Overview TECHIS Carry out security testing activities

Size: px
Start display at page:

Download "Overview TECHIS60441. Carry out security testing activities"

Transcription

1 Overview Information, services and systems can be attacked in various ways. Understanding the technical and social perspectives, how attacks work, the technologies and approaches used are key to being able to protect against attacks This standard covers the competencies required to conduct security testing under supervision. In order to contribute to the determination of the level of resilience of an information system to information security threats and vulnerabilities. Assisting applying testing methods, including penetration testing, assessing the robustness of an information system, against a coordinated attack. TECHIS

2 Performance criteria You must be able to: 1. be responsible for penetration testing in own area of work 2. develop and maintain security testing standards and procedures in line with organisational standards 3. tailor the scope of testing to meet business requirements 4. undertake information security tests, under controlled conditions, to assess vulnerabilities and compliance against relevant internal and/or external standards 5. use a range of appropriate methods, tools and techniques to conduct penetration testing for the systematic identification of vulnerabilities across multiple information systems 6. select and specify the most appropriate tools to be used during penetration testing 7. design and implement tests plans for networks and information systems in line with organisationalstandards 8. develop through life test programmes to assess whether security is maintained 9. lead and manage a penetration testing team, prioritising resource allocation and capability management ensuring that appropriate ongoing training and development is in place 10. scan information systems and networks for public domain vulnerabilities and assesses the potential for exploitation, where appropriate by conducting exploits. Reports potential issues and mitigation options 11. scan web applications and services for public domain vulnerabilities and assesses the potential for exploitation, where appropriate by conducting exploits. Reports potential issues and mitigation options 12. scan Wi-Fi networks for public domain vulnerabilities and assesses the potential for exploitation, where appropriate by conducting exploits 13. scan control systems and networks for public domain vulnerabilities and assesses the potential for exploitation, where appropriate by conducting exploits. Reports potential issues and mitigation options 14. report potential issues and mitigation options for security scanning operations 15. plan and execute social engineering attack exercises within an organisation or part thereof to assess the security awareness and culture 16. clearly and accurately scope and plan the information security test approach, prioritising testing activity to proactively target the most significant threats and vulnerabilities first 17. interpret information assurance requirements to produce information security test acceptance criteria TECHIS

3 carefully plan a context driven test approach to systematically test a system in order to validate its information security status design and develop accurate and clear test scripts, plans and acceptance criteria to ensure that information assurance requirements can be tested against relevant internal and/or external standards critically review the results of penetration testing and accurately identify specific vulnerabilities within any specified information system prioritise outcomes and recommend specific and timely action to address vulnerabilities identified as a result of information security testing clearly report on and communicate the results of information security testing, recommending mitigation actions ensure information security testing reports are high quality and relevant to the audience communicate the results of information security testing to a range of audiences justifying and evidencing any recommendations on security failures and non compliance TECHIS

4 Knowledge and understanding You need to know and understand: the specific threats that may be of particular importance to any particular information system how to organise a information security testing approach following standard procedures how to use the range of tools and techniques that can be applied for penetration testing relevant UK legislation and its impact on penetration testing (including computer misuse act 1990; human rights act 1998 data protection act 1998 police and justice act 2006 the latest information and data on a wide range of information security vulnerabilities the importance of ensuring that information security testing is designed to ensure testing of all aspects of information systems across the core principles: ( including confidentiality integrity availability authorisation authentication non repudiation ) the potential impact of the vulnerabilities identified on any information system and on the organisation where to find the latest information on vulnerabilities or exploits and can design tests to identify them TECHIS

5 Developed by e-skills Version Number 1 Date Approved January 2016 Indicative Review Date Validity Status Originating Organisation Original URN Relevant Occupations Suite Keywords April 2019 Current Original The Tech Partnership TECHIS60441 Information and Communication Technology; Information and Communication Technology Officer; Information and Communication Technology Professionals Information Security Information security, cyber security, penetration testing TECHIS

ESKISP6054.01 Conduct security testing, under supervision

ESKISP6054.01 Conduct security testing, under supervision Overview This standard covers the competencies required to conduct security testing under supervision. In order to contribute to the determination of the level of resilience of an information system to

More information

IT Professional Standards. Information Security Discipline. Sub-discipline 605 Information Security Testing and Information Assurance Methodologies

IT Professional Standards. Information Security Discipline. Sub-discipline 605 Information Security Testing and Information Assurance Methodologies IT Professional Standards Information Security Discipline Sub-discipline 605 Information Security Testing and Information Assurance Methodologies December 2012 Draft Version 0.6 DOCUMENT REVIEW Document

