Information Security Management SystemsSyllabus

Subject code

MM-1402-EN

Credits

6

Student workload

135

Semester

Autumn semester

Academic year

2

Subject type

Mandatory

Form of education

Full-time

Language of instruction

English

In-class hours

a) 30 hours – Lectures; b) 15 hours – Seminars

Out-of-class hours

a) 80 hours – Independent Study; b) 55 hours – Project Work or Consultation Hours, etc.

The course Information Security Management Systems examines the fundamental principles of protecting information assets, managing information security risks, and ensuring information security systematically within organizations. The course covers the establishment of an Information Security Management System (ISMS), the development of security policies, risk assessment and management, information asset classification, access control, incident management, business continuity, security audits, and monitoring mechanisms. It also explores the requirements of ISO/IEC 27001 and related standards, the selection and implementation of security controls, compliance assessment, and continuous improvement processes.

• lecture
• seminar
• interactive discussion
• project-based learning
• teamwork
• case study

1. 1

   CLO 1: Identify and distinguish the fundamental principles and components of information security management systems (isms) and apply international standards, including iso/iec 27001, nist, and cobit, appropriately and purposefully.

2. 2

   CLO 2: Identify and assess an organization's cyber risks and select appropriate management and technical measures to mitigate them.

3. 3

   CLO 3: Develop and implement information security policies, procedures, and control mechanisms.

4. 4

   CLO 4: Identify security incidents and develop incident response plans (irps) and business continuity and disaster recovery plans (bcps/drps).

5. 5

   CLO 5: Plan audit and compliance processes, collect evidence, and prepare reports.

6. 6

   CLO 6: Plan, implement, and analyze the outcomes of cybersecurity management projects independently or as part of a team.

1. 1.
   Fundamentals and principles of information securityLecture

   This topic introduces the fundamental concepts, objectives, and principles of information security. it develops foundational knowledge of the principles of confidentiality, integrity, and availability, as well as information assets, threats, vulnerabilities, and security controls.

2. 2.
   Standards complianceLecture

   This topic examines international standards and regulatory requirements applicable to information security. it explores the establishment of standards-compliant security processes within organizations, compliance assessment, and the principles of auditing.

3. 3.
   Information security management systemLecture

   This topic covers the objectives, structure, and implementation principles of an information security management system (isms). it examines the development of security policies, process management, risk assessment, and approaches to continuous improvement.

4. 4.
   Asset management and security policiesLecture

   This topic explores the identification, classification, inventory, and lifecycle management of information assets. it also examines the development and implementation of security policies and their alignment with organizational objectives.

5. 5.
   Risk managementLecture

   This topic examines methods for identifying, analyzing, assessing, and managing information security risks. it covers the identification of threats and vulnerabilities, risk prioritization, and the selection of appropriate risk mitigation measures.

6. 6.
   Organizational and human securityLecture

   This topic examines the role of human and organizational factors in ensuring information security. it addresses employee security awareness, the definition of roles and responsibilities, access rights management, and the mitigation of risks arising from human factors.

7. 7.
   Physical securityLecture

   This topic covers the principles of protecting information systems, equipment, and information resources against physical threats. it examines physical access control, security zones, surveillance systems, equipment protection, and measures for safeguarding against emergencies.

8. 8.
   Technological securityLecture

   This topic explores methods for protecting information systems and technological infrastructure against modern cyber threats. it covers network security, authentication, encryption, firewalls, malware protection, and secure system configuration.

9. 9.
   Incident managementLecture

   This topic examines the processes involved in detecting, registering, analyzing, responding to, and mitigating information security incidents. it covers the development of incident response plans, the assignment of responsibilities, and post-incident recovery measures

10. 10.
    Security operations center (soc)Lecture

    This topic explores the structure, functions, and operational principles of a security operations center (soc). it examines security event monitoring, threat detection, log analysis, incident response, and the operational management of security processes.

11. 11.
    Information security control mechanismsLecture

    This topic examines administrative, physical, and technical controls used to reduce information security risks. it covers the selection and implementation of access controls, monitoring mechanisms, encryption, backup procedures, and other security controls.

12. 12.
    Evaluating the effectiveness of information security managementLecture

    This topic explores methods for measuring and evaluating the effectiveness of information security management processes. it examines security metrics, auditing, monitoring, compliance assessment, and the continuous improvement of security processes.

13. 13.
    Management of secure software developmentLecture

    This topic covers the principles of integrating security requirements into the software development process. it examines secure programming, the definition of security requirements, vulnerability management, code review, and the secure software development lifecycle.

14. 14.
    Security testing management and a devsecops-based secure development environmentLecture

    This topic examines the planning, execution, and management of security testing for software and information systems. it explores the integration of security controls into ci/cd pipelines within the devsecops approach, automated testing, vulnerability detection, and continuous security monitoring.

15. 15.
    Information security project managementLecture

    This topic examines the principles of planning, organizing, and managing the implementation of information security projects. it covers defining project objectives, resource and schedule planning, risk management, communication with stakeholders, and evaluating project outcomes.

1. Nair, adarsh, and m. r. greeshma. mastering information security compliance management. packt publishing, united kingdom, 2023/2024.
2. Oh, kok-boon, chien-ta bruce ho, and bret slade. cybersecurity risk management: an enterprise risk management approach. nova science publishers, incorporated, 2022.
3. Brumfield, cynthia. cybersecurity risk management: mastering the fundamentals using the NIST cybersecurity framework. john wiley & sons, 2022.
4. Iso/iec 27001:2022 – information security management systems (isms) — requirements. international standard.
5. National institute of standards and technology (nist). cybersecurity framework. available at:(opens in a new tab)
6. Isaca. resources on information systems auditing, governance, risk management, and cybersecurity(opens in a new tab)