Information and analytical support for business security. Business (competitive) intelligence. Information security audit and policy

Programme

Information and analytical support of business security

Business (competitive) intelligence

• Basic principles of business (competitive) intelligence. Main tasks of business (competitive) intelligence. Lawful methods of collecting and analysing information. Legal and ethical norms of conducting business intelligence
• Business (competitive) intelligence and industrial espionage
• Main directions of business (competitive) intelligence. Subjects of interest in the strategic and operational directions. Where the results of business (competitive) intelligence can be used
• Creating a business (competitive) intelligence service. Structure and functions of the business (competitive) intelligence unit. Forming the team of performers. Groups of specialists working in business (competitive) intelligence. Subjects of information and analytical work. Outsourcing business (competitive) intelligence services
• Building relationships between the business (competitive) intelligence service and company management, as well as other customers and consumers of their information services. Financing and technical equipment of the business (competitive) intelligence service
• Stages of business (competitive) intelligence. The concept of the intelligence cycle. From setting the task to documenting the results. Structure and format of the information and analytical brief. Providing information to company management to form its information field before making management decisions
• Classification of information and information resources. Primary and secondary information. The influence of subjective factors on the reliability of information. Relevance of information. Creating a subject classifier for the main directions of collecting and analysing information. Methods of evaluating information (the Kent method). The procedure for turning information into intelligence. Types of operational provision of information services
• Methods of collecting information. Systematising the work of collecting information about a legal entity. Obtaining information from open sources. Identifying internal sources of information. What information to request from a potential counterparty? Procedure for collecting information presented on a potential counterparty's website. Obtaining information from the mass media
• Obtaining information from databases. Using Internet information resources for competitive intelligence tasks. Working in chats, blogs, LiveJournals and other information arrays
• Procedure for obtaining official information from state bodies and registration organisations. Overview of the official websites of state bodies and the information resources presented on them
• Information obtained by «operational» methods. Obtaining information using the «human factor». Motivating a person to pass on (disclose) information
• Methods of analysing information (SWOT analysis, analysis of the competitive environment using Michael Porter's 5 forces, sabotage analysis, the analogy method, the exclusion method, cause-and-effect analysis, expert analysis methods, etc.)
• Overview of automated information systems (AIS) available on the market. What AIS can do and what they are used for. Processing large arrays of information, building links between recorded objects, working by scenarios and other algorithms built into AIS. Building corporate databases
• New information technologies in solving business (competitive) intelligence tasks

Methods for determining the reliability of counterparties and the safety of commercial proposals

• The concept of «due care», the Due Diligence procedure
• Studying counterparties. Security in contract work. Risks associated with bad-faith partnership
• Key indicators for evaluating a partner
• Sources of information used in studying counterparties
• Automating counterparty verification procedures. Practical work with information sources
• Identifying affiliation between company employees and counterparties. Hidden affiliation. Existing methods and ways of identifying affiliation
• Working with foreign counterparties

Company information security

Information security audit and policy

• The relevance of the information protection problem. Information protection as an integral part of the overall security system of the organisation (enterprise). The concept of information security. Main components
• The most common threats. Basic definitions and criteria for classifying threats
• Main directions of information protection
• The legislative level of information security. Basic concepts, terms and definitions in the field of information protection
• The administrative level of information security. The concept of an information security management system. Shortcomings of the project approach to building an information security management system. The process approach to ensuring information security
• International information system security standards. The standard based on the process approach to information security — ISO 27001. ISO 27001 and national regulatory documents on IS. ISO 27001 requirements
• Security policy. Organising IS. Asset management. The information security policy as the basis of the IS management system. Goals and objectives of the Information Security Policy. General structure of the Information Security Policy
• Assessing the current state of the organisation's information security. Auditing the state of information security at the enterprise. Procedure for conducting an information security audit in the company. ISO/IEC 27007:2007. Guidelines for auditing the IS management system
• Information security risk management. Basic concepts. Preparatory stages of risk management. Main stages of risk management
• Organising the response to emergencies (incidents)
• Software supporting information security management at the enterprise. Using software to manage risks and information security policy

Countering industrial espionage. Technical protection of information

• Classification of technical channels of information leakage
• Technical channels of acoustic information leakage
• Protecting acoustic (speech) information
• Compromising electromagnetic emanations and interference
• Methods of protecting information from leakage via compromising emanations
• Means and methods of detecting technical channels of information leakage
• Measures to identify technical channels of information leakage. Assessing the protection of information from leakage via technical channels

The trade secret regime. Confidential records management

• Trade secrets. The concept of «trade secret» in entrepreneurial activity. Regulatory legal acts of the Republic of Kazakhstan defining the concept of trade secret
• Procedure for establishing a trade secret regime in the company
• Drawing up and applying the list of information constituting the company's trade secret, recommended information that should constitute the company's trade secret
• Procedure for restricting access to information constituting the company's trade secret
• Internal regulatory documents governing the company's activities in protecting trade secrets. Amendments and additions to the company's regulatory documents when introducing the trade secret regime
• The employee's obligation to keep the company's trade secrets
• Observing the trade secret regime in contract work
• Procedure for transferring information constituting the company's trade secret to state bodies
• HR, regime and organisational ways of protecting the company's trade secrets
• Technical, engineering and IT measures to protect the company's trade secrets
• Types of legal liability for disclosing trade secrets and for unlawfully obtaining information. Necessary and sufficient conditions for it to arise, other types of liability related to breaches of information confidentiality in the company
• Confidential records management — an integral part of the company's security system. Confidential records management as an element of the trade secret protection regime
• Principles of building confidential records management
• Procedure for interaction between open and confidential records management
• The physical (paper) document and the document in electronic form, common features and fundamental differences, physical (paper) and electronic document flow, and the systems that link them
• Confidential document flow and the confidential information repository as components of the confidential records management system
• Capabilities that electronic confidential document flow and the electronic confidential information repository must have
• Stages of creating confidential records management, practical recommendations on the procedure for creating it

Methods and means of protecting computer systems. The information security unit

• The possibility of protecting information when working on the Internet. Firewalls
• VPN (virtual private network). Advantages of organising virtual private networks based on the Internet
• Active audit
• Fundamentals of cryptographic information protection. Classification of cryptographic methods of securing information
• «Cloud» technologies
• The electronic signature as the basic mechanism for ensuring the legal validity of a document in electronic document management and the most effective means of confirming the authorship and authenticity of an electronic document
• Practical examples of applying cryptographic methods of information protection
• The information security unit. What should the structure of an effective information security unit be? The place of the IS unit in the organisation's structure. Division of functions between the IS unit and the IT unit
• Organising interaction with the management of the information security unit and the heads of the company's IT structural units