More information

ESKISP6055.01 Manage security testing

ESKISP6055.01 Manage security testing Overview This standard covers the competencies concerning with managing security testing activities. Including managing resources activities and deliverables. This includes planning, conducting and reporting

More information

ESKISP6053.01 Assist security testing, under supervision

ESKISP6053.01 Assist security testing, under supervision Overview This standard covers the competencies required to assist security testing under supervision. In order to contribute to the determination of the level of resilience of an information system to

More information

Overview TECHIS60241. Carry out risk assessment and management activities

Overview TECHIS60241. Carry out risk assessment and management activities Overview Information in all its forms is a vital component of the digital environment in which we live and work. The protection of information in its physical form is well understood but the protection

More information

ESKISP6056.01 Direct security testing

ESKISP6056.01 Direct security testing Direct security testing Overview This standard covers the competencies concerning with directing security testing activities. It includes setting the strategy and policies for security testing, and being

More information

ESKISP6064.03 Conducts vulnerability assessment under supervision

ESKISP6064.03 Conducts vulnerability assessment under supervision Conducts vulnerability assessment under supervision Overview This standard covers the competencies required to conduct vulnerability assessments under supervision. This includes following processes for

More information

Overview TECHIS60851. Manage information security business resilience activities

Overview TECHIS60851. Manage information security business resilience activities Overview Information security business resilience encompasses business continuity and disaster recovery from information security threats. As well as addressing the consequences of a major security incident,

More information

Overview TECHIS60341. Carry out security architecture and operations activities

Overview TECHIS60341. Carry out security architecture and operations activities Overview The protection of information, services and systems relies on a range of technical and procedural activities, often grouped in a framework. The framework will contain technical and logical, physical

More information

ESKITP2034.03 Assist in the preparation of change management plans and assignments for IT enabled systems 1

ESKITP2034.03 Assist in the preparation of change management plans and assignments for IT enabled systems 1 Assist in the preparation of change management plans and assignments for IT Overview This sub-discipline, Change Management (203) is concerned with the competencies required to manage the introduction

More information

ESKISP6046.02 Direct security architecture development

ESKISP6046.02 Direct security architecture development Overview This standard covers the competencies concerned with directing security architecture activities. It includes setting the strategy and policies for security architecture, and being fully accountable

More information

ESKITP714601 Authorise strategy, policies and standards relating to IT service delivery performance metrics management

ESKITP714601 Authorise strategy, policies and standards relating to IT service delivery performance metrics management service delivery performance metrics Overview This sub-discipline covers the competencies required to direct the monitoring, analysis and communication of IT service delivery performance metrics. Monitoring

More information

ESKITP2035.01 Identify change management opportunities and options for IT enabled systems 1

ESKITP2035.01 Identify change management opportunities and options for IT enabled systems 1 Identify change management opportunities and options for IT enabled Overview This sub-discipline, Change Management (203) is concerned with the competencies required to manage the introduction of business

More information

ESKITP6026 IT Security Management Level 6 Role

ESKITP6026 IT Security Management Level 6 Role Overview This sub-discipline is about the competencies required to ensure the security of all aspects of Information Technology services, systems and assets within an organisation. This includes the data,

More information

Committees Date: Subject: Public Report of: For Information Summary

Committees Date: Subject: Public Report of: For Information Summary Committees Audit & Risk Management Committee Finance Committee Subject: Cyber Security Risks Report of: Chamberlain Date: 17 September 2015 22 September 2015 Public For Information Summary Cyber security

More information

ESKITP714401 Implement procedures and standards relating to metrics for IT service delivery

ESKITP714401 Implement procedures and standards relating to metrics for IT service delivery Overview This sub-discipline covers the competencies required to perform performance metrics. Monitoring service level performance is a complex task requiring collection of data, detailed analysis, and

More information

ESKITP2035.02 Design and implement change management plans for IT enabled systems 1

ESKITP2035.02 Design and implement change management plans for IT enabled systems 1 Design and implement change management plans for IT enabled systems Overview This sub-discipline, Change Management (203) is concerned with the competencies required to manage the introduction of business

More information

Application Guidance CCP Penetration Tester Role, Practitioner Level

Application Guidance CCP Penetration Tester Role, Practitioner Level August 2014 Issue No: 1.0 Application Guidance CCP Penetration Tester Role, Practitioner Level Application Guidance CCP Penetration Tester Role, Practitioner Level Issue No: 1.0 August 2014 This document

