The 1st CIBOK Workshop (Study Group)

Objective : For the members and non-members who will be invited by members to understand, learn each other by driving the subject matter topic referring to the content of CIBOK.

Title	How to recognize the cyber risk as the top management issues ? How to organize the team to combat against those risks ?
Content	Time past after cyber risk is recognized as the management level of risk, still a lot of enterprises are struggling on how to deal with those risks. In this session, learn about how to fulfil the gap between top management and practical cyber security operation.
Target Audience	Board Members (CEO、CFO、CRO、CISO etc.), Coordinators of ISAC(s) or government bureau in charge of governance of security over the industries
Agenda	Management Level of Risks What are the “management level of risk” for private company? History of surrounding risk which impact to the management Global Risk Landscape 2018 Impact caused by Cyber Incident Gaps between expectation from investors vs board member Cyber Risk Management Scope of Risk Management “Silo” across operations as well as gap from board members Integrated Risk Management Cyber Security Management Guideline 2.0 (by IPA^1) Hybrid type of risk management organization Tips for the risk management Differentiate threat, risk factor and risk (risk scenario) Characteristic of cybercrime and its scope Impact of Cybercrime 5 layers over security risk Cyber Defense Kill Chain Model Reactive to proactive (Threat Hunting) Strategic Management Life Cycle (PDCA+OODA) Risk Management Model based on “TO-BE” approach Organize the team to face cyber risks Role for the board members ^1 : IPA : Information-technology Promotion Agency, Japan
Reference	CIBOK Chapter 8-10

Title	Basic understanding of “risk management”
Content	As a fundamental knowledge area for the cyber risk management, it gives the opportunity to start with understanding risk management framework from existing international standardized model
Target Audience	Member of risk management team, CSIRT of private company.
Agenda	Understanding the basic risk management framework Basic Process of Risk Management Risk Identification Risk Analysis Risk Evaluation Risk Response (Plan) Risk Monitoring Understanding the existing risk management frameworks ISO 31000, ISO 22301 Cobit 5, Risk IT COSO ERM (Enterprise Risk Management) 2017 edition
Reference	CIBOK Chapter 10, ISO31000, COSO ERM, Cobit5, RiskIT

Title	Basic Understanding of Cyber Security Management
Content	For those who just started security management, the course gives the structured approach to grasp those existing security management frameworks very shortly and effectively.
Target Audience	Beginner level of member of risk management, CSIRT of private company
Agenda	Basic Framework for Security Management ISO27000 ISO27001 ISO27002 ISO27005 NIST SP 800 Series NIST SP 800 - 53 NIST SP 800 - 30 NIST SP 800 - 37 NIST SP 800 - 61 NIST SP 800 - 161 NIST SP 800 - 171 GDPR Important view-point for effective security management What is the resolution of Cybercrime Case? Threat, Risk factor and Risk (Scenario) Risk view point over Cyber Space 5-layerd model of cyber security Defense kill chain and best practices PDCA+OODA model Risk Appetite, ALARP How to manage the KPI for the Risk Management / CSIRT team?
Reference	CIBOK Chapter 4, 8 and 10, ISO27000、NIST SP 800 Series

Title	Practical cyber risk management for the next generation
Content	For those who already studied the basic risk management, security management, bringing in the best practice experiences so that the audience can take away the leaning and adopt to the on-going security management.
Target Audience	Manager or the member of Risk Management / CSIRT team in private company
Agenda	How to build up the organization? What is the success of the team (risk management / CSIRT)? Business Strategy and risk management Risk Structure (brings in the multiple subject matter domain area) Governance Type vs Category Type Organization Chart of Hybrid Model Understand the existing framework and make a choice Customize the framework Identification of the Risks Analysis and Evaluation of the Risks Risk Communication 4 steps to enhance the cyber resilience Base Line enhancement Security Solution (fulfil the surface) Digital Asset Management Vulnerability Management Training and Education Enhance the capability against Cybercrime Understand the proper “resolution” of cybercrime How to collaborate with law enforcement? Improve the core capability of “CSIRT” Dynamic Risk Analytics Triggers for dynamic risk analysis OODA (Observe, Orient, Decide and Act) Information Sharing and Collaboration What does it mean by “info-sharing”? Info-sharing models (US/Japan) Importance of threat “intelligence”
Reference	CIBOK Chapter 8-10, ISO27000, NIST SP 800 Series

