End-User Awareness

End-User Awareness Training

Employees must recognise that the corporate data on their computers is both valuable and vulnerable. They must understand their legal responsibilities regarding the unauthorised release of sensitive data. Note that sensitive data means data that requires protection due to the risk and magnitude of loss or harm that could result from its unavailability, disclosure, alteration, or destruction. The means of ensuring employee understanding and/or recognition of their responsibilities varies. User/employee security awareness training is one of the most common means available to achieve recognition of responsibility and computing asset worth.

The Security Awareness Program is designed for the everyday user of computers and networks. The program is in easy to understand language without all the techno jargon. Suitable for end users such as executives, admin staff, clerks, sales teams etc.

Duration: 4 hrs

Prerequisite: Working knowledge of computers and internet.

Program Overview

• Basics of Information Security
• Importance of Information Security policies
• Viruses, Worms and Trojan Horses
• Proper use of electronic resources
• Managing information
• Secure usage of email and internet
• Implications of wireless security
• Security resources and information
• Understanding and implementing proper passwords
• Proper response to security threats
• Summary
• Q & A Session

Management Awareness Training

Management Awareness Training

Management has the ultimate responsibility for implementing a data security program based on an assessment of business risk (corporate cost/benefit tradeoff) and an information system (IS) security risk assessment. All levels of management must be involved (and held accountable) to ensure the program is understood and properly implemented. Management must understand that they are legally responsible for the integrity of corporate data assets just as they are with other assets of the corporation.

The Security Awareness Program is designed for management personnel such as CSOs, CEOs, CTOs, COOs, VPs and other managerial positions. These special Information Security Awareness classes for management personnel will inform management of:

• Overall objectives of Information Security
• Information Security policies, standards and guidelines
• Legal and regulatory requirements for Information Security
• Information Security issues and controls

Duration: 4 hrs

Prerequisite: Working knowledge of computers and internet.

Program Overview

• Importance of Information Security
• Process of Information Security implementation
• Impact of security related threats and vulnerabilities
• Terminologies related to Information Security
• Role played by the Management
• Managing information
• Best practices and standards
• Secure usage of email and internet
• Wireless security risks
• Security resources and information
• Need for proper response to security threats
• Summary
• Q & A Session

Technical Staff Awareness

Technical Staff Awareness Training

IS vulnerabilities in general, relate to the weak points of the tangible computing assets in the corporation, and how exposed these assets might be to exploitation. These vulnerabilities can vary greatly depending on the network or stand-alone environment used by the corporation. Obviously, the weakest link in the security chain is also the most vulnerable point. Since the three basic goals of computer security are ensuring secrecy, integrity, and availability of data, vulnerabilities of a computer oriented business can include just about everything related to the business operation. Typical assets are hardware, software, data files, support documentation, people, and outside communication. The in house technical staff is responsible for maintaining the networks and other computing resources in a secure manner.

The Security Awareness Program is designed for technical staff such as Network professionals, Network and IT Managers.

Duration: 8 hrs

Prerequisite: Good understanding of computers and networking aspects, any kind of certification in basic networking and computers will be added advantage

Program Overview

• Importance of Information Security
• Process of Information Security implementation
• Terminologies related to Information Security
• Understanding threats and vulnerabilities
• Understanding and implementing IS policies
• Understanding firewall design and functionality
• Overview of Operating System security
• Wireless security vulnerabilities
• Overview of database and web server security
• Overview of PKI architectures
• Understanding response to IS incidents
• Summary
• Q & A Session

CNSA

Certified Network Security Administrator

Many business enterprises may not be able to afford the luxury of separate network and security administrators for their networks. More often than not, the network administrator is also looking after the enterprise network security. Are the network administrators qualified and competent to look after the security of their networks?

NSS has addressed this problem by giving you the Certified Network Security Administrator (CNSA) Course. This course is tailor made to address the above mentioned requirements.

Content

1. Basic Networking and TCP/IP Refresher
2. Internet Vulnerability Hacking Exploits
3. Designing and Configuring IDS
4. Securing Windows
5. Information Security Management System
6. Designing and Configuring Firewalls
7. Configuring Secure VPN
8. Securing UNIX and Linux

Course Objective: The urgent need to enhance the System / Network administrators knowledge base that of Information Security officer. This authoritative, state-of-the-art course is designed to meet the needs of both IT and Business Managers and will provide an outstanding opportunity to assess the true degree of your exposure to your organizations information, and will explain the steps required to secure your organisation's information and networks.

Target Audience: This authoritative, state-of-the-art course is designed to meet the needs of both IT and Business Managers and will provide an outstanding opportunity to assess the true degree of your exposure to your organizations information, and will explain the steps required to secure your organisation's information and networks.

Prerequisites: Graduates in any discipline with basic networking knowledge and background. MCSE, CCNA, or equivalent certifications will be an advantage.

Duration: 96 Hrs

Course Certificate: A Certificate of Achievement will be awarded to the participants by NSS.