More information

SFJCCAD2 Promote business continuity management

SFJCCAD2 Promote business continuity management Overview This unit is about providing advice and assistance on business continuity management, including general advice for the business and voluntary sectors, and specific advice and assistance to individual

More information

ESKITP7072 IT/Technology Capacity Management Level 2 Role

ESKITP7072 IT/Technology Capacity Management Level 2 Role Overview This sub-discipline is about the competencies required to manage the capacity of IT/technology services, systems and assets that support an organisation. Capacity management covers a range of

More information

GLASGOW SCHOOL OF ART OCCUPATIONAL HEALTH AND SAFETY POLICY. 1. Occupational Health and Safety Policy Statement 1

GLASGOW SCHOOL OF ART OCCUPATIONAL HEALTH AND SAFETY POLICY. 1. Occupational Health and Safety Policy Statement 1 GLASGOW SCHOOL OF ART OCCUPATIONAL HEALTH AND SAFETY POLICY CONTENTS PAGE 1. Occupational Health and Safety Policy Statement 1 2. Occupational Health and Safety Management System 2 3. Organisational Management

More information

FSPCOMP3 Assess and mitigate the compliance risks relevant to your organisation

FSPCOMP3 Assess and mitigate the compliance risks relevant to your organisation Assess and mitigate the compliance risks relevant to your Overview This unit is about assessing the probability and impact of compliance breaches occurring in your, and completing a risk assessment of

More information

Promote security system and service sales

Promote security system and service sales Page 1 of 5 Promote security system and service sales Level 3 Credits 2 Purpose This unit standard is for people who work, or intend to work, as security system or service sales representatives, or in

More information

ESKITP4082 IT/Technology Infrastructure Design and Planning Level 2 Role

ESKITP4082 IT/Technology Infrastructure Design and Planning Level 2 Role IT/Technology Infrastructure Design and Planning Level 2 Role Overview This sub-discipline is part of overall service design. It concerns the design of, and planning for, resilient IT/ technology infrastructure

More information

ESKITP6036 IT Disaster Recovery Level 5 Role

ESKITP6036 IT Disaster Recovery Level 5 Role Overview This sub-discipline is about the competencies required in order to manage all aspect of Disaster Recovery (DR), as it applies to IT within an organisation. ESKITP6036 1 Performance criteria You

More information

SFSMHS1 Receive mail safely and securely

SFSMHS1 Receive mail safely and securely SFSMHS1 Receive mail safely and securely Overview This standard sets out the skills, knowledge and understanding for mail handlers receiving mail of all types, doing so safely and securely, following organisational

More information

FSPAMFPI06 Complete reports for mortgage and/or financial planning clients

FSPAMFPI06 Complete reports for mortgage and/or financial planning clients Complete reports for mortgage and/or financial planning clients Overview You must be able to accurately complete reports of a complex nature, and take a proactive approach to the preparation of valuations

More information

The purpose of this Unit is to develop an awareness of the knowledge and skills used by ethical and malicious hackers.

The purpose of this Unit is to develop an awareness of the knowledge and skills used by ethical and malicious hackers. National Unit specification General information Unit code: H9HY 45 Superclass: CC Publication date: September 2015 Source: Scottish Qualifications Authority Version: 02 Unit purpose The purpose of this

More information

National Occupational Standards. Compliance

National Occupational Standards. Compliance National Occupational Standards Compliance NOTES ABOUT NATIONAL OCCUPATIONAL STANDARDS What are National Occupational Standards, and why should you use them? National Occupational Standards (NOS) are statements

More information

ESKITP6034 IT Disaster Recovery Level 4 Role

ESKITP6034 IT Disaster Recovery Level 4 Role Overview This sub-discipline is about the competencies required in order to manage all aspect of Disaster Recovery (DR), as it applies to IT within an organisation. ESKITP6034 1 Performance criteria You

More information

INFORMATION SECURITY TESTING

INFORMATION SECURITY TESTING INFORMATION SECURITY TESTING SERVICE DESCRIPTION Penetration testing identifies potential weaknesses in a technical infrastructure and provides a level of assurance in the security of that infrastructure.

