Contribute to operational security management activities
TECHIS60531
This standard covers the competencies required to contribute to secure operations management activities
under supervision. This includes:
- reacting to new threats and vulnerabilities,
- implementing processes for maintaining the security of information throughout its lifespan,
- applying security operating procedures in accordance with security policies and standards.
Performance Criteria
1. assist in identifying and assessing new vulnerabilities and potential security violations to
information assets
2. take appropriate and timely action to report incidents in line with organisational procedures
3. operate with integrity and confidentiality during information assurance activities
4. identify when and how to seek advice and guidance from other individuals during information
assurance activities
5. carry out operational security management activities in line with organisational requirements
Knowledge and Understanding
1. the processes, procedures, methods, tools and techniques relating to identifying information
systems vulnerabilities
2. where to source the policies and standards that are relevant to information systems operations
security activities
3. the range of examples of information security issues that information security operations
management seeks to protect against
4. how to interpret organisational information security policies and standards that apply to
information systems operations and apply them
5. what is meant by information assurance and information security operations management
6. what are the roles and responsibilities of the information assurance and security functions within
the organisation and the impact of off-shoring on those
7. the importance of the need to report and respond to security incidents rapidly and effectively
following organisational policies and standards
8. the need to implement basic technical vulnerability assessments and corrections
9. what is meant by the following core principles of information security: confidentiality; integrity;
availability; authorisation; authentication; non repudiation
10. what is meant by a vulnerability the need for information systems activities to be carried out in
accordance with organisational information security standards
Carry out operational security management activities
TECHIS60541
This standard covers the competencies required to implement secure operations management activities
under supervision. This includes reacting to new threats and vulnerabilities.
Establish processes for maintaining the security of information throughout its lifespan. Develop,
implement and maintains security operating procedures in accordance with security policies and
standards.
Performance Criteria
1. correctly identify and document the information assets that need to be to protected in line with
organisational standards
2. verify that applicable security patches and upgrades are implemented according to the
organisation's policy and standards
3. diagnose and resolve information security problems in response to reported incidents
4. install and operate information systems in accordance with organisational information security
policies and standards
5. monitor and evaluate the effectiveness of the organisation's information security procedures and
safeguards for information systems
6. effectively communication security issues and advice to managers and others
7. establish processes and operating procedures for maintaining the security of information
throughout its existence in accordance with security policies, standards and procedures
8. assess and respond to new technical, physical, personnel or procedural vulnerabilities
Knowledge and Understanding
1. where to source security records and documentation
2. how to identify and apply processes, procedures, methods, tools and techniques relating to
security operations management
3. who the administrator level and technical staff are to maintain secure access and to resolve
information security problems
4. the specific security procedures required for implementing security controls as required by
organisational policy and standards
5. the need to monitor and test that information security standards are correctly applied
6. the potential implications of the deliverables from information security operations management
activities being incorrect, inadequate and/or inappropriate
7. why the ongoing quality and effectiveness of information security operations management
activities need to be managed and monitored
8. the importance of considering both physical and non-physical controls that need to be applied in
order to secure information assets the need to maintain security records and documentation
Manage operational security management activities
TECHIS60551
This standard covers the competencies required to manage all aspects of secure operations and service delivery.
Establish processes for maintaining the security of information throughout its lifespan. Develop, implement and
maintains security operating procedures in accordance with security policies and standards. Manage the
implementation of information security operations, and co-ordinate information security operations activities across
the organisation.
