EDUCAUSE | Security Certification

Implementing Information Security Governance Using ISO 27000

ckeller — Thu, 02 Oct 2008 17:19:41 -0500

GSU's CIO sponsored the ISO 27001 certification initiative at Georgia State University in mid 2007 and the Information Security Department and Office of Disbursements were the first GSU departments to be included. We were successful in obtaining the certification in March 2008, which is a very prestigious achievement given that our university is one of the first (if not the first) in the nation to be awarded this
international designation.

Information Security Governance: Standardizing the Practice of Information Security

ckeller — Tue, 19 Aug 2008 09:05:37 -0500

This ECAR research bulletin discusses the trend to use a variety of risk assessment frameworks and standards to create an information security program that is sufficiently comprehensive for colleges and universities. These standards include the Control Objectives for Information and related Technology (CobiT) IT control framework, the Information Technology Infrastructure Library (ITIL) service management framework, and the set of information control objectives now commonly referred to as ISO 27001. In specific, the process of implementing this framework at Georgia State University (GSU) is discussed. In addition, the bulletin provides a rationale for an information security governance framework that enables executives to see the degree to which their information security programs are effective in assessing and mitigating risks, protecting confidential data, aligning goals with institutional academic and business objectives, and continuously improving over time.

Citation for this work: Clark, Tammy L., and Toby D. Sitko “Information Security Governance: Standardizing the Practice of Information Security” (Research Bulletin, Issue 17). Boulder, CO: EDUCAUSE Center for Applied Research, 2008, available from http://www.educause.edu/ecar.

Security Certifications in Higher Education

Rodney — Tue, 27 Nov 2007 14:22:03 -0600

The Security Task Force has created a resource page that provides information about security certifications, including links to known security certifications (under the heading of "Community Resources"). Please contact us if we are missing any known security certifications.

According to the 2006 security survey conducted by the EDUCAUSE Center for Applied Research (Safeguarding the Tower: IT Security in Higher Education), the following information is available regarding security certifications by IT security staff at colleges and universities:

18% of the respondents indicated that the person in charge of IT security holds one IT security certificate
3% of those in charge of IT security hold two certificates
3% of those in charge of IT security hold three certificates

Of the individuals who have certification, the following information available:

15.3% hold the Certified Information Systems Security Professional (CISSP) certificate;
5.5% hold the Certified Information Security Manager (CISM) certificate;
5.2% hold the Global Information Assurance Certification (GIAC);
2.4% hold the Certified Information Systems Auditor (CISA) certificate; and
14.9% hold other security certifications

The Security Task Force Awareness and Training Working Group is continuing to promote security training for IT staff and evaluate the role of security certifications in establishing credentials that advance the IT security profession in higher education. Your comments and suggestions are welcome.

IT Security Essential Body of Knowledge: A Competency and Functional Framework for IT Security Workforce Development

ckeller — Wed, 14 Nov 2007 12:06:50 -0600

The Department of Homeland Security's National Cyber Security Division worked with subject matter experts from government, the private sector, and academia to develop an umbrella framework that establishes a national baseline representing the essential knowledge and skills IT security practitioners must have to perform their jobs. The IT Security EBK builds directly on established work and is not intended to represent a standard, directive, or policy by DHS. Instead, it further clarifies key IT security terms and concepts for well-defined competencies, identifies notional security roles, and defines primary functional perspectives to help advance the IT security training and certification landscape as we strive to ensure that we have the most qualified and appropriately trained IT security workforce possible.

Tune In Nov. 14: Free Web Seminar on IT Security Essential Body of Knowledge for Workforce Development

vvogel — Thu, 08 Nov 2007 16:15:57 -0600

This free November 14 EDUCAUSE Live! Web seminar, IT Security Essential Body of Knowledge: A Competency and Functional Framework for IT Security Workforce Development, features presenter Brenda Oldfield, Director of Education, Training, and Workforce Development, Office of Cyber Security and Communications, U.S. Department of Homeland Security.

Those unable to attend may wish to visit the archives after the event or browse related EDUCAUSE resources:

Tune In Nov. 14: Free Web Seminar on IT Security Essential Body of Knowledge for Workforce Development

cluckett — Wed, 07 Nov 2007 17:18:53 -0600

This free November 14 EDUCAUSE Live! Web seminar, IT Security Essential Body of Knowledge: A Competency and Functional Framework for IT Security Workforce Development, features presenter Brenda Oldfield, director of education, training, and workforce development, office of cyber security and communications, U.S. Department of Homeland Security,

Those unable to attend may wish to visit the archives after the event or browse related EDUCAUSE resources:

Information Technology (IT) Security Essential Body of Knowledge (EBK): A Competency and Functional Framework for IT Security Workforce Development

ckeller — Tue, 09 Oct 2007 12:45:08 -0500

This federal register notice informs the public and interested stakeholders that the Department of Homeland Security (DHS) is making available for public review and comment ``Information Technology (IT) Security Essential Body of Knowledge (EBK): A Competency and Functional Framework for IT Security Workforce Development.'' This framework is intended to assist the public, private, and academic sectors with strategic IT security workforce development initiatives including professional development, training and education. The EBK is not an additional set of DHS guidelines, and it is not intended to represent a standard, directive, or policy by DHS. Instead, it further clarifies key IT security terms and concepts for well-defined competencies, identifies notional security roles, defines four primary functional perspectives, and establishes an IT Security Role, Competency, and Functional Matrix.

IT Security Essential Body of Knowledge: Federal Register Notice Request for Comments

Rodney — Tue, 09 Oct 2007 11:20:50 -0500

A Federal Register Notice has been published for the Department of Homeland Security's "Information Technology (IT) Security Essential Body of Knowledge (EBK): A Competency and Functional Framework for IT Security Workforce Development." The deadline for comments is December 7, 2007.

According to the Notice:

The EBK is not an additional set of DHS guidelines, and it is not intended to represent a standard, directive, or policy by DHS. Instead, it further clarifies key IT security terms and concepts for well-defined competencies, identifies notional security roles, defines four primary functional perspectives, and establishes an IT Security Role, Competency, and Functional Matrix.

More information, including a downloadable version of the IT Security EBK, is available at http://www.us-cert.gov/ITSecurityEBK/

There will be a briefing for the higher education sector with Brenda Oldfield from DHS as part of an EDUCAUSE Live on November 14, 2007, at 1 p.m.

Certified Internet Web Professional Program - Security Professional

ckeller — Tue, 28 Aug 2007 15:24:35 -0500

The CIW Security Professional exam focuses on management and deployment of e-business transaction and payment security solutions. This certification validates knowledge and skills in implementing e-business security policies; identifying security threats; developing countermeasures using firewall systems and attack-recognition technologies; and managing the deployment of security solutions.

Check Point Certifications

ckeller — Tue, 28 Aug 2007 15:33:20 -0500

Check Point training and certification provides over a dozen security certifications.