A Major Revision of the CISRCP Program

The International Association of Risk and Compliance Professionals (IARCP) today announced a major

  1. GoogleNewsSubmit
    The International Association of Risk and Compliance Professionals (IARCP) today announced a major
    Transcript Header:
    A Major Revision of the CISRCP Program
    Transcript Body:
    • 1. wireservice.co http://www.wireservice.co/2015/05/a-major-revision-of-the-cisrcp-program/ A Major Revision of the CISRCP Program WASHINGTON, DC / May 22, 2015 / The International Association of Risk and Compliance Professionals (IARCP) today announced a major revision of the Certified Information Systems Risk and Compliance Professional (CISRCP) certification program. “The CISRCP update is designed to keep pace with evolving job roles and new requirements for risk and compliance management after the financial crisis and the increasing shortage of cyber security, IT security and information security experts,” said George Lekatis, president of the IARCP. George continued: “According to President Obama, economic prosperity, national security, and individual liberties depend on our commitment to securing cyberspace and maintaining an open, interoperable, secure, and reliable Internet. Critical infrastructure continues to be at risk from threats in cyberspace, economies are harmed by the theft of intellectual property and organizations face challenges to protect their infrastructure. Janet Napolitano, the head of Homeland Security has also said that we need people who are experienced in intelligence as it relates to the cyber- universe.” The revised CISRCP program covers international standards, principles and best practices in IT risk management and IT security, including the critical infrastructure protection principles in the USA and the EU, the Executive Order 13587, the Executive Order 13636, the Presidential Policy Directive (PPD) 21 – Critical Infrastructure Security and Resilience, the NIST Cybersecurity Framework, the Cybersecurity Strategy of the European Union, the Directive 2008/114/EC on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection and much more. Objectives: The seminar has been designed to provide with the knowledge and skills needed to understand international standards and best practices in IT risk management and information security. Also, to provide with the knowledge and skills needed to pass the CISRCP exam and become a Certified Information Systems Risk and Compliance Professional (CISRCP). Target Audience: The CISRCP certification program is beneficial to: – IT managers, employees, auditors and consultants – Information security managers, employees, auditors and consultants – Risk and compliance managers, employees, auditors and consultants – Network, systems and security administrators – Incident handlers and incident response professionals – Threat analysts – Vulnerability assessment personnel – IT and information security operations engineers and analysts – IT and information security vendors, suppliers and service providers This course is intended for employers demanding qualified IT and Information Security professionals that meet the fit and proper requirements in risk and compliance management.
    • 2. Course Synopsis: Part 1 – Information Technology and Information Security Information Technology: The engine that drives the economy Information security risk Managing information security risk The dark side of the threat landscape Types of threat information: Strategic (S), Tactical (T), Operational (O) Threat intelligence is becoming more important Malware (worms/trojans and Potentially Unwanted Programs – PUPs) Web-based attacks Web application attacks / Injection attacks Botnets Denial of Service Spam Phishing Exploit Kits Data Breaches Insider threat Information leakage Identity theft/fraud Cyber espionage Ransomware, Rogueware, Scareware Strategic web compromise (watering hole attack) Cyber-opportunity makes the thief Overview of Threat Agents Cybercriminals Online Social Hackers Hacktivists Nation States Corporations Employees (current, ex, internal and external) Cyber Fighters Cyber Terrorists Script Kiddies Emerging Threat Landscape (ETL) Explaining Information Security to employees and end users Information Security Awareness Part 2 – Critical infrastructure protection: International standards, principles and best practices In the USA Introduction Executive Order 13587 – Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information Executive Order 13636 – Improving Critical Infrastructure Cybersecurity Presidential Policy Directive (PPD) 21 – Critical Infrastructure Security and Resilience NIST Cybersecurity Framework
