This course is intended for managers, government officers or researcher/educators who are interested to understand high level information about digital forensic. Participants are encouraged to participate in decision making to manage evidence, forensics team, tools and resources.

• Identify the methodology of conducting forensic on digital evidence
• Understand ways to preserve and analyze evidence and to present result to stakeholders
• Learn to setup a forensic laboratory, to manage evidence and resources

• Managers
• Government officers involve in incident response
• Researchers/Educators
• Individual interested in digital forensics

• DIGITAL FORENSICS IN MALAYSIA LANDSCAPE
• Forensic Science: An Introduction
• Digital Forensic: An Introduction
• Digital Evidence
• People & Roles
• Case Study
• Challenges


• DIGITAL FORENSICS METHODOLOGY & TERMINOLOGY
• To be involved in digital crime investigation, one must first know and understand the methodology of the digital forensics. Basically, there are 5 main processes in conducting forensics examination and analysis. All of these processes will be taught in details during the course. Participants will also learn about the Best Practice for seizing and acquiring evidence at crime scene. The topics covered include:
• Digital Forensics Methodology
• Terminology
• Conclusion


• DIGITAL EVIDENCE: WHAT DATA CAN YOU RETRIEVED?
• What types of data can be extracted from computer or mobile phone or CCTV? What challenges do they present? In this topic, participants will be exposed with types of data that can be collected from different kind of digital media, as well as the challenges in getting all the potential evidentiary data. The topics covered include:
• Computer Analysis
• Mobile Device Analysis
• Internet/Email Analysis
• Video Analysis
• Image Analysis
• Audio Analysis
• Conclusion


• FIRST RESPONDER STANDARD OPERATING PROCEDURE
• First Responder is the first person that is responsible to react towards an incident. To be a First Responder, one must know the steps taken to preserve the evidence as best as one could. The first responder should be prepared and his actions should be planned. Deliberate, rush or hurried actions could damage potential evidence. He/she should have a first responder toolkit and a predetermined incident response plan to follow regardless of the type of data being collected. The topics covered include:
• Who is First Responder?
• What are the Roles?
• When First Responder Comes In?
• How to Perform the Tasks?


• INTRODUCTION TO DATA IMAGING
• First Responder is the first person that is responsible to react towards an incident. To be a First Responder, one must know the steps taken to preserve the evidence as best as one could. The first responder should be prepared and his actions should be planned. Deliberate, rush or hurried actions could damage potential evidence. He/she should have a first responder toolkit and a predetermined incident response plan to follow regardless of the type of data being collected. The topics covered include:
• Introduction
• Live Imaging
• Dead Imaging
• Hardware Based Tool
• Software Based Tool
• CSI: What to Expect?
• Conclusion


• IMAGE WITH FTK IMAGER


• AUTOPSY
• The next step after acquisition process is to analyze what has been acquired. In this topic, participants will be exposed with the analysis on digital evidence and writing a forensic report.


• QUALITY MANAGEMENT FOR DIGITAL FORENSICS
• To produce high quality evidence and to ensure that it is admissible into the court, certain measures need to be taken by the laboratory and the analyst. This topic shall discuss in details the elements need to be considered when dealing with digital evidence. The topics covered include:
• Inroduction
• ISO/IEC 17025
• Importance of Quality Management
• Management Requirements
• Technical Requirements
• Conclusion


• BUILDING A DIGITAL FORENSICS LABRATORY
• How many staff should I employ? What are the tools that I need to purchase? What are the conditions that a storage room should have? How to ensure that the evidence is secured? All these questions will be answered in this topic.

This course is designed specifically to create understanding on basics of cryptography and presenting main ideas in simple language.

• Undertstand cryptography
• Learn why, where and when to apply the cryptography

• Computer users who are new to cryptography

• INTRODUCTION TO CRYPTOGRAPHY
• Terminology
• Who uses Cryptography?
• Why we need Cryptography?