More information

LEICESTERSHIRE COUNTY COUNCIL RISK MANAGEMENT POLICY STATEMENT 2011-2012

LEICESTERSHIRE COUNTY COUNCIL RISK MANAGEMENT POLICY STATEMENT 2011-2012 106 LEICESTERSHIRE COUNTY COUNCIL RISK MANAGEMENT POLICY STATEMENT 2011-2012 Leicestershire County Council believes that managing current and future risk, both opportunity and threat, is increasingly vital

More information

National Cybersecurity Assessment and Technical Services: Capability Brief. Presented by: Sean McAfee Updated: May 5, 2014

National Cybersecurity Assessment and Technical Services: Capability Brief. Presented by: Sean McAfee Updated: May 5, 2014 National Cybersecurity Assessment and Technical Services: Capability Brief Presented by: Sean McAfee Updated: May 5, 2014 Program Overview Offer Full-Scope Red Team/Penetration Testing Capabilities Services

More information

TRINIDAD AND TOBAGO CYBER SECURITY AGENCY POLICY AND BILL

TRINIDAD AND TOBAGO CYBER SECURITY AGENCY POLICY AND BILL TRINIDAD AND TOBAGO CYBER SECURITY AGENCY POLICY AND BILL Presented By: Sunita Ramsumair Legal Officer Ministry of National Security September 29, 2014 Format of Presentation Background Trinidad and Tobago

More information

SFJ EFSM14 Manage the performance of teams and individuals to achieve objectives

SFJ EFSM14 Manage the performance of teams and individuals to achieve objectives Manage the performance of teams and individuals to achieve objectives Overview This standard is about making the best use of your team and its members so that they can achieve your organisation's objectives.

More information

CFAMLE6 Ensure health and safety requirements are met in your area of responsibility

CFAMLE6 Ensure health and safety requirements are met in your area of responsibility Ensure health and safety requirements are met in your area of Overview This unit is concerned with managing the overall health and safety process in your area of. It is intended to go beyond meeting health

More information

Safety by trust: British model of cyber security. David Wallace, First Secretary, Head of of the Policy Delivery Group British Embassy in Warsaw

Safety by trust: British model of cyber security. David Wallace, First Secretary, Head of of the Policy Delivery Group British Embassy in Warsaw Safety by trust: British model of cyber security David Wallace, First Secretary, Head of of the Policy Delivery Group British Embassy in Warsaw Strategy Structure Campaign Partnerships Strategy The UK

More information

Developing Health and Independence. Pt 22-27, 19,621-22,958 (depending on experience)

Developing Health and Independence. Pt 22-27, 19,621-22,958 (depending on experience) Developing Health and Independence JOB DESCRIPTION Job Title: NJC Point: Hours: Scale Annual Leave: Location: Pension: Accountable to: Responsible for: Criminal Justice Worker Pt 22-27, 19,621-22,958 (depending

More information

ESKITP5023 Software Development Level 3 Role

ESKITP5023 Software Development Level 3 Role Overview This sub discipline covers the core competencies required to create software to address the needs of business problems and opportunities, resulting in a variety of software solutions, ranging

More information

ESKITP5022 Software Development Level 2 Role

ESKITP5022 Software Development Level 2 Role Overview This sub discipline covers the core competencies required to create software to address the needs of business problems and opportunities, resulting in a variety of software solutions, ranging

More information

Northern Ireland Social Care Council. Job Description

Northern Ireland Social Care Council. Job Description Northern Ireland Social Care Council Job Description Post: Location: Band: Reporting to: Responsible to: Head of Workforce Development Northern Ireland Social Care Council, 7 th Floor, Millennium House,

More information

Aberdeen City Council IT Security (Network and perimeter)

Aberdeen City Council IT Security (Network and perimeter) Aberdeen City Council IT Security (Network and perimeter) Internal Audit Report 2014/2015 for Aberdeen City Council August 2014 Internal Audit KPIs Target Dates Actual Dates Red/Amber/Green Commentary

More information

developing your potential Cyber Security Training

developing your potential Cyber Security Training developing your potential Cyber Security Training The benefits of cyber security awareness The cost of a single cyber security incident can easily reach six-figure sums and any damage or loss to a company

More information

COSCSMO18 - SQA Unit Code FM1T 04 Manage marketing and customer service

COSCSMO18 - SQA Unit Code FM1T 04 Manage marketing and customer service Overview This unit is about establishing and managing the Marketing and Customer Service process to meet organisational and business objectives. You will need to develop and implement a Marketing process

More information

ISO 27001 Information Security Management Services (Lot 4)

ISO 27001 Information Security Management Services (Lot 4) ISO 27001 Information Security Management Services (Lot 4) CONTENTS 1. WHY LEICESTERSHIRE HEALTH INFORMATICS SERVICE?... 3 2. LHIS TECHNICAL ASSURANCE SERVICES... 3 3. SERVICE OVERVIEW... 4 4. EXPERIENCE...