Performance Criteria
1. manage the implementation of information security programmes, and co-ordinate security
activities across the organisation in line with organisational requirements
2. manage all aspects of a security programme, including reacting to new threats and vulnerabilities,
secure operational and service delivery consistent with security policies, standards and procedures
3. ensure that operations and service delivery activities align together and with appropriate
organisational strategy, policy and standards relating to the security of information assets
4. analyse instances of non-compliance to procedures and take appropriate administrative or
technological action to correct and minimise security risks
5. lead development of operations procedures used across multiple information systems in line with
organisational procedures
6. ensure consistency across security operations in order to deliver cost-effective security implement
and maintain the standards and procedures for managing secure operations and service delivery
across the full range information systems
7. routinely monitor operational security provision, taking action to address potential vulnerabilities
8. develop and implement the necessary information security operations management plans and
procedural documentation to ensure that information security incidents are avoided during
ongoing operations and shutdown/closure of information systems
9. design, implement and monitor the user access rights management framework for the full range of
information systems
10. manage the review cycle for security operations, taking into account information from incidents,
vulnerability assessments, penetration tests, threat assessments and changes to relevant
legislation and regulations
11. raise awareness of security operations across the organization
12. routinely evaluate compliance to legal, regulatory, contractual and organisational requirements for
the security of information assets, report the results to sponsors, stakeholders and other
internal/external individuals and bodies provide advice regarding security operations management
activities
Knowledge and Understanding
1. how to write and maintain procedures required to ensure security of the organisation's
information infrastructure
2. the specific requirements for the protection and security of customer/business information assets
3. the results from any security incidents, vulnerability assessments, penetration tests, threat
assessments and the actions taken to mitigate, relevant to inform future information system
operations management
4. how to ensure alignment of information system security operating processes and procedures to
ensure that they provide cost effective security provision
5. how to influence sponsors and stakeholders to resource security operation management activities
to ensure ongoing compliance with security requirements
6. the importance of ensuring that operational environments apply and maintain appropriate levels of
security in line with standards and procedures
7. the fact that information security requirements may form part of specific service level and
operational level agreements for information systems
8. the detailed content and relevance of organisational policies and standards for security operations
management
9. the importance of reviewing and updating operating procedures for information security
operations management
10. the need to maintain up to date security records and documentation
11. the need to manage the review cycle for information system
Contribute to vulnerability assessments
TECHIS60532
This standard covers the competencies required to assist conducting vulnerability assessments under supervision. This
includes following processes for planning and undertaking vulnerability assessments under supervision.
Performance Criteria
1. source, gather and collate information and data about the vulnerabilities in specified information
systems and assets
2. review information on emerging vulnerabilities and determine their importance
3. identify when and how to seek advice and guidance from other individuals during vulnerability
assessment activities
4. carry out vulnerability assessment activities in line with organisational requirements
5. monitor data from protective monitoring systems to identify potential exploitation of
vulnerabilities
6. communicate relevant stakeholders on the need to respond to new vulnerabilities
7. identify information systems that are vulnerable to attack
8. recommend mitigating actions for new vulnerabilities
9. assist in documenting the outcomes of vulnerability assessments
Knowledge and Understanding
1. the range of information assets on which vulnerability assessments need to be conducted
2. the range of vulnerabilities that may compromise an organisation's infrastructure and information
assets
3. the processes, procedures, methods, tools and techniques relating to vulnerability assessment
activities and their deliverables
4. the range of scanning and testing activities that can be used to identify vulnerabilities in an
organisation's information systems and assets
5. the purpose of vulnerability assessments in maintaining information security
6. the role of vulnerability assessment activities in information security provision
7. how to source current vulnerability information
8. the processes and procedures that need to be followed when undertaking vulnerability
assessments
Carry out vulnerability assessments
TECHIS60542
This standard covers the competencies required to conduct vulnerability assessments under supervision.
This includes following processes for planning and undertaking vulnerability assessments under
supervision.
Performance Criteria
1. select and apply the most appropriate methods and tools to be used for vulnerability assessments
in line with organisational standards
2. clearly and accurately identify specific vulnerabilities within target information systems
3. critically review the results of vulnerability assessments, identifying priorities for action where
appropriate
4. assess vulnerability intelligence in order to determine the potential impact to the organisation's
information systems infrastructure
5. ensure the preservation of information integrity where vulnerabilities have been identified
6. communicate vulnerability assessment outputs informing appropriate stakeholders of the impact
and potential resolutions
7. prioritise and recommend improvements to the organisation's information systems infrastructure
and assets to reduce the risks associated with identified vulnerabilities
8. ensure that agreed improvements to the organisation's information systems infrastructure and
assets are implemented in a timely manner
Knowledge and Understanding
1. the range of information assets on which vulnerability assessments need to be conducted
2. the range of vulnerabilities that may compromise an organisation's infrastructure and information
assets
3. the range of scanning activities that can be used to identify vulnerabilities in an organisation's
information systems
4. how to monitor and assess information and data in external vulnerability reports to ensure
relevance to the organisation, ensuring that relevant vulnerabilities are identified and rectified
5. how to distribute warning material to relevant operations functions relating to security
vulnerabilities in a timely manner and suitable for the target audience
6. how to present and communicate vulnerability detection and mediation activities to sponsors and
stakeholders
7. how to design, develop, implement and report on metrics for monitoring the level and significance
of information system vulnerabilities
8. how to identify the potential business impacts if vulnerabilities are exploited
9. the relationship between vulnerability assessments, security audits/reviews and risk management
activities
10. the fact that new threats and vulnerabilities may emerge at any time
11. the importance of prioritising vulnerabilities and recommend specific and timely action to address
identified vulnerabilities
12. the importance of proactively identifying vulnerabilities within the organisation's information
systems
13. the role of vulnerability assessment activities in informing and directing countermeasures to
maintain and reinforce information security provision
14. the importance of ensuring that processes and procedures are implemented and followed to
restrict the knowledge of new vulnerabilities externally until appropriate remediation or mitigation
is available
Manage vulnerability assessments
TECHIS60552
This standard covers the competencies required to manage vulnerability assessment activities. This includes managing
resources, activities, deliverables and defining and implementing organisational policies, standards and processes.