• HISTORY OF CRYPTOGRAPHY
• Manual Era
• Machine Era
• Modern Era


• CLASSICAL CRYPTOGRAPHY
• Substitution
• Transposition


• CRYPTOGRAPHIC ALGORITHM
• Symmetric Cryptosystem
• Block Cipher
• Stream Cipher
• Asymmetric


• HASHING AND CHECKSUM


• PUBLIC KEY INFRASTRUCTURE (PKI)
• Introduction to Certificate
• Certification Process


• DIGITAL SIGNATURE
• Digital Signature Overview
• Hash Function


• CRYPTANALYSIS
• Digital Signature Overview
• Hash Function


• CONCLUSION

This training is designed specifically to help you understand the importance of data protection; presenting the main ideas in simple language. This training will explain what data encryption is and how it can help you to protect confidential files and other data that is critical for your organization, business and/or personal.

• To understand the importance of data encryption
• Learn how to use data encryption to prevent data breaches and reduce risks

• Computer users who are new to data encryption

• INTRODUCTION
• Who needs data encryption
• Why data encryption


• WHAT IS DATA ENCRYPTION
• Basic information on cryptography
• Using encryption in data protection


• FILE ENCRYPTION: STORED DATA
• Information on encryption software


• ENCRYPT DATA USING EFS
• Introduction to EFS
• Key Features of EFS
• Encrypt using EFS
• Decrypt using EFS
• Back up EFS Certificate
• Troubleshooting


• ENCRYPT DATA USING TRUECRYPT
• Introduction to TrueCrypt
• How it works
• Installing and configuring TrueCrypt
• Using TrueCrypt


• EMAIL ENCRYPTION WITH THUNDERBIRD
• Introduction to Thunderbird
• Configure Thunderbird
• Using PGP with Thunderbird
• Sending an encrypted message


• CONCLUSION

• The implementation of Business Continuity Management (BCM) is crucial in all organizations regardless of the size and nature of business.
• For a company to remain resilient and competitive, a robust BCM implementation must be in place. This can be achieved through experience or best practice or standards specifically the ISO 22301 Business Continuity Management System.
• ISO 22301 helps establish a business continuity management system within the organization and clarify roles and responsibilities as well as action plans during disruption. It is also a standard for audit that determines whether an organization is certified. BCMS certification ensures organizational resilient as well as competitive advantage.

• Provide an overview of ISO 22301 and its relevant clause
• Understand ISO 22301 requirements and prepare certification criteria; if required
• Learn to plan, design, implement and review BCM system

• In general, any individual interested to know more on BIA and its implementation
• In specific, any personnel who is involved in business continuity areas within the organization such as:
• BCM Implementers/Drivers
• BCM Manager
• Risk Management personnel

• Why Business Continuity Management?
• Business Continuity Management Definition and Framework
• Business Continuity Risk Assessment
• Business Impact Analysis
• Business Continuity Strategies
• Business Continuity Plans and Procedures
• Exercising
• Crisis Management

• This course provides general understanding about the importance of cyber security; create awareness on the growing cyber threats and trends and its impact towards cyber terrorism and internet radicalization. It also explains cyber terrorism framework and describes the core aspects of cyber terrorism.
• This 2-days comprehensive course is tailored according to Malaysian perspective.

• Nurture participants on the importance of cyber security
• Increase awareness on the use of internet in radicalization
• Raise the adoption of cyber security in creating a safer cyberspace and a better place to live and work
• Identify different types of threats, risks and vulnerabilities that exist in both cyberspace and non-cyberspace environment
• Learn different type of security management practices
• Learn various components of cyber terrorism
• Understand cyber terrorism framework
• Develop thorough understanding on cyber security by analysing case studies

• IT and non-IT managers and executives
• Individuals who are new to cyber security and are seeking to learn and improve their knowledge and skills in the field
• Cyber security Team leaders and critical information custodians
• Individual with basic IT fundamentals and is interested to learn more about information security and cyber terrorism

• CYBER SECURITY - THE NEW FRONTIER
• Training & Capacity Building
• Introduction to Cyber Security
• Cyber Security Landscape in Malaysia
• The Human Factors & Motivations
• The Needs of Cyber Security Capacity Building
• The Cyber Security Education Framework