Title	Resolution Model of Cybercrime
Content	Only very few cybercrime has been properly resolved, the session brings the common sense over the resolution (how can you say, the case is solved?) and the common approaches, process, procedures for supporting public – private collaborative resolution of cybercrime.
Target Audience	Those who is responsible for Cybercrime Investigation (both in Public/Private), Risk Management, as well as the government bureau coordinator who is in charge of the security.
Agenda	Understanding what is “Cybercrime” Impact caused by cybercrime Characteristics of cybercrime which makes investigation more complicated Category of cybercrime Technology as a tool of crime Technology as a target of crime Technology as a destruction of crime Who are the cyber criminals? Labor division / CaaS (Crime as a Service) Virtual Currency, Dark Web to support criminals What is the cybercrime investigation? What is the impact to the victim? Understand the “stage” of the crime Scope of cybercrime Understand the resolution model Gap between Law Enforcement vs Victimized Private Company Collaborative investigation is mandatory Trigger of the cybercrime Repot to the law enforcement Scoping of the investigation Grasp the whole picture Preserve the “evidence” Support by “intelligence” and its development Procedures by victimized company Technical remediation Communication Residual risk Analysis Learning and Improvement
Reference	CIBOK Chapter 1 - 10

Title	Usage of “threat intelligence” and how to develop it?
Content	Most of the people says “threat intelligence” is important, however, still its definition is unclear and not effectively developed and used. In the session. In this session, the attendee can grasp the high level domain knowledge required for dealing with threat intelligence
Target Audience	Those who both in public and private sectors who needs the intelligence (e.g. risk analysis and evaluation, or in-depth crime investigation or even for the cyber defense)
Agenda	Basic Common Sense Cyber Security Framework as the basic domain knowledge Crime Scene Indicators Source and its collection Data Analytic framework Data Quality Case Studies Build up the infrastructure for data aggregation and analytics Data Aggregation Data Analysis Practice for insight Future Direction Review
Reference	CIBOK Chapter 3 - 7

Title	Practical collection and investigation of evidence triggered at / by Open Source (OSINT)
Content	The practical hands-on training to understand how to research over the Open Source Intelligence (OSINT).
Target Audience	Those who both in public and private sectors who needs the intelligence (e.g. risk analysis and evaluation, or in-depth crime investigation or even for the cyber defense)
Agenda	Basic Common Sense Borrow the power of “community” Theme and Activities for Cyber Patrol External Source of Evidence Query to figure out the hidden information Search Engine for private information How to investigate the account in Social Network? Case Study Patrol for Phishing Scam OSINT Tools Platform Review
Reference	CIBOK Chapter 3 - 7

Title	What is the “Cybercrime” and “Cybercrime Investigation”?
Content	For the beginner or the entry level of people in charge of the cybercrime investigation both in public and private sectors, the session to identify the required domain knowledge in structured approach and basic knowledge which will be needed in-depth training in the near future.
Target Audience	Beginner, Student who will try to become a “cybercrime investigator” both in public and private sectors.
Agenda	What is the “cybercrime”? Definition of Crime and Cybercrime Category of Cybercrime What is the “Cybercrime Investigation”? How it began? Who is the victim? Who did it? Flow of investigation Arrest and Prosecution
Reference	CIBOK Chapter 1 - 8

Title	What is the required domain knowledge for build-up and manage the organization against cybercrime?
Content	If you are just try to build up the organization to combat against cybercrime (or just need to enhance it), the session can provide you to grasp holistic pictures you need to learn and having the experiences for the better organization management.
Target Audience	Board Member of private enterprise (CEO, CFO, CRO and CISO), head of risk management or CSIRT, Top level management of public sectors etc.
Agenda	Strategy and Governance Vision, Mission and Strategy Strategic Objective and Balanced Score Card (BSC) How to cascade down the top level objective to organization, individuals Risk Communication Required Domain knowledge of Management Organization Planning Budget Management Human Resource Performance Management People Management Tool Management (Cybercrime Investigation) Execution Framework Structure of Cyber Security Solution “Silo” and “Overwrap” - RACI OODA loop for incident handling Workshop Develop the vision, mission and strategy Develop the Critical Success Factor Cascade down to security requirement and develop the security KPI (or KRI)
Reference	CIBOK Chapter 10

Title	Understanding the next generation security management, PDCA+OODA model
Content	Cyber Risk became more dynamic, no more static. To face the dynamic risk, you can learn how to adopt the PDCA + OODA model into your organization by understanding the essence.
Target Audience	Board Member of private company (CRO, CISO), head of Risk Management or CSIRT, as well as top management of public sectors
Agenda	The 4 steps to enhance your cyber resilience Base Line enhancement Security Solution (fulfil the surface) Digital Asset Management Vulnerability Management Training and Education Enhance the capability against Cybercrime Understand the proper “resolution” of cybercrime How to collaborate with law enforcement? Improve the core capability of “CSIRT” Dynamic Risk Analytics Triggers for dynamic risk analysis OODA (Observe, Orient, Decide and Act) Information Sharing and Collaboration What does it mean by “info-sharing” ? Info-sharing models (US/Japan) Importance of threat “intelligence”
Reference	CIBOK Chapter 1-10