Information, Risk, Security and Crisis Management

Course Contents, Concepts and Issues:

Understanding Risk and Risk Management¨

• Defining risk
• Contextualising Risk
• Formulating Risks Statements
• Risk Examples
• Non-Risk Examples
• Proposal Risk
• Performance Risk
• Management’s perception and calculation of risk
• Risk probability and improbability
• The traditional ‘number line’ and traditional risk management calculation
• Risk-Improbability Scale Or Continuum’
• Understanding risk in organisations
• Analyzing and identifying risk in organisations
• Developing strategies and approaches to treat and manage risk
• What is Risk Management?
• Continuous Risk Management Example
• Non-Continuous Risk Management Example
• Evaluating likely risks and consequences
• Assessing the options for accommodating risks
• Prioritising risk management efforts
• Developing risk management plans
• Authorising the implementation of risk management plans
• The context of risk management in organisations
• The link between Risk Management and Governance arrangements
• Risk Management Standards
• The differing levels of risk within an organisation, business risk, project risk and process risk
• ¨Developing criteria for determining acceptable levels or residual risk

Crisis Management: Security and Natural Disaster Recovery

• Contingency Planning
• Continuity Management and Disaster Recovery
• Recovery Planning
• Recovery Planning and Logistics
• Business Continuity Management
• Introduction to BS 25999: Business Continuity Management
• Business Recovery Management

Information Security Management ¨

• Defining Information Security Management System

• Types of Information Security
• Physical Controls
• Purpose of Information Security
• Threats to Confidentiality
• Confidentiality
• Personnel security
• Risk Management in Organisation; A Systems Perspective
• The Self-hack Audit
• Information Security Policy –
• Organisational Information as assets and resources
• The role of the Information Security Management System (ISMS) auditor
• The Auditor’s plan
• The Auditor’s report
• Asset classification and control
• Personnel security
• Physical and environmental security
• Communications and operations management
• Access control
• Systems development and maintenance
• Business continuity management
• Information security compliance
• Information security – confidentiality
• Understanding an organisation’s information as assets and resources
• Asset classification and control

BS 7799-2:2002 Specification for Information Security

• The BS7799 / BS7799 Security Standard
• Explaining BS 7799-2:2002
• Requirements of BS 7799 – 2:2002 and EA 7-03 in the context of Information Security Management Systems Audit
• The auditor and ISO
• Complying With BS7799 (ISO 17799)
• The traditional risk
• BS 7799 in Europe, Middle East and Africa

Introduction to BS 7799 services
ISO/IEC 17799 Code of practice for Information Security Management

• Formulating an information security policy
• Telecommunication Security: A Self-Hack Audit
• Objectives Of The Self-Hack Audit

Information Risk Management Issues:

• Distinction Between Data And Information
• Primary And Secondary Data
• Primary And Secondary Sources Of Information
• Secondary Sources Of Information
• Primary Sources Of Information Or Data

Sampling And Its Importance in Information Security Management

• Types Of Sampling
• Convenience Or Non-Random Samples
• Probability Or Random Samples
• Simple Random Samples
• Stratified Sampling
• Multi-Stage Sampling

Information system and organisational effectiveness

• Information Systems: Definition
• Need for constant review of information system
• Characteristics of an effective information system

Information as Intellectual Capital – Industrial Espionage and Industrial Sabotage

• Organisational information and security
• Protecting an organisation’s intellectual capital
• Investigating and averting Industrial Espionage
• Detecting, dealing with and averting industrial sabotage

Information and National Security

• Information as ‘Secret’
• Information Moratorium
• In formation and confidentiality
• Information as a control mechanism
• The information Act and its implications for internal security
• Data Protection Act 1998: Whose data?
• Freedom of information Act: National Security Pro