Security Program Development

-
Security Program Development

ISO/IEC 27000 Series : International standards on how to develop and maintain an ISMS developed by ISO and IEC.

Enterprise Architecture Development:

    1.     Zachman Framework : Model for the development of enterprise architectures developed by John Zachman.
    2.     TOGAF : Model and methodology for the development of enterprise architectures developed by The Open Group.
    3.     DoDAF : U.S. Department of Defense architecture framework that ensures interoperability of systems to meet military mission goals.
    4.     MODAF : Architecture framework used mainly in military support missions developed by the British Minsitry of Defence.
    5.     SABSA Model : Model and methodology for the development of information security enterprise architectures.
          
      Security Controls Development:

        1.     COBIT 5 : A business framework to allow for IT enterprise management and governance that was developed by Information Systems Audit and  Control Association (ISACA).
        2.     NIST SP 800-53 : Set of controls to protect U.S. federal systems developed by the National Institute of Standards and Technology.
        3.     COSO Internal Control-Integrated Framework : Set of internal corporate controls to help reduce the risk of financial fraud developed by the committee of Sponsoring Organizations (COSO) if the Treadway Commission.

          Process Management Development:

            1.     ITIL : Processes to allow for IT Service management developed by the United Kingdom's Office of Government Commerce.
            2.     Six Sigma : Business management strategy that can be used to carry out the process improvement.
            3.     Capability Maturity Model Integration (CMMI) : Organizational development for process improvement developed by Carnegie Mellon University. (I.R.D.M.O) - Initial, Repeatable, Defined, Managed, Optimized

                  
              ISO/IEC 27000 Series
                1.     ISO/IEC 27000 Overview and vocabulary
                2.     ISO/IEC 27001 ISMS requirements
                3.     ISO/IEC 27002 Code of practice for information security management
                4.     ISO/IEC 27003 ISMS implementation
                5.     ISO/IEC 27004 ISMS measurement
                6.     ISO/IEC 27005 Risk Management
                7.     ISO/IEC 27006 Certification body requirements
                8.     ISO/IEC 27007 ISMS auditing
                9.     ISO/IEC 27008 Guidance for auditors
                10.     ISO/IEC 27011 Telecommunications organizations
                11.     ISO/IEC 27014 Information security governance
                12.     ISO/IEC 27015 Financial sector
                13.     ISO/IEC 27031 Business continuity
                14.     ISO/IEC 27032 Cybersecurity
                15.     ISO/IEC 27033 Network security
                16.     ISO/IEC 27034 Application security
                17.     ISO/IEC 27035 Incident management
                18.     ISO/IEC 27037 Digital evidence collection and preservation
                19.     ISO/IEC 27799 Health organizations

                Comments

                Post a Comment

                Popular posts from this blog

                OIM 11g Custom ADF Application Development

                -
                Image
                In this post , I will cover the steps required to create a custom ADF web application. What this application does is facilitate Account Claim Process. Users has been migrated from some other IAM product to OIM and exist in disabled state and hence cannot login to perform Self Service operations. User needs to identify themselves by providing their personal details like personal identification number, zip code and dob etc. After successfully Identifying themselves they will be able to set a new password and set their challenge questions and answers. During this process the application will activate their account and set the new password and QnA. At the end of the process, they will be able to login OIM with their new password set. The application has been developed using JDeveloper using ADF technology to render user interfaces and MVC design pattern to keep the concerns separate. Application Structure                                                                                  
                Read more

                Oracle Identity Manager (OIM) Interview Questions

                -
                This is my 100th post on my blog and in this post, I will list down interview questions on OIM. This post will always be work in progress as I keep appending this list with more and more questions. Please find the list of questions below :-) What are the new features in PS3 ? What are the differences between PS2 and PS3 ? How do you identify rogue account creation in target system ? What is the high level architecture of OIM 11g ? List out difference between OIM 9.1 and 11g and possibly 11gR2 What are the new features in 11gR2 PS2 , PS3 How do you save multi-valued attribute in process form and how the linking happens between process form & child form ,   1 child form per multi valued attribute Can we still use entity adapters in OIM 11g What is pluginservice in oim 11g/  What is the orchestration service in oim 11g. what is the difference between entity match found  and process match found ? what are service accounts in oim ? why remote manager is used ? What is a c
                Read more

                OIM 11g R2 PS2 : SOA Approval Workflow Sample

                -
                Image
                In this post I am posting the sample code for a sample SOA approval workflow. Some of the features that this workflow addresses are Approval to Manager or Role Owners is dynamic based on the custom OIM system property "approval-condition". Value is set either "AND" or "OR". Manager or Role Owner can be set to be notified only with no approval required. In this case only email is sent to notify them but no approval is required from them. Custom OIM system property are created to address this.   manager-notify-only = TRUE or FALSE  TRUE = only notify the manager no approval request sent. FALSE = notify the manager and send an approval request.   roleowner-notify-only = TRUE or FALSE  TRUE = only notify the role owner no approval request sent. FALSE = notify the role owner and send an approval request. Third Level System Notification was required but it should be dynamic.  Custom OIM system property are created to address this sysadmin-noti
                Read more