More information

ESKITP7102 IT/Technology Asset and Configuration Management Level 2 Role

ESKITP7102 IT/Technology Asset and Configuration Management Level 2 Role IT/Technology Asset and Configuration Management Level 2 Role Overview This sub-discipline is about the competencies required to maintain the integrity and consistency of the IT/technology configuration

More information

3. OPERATING COMPANY'S ANNUAL ROAD SAFETY REVIEW 1

3. OPERATING COMPANY'S ANNUAL ROAD SAFETY REVIEW 1 SCOTTISH MINISTERS' REQUIREMENTS 1. SCHEDULE 8 PART 3 ROAD SAFETY AND ACCIDENT INVESTIGATION AND PREVENTION CONTENTS Page No. 1. GENERAL 1 1.1 Introduction 1 2. ROUTE SAFETY FILES 1 3. OPERATING COMPANY'S

More information

DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABILITY ASSESSMENT AND NETWORK PENETRATION TEST JUNE 2009

DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABILITY ASSESSMENT AND NETWORK PENETRATION TEST JUNE 2009 DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABILITY ASSESSMENT AND NETWORK PENETRATION TEST JUNE 2009 AUDIT SUMMARY Our vulnerability assessment and network penetration test of the Department of Medical

More information

University of Liverpool

University of Liverpool University of Liverpool Information Security Review Policy Reference Number Title CSD-014 Information Security Review Policy Version Number 1.2 Document Status Document Classification Active Open Effective

More information

National Approach to Information Assurance 2014-2017

National Approach to Information Assurance 2014-2017 Document Name File Name National Approach to Information Assurance 2014-2017 National Approach to Information Assurance v1.doc Author David Critchley, Dave Jamieson Authorisation PIAB and IMBA Signed version

More information

National Cybersecurity Assessment and Technical Services

National Cybersecurity Assessment and Technical Services National Cybersecurity Assessment and Technical Services Updated: September 9, 2015 NCATS Program Overview Offer Full-Scope Red Team/Penetration Testing Capabilities through two primary programs: Risk

More information

CFAM&LBB2 Develop, maintain and evaluate business continuity plans and arrangements

CFAM&LBB2 Develop, maintain and evaluate business continuity plans and arrangements Develop, maintain and evaluate business continuity plans and arrangements Overview This standard is about developing, maintaining and evaluating business continuity plans to ensure that organisations continue

More information

Business Plan 2012/13

Business Plan 2012/13 Business Plan 2012/13 Contents Introduction 3 About the NFA..4 Priorities for 2012/13 4 Resources.6 Reporting Arrangements.6 Objective 1 7 To raise the profile and awareness of fraud among individuals,

More information

DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABLILITY ASSESSMENT AND NETWORK PENETRATION TEST

DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABLILITY ASSESSMENT AND NETWORK PENETRATION TEST DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABLILITY ASSESSMENT AND NETWORK PENETRATION TEST AS OF OCTOBER 2013 www.apa.virginia.gov (804) 225-3350 reports@apa.virginia.gov Audit Summary Our vulnerability

More information

ESKITP7074 IT/Technology Capacity Management Level 4 Role

ESKITP7074 IT/Technology Capacity Management Level 4 Role Overview This sub-discipline is about the competencies required to manage the capacity of IT/technology services, systems and assets that support an organisation. Capacity management covers a range of

More information

Security Testing for Web Applications and Network Resources. (Banking).

Security Testing for Web Applications and Network Resources. (Banking). 2011 Security Testing for Web Applications and Network Resources (Banking). The Client, a UK based bank offering secure, online payment and banking services to its customers. The client wanted to assess

More information

Policy. VBA Enterprise Risk Management. Governance Unit

Policy. VBA Enterprise Risk Management. Governance Unit Policy VBA Enterprise Risk Management Governance Unit Keywords: Policy; risk; governance. ID: Version no: Status: VBAPOL-0074 2.0 Final Issue date: Date of effect: Next review date: 14/07/2015 14/07/2015

