BCS Foundation Certificate in Information Security Management Principles - Virtual Classroom

Course Description

The BCS Foundation Certificate in Information Security Management Principles offers an extensive exploration of various methods, ideas, and methodologies. It equips participants with a solid comprehension of information security management concerns, encompassing areas such as risk management, adherence to security standards, legal requirements, and ensuring business continuity.

Modules Covered

Foundation Certificate in Information Security Management Principles Syllabus

Learning Outcomes

Participants will showcase their comprehension of Information Security Management Principles across these domains:

• Familiarity with fundamental concepts in information security management, including confidentiality, integrity, availability, vulnerability, threats, risks, and countermeasures.
• Grasp of current legislation and regulations pertinent to information security management.
• Understanding of current national and international standards, frameworks, and organisations that facilitate information security management.
• Awareness of the operational contexts in which information security management operates.
• Understanding of the classification, implementation, and efficacy of various types and features of controls.

Information Security Management Principles (10%)

• Recognise the definitions, interpretations, and applications of concepts and terminology within information security management, including:
• Information security
• Types of assets and asset categorisation
• Determining asset value and conducting asset valuation
• Understanding threats, vulnerabilities, impacts, and risks

Information Risk (10%)

• Risk arises from the presence of threats and vulnerabilities.
• Threats and vulnerabilities are particularly relevant within IT systems.
• Controls come in operational forms: physical, procedural (human), and technical.
• Understanding the purpose of impact and various methodologies to address it.
• Recognising and assessing the value of information assets.

Information Security Framework (15%)

• Illustrate the implementation of risk management within an organisation.
• Describe the management of information security within the organisation.
• Discuss the roles related to information security within the enterprise.

Security Lifecycle (10%)

• Show comprehension of the significance and applicability of the information lifecycle.
• Explore the utilisation of architecture frameworks such as SABSA and TOGAF.
• Examine Agile development methodologies, including DevOps and DevSecOps, and potential conflicts with security.
• Discuss the concept of information sharing by design.
• Address the importance of service continuity and reliability.

Procedural/People Security Controls (15%)

• Elaborate on the risks associated with information security concerning individuals.
• Discuss the organisational culture promoting security.
• Highlight the importance of security awareness among employees, contractors, and business partners.
• Address security clearance and vetting processes.
• Discuss the role of employment contracts in ensuring security measures.

Technical Security Controls (25%)

• Provide an overview of technical measures aimed at safeguarding against Malicious Software.
• Discuss various types of malicious software, including Trojans, botnets, viruses, worms, and active threats.
• Examine diverse infection vectors for systems, such as phishing, spear-phishing, click-bait, and third-party content.
• Explore methods of control for mitigating malware threats.
• Discuss security principles like security by design, security by default, and configuration management.
• Address network entry points and associated authentication methods.
• Analyse the role of cryptography in enhancing network security.
• Discuss strategies for regulating third-party access to systems and networks.

Physical and Environmental Security Controls (5%)

• Provide an overview of the physical security components within a multi-layered approach.
• Discuss general measures for monitoring and controlling access to physical locations, including sites, offices, secure areas, cabinets, and rooms.
• Address the protection of both IT and non-IT equipment.
• Discuss the necessity of protocols to manage intruder alerts and respond to deliberate or accidental physical incidents.
• Explain the importance of implementing a clear screen and desk policy.
• Describe procedures for disposing of equipment containing digital data retention facilities.

Disaster Recovery and Business Continuity Management (5%)

• Connection with risk assessment and impact analysis
• System and infrastructure resilience
• Strategies for drafting and executing plans
• Requirement for documentation, upkeep, and testing of plans
• Connection with security incident management
• Adherence to standards

Other Technical Aspects (5%)

• Typical procedures, tools, and methods for conducting inquiries, encompassing intelligence-sharing platforms
• Legal and regulatory directives regarding disclosures, investigations, forensic preparedness, and evidence conservation
• Importance of interactions with law enforcement, including specialised computer crime units and security counsel
• Considerations when outsourcing forensics and investigative assistance from third parties
• Explaining the role of cryptography in safeguarding systems and assets
• Fundamental principles, techniques, and types of cryptographic algorithms

Information Security Management Principles Exam Details 

Exam format - Multiple-choice.

Number of questions - 100.

Duration - 120-mins.

Supervised - Yes.

Open book - No.

Pass mark – 65/100 (65%).

Accreditation

 This course is nationally accredited by BCS - The Chartered Institute for IT.

Benefits

• Join a community of over 615,000
• Experience Level: Beginner
• Exam Pass Guarantee*
• 1-year BCS membership included

Eligibility

This certification training offers a comprehensive knowledge base, enabling advancement into higher-level positions.

Ideal for:

• Individuals interested in information security, whether for general understanding or skill enhancement.
• Those seeking career transitions.
• For professionals already engaged in this field, the BCS Foundation Certificate serves to refresh and enhance existing knowledge, while also bestowing a globally recognised qualification that enhances prospects for future career growth.