Cybersecurity Auditing in an Unsecure World

Overview

Is your organization ready for a cyber-attack? Are you protecting your customer’s precious data? A few million dollars — that’s the average cost of a data breach to a U.S.-based company. It’s no surprise then that cybersecurity is a hot topic and a major challenge in internal auditing today. Cybersecurity is as much of a business risk as it is a security one, making it critical for internal auditors to develop the skill set needed to take on these challenges. In this course, you will develop an understanding of cybersecurity concepts that can be used to facilitate integrated audit efforts within your organization. Developed with and facilitated by leading industry experts, this course will examine preventive, detective, and corrective controls, and how to apply the audit process to a cloud environment. You will also be exposed to the mobile environment and cyber standards, as well as learn how to audit common security solutions.

Target Audience

This course is designed for internal auditors involved in integrated audits or those involved in audit activities that require an understanding of how to manage the impact of cybersecurity events on business risks.

Course Objectives

- Define cybersecurity from an audit perspective, including an understanding of its scope, limitations, and how to measure effectiveness. 

- Identify the purpose of preventive, detective, and corrective controls. 

- Understand cyber liability insurance and its impact on cybersecurity. 

- Understand cyber standards, state notification laws, and how they affect an organization.

- Understand how to assess an organization’s cyber capabilities from an attacker perspective, using threat modeling. 

- Assess cybersecurity risks and controls related to using cloud providers or third-party vendors

Course Content

- Overview of Cybersecurity

- Preventive Controls 

- Detective Controls 

- Corrective Controls 

- Cybersecurity Risks, Cyber Liability Insurance, and State Notification Laws 

- Applying the Audit Process to a Cloud Environment or Third-Party Service Provider 

- The Mobile Environment, Bring Your Own Device (BYOD), and Social Networking 

- Cyber Standards 

- Auditing Common Security Solutions

Prerequisites

This intermediate training program is tailored for auditors with a solid foundation in auditing practices. Participants are not required to have knowledge of cybersecurity; however, a basic understanding of IT concepts and risks is recommended.

Timing

7 October: 9am until 5pm

8 October: 9am until 1pm

4 November: 9am until 1pm