More information

DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABILITY ASSESSMENT AND NETWORK PENETRATION TEST FEBRUARY 2007

DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABILITY ASSESSMENT AND NETWORK PENETRATION TEST FEBRUARY 2007 DEPARTMENT OF MEDICAL ASSISTANCE SERVICES VULNERABILITY ASSESSMENT AND NETWORK PENETRATION TEST FEBRUARY 2007 AUDIT SUMMARY Our vulnerability assessment and network penetration test of the Department of

More information

E-SECURITY REVIEW 2008 DISCUSSION PAPER FOR PUBLIC CONSULTATION

E-SECURITY REVIEW 2008 DISCUSSION PAPER FOR PUBLIC CONSULTATION 1. Introduction E-SECURITY REVIEW 2008 DISCUSSION PAPER FOR PUBLIC CONSULTATION Australia s national security and economic and social well-being rely upon the use and availability of a range of Information

More information

SCDSW19 Evaluate outcomes of social work practice

SCDSW19 Evaluate outcomes of social work practice Overview This standard is for social workers working with individuals, families, carers, groups and communities. Evaluation can easily be overlooked when new demands are constantly being presented, but

More information

DWP INFORMATION SECURITY POLICY

DWP INFORMATION SECURITY POLICY DWP INFORMATION SECURITY POLICY Contents Background... 1 Scope... 1 Accountabilities... 2 Policy Statements... 2 Responsibilities... 3 Background 1.1 DWP is committed to ensuring that effective security

More information

CYBER SECURITY TRAINING SAFE AND SECURE

CYBER SECURITY TRAINING SAFE AND SECURE CYBER SECURITY TRAINING KEEPING YOU SAFE AND SECURE Experts in Cyber Security training. Hardly a day goes by without a cyber attack being reported. With this ever-increasing threat there is a growing need

More information

Cyber Security : preventing and mitigating incidents. Alexander Brown Robert Allen

Cyber Security : preventing and mitigating incidents. Alexander Brown Robert Allen Cyber Security : preventing and mitigating incidents Alexander Brown Robert Allen 07 & 08 October 2015 Cyber Security context of the threat The magnitude and tempo of [cyber security attacks], basic or

More information

WHAT ARE THE BENEFITS OF OUTSOURCING NETWORK SECURITY?

WHAT ARE THE BENEFITS OF OUTSOURCING NETWORK SECURITY? WHAT ARE THE BENEFITS OF OUTSOURCING NETWORK SECURITY? Contents Introduction.... 3 What Types of Network Security Services are Available?... 4 Penetration Testing and Vulnerability Assessment... 4 Cyber

More information

Risk Management Policy

Risk Management Policy 1 Purpose Risk management relates to the culture, processes and structures directed towards the effective management of potential opportunities and adverse effects within the University s environment.

More information

JOB DESCRIPTION CONTRACTUAL POSITION

JOB DESCRIPTION CONTRACTUAL POSITION Ref #: IT/P /01 JOB DESCRIPTION CONTRACTUAL POSITION JOB TITLE: INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SECURITY SPECIALIST JOB SUMMARY: The incumbent is required to provide specialized technical

More information

External Supplier Control Requirements

External Supplier Control Requirements External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must

More information

ESKITP5022v2 Perform software development activities under direction

ESKITP5022v2 Perform software development activities under direction Perform development activities under direction Overview This sub discipline covers the core competencies required to create to address business problems and realise opportunities, resulting in a variety

More information

Qualification Specification. Level 4 Certificate in Cyber Security and Intrusion For Business

Qualification Specification. Level 4 Certificate in Cyber Security and Intrusion For Business Qualification Specification Level 4 Certificate in Cyber Security and Intrusion For Business ProQual 2015 Contents Page Introduction 3 Qualification profile 3 Centre requirements 4 Support for candidates

More information

Information Security Policy ISO 27001:2013 Version 2.6. June 2016

Information Security Policy ISO 27001:2013 Version 2.6. June 2016 Information Policy ISO 27001:2013 Version 2.6 June 2016 Information Policy A safe and secure working environment is fundamental to business success and we seek to protect our personnel, physical assets,

More information

ESKITP7022 IT/Technology Service Help Desk and Incident Management Level 2 Role

ESKITP7022 IT/Technology Service Help Desk and Incident Management Level 2 Role IT/Technology Service Help Desk and Incident Management Level 2 Role Overview This sub-discipline is about the competencies required to manage the contacts made by customers of IT/technology systems, services