    • 3. In the European Union EU Cybersecurity plan to protect open internet and online freedom and opportunity European Cybercrime Centre (EC3) Cybersecurity Strategy of the European Union 1. Achieving cyber resilience 2. Drastically reducing cybercrime 3. Developing cyberdefence policy and capabilities related to the Common Security and Defense Policy (CSDP) 4. Develop the industrial and technological resources for cybersecurity 5. Establish a coherent international cyberspace policy for the European Union and promote core EU values Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection Part 3 – Risk Management and Compliance Introduction Regulatory Compliance and Risk Management Definitions, roles and responsibilities The role of the board of directors, the supervisors, the internal and external auditors The new international landscape and the interaction among laws, regulations and standards The difference between a best practice and a regulatory obligation Basel Committee, corporate governance principles for banks (2014) Financial Stability Board, Thematic Review on Risk Governance OECD Principles of Corporate Governance Benefits of an enterprise wide compliance program Compliance culture: Why it is important, and how to communicate the obligations Policies, Workplace Ethics, Risk and Compliance Policies, procedures and the ethical code of conduct Privacy and information security Handling confidential information Conflicts of interest Use of organizational property Fair dealings with customers, vendors and competitors Reporting ethical concerns The definition of Governance, Risk and Compliance The need for Internal Controls Understand how to identify, mitigate and control risks effectively Approaches to risk assessment Qualitative, quantitative approach Integrating risk management into corporate governance and compliance IT, Information Security, business risk and compliance Case Study: IW-130, Security Measures of Information Warfare Australia/New Zealand Standard 4360 Risk Management Guide for Information Technology Systems, NIST Special Publication 800-30 Threats and Vulnerabilities Outsourcing and Risk Management Part 4 – The Frameworks: COSO, COSO ERM, COBIT Internal Controls – COSO, The Internal Control Integrated Framework by the COSO committee Using the COSO framework effectively The Control Environment
    • 4. Risk Assessment Control Activities Information and Communication Monitoring Effectiveness and Efficiency of Operations Reliability of Financial Reporting Compliance with applicable laws and regulations IT Controls Program Change Deterrent, Preventive, Detective, Corrective Controls Recovery, Compensating, Monitoring and Disclosure Controls Layers of overlapping controls COSO Enterprise Risk Management (ERM) Framework Is COSO ERM necessary for compliance? COSO and COSO ERM Internal Environment Objective Setting Event Identification Risk Assessment Risk Response Control Activities Information and Communication Monitoring The two cubes Objectives: Strategic, Operations, Reporting, Compliance ERM – Application Techniques Core team preparedness Implementation plan Likelihood Risk Ranking Impact Risk Ranking COSO 2013 Internal Control Integrated Framework What is different now? Components and Principles Significant changes to the original framework COBIT – the framework that focuses on IT Is COBIT needed for compliance? COSO or COBIT? Corporate governance, financial reporting COBIT, Executive Summary Management Guidelines The Framework The 34 high-level control objectives What to do with the 318 specific control objectives COBIT Cube Maturity Models Critical Success Factors (CSFs) Key Goal Indicators (KGIs) Key Performance Indicators (KPIs) How to use COBIT for compliance
    • 5. The alignment of frameworks COSO and COBIT COSO ERM and COBIT ITIL and COBIT ISO/IEC 17799:2000 and COBIT ISO/IEC 15408 and COBIT Software and Spreadsheets Is software necessary for risk and compliance? Is software needed? When and why How large is your organization? Is it geographically dispersed? How many processes will you document? Are there enough persons for that? Selection process Spreadsheets Certain spreadsheets must be considered applications Development Lifecycle Controls Access Control (Create, Read, Update, Delete) Integrity Controls Change Control Version Control Documentation Controls Continuity Controls Segregation of Duties Controls Spreadsheets – Errors Spreadsheets and material weaknesses Third-party service providers and vendors| Redefining outsourcing Key risks of outsourcing What is needed from vendors and service providers SAS 70 Type I, II reports Advantages of SAS 70 Type II Disadvantages of SAS 70 Type II Part 5 – NIST Special Publication 800-39 Components of risk management Multitiered risk management Tier 1 – Organization view Tier 2 – Mission / business process view Tier 3 – Information systems view Trust and Trustworthiness Organizational Culture Relationship among key risk concepts Framing risk Assessing risk Responding to risk Monitoring risk Glossary
