  • Value Delivery

    00:35

  • Resource Management

    01:22

  • Assurance Process Integration

    00:27

  • Performance Measurement

    00:41

  • Security Baselines

    00:38

  • Lesson Eleven: Security Program Services and Operational Activities

    00:48

  • IS Liaison Responsibilities Part One

    10:17

  • IS Liaison Responsibilities Part Two

    02:28

  • Cross-Organizational Responsibilities

    01:34

  • Security Reviews and Audits Part One

    03:27

  • Security Reviews and Audits Part Two

    01:38

  • Management of Security Technology

    01:25

  • Due Diligence Part One

    04:10

  • Due Diligence Part Two

    01:36

  • Compliance Monitoring and Enforcement Part One

    02:02

  • Compliance Monitoring and Enforcement Part Two

    01:46

  • Assessment of Risk and Impact Part One

    02:16

  • Assessment of Risk and Impact Part Two

    01:28

  • Outsourcing and Service Providers

    02:33

  • Cloud Computing Part One

    01:36

  • Cloud Computing Part Two

    01:54

  • Cloud Computing Part Three

    02:23

  • Integration with IT Processes

    00:42

  • Section Review

    01:13

• Knowledge Check

  • Knowledge Check Three

• Domain 04: Information Security Incident Management

  03:33:59

  • Lesson One: Incident Management Overview Part One

    00:47

  • Incident Management Overview Part Two

    03:08

  • Incident Management Overview Part Three

    03:45

  • Types of Events Part One

    02:43

  • Types of Events Part Two

    03:20

  • Goals of Incident Management Part One

    04:45

  • Goals of Incident Management Part Two

    06:31

  • Goals of Incident Management Part Three

    03:26

  • Lesson Two: Incident Response Procedures Part One

    00:23

  • Incident Response Procedures Part Two

    03:40

  • Importance of Incident Management

    01:53

  • Outcomes of Incident Management

    03:50

  • Incident Management

    01:34

  • Concepts Part One

    02:07

  • Concepts Part Two

    01:35

  • Concepts Part Three

    01:34

  • Incident Management Systems Part One

    04:02

  • Incident Management Systems Part Two

    00:53

  • Lesson Three: Incident Management Organization

    02:30

  • Responsibilities Part One

    03:01

  • Responsibilities Part Two

    02:58

  • Responsibilities Part Three

    05:10

  • Senior Management Commitment

    01:02

  • Lesson Four: Incident Management Resources

    00:25

  • Policies and Standards

    00:36

  • Incident Response Technology Concepts

    00:42

  • Personnel

    03:11

  • Roles and Responsibilities (eNotes)

    03:10

  • Skills

    08:09

  • Awareness and Education

    01:20

  • Audits

    02:49

  • Lesson Five: Incident Management Objectives

    00:17

  • Defining Objectives

    00:48

  • The Desired State

    02:36

  • Strategic Alignment

    06:42

  • Other Concerns

    02:32

  • Lesson Six: Incident Management Metrics and Indicators

    05:14

  • Implementation of the Security Program Management

    03:01

  • Management Metrics and Monitoring Part One

    00:21

  • Management Metrics and Monitoring Part Two

    02:48

  • Other Security Monitoring Efforts

    04:24

  • Lesson Seven: Current State of Incident Response Capability

    00:11

  • Threats

    04:39

  • Vulnerabilities

    04:09

  • Lesson Eight: Developing an Incident Response Plan

    00:44

  • Elements of an Incident Response Plan

    00:53

  • Gap Analysis

    03:05

  • BIA Part One

    03:04

  • BIA Part Two

    02:48

  • Escalation Process for Effective IM

    02:41

  • Help Desk Processes for Identifying Security Incidents

    01:27

  • Incident Management and Response Teams

    01:30

  • Organizing, Training, and Equipping the Response Staff

    01:55

  • Incident Notification Process

    00:55

  • Challenges in making an Incident Management Plan

    00:56

  • Lesson Nine: BCP/DRP

    07:49

  • Goals of Recovery Operations Part One

    02:02

  • Goals of Recovery Operations Part Two

    01:57

  • Choosing a Site Selection Part One

    05:37

  • Choosing a Site Selection Part Two

    00:45

  • Implementing the Strategy

    03:58

  • Incident Management Response Teams

    02:10

  • Network Service High-availability

    04:17

  • Storage High-availability

    04:01

  • Risk Transference

    01:27

  • Other Response Recovery Plan Options

    01:29

  • Lesson Ten: Testing Response and Recovery Plans

    00:18

  • Periodic Testing

    01:17

  • Analyzing Test Results Part One

    02:06

  • Analyzing Test Results Part Two

    03:39

  • Measuring the Test Results

    00:57

  • Lesson Eleven: Executing the Plan

    01:56

  • Updating the Plan

    01:15

  • Intrusion Detection Policies

    01:38

  • Who to Notify about an Incident

    01:52

  • Recovery Operations

    01:53

  • Other Recovery Operations

    01:57

  • Forensic Investigation

    02:02

  • Hacker / Penetration Methodology

    11:50

  • Section Review

    01:15

  • Sequence Five

    01:53

• Knowledge Check

  • Knowledge Check Four