Performance Criteria
1. be accountable for undertaking accurate security vulnerability assessments on information systems
2. develop, implement and maintain plans, processes, procedures, methods, tools and techniques for
vulnerability assessment activities and their deliverables
3. clearly and accurately define the scope of vulnerability assessment activities, adjusting the process
to suit specific contexts
4. select and apply the most appropriate methods and tools to be used during vulnerability
assessments
5. set the resourcing and training plan for vulnerability assessment activities
6. identify, source and secure the most appropriate resources to conduct specialised vulnerability
assessment activities
7. be responsible for designing, implementing and reporting metrics for monitoring information
system vulnerabilities effectiveness
8. critically review the results of vulnerability assessments, identifying priorities for action where
appropriate
9. verify and validate new potential vulnerabilities that may impact on the organisation's information
assets
10. monitor the quality and effectiveness of vulnerability assessment activities, critically reviewing the
vulnerability assessment process and making recommendations for improvement where
appropriate
11. advise and guide others on all aspects of vulnerability assessment activities and their deliverables
12. effectively communicate vulnerability assessment status and results to a wide range of sponsors,
stakeholders and other individuals
Knowledge and Understanding
1. need to ensure that the most appropriate resources from within the organisation conduct
vulnerability assessment activities
2. how to examine information system vulnerabilities and determine actions to mitigate them
3. how to develop and implement effective vulnerability countermeasures
4. the need to ensure that vulnerability evaluations are performed on an ongoing basis
5. information on latest identified threats, vulnerabilities and exposures
6. the organisational, external standards, best practice frameworks and codes of conduct that
vulnerability assessment should comply with
7. how to analyse and assess internal problem reports for signs of vulnerabilities
8. how to engage proactively with stakeholders to ensure that mitigation for vulnerabilities are
understood and processes in a timely manner
9. how to ensure that processes and procedures are implemented and followed to restrict the
knowledge of new vulnerabilities until appropriate remediation or mitigation is available
10. how to maintain lists of authorised or banned applications or devices for use on protective
monitoring systems
11. the range of methods for performing vulnerability assessments and the outputs they produce
12. the need to critically review the results of vulnerability assessments, identifying priorities for action
where appropriate
13. how to analyse information security vulnerability bulletins for their potential impact on information
systems and undertake or recommends appropriate action
14. the importance of monitoring the quality and effectiveness of vulnerability assessment activities
15. how to identify and implement improvements to the vulnerability assessment processes and
procedures
Contribute to identity and access management activities
TECHIS60533
Identity and access management (IAM) deals with how users within an organisation are given an identity
and how it is protected. It also included protecting critical applications, data and systems from
unauthorised access, and managing access rights of people both inside and outside the organisation. This
is especially important in the light of recent trends towards bring-your-own-device, cloud computing,
mobile apps and an increasingly mobile workforce. Identity and access management involves protecting
our data assets and implementing processes and procurement standards to run organisations more
intelligently.
This standard involves the competencies associated with contributing to effective operation of identity
and access management systems, and managing access to different sets of information and systems across
an organisation. As employees migrate through different roles and require different access rights within
and across organisation, and it becomes more difficult to manage identity and access.
Performance Criteria
1. use identity and access management tools and methods in line with organisational standards
2. configure and implement custom extensions to identity and access management tools to meet
organisational requirements
3. implement account provisioning processes to ensure that the creation of user accounts and access
to software and data is in line with organisational policies and standards
4. assist with the identification and resolution of identity and access issues in line with
organisational requirements
5. assist with identity and access management integration across systems and applications to meet
business requirements
6. implement upgrades and manage patch status for the identity and access management
infrastructure in line with organisational standards
Knowledge and Understanding
1. what is meant by identity and access management and how to implement it
2. that an identity access management (IAM) system can be used to initiate, capture, record and
manage user identities and their related access permissions in an automated fashion
3. the main features of an identity and access management system that facilitates the management
of electronic identities and access privileges
4. that XACML (eXtensible Access Control Markup Language) is an open standard designed to express
security policies and access rights to information for Web services, digital rights management
(DRM), and enterprise security applications
5. that there are a range of supporting technologies and protocols relevant to identity and access
management including Linux administration, Hypertext Transfer Protocol (HTTP), XML, LDAP, and
SQL
6. that identity management relates to user account provisioning and workflow processes
7. that access management concerns authentication and entitlement to access different systems and
data across an organisation
8. that data security and privacy concerns database access to specific datasets
9. that access privileges are granted according to a consistent interpretation of policy and all
individuals and services are properly authenticated, authorized and audited
10. what the underlying database structure that is used in information systems access privileges is in
order to successfully manage identities and access.