    • 6. Governance models Trust models Part 6 – Assessing security and privacy controls Security and Privacy Control Assessment Assessments within the System Development Life Cycle Strategy for conducting control assessments Building an effective assurance case Assessment procedures Conducting effective security and privacy control assessments Preparing for security and privacy control assessments Developing security and privacy assessment plans Determine which security or privacy controls are to be assessed Tailor assessment procedures Assessment method and object-related considerations Depth and coverage-related considerations Common control-related considerations Reuse of assessment evidence-related considerations Changing conditions associated with security controls and privacy controls Amount of time that has transpired since previous assessments Degree of independence of previous assessments External information system-related considerations Optimize selected assessment procedures for maximum efficiency Finalize assessment plan and obtain approval to execute plan Analysing assessment report results Part 7 – CERTs (Computer Emergency Response Teams) and Security Incident Response Introduction Incident Handling Process Incident report Registration Triage Incident verification Incident initial classification Incident assignment Incident resolution Data analysis Resolution research Actions proposed Action performed Eradication and recovery Incident closure Final classification Archiving Post-analysis Processing actionable information Collection Sources of information: internal vs. external Level of automation
    • 7. Recurrence Consumption model Granularity Evaluation of data sources Collection Preparation Parsing Normalization Aggregation Enrichment Automation Storage Retention time Scale Dataset management Technologies Triage and results Metrics Distribution Part 8 – The Sarbanes Oxley Act: New international standards The Need The Sarbanes-Oxley Act of 2002: Key Sections SEC, EDGAR, PCAOB, SAG The Act and its interpretation by SEC and PCAOB PCAOB Auditing Standards: What we need to know Management’s Testing Management’s Documentation Reports used to Validate SOX Compliant IT Infrastructure Documentation Issues Sections 302, 404, 906: The three certifications Sections 302, 404, 906: Examples and case studies Management’s Responsibilities Committees and Teams Project Team Steering Committee Disclosure Committee Certifying Officers Audit Committee Report to the Board of Directors Control Deficiency Deficiency in Design Deficiency in Operation Significant Deficiency Material Weakness Is it a Deficiency, or a Material Weakness? Reporting Weaknesses and Deficiencies Examples Case Studies Public Disclosure Requirements
    • 8. Real Time Disclosures on a rapid and current basis? Whistleblower protection Rulemaking process Companies Affected International companies Foreign Private Issuers (FPIs) American Depository Receipts (ADRs) Employees Affected Effective Dates IT and Information Security Control Objectives and Control Framework Part 9 and 10 – Basel II and the Basel III amendment Realigning the regulation with the economic realities of the global banking markets New capital adequacy framework replaces the 1988 Accord Improving risk and asset management to avoid financial disasters “Sufficient assets” to offset risks The technical challenges for both banks and supervisors How much capital is necessary to serve as a sufficient buffer? The three-pillar regulatory structure Purposes of Basel Pillar 1: Minimum capital requirements Credit Risk – 3 approaches The standardized approach to credit risk Claims on sovereigns Claims on banks Claims on corporates The internal ratings-based (IRB) approaches to credit risk Some definitions: PD – The probability of default, LGD – The loss given default, EAD – Exposure at default, 5 classes of assets Pillar 2: Supervisory review Key principles Aspects and issues of the supervisory review process Pillar 3: Market discipline Disclosure requirements Qualitative and Quantitative disclosures Guiding principles Employees Affected Effective Dates Operational Risk Legal risk Information Technology operational risk Operational, operations and operating risk The evolving importance of operational risk Quantification of operational risk Loss categories and business lines Operational risk measurement methodologies Identification of operational risk
