Welcome and Intro

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Time
14 hours 39 minutes
Difficulty
Intermediate
CEU/CPE
13
Video Transcription
00:00
>> Hello. Welcome to Certified
00:00
>> Information Security Manager,
00:00
>> Cybrary: CISM preparation course.
00:00
What we're going to try to do
00:00
>> in this course, of course,
00:00
>> is to get you ready to take the CISM exam and
00:00
what we want to work towards is going
00:00
to help you pass it the first time.
00:00
My name is Kelly Handerhan,
00:00
I'll be your instructor throughout the material.
00:00
I'm really glad that you've chosen
00:00
Cybrary to help you get your certification.
00:00
Before we get moving just a little
00:00
bit about the CISM certification,
00:00
this is put out by an organization called ISACA,
00:00
which stands for
00:00
Information Systems Audit and Control Association,
00:00
and they put out a cert on auditing,
00:00
which is the CISM exam.
00:00
They also put out a risk management, C-Risk,
00:00
and some other organizational study
00:00
guides and study materials.
00:00
ISACA is a great organization.
00:00
CISM is becoming one of those certs
00:00
that's more and more recognized in the field,
00:00
and as a matter of fact,
00:00
it's one of those few courses where we can't find
00:00
enough certified people to fill the jobs for CISM.
00:00
This is a great course,
00:00
I think it's a really important cert that you've
00:00
chosen to take and we'll move forward
00:00
a little more introductory material
00:00
and then we'll get right
00:00
into the course material
00:00
focusing on the CISM body of knowledge.
00:00
About your instructor, that's me, Kelly Handerhan.
00:00
A little younger, a little thinner,
00:00
but these things happen.
00:00
I've been around the IT field since the late '90s.
00:00
Got my start with Novell,
00:00
moved over into Windows NT 3.51,
00:00
NT 4.0, and kind of sold my soul to Microsoft early on.
00:00
I know what you security professionals,
00:00
many of you are scuffing at that,
00:00
but I always felt like if
00:00
you could secure a Microsoft system,
00:00
you are going to have a job and that has
00:00
been true for me this far.
00:00
Now, certainly, I work with Linux and Unix
00:00
and many other elements of a network,
00:00
but that's sort of my background.
00:00
I focused in on information security for
00:00
maybe the last 11 or 12 years.
00:00
It's certainly one of those areas of IT that can't
00:00
be outsourced or really probably shouldn't be outsourced.
00:00
It's another one of those things that I feel like
00:00
is a position that's always going to have
00:00
a degree of job security.
00:00
Now, I've been in this field for a long time,
00:00
so I have a lot of certifications.
00:00
I know that some of you may not be
00:00
really big believers in certification,
00:00
but the bottom line is,
00:00
you have to have something
00:00
that sets you apart from others
00:00
in this field and certifications are the way to do that.
00:00
It doesn't mean just because you're
00:00
certified that you can handle your job,
00:00
but it means that it will at
00:00
least get you in the door for
00:00
an interview having the appropriate certs.
00:00
The certifications that I have currently,
00:00
I have the PMP,
00:00
I have, of course, the CISM,
00:00
CISSP, and C-Risk.
00:00
Like I said, I have numerous technical certifications,
00:00
but these are the ones that
00:00
I feel they're are going to help
00:00
you the most for this material,
00:00
and I've certainly found them to be very useful.
00:00
The overview of the CISM certification as a whole.
00:00
Let's talk about what we're going to
00:00
talk about in this course.
00:00
Various objectives and we're going
00:00
to be able to just check these off and say,
00:00
yes, we've accomplished this and this.
00:00
We're going to start off with
00:00
just an introduction to this certification.
00:00
Some of you may be new to it.
00:00
Some of you might just be here to check it out,
00:00
or some of you may very purposefully have chosen to take
00:00
this cert and we want to just make
00:00
sure that it's going to meet your needs.
00:00
We'll talk about who is a CISM?
00:00
What does the CISM do within the organization?
00:00
The CISM certification has
00:00
four domains that you'll be tested on.
00:00
We'll talk about in the security governance,
00:00
we'll talk about risk management,
00:00
we'll talk about a security program,
00:00
and we'll talk about incident response.
00:00
Those are on a high level,
00:00
the domains that we'll be covering.
00:00
The big piece of this exam that we really want to
00:00
stress is how we serve
00:00
the needs of the business by what we do as
00:00
CISMs and our focus in those four domains.
00:00
Because when it comes down to it,
00:00
when push comes to shove,
00:00
there is only one reason
00:00
any organization has an information security department.
