Managing comprehensive enterprise security / CSO (Chief Security Officer)

Programme

General issues of building a corporate security system

• What a security policy (concept) is. Framing questions before creating a business protection system
• What we will protect (defining the objects of security)
• Who will ensure business security (defining the subjects of security). The enterprise's own Security Service or outsourced services. What to choose. Pros and cons of both options
• The legal side of the enterprise Security Service's activities. Subordination of the Security Service. Interaction with shareholders, owners and business managers. Regulations on the enterprise Security Service. Building the Security Service's relationships with other units of the enterprise
• Which threats we will protect the business from (external/internal, permanent/temporary, threat monitoring, determining the probability of occurrence, assessing possible damage).
• How we will build the business security system
• Principles of building corporate security
• Directions of ensuring business security
• Structure of the organisation's security system
• Criteria for evaluating the effectiveness of the organisation's security system
• Ways of checking the effectiveness of security measures
• Preparing to create the security system
• Forming the regulatory (legal) support of business security. The enterprise security concept (policy), instructions, regulations and algorithms
• Managing corporate security in crisis situations. The security service's participation in crisis management measures
• Managerial and organisational security measures when operating in a crisis situation, under threat of an attack on the organisation or a terrorist act

Method of conducting an enterprise security audit

• Basic concepts and types of audit. Audit criteria
• Organising the audit process. Internal audit control procedures. The auditor's professional qualifications
• Methods of comprehensive assessment of enterprise security

The risk analysis and management system at the enterprise

• Types of economic risks
• Creating a system for analysing and managing economic risks. The security service's participation in managing economic risks
• Forecasting the risk situation. Identifying the sources of information that make it possible to identify the causes of risk and its possible types. Establishing the sources of risk. Forecasting the main types of risk. Identifying the objects affected by a particular type of risk
• The risk management process
• Methods used for risk diagnostics
• Risk identification
• Risk calculation methods. Comparing quantitative and qualitative calculation methods
• Stages of risk diagnostics
• Risk assessment. Determining acceptable risk limits
• Risk acceptability. Building the risk map
• Preparing the risk report
• Developing the risk management action programme
• Monitoring
• Using risk management in decision-making. The need to use risk management. Specifics of considering risks in decision-making
• Organisational aspects of risk management. Requirements for implementing a risk management system. Possible risk management structure. Performing the risk management function

Incident management at the enterprise

• Fundamentals of incident management
  • Planning and preparation
  • Detecting and reporting security events
  • Assessing and deciding on security events
  • Responding to security incidents
  • Analysis
  • Improvement
• Organising incident management in the company
  • Stages of incident management
  • Implementing an incident management system
• The relationship between incident management and risk management
• General algorithm of actions when an incident occurs