    • 9. Operational Risk Approaches Basic Indicator Approach (BIA) Standardized Approach (SA) Alternative Standardized Approach (ASA) Advanced Measurement Approaches (AMA) Internal Measurement Approach (IMA) Loss Distribution (LD) Standard Normal Distribution “Fat Tails” in the normal distribution Expected loss (EL), Unexpected Loss (UL) Value-at Risk (VaR) Calculating Value-at Risk Stress Testing Stress testing and Basel (AMA) Advantages / Disadvantages Operational Risk Measurement Issues The game theory The prisoner’s dilemma – and the connection with operational risk management Operational risk management Operational Risk Management Office Key functions of Operational Risk Management Office Key functions of Operational Risk Managers Key functions of Department Heads Internal and external audit Operational risk sound practices Operational risk mitigation Insurance to mitigate operational risk IT and Information Security in the Basel framework and projects Basel II and other regulations Capital Requirements Directive (CRD) Aligning Basel II operational risk and Sarbanes-Oxley 404 projects Common elements and differences of compliance projects New standards Disclosure issues Multinational companies and compliance challenges Basel III: The New Risk Management and Corporate Governance Standards Introduction to the Basel III Amendments Sound corporate governance principles Financial Stress Testing Use of stress testing and integration in risk governance Part 11 – Designing and implementing an enterprise wide Risk and Compliance Program Designing an internal compliance system Compliance programs that withstand scrutiny How to optimize organizational structure for compliance Documentation Testing Training Ongoing compliance with laws and regulations Compliance Monitoring
    • 10. The company and other stakeholders Managing change in regulations International and national regulatory requirements Regulatory compliance in Europe Regulatory compliance in the USA What is different The GCC countries The Caribbean The Pacific Rim Common elements and differences of compliance projects New standards Disclosure issues Multinational companies and compliance challenges Part 12 – Reference: Threat Landscape and Good Practice Guide for Smart Home and Converged Media Smart home infrastructure including converged media and television Valuable assets in smart homes and converged media Threats Smart home assets exposure to cyber threats Threat agents To learn more about the CISRCP program you may visit: http://www.risk-compliance-association.com/Certified_Risk_Compliance_Training.htm http://www.risk-compliance-association.com/CISRCP_Distance_Learning_and_Certification.htm Media Contact: George Lekatis President of the IARCP General Manager, Compliance LLC 1200 G Street NW Suite 800 Washington, DC 20005, USA Tel: (202) 449-9750 Email: lekatis@risk-compliance-association.com Web: www.risk-compliance-association.com HQ: 1220 N. Market Street Suite 804 Wilmington, DE 19801, USA Tel: (302) 342-8828 About The International Association of Risk and Compliance Professionals: The International Association of Risk and Compliance Professionals (IARCP) offers standard, premium and lifetime membership, weekly updates, training, certification, Authorized Certified Trainer (ACT) programs, advocacy and other services. SOURCE: The International Association of Risk and Compliance Professionals Posted In Business Tags About The Author
    • 11. WireService.co WireService.co offers unlimited press release distribution on many of the countries most popular media destinations for $25 per month. Get residual, targeted Google traffic for $25 a month. You might also like Business Global Food Grade Lubricants Market 2015 Size, Share, Growth, Trends, Demand and Forecast Global Food Sugar Substitute Market 2015 Size, Share, Growth, Trends, Demand and Forecast Global Food Preservative Market 2015 Size, Share, Growth, Trends, Demand and Forecast Global Food Color Fixative Market 2015 Size, Share, Growth, Trends, Demand and Forecast Global Food Anti-Caking Agent Market 2015 Size, Share, Growth, Trends, Demand and Forecast Global Fluorescent Mineral Element Analyzer Market 2015 Size, Share, Growth, Trends, Demand and Forecast
    View More