• FUNDAMENTAL OF CYBER SECURITY
• Cyber Security Guiding Principles
• Vulnerabilities & Threats
• Stages of Cyber Security Mitigation
• Cyber Security at Workplace
• Cyber Crimes
• Common Cyber Threats
• Anatomy of Cyber Attacks
• Cyber Security Issues and Challenges


• BREACHES, ATTACKS AND CYBER CRIMES
• Cyber Space Challenges
• Cyber Crimes
• Real Cyber Incidents
• Case Studies in Handling High Technology Crimes
• Mitigation


• MALAYSIA INITIATIVES
• Defense-in-Depth in Summary
• Malaysia Initiatives
• CNII Sectors
• NCSP
• Cyber Related Laws
• Cyber Security Issues and Challenges


• INTRODUCTION TO CYBER TERRORISM
• Definition of Cyber Threats
• Concept of Cyber Terrorism


• INTERNET RADICALIZATION
• Internet Radicalization and Terms
• The Internet as Enabler of Cyber Terrorism


• TERRORIST USE OF THE INTERNET
• Conceptualizing Use of the Internet for Terrorist Purposes & Type of Activities


• CYBER TERRORISM FRAMEWORK
• Existing Models
• Framework Components
• Analysis of Cyber Terrorism Incidents (case study)

• Organisations are increasingly aware of the value of their business-critical information and the need to protect their information related assets.
• An Information Security Management System (ISMS) is based on risk management approach to maintain the confidentiality, integrity and availability of the organization’s information.
• ISO/IEC 27001:2013 Information Security Management System (ISMS) - Requirements - specifies requirements for the establishment, implementation, monitoring, review, maintenance and improvement of a management system to manage an organization’s information security risks.
• This one-day course aims to spread knowledge on the objectives and benefits of information security; the requirements specified in ISO/IEC 27001:2013 ISMS - Requirements; the controls provided in ISO/IEC 27002:2013 Code of Practice for Information Security Controls; and an insight into the emerging ISO 27000 series of standards.

• This course is designed for beginners and provides an introduction to Information Security and Information Security Management System (ISMS) ISO/IEC 27001:2013. It gives participants an overview of the related standards. Discussions on the benefits and critical success factors for implementing ISO/IEC 27001 ISMS is also included for participants to ensure effective and successful ISMS implementation.

• Senior Managers/Managers
• ISMS Implementors
• ISMS Consultants
• Information Security Practicioners
• Individual who needs to acquire general knowledge in ISMS

• What is Information Security
• What is Information Security Management Systems (ISMS)?
• Why ISMS
• ISO/IEC 27001:2013 Information Security Management System - Requirements
• ISO/IEC 27002:2013 Code of Practice for Information Security Control
• Benefits
• Critical Success Factor

• This course provides a basic introduction to the services delivered by the MyCC Scheme, Common Criteria evaluation and certification concepts and benefits of product/IT system security evaluation. It also serves as a basic guidelines in understanding documents such as Security Targets and Protection Profiles, understanding the role of the sponsor/ developer and what is needed as requirements to participating in Common Criteria evaluation and certification processes.

• Increase awareness on the benefits of the product/IT system security evaluation plus certification processes and IT evaluation concepts
• Learn about MyCC Scheme that includes the MyCC Scheme policy framework, roles and responsibilities, and MyCC Scheme services
• Identify the layout of Common Criteria (CC) knowledge, Security Target (ST) document structure and its privilege, Protection Profile (PP) guidance as a reference document and Assurance Maintenance perspective
• Understand the roles and responsibilities of the Sponsor and Developer in Common Criteria Evaluation and Certification processes

• Consumers, Developers and Sponsors
• Potential Common Criteria/IT Product Consultants
• Technical Writer interested in learning Common Criteria and MyCC Scheme
• Any interested parties

• IT SECURITY EVALUATION
• This module provides a background to IT security concepts and evaluation. The topics covered include:
• The value of Information
• The importance of Information Technology
• The need for Information Security
• The concept of Assurance
• The benefits of IT Security Evaluation


• OVERVIEW OF THE MYCC SCHEME
• This module provides an overview of the MyCB functions, roles and responsibilities, Recognition Arrangements, and policy framework. The topics covered include:
• MyCC Scheme background and history
• Common Criteria Recognition Arrangement
• What is a certification and evaluation scheme
• MyCC Scheme services
• MyCC Scheme roles and responsibilities
• MyCC Scheme documentation


