Managing Enterprise Information Security: A Practical Approach for Achieving Defense-in-Depth

This three-day course begins with a brief review of the conceptual foundations of information security. Next, students will be introduced to the CERT Defense-in-Depth Framework: eight operationally focused and interdependent management components which will be synergistically applied to a fictitious organization's Information Technology (IT) enterprise (see "Topics" below). Through lectures, demonstrations, scenario-based exercises, small group activities, and open discussions, students will learn high-level best practices for effectively integrating each of these eight components into all aspects of IT operations. Further, the course scenario is used extensively to reinforce these best practices with technical information security implementations.

This course is designed for individuals charged with implementing information security throughout the IT enterprise. Therefore, this course is an ideal pursuit for IT and Security managers, and/or system administrators and IT security personnel who would like to step up to the management level.

Who should attend?

Technical staff members who manage or support networked information systems and have

• two years of practical experience with networked systems or equivalent training/education
• some degree of specific familiarity with the ISO/OSI 7- layered reference model as well as Ethernet, TCP/IP, and major network operating systems such as Windows NT/2000/ XP and Unix

What will you learn?

Successful completion of this course will enable participants to

• describe the CERT Defense-in-Depth framework and its components
• holistically examine IT operations for IA threats and vulnerabilities
• apply the framework to improve the overall security posture of IT operations