00:00
I'm going to say that again, there is only one reason,
00:00
every organization out there
00:00
has an information security team.
00:00
That reason is simply that that supports the business.
00:00
But doesn't that give us due care?
00:00
Well, of course, it does,
00:00
and that supports the business.
00:00
But doesn't it help us meet customer requirements?
00:00
Of course, it does. That supports the business.
00:00
Every reason that you can think of that we
00:00
care about security can be summed up with,
00:00
we support the business.
00:00
We help the organization meet
00:00
their long-term or their strategic goals,
00:00
and that's what it's all about.
00:00
We're going to frame that in the world of
00:00
risk management because really
00:00
all security is, is risk management.
00:00
We're going to look at our assets.
00:00
We'll look at threats and vulnerabilities,
00:00
try to figure out a potential for loss,
00:00
and then figure out how to mitigate those risks.
00:00
It's really important that all of
00:00
our decisions start with risk management because
00:00
that's how we can make
00:00
the most quantitatively proven choices
00:00
in order to secure our environment.
00:00
The main goal.
00:00
The main goal is really for me two-fold.
00:00
Certainly, we want to get you ready
00:00
for the CISM exam and I'm going to give you
00:00
as many exam tips and hopefully
00:00
give you some new ways to think about things.
00:00
But it's also really important to me that this is
00:00
a meaningful class so that you just
00:00
don't walk out with paper certification,
00:00
but that the material that we talk about
00:00
really makes sense and that it
00:00
teaches us a new way to
00:00
approach information security and to
00:00
align your thoughts with
00:00
best practices as we can serve the business.
00:00
I want you certified and we're going
00:00
to do everything we can to get you certified.
00:00
But I also want you to understand the material
00:00
and see the validity
00:00
of what we're talking about in this class.
00:00
It's going to be my job to get both of those.
00:00
Now, when we do talk about
00:00
earning your CISM certification,
00:00
there are several pieces.
00:00
The first step is to register for the exam.
00:00
After you take this course,
00:00
you'll want a little bit of time to study,
00:00
but you don't want this hanging out in the horizon,
00:00
someday I'll get to it, I'll get to it.
00:00
Once you have the knowledge,
00:00
study up and go take the certification exam.
00:00
Many times people will wait and say,
00:00
I'll come back around to it,
00:00
and then the longer you put that off,
00:00
the less and less you care and
00:00
the less likely you are to take it.
00:00
Even if you do take it,
00:00
you will have forgotten a lot of what we do today.
00:00
Schedule the exam. Then,
00:00
of course, you've got to prep for the exam.
00:00
I'm imagining a portion of you
00:00
already have the exam scheduled and
00:00
that you're using this as part of
00:00
your study tools, so that's great.
00:00
If you don't have it scheduled,
00:00
you'll get it scheduled and
00:00
this is a great tool to help you prepare.
00:00
Then the next step,
00:00
you've scheduled the exam,
00:00
might as well show up and take it.
00:00
I will encourage you that when
00:00
you do take this exam that you go
00:00
back in your mind and remember some of the things that
00:00
we've stressed as part of course preparation.
00:00
I want you to remember what we talked about because
00:00
those little pieces are going to be
00:00
the key to passing the exam.
00:00
Now, many people say, woo-hoo,
00:00
I passed the exam, we're done,
00:00
and that's actually not correct.
00:00
You have to complete an application for
00:00
certification that has to be approved.
00:00
Then once you are CISM certified, every three years,
00:00
you have to submit a certain amount of
00:00
continuing education units so that you
00:00
can maintain your certification.
00:00
There are a lot of pieces here to getting CISM certified.
00:00
Now, the material that we're going to cover,
00:00
and again, this is high level,
00:00
but there are four domains that we
00:00
need to cover as part of this course.
00:00
The first piece,
00:00
Information Security Governance,
00:00
and everything's going to start from governance.
00:00
When I say governing
00:00
entities or we talk about governance,
00:00
we're thinking about high level.
00:00
We're thinking about board of directors,
00:00
were thinking about senior management,
00:00
we're talking about any steering committees.
00:00
Those are the entities that
00:00
are responsible for governance.
00:00
In a word, or maybe two words,
00:00
Information Security Governance is responsible
00:00
for strategic direction,
00:00
long-term goals where we want to be.
00:00
That lays the groundwork.
00:00
Now, once we have a broad understanding of where
00:00
we want to be in 3-5 years out, long term,
00:00
then we have to have
00:00
risk management that'll help us figure out,
00:00
well, here's where I am,
00:00
here's where I want to be.
00:00
What are the appropriate ways to close that gap?
