Access Control, Authentication, And Public Key Infrastructure Training

Access Control Framework

• Access and access control
• Principal components of access control
• Access control process
• Logical access controls
• Authentication factors

Assessing Risk and Its Impact on Control

• Definitions and concepts
• Threats and vulnerabilities
• Risk assessment
• Value, situation and liability
• Case studies and examples

Business Drivers for Access Control

• Business requirements for asset protection
• Classification of information
• Competitive use of information
• Business drivers
• Controlling access and protecting value
• Examples of access control successes and failures in business

Access Control Policies , Standards, Procedures, and Guidelines

• U.S. compliance laws and regulations
• Access control security policy best practices
• IT security policy framework
• Examples of access control policies, standards procedures and guidelines

Security Breaches and the Law

• Laws to deter information theft
• Cost of inadequate front-door and first-layer access controls
• Access control failures
• Security breaches

Mapping Business Challenges to Access Control Types

• Access controls to meet business needs
• Solving business challenges with access control strategies
• Case studies and examples

Human Nature and Organizational Behavior

• The human element
• Organizational structure and access control strategy
• Job rotation and position sensitivity
• Requirement for periodic vacation
• Separation of duties
• Responsibilities of access owners
• Training employees
• Ethics
• Best practices for handling human nature and organizational behavior
• Case studies and examples

Access Control for Information Systems

• Access control for data
• Access control for file systems
• Access control for executables
• Microsoft Windows workstations and servers
• UNIX and Linux
• Supervisory Control and Data Acquisition (SCADA) and process control systems
• Best practices for access control for information systems
• Case studies and examples

Physical Security and Access Control

• Physical security
• Designing a comprehensive plan
• Biometric access control systems
• Technology-related access control solutions
• Outsourcing physical security – pros and cons
• Best practices for physical access control
• Case studies and examples

Access Control in the Enterprise

• Access Control Lists (ACLs) and Access Control Entries (ACEs)
• Access control models
• Authentication factors
• Kerberos
• Network access control
• Wireless IEEE 802.11 LANs
• Single Sign-On (SSO)
• Best practices for handling access controls in an enterprise organization
• Case studies and examples

Access Control System Implementations

• Transforming access control policies and standards into procedures and guidelines
• Identity management and access control
• Size and distribution of staff and assets
• Multilayered access control implementations
• Access controls for employees, remote employees, customers and business partners
• Best practices for access control implementations
• Case studies and examples

Access Control Solutions for Remote Workers

• Growth in the mobile work force
• Remote access methods and techniques
• Access protocols to minimize risk
• Remote authentication protocols
• Virtual Private Networks (VPNs)
• Web authentication
• Best practices for remote access controls to support remote workers
• Case studies and examples

Public Key Infrastructure and Encryption

• Public Key Infrastructure (PKI)
• Ensuring integrity, confidentiality, authentication and non-repudiation
• What PKI is and what it is not
• What are the potentials risks associated with PKI?
• Implementations of business cryptography
• Certificate Authorities (CA)
• Best practices for PKI use within large enterprises and organizations
• Case studies and examples

Testing Access and Control Systems

• Purpose of testing access control systems
• Software development life cycle and the need for testing software
• Security development life cycle and the need for testing security systems
• Information security activities
• Performing the access control system penetration test
• Preparing the final test report

Access Control Assurance

• What is the information assurance>
• How can information assurance be applied to access control systems?
• What are the goals of access control system monitoring and reporting?
• What checks and balances can be implemented?
• Audit trail and audit log management and parsing
• Audit trail and audit log reporting issues and concerns
• Security Information and Event Management (SIEM)
• Best practices for performing ongoing access control system assurance
• Case studies and examples