If you wish to find out more you can check our calendar for upcoming events or contact us directly.

CPTP

Certified Penetration Testing Professional

The words like Hackers, Penetration Testing have started grabbing attention in the IT World. What is Hacking? In simple terms, Hacking is nothing but stealing information, gaining illegal access. The IT world is aware that the hackers and crackers have already crossed the barriers. Irrespective of the organization size, it is imperative to secure the network of the organization. Internet is widely used in today's era. The ratio of organizations been attacked is tremendously increasing. There is a tremendous growth in Virus, Worms and Backdoor attacks taking place. The worst part is that there are many automated tools readily available in the market today. Identifying and exploiting a system in a network with these tools is a job of few mouse clicks. So securing the network from attacks to the greatest possible extent is the need of the day. Learning the hackers' perspective so as to countermeasure the attacks is very vital.

NSS has designed CPTP to educate the employees of your organization to counter these attacks. This course not only imparts theoretical knowledge but also gives detailed hands on experience to the student. This experience is unmatched and invaluable in terms of the knowledge gain, which later on translates to securing the network.

Content

1. An Introduction to Penetration Testing
2. Penetration Testing Techniques I
3. Penetration Testing Techniques II
4. Attacking Networks Routers, Firewall and IDS
5. Malaria & Trojans
6. Attacking Windows
7. Attacking Linux
8. Attacking Database
9. Attacking Web Applications
10. Attacking Wireless Networks
11. CPTP Summary

Course Objectives: This particular course is going to benefit the network administrator, security officers, and other individuals who are concerned about the security and keen to learn the methodologies and techniques of hacking. It will also add to the skills of the individual as how to find the vulnerabilities in the system using the similar technique as that of a hacker but with a difference in intention and motive.

Target Audience: This authoritative, state-of-the-art course is designed to meet the needs of IT Professionals and Network Security Administrators and will provide an outstanding opportunity in securing your organization network from various attacks, and will make you able to learn all the techniques followed by an attacker to perform an attack. This course is designed for professionals willing to seek a carrier in the field of Information Security.

Prerequisites: Security Professionals with sound knowledge of networking and operating systems or professionals with certifications like CNSA, MCSE, SCNP, Security +, CISSP and all those having equivalent knowledge and experience in the filed of Networking.

Duration: 40 hrs

Course Certificate: A Certificate of Achievement will be awarded to the participants by NSS.

If you wish to find out more you can check our calendar for upcoming events or contact us directly.

Integrated Security Training

Integrated Security Training

If you think that the answer to securing your networks is a decent firewall and trustworthy anti-virus software, you are making a fatal mistake. Like a gun, those tools are only as effective as the hands that use them. When it comes to securing an enterprise's information assets, you cannot afford to put that responsibility in the hands of just anyone. You need someone you can trust, someone with the proven skills and a broad understanding of ALL the dangers that can cause catastrophic damage to your company. Just ask the millions of companies crippled by Nimda, Code Red and other viruses. Of the companies who have lost billions in revenues and assets because of hackers, or because of a breakdown of security policy, ask them what they should have done to avoid the disaster. They will all provide the same answer: Be a qualified, Certified Security Professional.

The Ten Domains of Security

• Access Control Systems & Methodology: This domain requires that the candidate understand the concepts, systems and methodologies involved in granting and restricting access to resources.
• Applications & Systems Development: This domain requires that the candidate understand the security controls found in systems and application software, such as the effects of malicious code on distributed application environments and the security controls involved in data warehousing.
• Business Continuity & Disaster Recovery Planning: It involves the preparation, planning and updating of specific actions to protect mission critical services and data.
• Cryptography & PKI: This domain addresses the concepts, means, and methods of encrypting data to ensure authenticity, integrity, and confidentiality.
• Compliance, Law, Investigation & Ethics: This domain addresses computer crime laws, methods for gathering evidence, and related ethical issues.
• Operations Security (Computer): This domain identifies the controls over hardware, media, and the operators of these resources, and issues related to auditing and monitoring.
• Physical Security: This domain involves the threats, vulnerabilities, and countermeasures utilized to physically protect enterprises' resources.
• Security Architecture & Models: This domain involves the design, concepts, standards, and implementation security measures that ensure the availability, integrity, and confidentiality of operating systems, applications, and equipment.
• Security Management: Involves the identification of a company's information assets, and the development, documentation and implementation of security policies.
• Telecommunications & Network Security: This domain involves designing and planning voice and data infrastructure and communications with a security strategy that includes preventative, detective, and corrective measures.

For further information, please contact us, and check our Events for the next session.

ISO 27001 ISMS Implementation Course

ISO 27001 Information Security Management System Implementation Course

Recent high profile information security breaches and the value of information are highlighting the ever-increasing need for organisations to protect their information. An Information Security Management System (ISMS) is a controlled approach to managing sensitive company information so that it remains secure. It encompasses people, processes, and Information Management Security Systems.