More information

CYBER SECURITY AND RISK MANAGEMENT. An Executive level responsibility

CYBER SECURITY AND RISK MANAGEMENT. An Executive level responsibility CYBER SECURITY AND RISK MANAGEMENT An Executive level responsibility Cyberspace poses risks as well as opportunities Cyber security risks are a constantly evolving threat to an organisation s ability to

More information

Information Security Policy

Information Security Policy Information Security Policy Revised: September 2015 Review Date: September 2020 New College Durham is committed to safeguarding and promoting the welfare of children and young people, as well as vulnerable

More information

Cyber Security and Privacy Services. Working in partnership with you to protect your organisation from cyber security threats and data theft

Cyber Security and Privacy Services. Working in partnership with you to protect your organisation from cyber security threats and data theft Cyber Security and Privacy Services Working in partnership with you to protect your organisation from cyber security threats and data theft 2 Cyber Security and Privacy Services What drives your security

More information

¼ããÀ ããè¾ã ¹ãÆãä ã¼ãîãä ã ããõà ãäìããä ã½ã¾ã ºããñ à Securities and Exchange Board of India

¼ããÀ ããè¾ã ¹ãÆãä ã¼ãîãä ã ããõà ãäìããä ã½ã¾ã ºããñ à Securities and Exchange Board of India CIRCULAR CIR/MRD/DP/13/2015 July 06, 2015 To, All Stock Exchanges, Clearing Corporation and Depositories. Dear Sir / Madam, Subject: Cyber Security and Cyber Resilience framework of Stock Exchanges, Clearing

More information

Overview COSCSMO10. Implement, monitor and control strategic procurement systems in construction management

Overview COSCSMO10. Implement, monitor and control strategic procurement systems in construction management Overview This standard is about agreeing and implementing with stakeholders what systems are most effective for managing the project. The systems identified will need to be prioritised and formalised if

More information

Road map for ISO 27001 implementation

Road map for ISO 27001 implementation ROAD MAP 1 (5) ISO 27001 adopts the "Plan-Do-Check-Act" (PDCA) model, which is applied to structure all ISMS processes: PDCA Plan (establish the ISMS) Do (implement and operate the ISMS) Descriprion Establish

More information

Information Governance Strategy

Information Governance Strategy Information Governance Strategy THCCGCG9 Version: 01 The information governance strategy outlines the CCG governance aims and the key objectives of its governance policies. The Chief officer has the overarching

More information

Cyber threat intelligence and the lessons from law enforcement. kpmg.com.au

Cyber threat intelligence and the lessons from law enforcement. kpmg.com.au Cyber threat intelligence and the lessons from law enforcement kpmg.com.au Introduction Cyber security breaches are rarely out of the media s eye. As adversary sophistication increases, many organisations

More information

ANNEX. to the COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE

ANNEX. to the COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE EUROPEAN COMMISSION Brussels, 21.8.2014 COM(2014) 527 final ANNEX 1 ANNEX to the COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE

More information

Cyber Essentials Scheme

Cyber Essentials Scheme Cyber Essentials Scheme Requirements for basic technical protection from cyber attacks June 2014 December 2013 Contents Contents... 2 Introduction... 3 Who should use this document?... 3 What can these

More information

ESKITP7025 IT/Technology Service Help Desk and Incident Management Level 5 Role

ESKITP7025 IT/Technology Service Help Desk and Incident Management Level 5 Role IT/Technology Service Help Desk and Incident Management Level 5 Role Overview This sub-discipline is about the competencies required to manage the contacts made by customers of IT/technology systems, services

More information

Get Better Protected... Secure data sharing made possible with Updata s Encryption Overlay Service.

Get Better Protected... Secure data sharing made possible with Updata s Encryption Overlay Service. i Compliant Fully managed Encryption Overlay service enabling data sharing across secure networks. Provides operational efficiencies and cost savings through simplified procurement Get Better Protected...

More information

JOB DESCRIPTION. IS teams, Hanover colleagues, third party suppliers. Principal Duties and Responsibilities

JOB DESCRIPTION. IS teams, Hanover colleagues, third party suppliers. Principal Duties and Responsibilities JOB DESCRIPTION Job title: IT Security Analyst Grade: Responsible to: Responsible for: Liaises with: Head of IS N/A IS teams, Hanover colleagues, third party suppliers Role Purpose: Location: The purpose

More information

93% of large organisations and 76% of small businesses

93% of large organisations and 76% of small businesses innersecurity INFORMATION SECURITY Information Security Services 93% of large organisations and 76% of small businesses suffered security breaches in the last year. * Cyber attackers were the main cause.