• INTRODUCTION TO CC, STS AND THE PPS
• This module provides a high level overview of Common Criteria (CC) and
  Methodology, as well as detailing the Security Target (ST)/ Protection Profile (PP)
  and how they form the foundation of evaluations.
  The following topics are included:
• The history, purpose, paradigm, terminology and structure of the
  Common Criteria
• How the Common Criteria defines assurance
• The purpose and components of a Security Target
• The purpose and components of a Protection Profile
• The differences between Assurance packages


• MYCC SCHEME EVALUATION AND MAINTENANCE
• Reviewing an Impact Assessment Report (IAR)
• Supporting an ICT security evaluation
• Evaluation evidence
• CC Maintenance of Assurance Paradigm
• Writing an Impact Assessment Report (IAR)
• Reviewing an Impact Assessment Report (IAR)

• Search-Fu - Power Search Techniques is a 2-days hands-on workshop which aims to educate Internet users to search information effectively using various search engines.
• Internet users often use only one or two search engines such as Google, Yahoo or Bing and do not leverage on the built-in features in the search engines
• There are tons of information on the Internet. Without effective information searching techniques, Internet users will suffer information overload.
• There are two different techniques for information searching: recall and precision. In this course participants are able to learn 3 crucial elements that are information searching mindset, various search engines and search-fu skills.

• Educate internet users on various concepts and techniques in information searching to get the better search results
• Highlight various search engines to assist the internet users to search information on the internet
• Identify various search-fu skills to find specific information on the internet

• Individuals who want to improve their internet searching skills

• INFORMATION SEARCH & SEACH ENGINES
• What is Search-Fu?
• Introduction to Information Search
• Case Study: How Google Works?
• Information Search Strategy I: Relevance Seesaw
• Information Search Strategy II: Expertise Matrix
• Information Search Strategy III: Search Mode


• ADVANCED SEARCH TECHNIQUES
• Keywords
• Advanced Operators
• Exercise I
• Advanced Search Page
• Exercise II
• Search Tools
• Exercise III
• Boolean Operation
• Exercise IV
• Search Results Reductions
• Exercise V
• Case Study - MH17 Incident


• LEVERAGING WITH OTHER SEARCH ENGINES
• People Search Engines
• Social Media Search Engine
• Blog Search Engine
• Twitter Search Engine
• Knowledge Search Engine
• Image Search Engine
• Similar Site Search
• Archive Search Engine
• Infrastructure Search Engine
• News Search
• Alert & Monitor

• This 1-day course provides general understanding about cyber threats landscape and creates awareness on cyber terrorism and internet radicalization. It includes knowledge on cyber terrorism framework that exposes the core aspects of cyber terrorism.

• Identify different types of threats
• Increase awareness on the use of internet in radicalization
• Identify various components in cyber terrorism
• Understand cyber terrorism framework
• Develop understanding on the use of ICT and Cyberspace by analyzing case studies

• IT and non-IT managers and executives
• Individuals who are new to cyber terrorism and are seeking to learn and improve their knowledge in the field
• Information Security Team leaders and critical information custodians
• Individual with basic IT fundamentals and is interested to learn more about information security and cyber terrorism

• Introduction of Cyber Threats
• Cyber Security Incident Statistic
• Technology related threat
• Cyber content related threat
• Malaysia’s Critical National Information Infrastructure
• National Cyber Security Policy
• CNII in Malaysia
• Relationship between Cyber Security and other security domain
• Threats to CNII
• Internet Radicalization
• Process in radicalization
• Enormous concern on Internet Radicalization Worldwide
• Use of Internet in Radicalization
• Cyber Terrorism
• Enormous Attention on Cyber Terrorism Worldwide
• Cyber Terrorism Framework

• This training exposes participants with the relevant skills and knowledge in Cloud Computing Security (also known as Cloud Security) supported with the fundamental of understanding the cloud computing technology and its deployment ecosystem. Participants will have the understanding on cloud computing services (IaaS, PaaS, and SaaS) and the understanding of cloud deployment models consist of Public Cloud, Private Cloud and Hybrid Cloud.
• Participants will be able to understand the security aspect, requirements, and ecosystems of cloud computing operations from the perspectives of cloud service provider and cloud service subscribers. Understanding the cloud architecture and cloud operations through the views of cloud computing security are crucial in ensuring assurance of secure cloud ecosystem in the cloud operations.