00:00
We talk about that as gap analysis and we'll
00:00
talk about current state versus desired state.
00:00
What we have to look at our threats and
00:00
vulnerabilities in context of what we value our assets,
00:00
and we have to figure out how we
00:00
implement mitigating strategies to
00:00
close up the gaps that we have
00:00
currently in our current structure
00:00
versus where we want to be.
00:00
Risk management is where it's at.
00:00
That's where the cool kids today are
00:00
focusing their time and effort and energy
00:00
because risk management is
00:00
an essential skill in
00:00
order to make good business decisions.
00:00
As a matter of fact, I'll encourage
00:00
you guys after you go out and get your CISM to
00:00
look at that C-Risk [NOISE] certification
00:00
because what that's going to
00:00
do is that's going to provide
00:00
assurance that you're knowledgeable in risk management,
00:00
very important in today's world.
00:00
Then we move into
00:00
Information Security Program Development and Management.
00:00
We talked about governance in the first section.
00:00
Our first domain is governance,
00:00
that figures what we want to do big picture.
00:00
Well, the security program
00:00
is going to tell us how we're going to do it.
00:00
It's the day-to-day, the operational stuff that will
00:00
help us figure out our policies, procedures, standards,
00:00
guidelines, what architecture we
00:00
configure for our network,
00:00
how we align big picture with smaller objectives.
00:00
That's going to be domain 3,
00:00
and then domain 4,
00:00
what if we have problems?
00:00
What if the best-laid plans
00:00
still have compromised or
00:00
still fail in some aspect or another?
00:00
Well, we have to be able to
00:00
respond to those incidents very
00:00
quickly and in such a manner that
00:00
minimizes the impact of the business.
00:00
Now, with Domain Structure Part 2,
00:00
this just shows how those domains run together.
00:00
Governance is going to
00:00
dictate that we use risk management,
00:00
which is going to help us deploy our security program,
00:00
and then Incident Security Management is
00:00
going to be a direct result of our program.
00:00
That's ultimately going to provide
00:00
information back to governance so that we
00:00
can continue working and improving our environment.
00:00
>> Now, the CISM exam itself is one of
00:00
these search that we're actually
00:00
finding that we don't have
00:00
enough people that are
00:00
certified to fill the jobs that are out there.
00:00
I may have mentioned that before,
00:00
but that means this is
00:00
a great certification for those of you that
00:00
are interested in moving
00:00
into information security management.
00:00
This is a great start to have any time,
00:00
there are more jobs than people.
00:00
That's a great place to be.
00:00
There are a few technical aspects of this certification,
00:00
but it's not a technical exam.
00:00
It's much more geared towards senior management,
00:00
and it's much more geared
00:00
towards risk management and making
00:00
good business decisions in
00:00
the world of information security management.
00:00
In there, just a few other pieces
00:00
of information I'll let you go through there.
00:00
I'll just point out a couple of things.
00:00
It's a computer-based exam.
00:00
They will provide you,
00:00
this says pencil and eraser are allowed.
00:00
They'll actually give you
00:00
a sharpie and a little laminated board,
00:00
and that's all you can take into
00:00
the testing room with you.
00:00
You've got those two things but nothing else.
00:00
They may also give you noise-canceling headphones.
00:00
If they do, that's great.
00:00
That's always helpful and I would recommend
00:00
that you use them if they're available.
00:00
It is a multiple-choice exam,
00:00
and I do believe also,
00:00
this has shifted down to being 150 questions.
00:00
You may just make
00:00
a note of that as we're going through our reserve,
00:00
the right to tweak the slides here and there,
00:00
because the thing about
00:00
every certification exam is they are in a state of flux.
00:00
Each organization reserves the right to make changes,
00:00
change the test pen, change the outline.
00:00
If there are anything that
00:00
strikes me as needing the change or at least consider,
00:00
I'll certainly let you know.
00:00
I do believe the exam is now 150 questions,
00:00
you still get four hours to complete.
00:00
There are no negative points,
00:00
which means you get
00:00
points for what you answered correctly.
00:00
Do not skip questions on the exam.
00:00
If you skip it, it's automatically wrong.
00:00
What if you guess C,
00:00
C is a fine answer,
00:00
when in doubt, Charlie out.
00:00
If you don't know anything, put something down.
00:00
You can always mark it and go back later,
00:00
but you need to put something
00:00
down in case you don't have the time.
00:00
Now, this is interesting,
00:00
no prerequisite for the exam. That really is true.
00:00
You don't have to have any certification,
00:00
any background to take the exam.