Information security

• Information protection as an integral part of the organisation's overall security system. The concept of the information society. The concept of information security. The most common threats. Basic definitions and criteria for classifying threats. Main directions of information protection
• Levels of forming the IS regime. The legislative level
• The administrative level. The concept of an information security management system. Shortcomings of the project approach to building an information security management system. The process approach to ensuring information security. International information system security standards. The standard based on the process approach to information security — ISO 27001. ISO 27001 and national regulatory documents on IS. ISO 27001 requirements. The information security policy as the basis of the IS management system. Goals and objectives of the Information Security Policy. General structure of the Information Security Policy. Auditing the state of information security at the enterprise. Procedure for conducting an information security audit in the organisation
• The software and hardware level. The concepts of user authorisation, identification and authentication. Access control. Information protection technologies: cryptographic protection methods, the electronic digital signature as the basic mechanism for ensuring the legal validity of a document in electronic document management and the most effective means of confirming the authorship and authenticity of an electronic document, firewalls, VPN (virtual private network), active audit (DLP systems, malware and antivirus software)
• Internet services
• Social engineering
• Countering industrial espionage. Technical protection of information. Classification of technical channels of information leakage. Technical channels of acoustic information leakage. Protecting acoustic (speech) information. Means and methods of detecting technical channels of information leakage. Measures to identify technical channels of information leakage. Assessing the protection of information from leakage via technical channels
• The trade secret regime. Confidential records management. The concept of «trade secret» in entrepreneurial activity. Regulatory legal acts of the Republic of Kazakhstan defining the concept of trade secret. Procedure for establishing a trade secret regime in the organisation. Drawing up and applying the list of information constituting the organisation's trade secret, recommended information that should constitute the organisation's trade secret. Procedure for restricting access to information constituting the organisation's trade secret. Internal regulatory documents governing the organisation's activities in protecting trade secrets. Amendments and additions to the organisation's regulatory documents when introducing the trade secret regime. The employee's obligation to keep the organisation's trade secrets. Observing the trade secret regime in contract work. Procedure for transferring information constituting the organisation's trade secret to state bodies. Types of liability for disclosing trade secrets and for unlawfully obtaining information
• Confidential records management — an integral part of the organisation's security system. Confidential records management as an element of the trade secret protection regime. Principles of building confidential records management. Procedure for interaction between open and confidential records management. Stages of creating confidential records management, practical recommendations on the procedure for creating it
• The information security unit. What should the structure of an effective information security unit be? The place of the IS unit in the organisation's structure. Division of functions between the IS unit and the IT unit. Organising interaction with the management of the information security unit and the heads of the organisation's IT structural units

Personnel security

• Internal threats to the enterprise from the «human factor»
• Motivated and unmotivated disclosure of information
• Psychological characteristics of employees who pose a danger to the enterprise
• Vetting job candidates (applicants)
• Preventive measures taken by the company's Security Service to prevent information leakage by the enterprise's employees
• Various options for creating incentives and motivational factors aimed at strengthening employees' loyalty to the enterprise
• «Screening signs of danger» in employees. What to pay attention to in vetting measures
• Technical means of monitoring employees
• Testing (assessing) employees
• Employee dossiers. Rules for working with dossiers
• Hiring staff. Methods of ensuring security when hiring staff
• Vetting a candidate on hiring
• Ways of obtaining information about a candidate
• Checking an employee during work (the probation period)
• Safe dismissal of employees. Threats when dismissing employees
• Signs of employee dissatisfaction before dismissal
• Rules for dismissing employees
• Measures taken by the Security Service when dismissing employees
• Procedure for conducting an internal corporate check (investigation) into unlawful actions by staff
• Using the polygraph (lie detector) in internal corporate checks (investigations). The legal and organisational side of the matter. Is it possible to beat the polygraph?
• Applying psycho-probing methods in investigating unlawful actions
• Procedural documentation of the results of internal corporate checks (investigations)
• Interaction of the Security Service with law enforcement bodies in investigating unlawful actions

Economic security

Corporate fraud. Unlawful actions

• What is corporate fraud? General characteristics and types of crimes against property. Concept and features of fraud. How fraud differs from other types of crimes against property. Criminal liability for fraud
• Elements of fraud. Fraudsters and their motivation, psychological techniques used by fraudsters
• Structure of a fraudulent operation, forms and scenarios of fraud in various types of business
• How does corporate fraud affect the enterprise?
• How to distinguish inefficiency from fraud?
• The corporate fraud risk management cycle: overview
• Fraud risk management strategies
• Prevention: main measures (the system of internal controls, vetting counterparties and potential employees)
• Detection: main methods (hotline, tracking behavioural indicators, analytical methods)
• Investigation: what to pay attention to (the legal side of the matter)
• Response: what to do with the results
• What skills are needed to counter fraud effectively
• Creating a system at the enterprise for preventing and protecting against fraudulent operations

