Information Risk

• What is information risk management?
• Why is it of particular importance now?
• Corporate governance and management issues
• Measuring and prioritising information risk
• Key risk elements of information risk management
• Policy and procedures in information risk
• Information risk and operational resilience
• Where are the key elements of information risk within banking?
• How are they currently managed?
• Cybersecurity and Information Risk

Case Study:  Review a series of existing structures within banking for the management of information risk

Information Risk Management Strategy

• Managing complexity
• Reference architectures
• Why strategic information risk programmes fail and how to avoid failure
• The holistic approach
• Developing enterprise security architectures
• Strategy and concept phase
• Design phase
• Implementation phase
• Operational phase – management and measurement
• What is really under your control?

Case Study:  Develop an audit program to address Information risk management strategy

Auditing the Information Security Framework

• The role of systems engineering
• Basic systems design concepts
• The system boundaries and its environment
• Sub-system decomposition
• Control systems and advanced systems modelling techniques
• Business process analysis
• Dependency tree modelling
• The information register
• Identifying critical information
• Storage and BCP
• Considering third parties

Case Study:  Develop an audit program to address the information security framework

Auditing the Monitoring of Information Risk

• Return on investment for information security
• Monitoring and measurement
• The need for metrics
• Measurement approaches
• Scorecards
• Quantitative approaches
• Business drivers and traceability
• Data mining
• Business attributes profiling
• Setting up a metrics framework
• Maturity modelling applied to information security
• Risk reporting

Case Study:  Develop an audit program to address information risk monitoring

Auditing Information Security

• Unique entity naming
• Registration
• Public key certification
• Credentials certification
• Directory services
• Information model
• Service naming model
• Service functional model
• Service security model
• Authorisation services
• Entity authentication
• Use authentication
• Device authentication
• Communication security services
• Session authentication
• Message origin authentication
• Message integrity protection
• Message replay protection
• Message content confidentiality
• Non-repudiation
• Traffic flow confidentiality

Case Study:  Develop an audit program to address information security

Auditing Incident Management

• Identification of incidents
• Incident assessment
• Analysing the consquences
• Considering the control structure
• Reporting incidents
• Acting to increase resilience

Case Study:  Develop an audit programme to address incident management

Auditing the Management of the Information Risk Programme

• Selling the benefits of information risk management to senior management
• Getting sponsorship and budget
• Building the team
• Programme planning and management
• Collecting the information you need
• Getting consensus on the conceptual security architecture
• Architecture governance, compliance and maintenance
• Long-term confidence of senior management

Case Study:  Final program highlighting key elements of the work to be conducted.

All delegates completing the course will receive a personalised, dated Risk Reward CPD accredited Certificate in Auditing Information Security Risk in Banks & Financial Institutions.

Delegates will gain specialist world- class audit knowledge, techniques and experience of applying learned concepts through the live, in class development of audit programmes and will be able to audit:

• The main information risks that are faced by a large financial services firm;
• The approach taken to managing these risks;
• The information risk management ad security strategy;
• Design architectures, systems and processes to implement the potential strategies
• The key elements of the information security and risk framework

A Tier 1 Global Bank Risk & Internal Audit expert will led group activities and discussion to build the audit approaches and programmes for immediate application in the workplace. Theses include audit programs listed in the What Does It Cover section above.

Highly interactive expert-led intensive presentation, Q&A, group real-time in-depth case studies, regulation and discussion supported by key principles and theory. The virtual learning platform uses safe, industry preferred encrypted Cisco WebEx to optimize live face-to-face visual interaction, discrete chat, for polling and quizzes.

(An invitation via email with access link is included for all participants.)