MONDAY TRAINING CLASSES

This course is designed to provide the students with hands-on experience in behavioral threat hunting. This includes covering common models and how they relate to threat hunting, how to operationalize an intel report focusing on tactics, techniques, and procedures (TTPs), how to leverage intelligence to initiate and conduct a hunt, data pivoting from initial query to results, proper documentation techniques to compile and organize findings in a repeatable manner. The culmination of this process will be a series of simulated attack chains using real world adversary TTPs, that we like to call the crawl phase. The crawl phase will provide students with the opportunity to go hands-on with the data in a step-by-step hunting tutorial. This practical session will allow students to experience threat hunting in a structured and controlled manner, and allow them to practice the topics that were covered.

Students will be required to bring a laptop that meets these requirements: OS: Windows/OSX/Linux Memory: 8 GB RAM CPU: 4 cores Free Space: 50 GB Recommended Browser(s): Google Chrome / Microsoft Edge Virtual Box already installed on their machine. Other recommended applications: A way to view a pdf. A way to view and edit an Excel type document. As an optional requirement, if the student would want to leverage the Hunter platform before, during, or after the training, they would have to register for a community account well before the training.

ISS has updated and resurrected their CERP certification training.  This 2-day course is designed to provide participants with the knowledge and skills required to develop and implement enterprise-wide resiliency programs based on the principles of BS 65000 and ISO 22301 as well as other supporting industry standards. The course covers the essential aspects of resiliency planning and management, including risk assessment, measuring business impact, building a response, and recovery strategy.

The program is delivered in an interactive and engaging format that combines instructor-led training, case studies, group discussions, and practical exercises. The course also includes a comprehensive workbook study that tests participants’ knowledge and skills, and successful completion of the workbook leads to certification as a CERP.

Who is this course for?
The CERP course is suitable for professionals involved in developing and implementing resiliency programs in organizations of all sizes and types.

Learning Objectives:
Upon completing the course, participants will be able to:

1. Understand the fundamental principles and concepts of enterprise resiliency management.
2. Conduct a comprehensive risk assessment to identify potential threats and vulnerabilities to an organization’s operations.
3. Develop and implement a business impact analysis to identify critical business functions and their dependencies.
4. Develop and implement a response strategy to manage and respond to disruptive events.
5. Discussions of best practices on the planning to restoring of critical business functions and operations.
6. Establish a resiliency program framework and governance structure to ensure continuous improvement and effectiveness.
7. Understand the importance of effective communication, training, and awareness in resiliency management.
8. Understand the role of standards such as BS 65000 and ISO 22301 in resiliency management and certification.  All attendees will be provided access to BS 65000, ISO22301 and ISO27002 standards for 1 year after the class. 

The CERP course equips participants with the knowledge and skills required to develop and implement enterprise-wide resiliency programs, ensuring organizations can effectively respond to disruptive events and quickly recover critical business functions.

Note for people who want to be a CERP Trainer:  Attending a CERP training class and completing the class workbook is one of the prerequisites to becoming an approved trainer.  If you want to be a CERP Trainer, attending this class will meet your training class requirement.  If you have any questions, contact cso@informationsecuritysummit.org.

TUESDAY TRAINING CLASSES

Abstract:

Enterprise Security Architecture (ESA) is an architectural discipline to align Information Security (Infosec) efforts to the highest priority risk and business objectives. This workshop outlines the architect’s view of optimizing and organizing Infosec strategic planning. Using the tools outlined in the workshop, Infosec leaders and architects will be able to take concepts back to their teams to aid in strategic planning, while efficiently addressing cybersecurity business alignment.

Are you ready to ‘Mechanize’ your Enterprise Security Architecture (ESA) program for the cyber war?
– Attend this session to gain insight into examples of creating ESA mechanics to drive Board Decisions and Infosec Program Maturity. Take your Infosec organization to the next level…

Topics covered include:

-Overview of ESA as a practice and discipline.
-ESA Mechanics – Capability Planning
-ESA Mechanics – ESA Taxonomy & Security Policies/Standards/SoPs
-Budget Principles
-Modern User Cases
-Q&A

Target Audience: IT/InfoSec Directors, Enterprise and Enterprise Security Architects (current or aspiring), IT/InfoSec practitioners with interest in Enterprise Architecture for Infosec.

Learning Objectives:

-Provide a foundational understanding of Enterprise Security Architecture as a discipline.
-Provide the audience with real-world examples of how to derive/execute cybersecurity strategy including security architecture techniques.
-Learn the Top 5 considerations for Creating an ESA program.

Audience: Beginner, intermediate, & some advanced

Designed Length: 4-hour ESA Workshop

Abstract:
The concept of Information Security Governance (ISG) is to oversee the work efforts (budgeting of resources, compliance, security posture) to ensure that your organization can achieve business priorities and still be secure by design.  ISG provides mechanics and due diligence that celebrate collaboration and coordination on critical cybersecurity resources.  Through effective planning (strategic and intermediate), cybersecurity efforts and initiatives will enable and optimize business objectives and rally the cause to a modern cybersecurity architecture.

In this workshop, we’ll examine real-world examples on how to get the most out of your cybersecurity budget, while supporting your cybersecurity strategy and planning.  Instead of asking all the cybersecurity leaders what they want to work on next year, these principles will create a single sheet of music for cybersecurity harmony.

Topics covered include:

-To Govern or not to Govern? … That is the question.
– Overview and current state of Cybersecurity Governance.
– How does ISG compare to IT Governance?
– Cybersecurity Budgeting Techniques
– The illustrious Security Portfolio.
– Aligning ESA (Enterprise Security Architecture) with cybersecurity strategy and ISG.
– Compliance – Exceptions – Risk Registry.
– Modern Governance Use cases.

Target Audience: IT/InfoSec Directors, Enterprise and Enterprise Security Architects (current or aspiring), IT/InfoSec practitioners with genuine interest in Cybersecurity Strategy & Governance.

Learning Objectives:

– Provide a foundational understanding of Information Security Governance as a discipline.
– Provide the audience with real-world examples of cybersecurity strategy including security architecture techniques.
– Examine Information Security Governance (ISG) as it pertains to budgeting and advancing program maturity…
– Learn the Top 5 considerations for Creating an effective ISG program.

Designed Length: 4-hour ISG Workshop