|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/internal-cybersecurity-audit-practitioners-approach/
课程评论：没有评论
**课程总结：内部网络安全审计：实践者方法** 本课程深入探讨了内部网络安全审计的重要性、流程和实践。随着企业对新兴技术（如社交、移动、分析、云计算和物联网）的广泛采用，加强网络安全对于企业韧性至关重要。 **核心要点：** * **网络安全审计的必要性：** 审计是确保组织治理和合规性的基石，特别是在应对日益增长的网络威胁时。组织风险管理能力与其对威胁、漏洞、可能性和影响的准备程度成正比。 * **策略、流程与控制：** 成功的网络安全不仅依赖于技术，还取决于健全的策略、流程和控制框架。许多组织遵循ISO 27001标准实施信息安全管理体系（ISMS），该体系包含网络安全策略、流程、控制和指南。 * **审计的关键阶段：** 课程详细介绍了审计的准备阶段、执行阶段和审计后阶段，强调了每个阶段的关键活动和注意事项。 * **软技能的重要性：** 除了技术专业知识，有效的沟通、利益相关者管理以及与被审计方的建设性互动对于成功的审计至关重要。课程强调了审计过程中的“すべきこと”（Do）和“すべきでないこと”（Don't），以指导审计师提高实践能力。 * **成为抢手的审计师：** 完成本课程后，学员将能够胜任内部网络安全审计工作，成为组织内各部门信赖的网络安全专家。 本课程旨在为学员提供一套实用的方法论，“为何”、“如何”进行内部网络安全审计，并以清晰明了的方式呈现实践中的要点，帮助审计师有效执行审计并为组织的风险管理能力做出贡献。
Internal Audit is the backbone of any organisation's governance and compliance check for led out policy, process and controls. With the advancement in social, mobile, analytics, cloud and IOT technologies and its adoption by enterprise, cybersecurity posture has become one of the cornerstone of an enterprise resilience to cybersecurity threats. The preparedness for cybersecurity threats and hence organisation risk management capacity is proportionate to the threat, vulnerability, likelihood and impact. Organisation risk management strategy with respect to cybersecurity threats not only depend on tools and technology deployment but policy, process and controls framework as well. As part of organisation cyber security threat management, every medium and large organisation, often, implements information security management system in line with ISO 27001 standard. These systems are a combination of cyber security policy, process, controls and guidelines. Once the cyber security management system, also called as, Information security management system(ISMS) is implemented, it needs to be regularly audited to validate the compliance and improvement based on new cyber threats. The audit ensures that organisation cyber security strategy is in tune with the laid down process and is it at par with current threat vectors. Hence, Cyber security Audit is always a difficult task. The stakeholder management becomes critical. There should be constructive discussion with auditee and auditor. The discussions and follow through requires a typical characteristic to be depicted during a fruitful audit exercise. This course explains the need for internal cybersecurity audit i.e. why, how and what is being done during audits. It explains the preparation phase, audit conducting phase and post audit phase of audit. The soft aspect of audit are as much important as the audit itself. The Do and Don't are very crisply highlighted that can be applied as a practice by the auditors. At the end of the course, you will be the most sought after auditor by the different unit of organisation.