More information

G- Cloud Specialist Cloud Services. Security and Penetration Testing. Overview

G- Cloud Specialist Cloud Services. Security and Penetration Testing. Overview Description C Service Overview G- Cloud Specialist Cloud Services Security and Penetration Testing This document provides a description of TVS s Security and Penetration Testing Service offered under the

More information

SecSDM: A Model for Integrating Security into the Software Development Life Cycle

SecSDM: A Model for Integrating Security into the Software Development Life Cycle SecSDM: A Model for Integrating Security into the Software Development Life Cycle Lynn Futcher, Rossouw von Solms Centre for Information Security Studies, Nelson Mandela Metropolitan University, Port Elizabeth,

More information

Cyber Security - What Would a Breach Really Mean for your Business?

Cyber Security - What Would a Breach Really Mean for your Business? Cyber Security - What Would a Breach Really Mean for your Business? August 2014 v1.0 As the internet has become increasingly important across every aspect of business, the risks posed by breaches to cyber

More information

FSPAMFPI01 Provide an administrative service for mortgage and/or financial planning clients

FSPAMFPI01 Provide an administrative service for mortgage and/or financial planning clients FSPAMFPI01 Provide an administrative service for mortgage and/or financial planning clients Overview You must be able to deal with clients as well as internal colleagues, whether you are responding to

More information

FSPPP07 Support the ongoing client relationship

FSPPP07 Support the ongoing client relationship Overview This standard is for those who provide paraplanning services to financial planners in the delivery of bespoke solutions to clients as part of the financial advice process. You must be able to

More information

Information Security Seminar 2013

Information Security Seminar 2013 Information Security Seminar 2013 Mr. Victor Lam, JP Deputy Government Chief Information Officer Office of the Government Chief Information Officer The Government of the Hong Kong Special Administrative

More information

Risk Management & Business Continuity Manual 2011-2014

Risk Management & Business Continuity Manual 2011-2014 ANNEX C Risk Management & Business Continuity Manual 2011-2014 Produced by the Risk Produced and by the Business Risk and Business Continuity Continuity Team Team February 2011 April 2011 Draft V.10 Page

More information

Sunderland City Council Review of Internal Audit June 2013

Sunderland City Council Review of Internal Audit June 2013 June 2013 Contents Introduction 2 Our approach 3 Main conclusions 4 Detailed findings 5 Our reports are prepared in the context of the Audit Commission s Statement of responsibilities of auditors and audited

More information

INFORMATION SECURITY POLICY

INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY INFORMATION SECURITY POLICY ISO 27002 5.1 Author: Owner: Organisation: Chris Stone Ruskwig TruePersona Ltd Document No: SP- 5.1 Version No: 1.0 Date: 10 th January 2010 Copyright

More information

G-Cloud Definition of Services Security Penetration Testing

G-Cloud Definition of Services Security Penetration Testing G-Cloud Definition of Services Security Penetration Testing Commercial in Confidence G-Cloud Services An Overview Inner Security is a leading CREST registered information security services provider. We

More information

Career proposition for software developers and web operations engineers

Career proposition for software developers and web operations engineers Career proposition for software developers and web operations engineers Introduction The Government Digital Service is at the centre of the digital transformation of government, making information and

More information

A Systems Approach to Protecting the U.S. Air Traffic Control System Against Cyber-Terrorism

A Systems Approach to Protecting the U.S. Air Traffic Control System Against Cyber-Terrorism A Systems Approach to Protecting the U.S. Air Traffic Control System Against Cyber-Terrorism Arthur Pyster Deputy Assistant Administrator for Information Services and Deputy Chief Information Officer arthur.pyster@faa.gov

More information

FINPP07 Support the ongoing client relationship

FINPP07 Support the ongoing client relationship Overview This unit is for those who provide paraplanning services to financial planners in the delivery of bespoke solutions to clients as part of the financial advice process. You must be able to support

More information

Penetration testing systems since 1989

Penetration testing systems since 1989 Pantone 641C Pantone 377C Penetration testing systems since 1989 Enex TestLab offers fully independent, cost effective and flexible penetration testing services. Our prices are compelling just ask but

More information

SFJPE1.3 Evaluate the effectiveness of the operational delivery business process

SFJPE1.3 Evaluate the effectiveness of the operational delivery business process Evaluate the effectiveness of the operational delivery business process Overview This standard concerns evaluating the effectiveness of new and adapted business processes. The scope of work needs to address

More information