11. how to implement multiple authentication techniques
Carry out identity and access management activities
TECHIS60543
Identity and access management (IAM) deals with how users within an organisation are given an identity
and how it is protected. It also included protecting critical applications, data and systems from
unauthorised access, and managing access rights of people both inside and outside the organisation. This
is especially important in the light of recent trends towards bring-your-own-device, cloud computing,
mobile apps and an increasingly mobile workforce. Identity and access management involves protecting
our data assets and implementing processes and procurement standards to run organisations more
intelligently.
This standard involves the competencies associated with effective implementation, operation and
management of identity and access management systems. This includes ensuring that company data is not
at risk from being compromised by those who do not have authority to access it within an enterprise
environment that may have diverse requirements for associated data access privileges. It also includes
revoking access privileges when they change or are no longer required.
Performance Criteria
1. define the user roles and access controls necessary to meet organisational requirements
2. determine how to make best use of available identity and access management infrastructure tools
for overall information resilience
3. implement identity and access management policies and standards in line with organisational
requirements
4. provide guidance to others on the identity and access management architecture in line with
organisational needs
5. review the identity and access management infrastructure for alignment with changing business
needs
6. monitor the operation of access controls for compliance with internal and external standards and
regulations
7. prioritise and recommend improvements to the identity and access management infrastructure
8. produce deployment models and architectures for applications to be managed
9. evaluate the impact of future requirements on the identity and access management infrastructure
Knowledge and Understanding
1. the importance of designing and maintaining user roles that are closely correlated with the security
status of data and applications accessed through information systems across the organisation
2. what the organisational security architecture is and how to apply this
3. how to customise the identity and access management system to align to business processes and
the security architecture
4. how to analyse and modify the underlying database structure that is used in information systems
access privileges
5. what the organisational structure and management processes for identities of employees,
contractors, customers and other constituents is
6. the range of tools and techniques that are used for identity and access management and how to
apply them
7. the organisational polices and standards that are used for identity and access management and
how to apply them
8. the need to ensure that identity and access management operations align to changing business
needs
9. the need to modify access controls in line with employees changing responsibilities, including
removal of access when no longer required
10. the importance of monitoring access controls in relation to regulatory compliance for sensitive data
11. how to identify possible future requirements for the identity and access management
infrastructure
Manage identity and access management activities
TECHIS60553
Identity and access management (IAM) deals with how users within an organisation are given an identity
and how it is protected. It also included protecting critical applications, data and systems from
unauthorised access, and managing access rights of people both inside and outside the organisation. This
is especially important in the light of recent trends towards bring-your-own-device, cloud computing,
mobile apps and an increasingly mobile workforce. Identity and access management involves protecting
our data assets and implementing processes and procurement standards to run organisations more
intelligently.
This standard involves the competencies associated with managing identity and access management
activities. This includes setting policies and standards and ensuring that identity and access management
processes are dynamic and respond to changing security status of data and information systems and also
ensure that intruders cannot gain access to systems or to user accounts, especially those with excessive
privileges to prevent data loss or theft.
Performance Criteria
1. implement information security policies, controls and standards for identity and access
management in line with organisational requirements
2. develop the identity and access management aspects of security architectures to support large user
communities with complex information authorisation rules and requirements
3. identify and review all compliance mandates (including privacy regulations) to which the
organisation is subject in a timely manner
4. regularly review organisational compliance with internal and external standards and regulations
5. evaluate and recommend new identity and access management security technologies, processes
and methodologies in line with business needs
6. ensure that all relevant staff are trained in the implementation and operation of identity and
access security systems in line with organisational standards
7. monitor adherence to identity and access management controls in line with organisational
standards
Knowledge and Understanding
1. how to define the identity and access management architecture
2. the importance of aligning identity and access management initiatives to business processes
3. the need to monitor identity and access management controls and ensure regulatory compliance
to required standards
4. how to apply performance metrics to identity and access management activities and their
deliverables
5. how to select and acquire technologies and vendors/service providers for identity and access
management
6. what the organisations current identity and access management capabilities are
7. how to identify technology and service gaps needing functional improvement
8. the need to keep up to date on the shifting compliance landscape
9. the importance of gaining management agreement on the vision and mandate behind the strategy
and policies for identity and access management
10. the need to establish appropriate resources, budget and governance systems for identity and
access management