• To understand the cloud computing evolution, characteristic and benefit of using the cloud computing technology. This topic also covers the introduction to the cloud service models and cloud deployment models.
• To understand the the security objective for cloud computing, the security threats in the cloud and the security model for cloud computing. This topic also covers the typical security controls, issues and security features as consideration in cloud computing implementation.
• To understand the cloud security assessment concepts from the aspects of testing methodology and audit methodology applicable for cloud service provider and cloud service subscriber.

• Individual may have background as IT engineers, cloud solution developers, IT security officers, security testers and anyone is concerned about cloud computing security and its ecosystem.

• MODULE 1: CLOUD COMPUTING FUNDAMENTAL
  • Topic 1.1: Introduction to Cloud Computing

    Summary: This topic will discuss on the introduction of cloud computing evolution, characteristic and benefit of using the cloud computing technology. This topic also covers the introduction to the cloud service models and cloud deployment models. The following is the sub-topics will be covered in the training module, as follows.

    • Introduction to Cloud Computing Technology:
      • What is Cloud Computing?
      • Characteristics of Cloud Computing.
      • Cloud Service Models.
      • Cloud Deployment Models.
    • Exercise 1 – Quizzes.

  • Topic 1.2: Virtualization in Cloud

    Summary: This topic will be discussing on concept of virtualization, hypervisor, virtual recourses and the component inside it that used by cloud computing.This topic will also explain on the benefit of server, desktop and application virtualization and how it can be related to cloud computing. Method of managing virtual machines, networking and storage will also be covered in this topic. Learning on the migration method from a physical server to virtualization environment. The following is the sub-topics will be covered in the training module, as follows.

    • Introduction to Virtualization for Cloud Computing:
      • What is this virtualization?
      • Desktop Virtualization (VDI)
      • Application Virtualization
      • Migrating physical server to virtual
    • Exercise 2 – Quizzes.

  • Topic 1.3: Cloud Networking concept and Implementation

    Summary: This topic will be discussing on cloud networking concept and implementation. It will cover the concepts of cloud network configuration, cloud network optimization, basic troubleshooting network connectivity issues in the cloud. The following is the sub-topics will be covered in the training module, as follows.

    • Cloud Networking Concepts:
      • Cloud Network configuration
      • Cloud Network optimization
      • Troubleshooting basic network connectivity issues on the cloud.
    • Exercise 3

    • Topic 1.4: Cloud Management Concept

      Summary: This topic will discuss on why managing your cloud deployment is important, the CSS and CSP responsibilities and the list of remote access tools for managing your cloud. The following is the sub-topics will be covered in the training module, as follows.

      • Introduction to Cloud Management:
        • Managing the cloud deployment.
        • Understand the CSS and CSP responsibilities.
        • Remote access tools for managing the cloud.
      • Exercise 4 – Quizzes.

    • Topic 1.5: Challenges in Cloud Security

      Summary: This topic will be discussing on the challenges in the cloud services against traditional IT, case study on the challenges of cloud implementation and top security challenges on cloud ecosystem. The following is the sub-topics will be covered in the training module, as follows.

      • Cloud Security Challenges:
        • Challenges in Cloud Services against Traditional IT.
        • Case Study: Challenges of Cloud Implementation.
        • Top Challenges on Cloud Implementation.
      • Exercise 5 – Quizzes.

  • MODULE 2: CLOUD COMPUTING SECURITY & ASSESSMENT
    • Topic 2.1: Introduction to Cloud Security

      Summary: This topic will be discussing on the security objective for cloud computing, the security threats in the cloud and the security model for cloud computing. This topic also covers the typical security controls, issues and security features as consideration in cloud computing implementation. The following is the sub-topics will be covered in the training module, as follows.