Countering kickbacks and commercial bribery in the enterprise's contract work

• The concepts of «kickback» and «commercial bribery» in the legislation of the Republic of Kazakhstan and in business customs. Elements of the offences and typical kickback schemes
• Types of legal liability for actions classified as «kickback» and «commercial bribery». Legal specifics of dismissing an employee involved in kickbacks
• Kickback risks
• Ways of detecting kickbacks
• Ways of preventing kickbacks through regulating business processes
• Ways of preventing kickbacks through a secure HR policy
• Schemes for getting rid of undesirable employees
• Collecting and analysing information on employees with «kickback» risks. Using technical means (video, audio, DLP systems) to prove an interest in a deal and unofficial arrangements with a counterparty. Collecting compromising material on employees using Internet information resources. Ways of legalising «operational» information
• The mystery shopper method in assessing employees' interest and the objectivity of pricing policy when selecting a counterparty
• Creating a «feedback» system at the enterprise. Hotlines, exit interviews with departing employees, contacts with unsuccessful suppliers and other ways of obtaining feedback
• Legal formalisation of the anti-kickback policy at the enterprise. Including anti-corruption clauses in employment and civil law contracts. Declaring a «good-faith organisation» policy. Creating a local regulatory framework for countering and preventing kickbacks and commercial bribery
• Introducing elements of collegial decision-making in contract work. Organising approval procedures and competitive procedures when selecting counterparties

Anti-corruption compliance

• What compliance is. Types of compliance
• Compliance and security: what is the difference
• Compliance control — what is it? Why compliance control matters for business. Two approaches to compliance control. Compliance control tools
• Compliance risk. Classification of compliance risks. Types of compliance risks. How to manage compliance risks
• The compliance manager: functions
• Implementing compliance
• Anti-corruption compliance
• Compliance as a system of effective management
• ISO 37301:2021 «Compliance management systems — Requirements with guidance for use»
• Algorithm of actions for developing a compliance programme
• Assessing corruption risks
• Developing anti-corruption measures
• Developing the enterprise's local anti-corruption documents
• Implementing anti-corruption measures

Intelligence and counterintelligence as tools for reducing risks and managing the enterprise

Basic principles of intelligence and counterintelligence

• Principles of obtaining information. Industrial espionage, intelligence and counterintelligence. Fair and unfair competition. Intelligence and counterintelligence as security bodies. Functions and tasks of intelligence and counterintelligence. Main tasks of intelligence. Types of intelligence. Methods of unauthorised access to confidential information. Purpose and types of operations. Success factors of business intelligence. Counterintelligence. Main directions of counterintelligence. The subject of counterintelligence activity. The adversary's business intelligence (BI) as a threat to enterprise security. Tasks of external counterintelligence
• Stages of business intelligence. Legal and ethical norms of conducting business intelligence. The intelligence cycle
• Setting the task and planning the operation. Drawing up the plan. Creating a business intelligence system. Structure and functions of the BI unit. Forming the team of performers
• Collecting information. Characteristics of and requirements for information. Specifics of human perception of information. Value characteristics of information. Sources of information. Methods of collecting information. Methods of verifying information. The information matrix. Information resources for business intelligence
• Analysing information. Analysis methods
• Presenting results
• New information technologies in solving business intelligence tasks

Methods for determining the reliability of counterparties and the safety of commercial proposals

• The concept of «due care», the Due Diligence procedure
• Signs indicating a counterparty's unreliability
• Studying counterparties. Security in contract work. Risks associated with bad-faith partnership
• Key indicators for evaluating a partner
• Sources of information used in studying counterparties
• Automating counterparty verification procedures. Practical work with information sources
• Specifics of obtaining information on individuals

Obtaining information by «operational» methods (obtaining information using the «human factor»). Motivating a person to pass on (disclose) information

• Personality assessment. General scheme of personality assessment (scheme of studying a personality). Personality assessment in the course of communication. Personality assessment by external signs. Personality assessment methods
• Establishing and developing psychological contacts. General scheme of psychological contact. Making an acquaintance (choosing a pretext; forming a first impression; taking the subject's perceptual characteristics into account; attracting attention). Building interest (arousing «sympathy»; drawing into conversation; the ability to listen). Establishing trust (specifics of trusting communication; building trust; overcoming the trust barrier)
• Eliciting information. Psychological foundations of elicitation. Method of eliciting information
• Psychological influence on a person. Persuasion — the main method of influence. The coercion method. The suggestion method