00:00
Now you can take the exam and pass it,
00:00
but there are prerequisites to actually being certified.
00:00
Basically what that's going to tell you
00:00
is you can have all the fun of
00:00
taking the exam without any other requirements being met.
00:00
But to be certified,
00:00
there are requirements you have to meet.
00:00
I'll tell you about those in a minute.
00:00
Now, recommend reading.
00:00
Let me tell you, any certification exam
00:00
you will benefit by studying a glossary of terms.
00:00
Every glossary is going to show you
00:00
certain terms that the organization
00:00
is going to use uniquely.
00:00
Some organizations will use risk appetite in
00:00
risk management and risk governance and
00:00
risk tolerance and risk capacity.
00:00
Those terms may get tossed around and used differently,
00:00
so you do want to have,
00:00
and you can search out on
00:00
the Internet glossary for CISM exam,
00:00
and you'll find some matches to that
00:00
and that's certainly worth a review.
00:00
Now, ISACA also puts out a review manual,
00:00
a development guide, risk IT framework.
00:00
I'll be honest with you, what I've tried to do in
00:00
these slides is summarize those elements.
00:00
If you didn't have Cybrary,
00:00
these would be things like very strongly
00:00
recommend that you go through and read.
00:00
But part of my job is to take
00:00
those text-based manuals that
00:00
may get more detailed and more technical,
00:00
ultimately, and I'm going to try to make them easy,
00:00
and I'm going to try to help it as easy as possible,
00:00
but I'm going to try to make them digestible.
00:00
I'm going to present the material that I fully
00:00
believe is what you need to pass the exam.
00:00
I don't want you to feel just
00:00
because I've referenced this slide,
00:00
I've got to go out and buy a lot of other material.
00:00
I really believe that if
00:00
you study and if you take my recommendations,
00:00
that what we do here,
00:00
I believe, is going to be enough to get you certified.
00:00
Now, of course, that depends on
00:00
your background and your skillset,
00:00
and are you a good test taker but I don't want you to
00:00
feel like after you get done with the CISM exam,
00:00
I've got to run out and spend a lot of
00:00
money on books because I don't believe that.
00:00
Like I said, you don't have
00:00
any prerequisites to take the exam,
00:00
but to be certified, you actually do,
00:00
so of course, the first thing you got to do
00:00
is take and pass the exam.
00:00
But then there are some additional steps and I have
00:00
the link isaca.org/cismapp,
00:00
and you do have to apply.
00:00
When you pass the exam,
00:00
you have five years to complete the application.
00:00
But remember, you're not
00:00
certified until the application is completed,
00:00
reviewed, and you get your notification that is accepted.
00:00
In addition to passing,
00:00
you have to document
00:00
relevant work experience in the CISM job practice areas.
00:00
Then you have to submit your application and
00:00
pay an application processing fee as well.
00:00
Now we don't go into those details because
00:00
like I said, these certifications change.
00:00
What I'm always going to do for
00:00
those exams specifics is say go to
00:00
isaca.org for all the facts about the certification.
00:00
Those, of course, will be the
00:00
most current and up-to-date.
00:00
When you pass, celebrate, again,
00:00
fill out the application,
00:00
pay your application processing fee,
00:00
document your CISM job at your work experience
00:00
in relation to the practice areas, those four domains.
00:00
Then after you submit your application,
00:00
ISACA will review,
00:00
and hopefully, you'll be well on your way
00:00
certified in information security management.
00:00
Just wrapping up, I've given you
00:00
an introduction to the course material,
00:00
talked at a very high level
00:00
about what we're going to cover.
00:00
The book or the material that I'll be going through
00:00
slide by slide is how we're going to cover this material.
00:00
We have the four domains,
00:00
which was information security governance,
00:00
and then we talked about risk management
00:00
then developing an information security program,
00:00
and then incident response as
00:00
being the four domains that we're going to work on.
00:00
We mentioned we're going to prepare for
00:00
150 questions multiple choice.
00:00
We talked about some additional material that
00:00
you could use in order to prepare.
00:00
But like I said, I really have
00:00
taken the material I think is most meaningful
00:00
from those sources and
00:00
that's going to be part of my presentation.
00:00
Take the exam, fill out your application document,
00:00
the work experience you need to,
00:00
and then you should be CISM certified and well,
00:00
on your way to
00:00
working in the information security management field.
00:00
That's all the preliminary information.
00:00
I know that was a lot,
00:00
but we want to make sure that we're on
00:00
the same page as we move forward.
00:00
The next thing we're going to do,
00:00
we're just going to jump right into the material.
Up Next