      • Cloud Security Introduction:
        • Security objective for cloud computing.
        • Challenges in Cloud Security
        • Security Threats in Cloud Computing.
        • Security Model for Cloud.
      • Exercise 6 – Quizzes.

    • Topic 2.2: Understanding Virtualization Security

      Summary: This topic will be discussing on the virtualization security and the typical security problems with virtualization. The content will cover the virtual machine discovery and inventory, configuration management, change management and network segmentation. The following is the sub-topics will be covered in the training module, as follows.

      • Virtualization Security:
        • Security Virtualization
        • Virtual machine discovery and inventory
        • Configuration management
        • Change management
        • Network segmentation
      • Exercise 7 – Quizzes.

    • Topic 2.3: Business continuity in the Cloud

      Summary: This topic will be discussing is on the business continuity aspects in the cloud. It will cover on phases of disaster recovery and the disaster recovery methods in the cloud such as failover and failback, replication, hot site etc. The following is the sub-topics will be covered in the training module, as follows.

      • Business continuity in the cloud:
        • Disaster Recovery.
        • Disaster Recovery Methods in Cloud.
      • Exercise 8 – Quizzes.

    • Topic 2.4: Cloud Network Security & Encryption

      Summary: This topic will be discussing on the typical cloud encryption technology and methods. Details will cover on the public key infrastructure (PKI) components, IPSec, SSL, TLS and Ciphers.

      • Cloud Network Security & Encryption: Cloud encryption technology and methods.
      • Exercise 9 – Quizzes.

    • Topic 2.5: Cloud Application Security

      Summary: This topic will be discussing on the cloud application security. It will cover the understanding of user access control, Operating System hardening via checklist, instance and image security, IAM roles and the data security in the cloud. The following is the sub-topics will be covered in the training module, as follows.

      • Cloud Application Security Concept:
        • Understanding user access control.
        • Operating System hardening.
        • Instance and image security.
        • Identity and Access Management (IAM) roles in Cloud Security.
        • Data Security.
      • Exercise 10 – Quizzes.

    • Topic 2.6: Cloud Security Assessment

      This topic will be discussing on the cloud security assessment. This will cover the vulnerability management in the cloud and the importance of cloud configuration. The content will be also discussing on the basic procedure on how to perform cloud-based penetration testing. Other typical security checking mechanism such as cloud intrusion detection in the cloud and log management will also be covered in this topic. The following is the sub-topics will be covered in the training module, as follows.

      • Cloud Security Assessment Concepts:
        • Cloud Penetration Testing Methodology.
        • Intrusion detection in the cloud.
        • Log management in the cloud.
      • Exercise 11 – Quizzes.

  • MODULE 3: CLOUD COMPUTING SECURITY AUDIT
    • Topic 3.1: Introduction to Security Audit

      Summary: This topic will be covering the introduction of security audit, what is IT audit and what is security audit. This topic will also explain the differences between IT audit and security audit. The following is the sub-topics will be covered in the training module, as follows.

      • Security Audit Introduction:
        • IT Audit.
        • Security Audit.
        • IT Audit vs. IT Security Audit.
      • Exercise 12 – Quizzes.

    • Topic 3.2: Cloud Security Audit

      Brief Info: This topic will be covering the cloud security audit overview and the cloud security audit process flow. The following is the sub-topics will be covered in the training module, as follows.

      • Cloud Security Audit Overview:
        • Overview of Cloud Security Audit
        • Cloud Security Audit Process Flow
      • Exercise 13 – Quizzes.

    • Topic 3.3: Cloud Security Standards & Best Practices

      Summary: This topic will be covering the cloud security standards and best practices. The content will be discussing the relevant standards and best practices from existing entities such as ISO, CSA etc. The following is the sub-topics will be covered in the training module, as follows.

      • Cloud Security Standards and Best Practices: Examples.
      • Exercise 14 – Quizzes.

    • Topic 3.4: Governance in Cloud
      • Cloud Security Governance and Requirements:
        • Cloud Governance Overview.
        • Cloud Governance & Risk.
      • Exercise 15 – Quizzes.

  Register