The objective of this course is to provide delegates with the necessary skills to implement ISMS that is compliant with the requirements of ISO 17799 and meets the certification requirements of ISO 27001: 2005. The course will provide delegates with a framework for implementation.

Who should attend?

• Staff tasked with the implementation and management of ISO 27001: 2005 Information security management system.
• Information security consultants
• The course is designed for people who have a good understanding of ISO 27001: 2005 and ISO 17799: 2005 Information security management systems, (attendance of Introduction to Information Security or the ISO 27001: 2005 lead auditor course is recommended).

Benefits to Your Business

Both the objective and result of the course will be the construction of effective ISMS under the expert tutelage and guidance of a BSI tutor. Take the knowledge and skills imparted during this exercise and use them to improve and protect your business.

Course Structure

• Background to Information Security
• Determination of scope and Information Security policy
• Identification of information assets
• Determination of the value of information assets
• Determination of risk and impacts
• Identification of control objective and controls
• Definition and implementation of polices.
• Production and implementation of policies, standards and procedures
• Completion of ISMS documentation requirements
• Awareness training.
• Certification process.
• Production of ISMS Project Implementation Plan.

For details of the next course, you can check our calendar or contact us.

ISO 27001 Lead Auditor

ISO 27001 Lead Auditor Training Course

BSI 27001:2005 (BS 7799) Information Security Management System Lead Auditor teaches students the fundamentals of auditing information security management systems to ISO 27001:2005 (BS 7799-2:2002).

This five-day intensive course trains students on how to conduct audits for certification bodies and facilitate the ISO 7001:2005 registration process. The auditing exercises and lectures are based on ISO 19011:2002, Guidelines for Quality and/or Environmental Management Systems Auditing. The course is designed specifically for those people who wish to conduct external assessments or internal audits to ISO 27001:2005, although students will also gain the knowledge and understanding necessary to give practical help and information to other individuals and organizations working toward conformance to the standard. This course is registered by the governing board of the IQA - International Register of Certified Auditors (IRCA) and meets part of the training requirements of those seeking registration as a lead auditor under that scheme.

It also meets the training requirements for IATCA auditor certification.

Learning Objectives

• Review the Requirements of ISO 27001:2005
• Understand the Relationship between ISO 27001:2005 and ISO/IEC 17799:2005
• Learn How to Assess Security Threats and Vulnerabilities
• Understand Security Controls and Countermeasures
• Understand the Roles and Responsibilities of the Auditor
• Learn How to Plan, Execute, Report, and Follow-up on an Information Security Management System Audit

Course Materials

Students receive comprehensive course manuals with reference materials, including:

• Copy of ISO 27001:2005
• Copy of ISO/IEC 17799:2005

Who Should Attend

• IT Security Officers
• IT Managers
• Auditors interested in 27001:2005 or ISO/IEC 17799:2005
• Information Security Consultants

For details of the next course, you can check our calendar or contact us.

ISMS Concepts

Information Security Management System Concepts course teaches delegates the fundamentals of auditing/implementing information security management systems to ISO 27001:2005 (BS 7799-2:2002) standard. This 3-day intensive course provides insight on Implementation and Audit methodology for the ISO 27001:2005 certification for an organization. It forms the foundation for delegates to take the internationally recognized courses and certifications to become ISO 27001 Lead Auditors or Lead Implementers – the first step in the increasingly important Information Security Management profession.

What will you learn?

• The component parts of the Standard
• How to manage information security?
• How the individual components of the process fit together?
• How to treat implementation as a project?
• Common pitfalls
• How to define and risk assess “information assets”?
• How to manage risks in a way suitable to your organization?
• The essential requirements for obtaining auditor approval, i.e. certification

Course Outline

THE 27001 STANDARD

• Why do you need certification to ISO 27001?
• What the Information Security Management System (ISMS) is and what it is trying to achieve

CONFIDENTIALITY, INTEGRITY, AVAILABILITY AND AUDIT

• Overview of the stages of the ISMS
• Defining an Information Security Policy
• Defining the scope of the ISMS

IDENTIFYING INFORMATION ASSETS

• What are information assets?
• Creating an asset classification system

UNDERTAKING A RISK ASSESSMENT

• Identifying asset values, threats and vulnerabilities
• Creating a usable and simple risk methodology
• Using risk tools
• Practical exercise – undertaking a risk assessment
• Results and conclusions resulting from an assessment

MANAGING RISK

• Risk measurement
• Risk reduction and acceptance techniques
• Practical exercise - determining control objectives
• Selecting control objectives and controls
• Security in depth
• ISO 27001 control objectives and controls
• The application of countermeasures
• Practical exercise – creating a workable countermeasure
• Additional controls not in ISO 27001
• Preparing a Statement of Applicability
• The need to review and audit the ISMS

AUDITING

• What does auditing achieve?
• How should auditing be conducted?
• Different types of audit
• The phase 1 and 2 ISO 27001 audits

Register online now or Contact Us for more information. Click here to download flyer.