Table of contents

KEY EXAM STRATEGIES
STRATEGY ONE: KEYWORD OR KEY PHRASE MATCHING.
STRATEGY TWO: CHOICES GROUPING.
STRATEGY THREE: THINK TRICKY.

SECURITY THEORIES
THE COMPUTER SYSTEM ITSELF AS LARGELY AN UNTRUSTED SYSTEM
DEFENSE IN DEPTH
VULNERABILITIES
SECURITY MEASURES
STANDARDS AND GUIDELINES

IS ORGANIZATION AND INFORMATION ASSETS PROTECTION
THE STAKEHOLDERS
THE BOARD
THE AUDIT MANAGER
AUDIT PERSONNEL  

IS CONTROLS
CLASSIFICATION OF CONTROLS
GENERAL CONTROLS VS APPLICATION CONTROLS

ACCESS CONTROL AND THE AUDITING PROCESS
ACCESS CONTROL MODELS
ACLS VERSUS CAPABILITIES 
WHAT IS ORANGE BOOK, BY THE WAY?
TYPES OF ACCESS CONTROL
THE AAA CONCEPT
ESTABLISHING ACCOUNTABILITY THROUGH EVENT LOGGING
THE AUDIT PROCESS
THE SARBANES–OXLEY ACT AND THE COSO FRAMEWORK
WHAT IS AUDITING, BY THE WAY?
THE ROLE OF AN AUDITOR
THE AUDIT PROCESS FLOW
AUDIT PLANNING
RECOMMENDED TYPES OF AUDIT
AUDIT FIELDWORKS
AUDIT PROGRAM
AUDIT REPORT
AUDIT FOLLOW-UP

IT STRATEGIC PLANNING
IT STRATEGIC PLANNING DEFINED
THE ROLE OF IS AUDITING IN THE PLANNING PROCESS
IN-HOUSE OR OUTSOURCE?
AVOIDING CONFLICTS OF INTEREST

PROTECTION OF INFORMATION ASSETS THROUGH SECURITY POLICY
INFORMATION ASSETS DEFINED
DATA CLASSIFICATIONS AND LAYER OF RESPONSIBILITIES
SECURITY POLICY
SECURITY MODELS AND MODES OF OPERATIONS
ORGANIZATION SPECIFIC CLASSIFICATION SCHEME
EXAMPLE POLICY
CONSEQUENCES OF VIOLATIONS
EVALUATION
CHANGE CONTROL

BUSINESS CONTINUITY PLANNING, CRISIS COMMUNICATIONS & BIA
DEFINITION
BCP VS BPCP VS DRP
BCP PHASES
STAKEHOLDERS AND CRISIS COMMUNICATIONS
THE RISK ASSESSMENT FLOW
RISK VS THREAT AND VULNERABILITY
IDENTIFYING RISKS
LOSS CALCULATIONS
BUSINESS IMPACT ANALYSIS DEFINED
BIA GOALS AND STEPS
BIA CHECKLIST
PREPARING FOR EMERGENCY
MANAGING RECOVERY
TESTING THE PLAN
USER ACCEPTANCE
PLAN MAINTENANCE
INCIDENT HANDLING

RISK MANAGEMENT
RISK MANAGEMENT DEFINED
THE RISK MANAGEMENT STEPS
IS AUDITING AND RISK MANAGEMENT
RISK-BASED AUDITING

PROJECT MANAGEMENT
PROJECT MANAGEMENT DEFINED
PROJECT MANAGEMENT AND AUDIT

CHANGE MANAGEMENT
CHANGE MANAGEMENT DEFINED
CHANGE MANAGEMENT STRATEGIES
CHANGE MANAGEMENT VS CHANGE CONTROL VS CONFIGURATION MANAGEMENT
CHANGE CONTROL REVISITED

APPLICATION PROGRAM DEVELOPMENT
GENERAL GUIDELINES
SYSTEM CHANGE CONTROL
SOFTWARE DEVELOPMENT PROCESSES AND MODELS
BUY VS MAKE: ACQUISITION MANAGEMENT METHODS

TECHNICAL READINGS

• SECTION 1: TOPICS ON SECURITY THEORY
• SECTION 2: TOPICS ON HACKING, ATTACKING, DEFENDING AND AUDITING
• SECTION 3: TOPICS ON ENCRYPTION AND VPN
• SECTION 4: TOPICS ON RESPONDING TO ATTACKS
• SECTION 5: TOPICS ON VIRUSES

VALUABLE THIRD PARTY RESOURCES

SPECIAL TOPIC COVERAGE
Information Security Program Development and Management, with coverage on:

• EISP
• ISSP
• SysSP
• Combination SysSP
• ISPME

IT Operations Management
Information Security Program and Policy Development
Policy and Program Management
Vulnerability & Patch Management
Data Storage Strategy
Environmental Controls
Imaging Technologies
ERP Security
Incident Response, with coverage on the different kinds of IRT
Concealing hard disk data

Baseline policy and guidelines
Planning and scoping of the assessment of risk
Methodologies for proper assessment of risk
Special notes on penetration testing
Internet Security
Firewall security
Virus security
Web server security
Name resolution security
Mail server security
RAS server security
Proxy server security
Authentication server security

Physical Site Management
Equipment and Media Management
Emergency Response
ERT Formation
ER Planning and Preparation
Coverage, goal and scope
Emergency priorities
Emergency Reporting Procedure
Emergency Escalation Procedure
Incident Monitoring

Forensic Processing
Software Testing

AUDIT OBJECTIVES AND AUDIT RISKS
OUTSOURCING IT AUDIT
SECURITY CONCERNS ON M&A

SAMPLE I.S. AUDIT QUESTIONNAIRE

140 Technical Drill Practice Questions

55 Program and Policy Drill Questions

Basic Networking Technotes

Appendix updated 8 Dec 08 covering:
CMM AND CMMI
ESCROWED ENCRYPTION STANDARD (EES)
OBJECT ORIENTED DESIGN
COMPUTER FORENSICS
INCIDENT RESPONSE (IR)
HIPAA
PLATFORM FOR PRIVACY PREFERENCES PROJECT (P3P)
OECD GUIDELINES
CEI’S COMMANDMENTS OF ETHICS
THE INFOSEC ASSESSMENT METHODOLOGY (IAM)
COVERT CHANNEL ANALYSIS
COMMON CRITERIA (CC)
PHYSICAL AND ENVIRONMENTAL SECURITY
INFORMATION RETENTION & DISPOSAL PROCEDURES
BALANCED SCORECARD
BUSINESS PROCESS REENGINEERING
INTERNAL PREVENTIVE CONTROLS VERSUS COMPENSATING CONTROLS
SOFTWARE DEVELOPMENT APPROACHES: THE PROS & CONS
EMERGING PROCESSOR TECHNOLOGIES
EMERGING WIRELESS SECURITY STANDARDS
IM SECURITY
VOIP
HR AND SECURITY

Now comes with Practice Questions to drill you in computer security, controls, IS audit and policy concepts!!!

The Technical Drill Practice Test Module is designed for reinforcing learning objectives and validating knowledge so you know you're prepared to answer even the toughest questions on the CISA certification exam. You will find this module to be a challenging and effective tool that will help you learn how to recognize IS security threats and recommend proper security control and audit solutions.