Cybersecurity Auditing in an Unsecure World – Virtual
05/12/2021 - 06/12/2021 @ 8:00 am - 12:00 pm - About this course: Course Description $5.4 million — that’s the average cost of a data breach to a U.S.-based company. It’s no surprise, then, that cybersecurity is a hot topic and a major challenge in internal auditing today. Cybersecurity is as much of a business risk as it is a security one, making it critical [...]
Map Unavailable

Date/Time
Date(s) - 05/12/2021 - 06/12/2021
8:00 am - 12:00 pm

Location


About this course:

Course Description

$5.4 million — that’s the average cost of a data breach to a U.S.-based company. It’s no surprise, then, that cybersecurity is a hot topic and a major challenge in internal auditing today. Cybersecurity is as much of a business risk as it is a security one, making it critical for internal auditors to develop the skill set needed to take on these challenges.
In this course, you will develop an understanding of cybersecurity concepts that can be used to facilitate integrated audit efforts within your organization. Developed with and facilitated by leading industry experts, this course will examine preventive, detective, and corrective controls, and how to apply the audit process to a cloud environment. You will also be exposed to the mobile environment and cyber standards, as well as learn how to audit common security solutions.
This course is designed for internal auditors involved in IT audits or those involved in audit activities that require an understanding of how to manage the impact of cybersecurity events on business risks.

 

Course Schedule

  • Day 1: 08:00 – 12:00
  • Day 2: 08:00 – 12:00

 

Course Objectives:

  • Define cybersecurity from an audit perspective, including an understanding of its scope, limitations, and how to measure effectiveness.
  • Identify the purpose of preventive, detective, and corrective controls.
  • Understand cyber liability insurance and its impact on cybersecurity.
  • Understand cyber standards, state notification laws, and how they affect an organization.
  • Understand how to assess an organization’s cyber capabilities from an attacker perspective, using threat modeling.
  • Assess cybersecurity risks and controls related to using cloud providers or third-party vendors.

 

Course Topics:

Overview of Cybersecurity

  • What is Cybersecurity?
    o Definition of Cybersecurity
    o Misconceptions
    o Cybersecurity Evolution
    o Types of Risks and Controls

Preventive Controls

  • Purpose of Preventive Controls
  • Types of Attackers
  • Threat Models
  • Anatomy of a Breach
    o “The Breach Quadrilateral”
  • Preventing Cyber Incidents
    o Network Controls (Internal and External)
    o Domain and Password Controls
    o Access Methods and User Awareness
    o Application Security
    o Secure Software Development Lifecycle (SSLDC)
    o Data Controls
    o Host and Endpoint Security
    o Vulnerability Management
    o Security Testing

Detective Controls

  • Purpose of Detective Controls
  • Detecting Cyber Incidents
  • Log Detail Concepts
  • Security Information and Event Management (SIEM)
    o Traditional Silo-Specific Model
    o Alert Rules
    o Correlation Rules
  • Data and Asset Classification

Corrective Controls

  • Purpose of Corrective Controls
  • Incident Response and Investigation Process
    o Incident Scoping and Evidence Preservation
    o Forensic Analysis
    o Defining Period of Compromise
    o Evaluating Risk of Harm to Information
    o Production of Data for Review
  • Corrective Actions
    o Incident Response Tasks
    o Identifying Potential Evidence Sources
  • Detection Dependencies
    o Understanding the Scope of the Breach
    o Identifying Compromised Systems and Applications
    o Determining Scope of Information to Be Preserved
    o Preparing for Future Media and Legal Inquiries

Cybersecurity Risks, Cyber Liability Insurance, and State Notification Laws

  • Mitigating Costs and Risks
    o Organizational Programs
    o Specific Preparation Tasks
    o Response Documentation
    o Data Segregation
    o Network and Application Patch Management
    o Backup and Archiving Solutions
    o Enterprise Monitoring Solutions
  • Insurance Overview
    o Security and Privacy Liability
    o Regulatory Defense and Penalties
    o Payment Card Industry Fines and Penalties
    o Breach Response Costs
  • Notification Law Overview
    o Who the Laws Apply To
    o What the Laws Do

Applying the Audit Process to a Cloud Environment or Third-Party Service Provider

  • Cloud Providers
    o Assessing the Provider
    o Evaluating the Data
    o Selecting the Provider
    o Annual Assessment/Service Organization Control (SOC) Reports
  • Third-Party Service Providers
    o Contractual Risks
    o Vendor Management Program
    o Individual Contractor Management/Security

The Mobile Environment, Bring Your Own Device (BYOD), and Social Networking

  • Mobile Computing Risks, Control Activities, and Incident Management
  • BYOD Risks, Control Activities, and Incident Management
  • Social Networking Risks, Control Activities, and Incident Management

Cyber Standards

  • Common Standards
    o ISO 2700 Series
    o NIST sp800 Series
  • Common Uses
    o Completeness vs. Correctness
    o Governance Mapping for Regulatory and Insurance Needs

Auditing Common Security Solutions

  • SEIM
  • Data Loss Prevention (DLP)
  • Intrusion Detection System (IDS)/Intrusion Prevention System (IPS)
  • Network Segmentation
  • Encryption

 

Course Duration: 2 days

CPE Credits: 8

Level: Basic

Field of Study: Information Technology

Pre-requisites: None

Delivery Format: Online


Bookings

Ticket Type Price Spaces
Non-members $505.00
Members $450.00 N/A
Strategic Partner/ADAA Member $380.00 N/A

Finance Department

Department Head



Disclaimer

The UAE IAA reserves the right to amend the Terms & Conditions at any time without prior notice.

While the UAE Internal Audit Association and its staff make every effort to observe and maintain the schedule of every training course as set forth in the organization’s training schedule, under certain circumstances that are out of our control we might feel obligated to cancel and/or reschedule any training course or event. Under these circumstances, our training department will forward all registrants to the next available schedule for the same course. The individual participant or the sponsoring organization will have the ability to request a different schedule for the same course or a different course within the same calendar year.

CPEs: 8 Point
Course Level: Foundation
Duration: 2 Day/s
Language: English
Member Fees:450USD
Nonmember Fees: 505USD

Number of Attendees:

Book your calendar