Information Security
This path teaches you to see security at the level of an organisation. You will learn to assess risk, manage access, classify data and write security policies. ISO/IEC 27001 and the Law of the Republic of Uzbekistan “On Personal Data” are covered at the level of general principles.
What you will learn
Key topics
- 01
Information security principles
Confidentiality, integrity and availability, core concepts and roles.
- 02
Risk management
Identifying assets, threats and vulnerabilities, then assessing and reducing risk.
- 03
Access control
Authentication, authorisation, least privilege and account management.
- 04
Data classification
Sorting data into categories and setting the controls each one needs.
- 05
Standards and regulation
The structure of ISO/IEC 27001 and general requirements for protecting personal data.
- 06
Security policies
Writing and introducing policies and procedures, and checking compliance with them.
Attack and defence
The attacker’s side
- See the risk created by excessive privileges and forgotten accounts.
- Understand how phishing and social engineering exploit the human factor.
- Trace where unclassified data tends to leak.
- Assess the risks of weak processes and unmanaged suppliers.
The defender’s side
- Build a risk register and prioritise controls.
- Design access rights around least privilege.
- Develop a data classification scheme.
- Write clear, workable security policies for an organisation.
Who it is for
- Specialists moving into information security management.
- Managers responsible for IT and business processes.
- Professionals in audit, compliance and risk.
By the end
- Identify and assess risks for an organisation.
- Design an access control model.
- Classify data and define the controls it needs.
- Prepare policies grounded in ISO/IEC 27001 requirements.
Other paths
Capture your first flag today
Create a free account and access 700+ hands-on challenges.