Description

This curriculum spans the technical and procedural rigor of a multi-workshop incident readiness program, covering the same ground as an internal capability build for breach prevention, detection, and response across identity, data, cloud, and third-party risk domains.

Module 1: Threat Landscape Analysis and Breach Typology

Classify observed breach patterns by attack vector (e.g., phishing, credential stuffing, insider misuse) using MITRE ATT&CK framework mappings.
Map historical breach data to organizational asset types (e.g., databases, cloud storage, endpoints) to prioritize monitoring efforts.
Implement automated ingestion of threat intelligence feeds (e.g., ISAC reports, CVE databases) into SIEM correlation rules.
Evaluate the frequency and impact of supply chain compromises when assessing third-party risk exposure.
Differentiate between targeted attacks and opportunistic scanning based on access patterns and payload delivery.
Adjust threat modeling assumptions based on industry-specific breach trends (e.g., ransomware in healthcare vs. IP theft in manufacturing).
Integrate dark web monitoring outputs into incident response playbooks for credential exposure scenarios.
Document attacker dwell time metrics from past incidents to refine detection threshold settings.

Module 2: Identity and Access Management in Breach Prevention

Enforce just-in-time (JIT) privilege elevation for administrative accounts using PAM solutions.
Implement conditional access policies that block or require MFA based on user location, device compliance, and sign-in risk.
Conduct quarterly access reviews for privileged roles with automated attestation workflows.
Disable legacy authentication protocols (e.g., SMTP, IMAP) to eliminate password-based attack surfaces.
Configure service accounts with non-interactive sign-in restrictions and monitor for anomalous usage.
Rotate long-lived API keys and secrets using automated credential management tools.
Enforce role-based access control (RBAC) alignment with job functions during employee transfers or role changes.
Implement identity federation with SAML or OIDC to reduce password sprawl across SaaS applications.

Module 3: Data Classification and Protection Controls

Deploy automated data discovery tools to identify unstructured sensitive data (e.g., PII, PCI) in file shares and cloud storage.
Apply metadata tagging to data assets based on classification levels (e.g., public, internal, confidential) for policy enforcement.
Encrypt data at rest using platform-native key management (e.g., AWS KMS, Azure Key Vault) with customer-managed keys.
Implement dynamic data masking in reporting tools to limit exposure of sensitive fields to authorized roles.
Define retention policies for log data containing personal information to comply with data minimization principles.
Enforce DLP policies at egress points (e.g., email, USB, cloud uploads) with content inspection and user notification.
Isolate high-risk datasets (e.g., source code, financial records) in segmented network zones with strict access logging.
Conduct regular audits of data access patterns to detect unauthorized queries or bulk extractions.

Module 4: Logging, Monitoring, and Detection Engineering

Standardize log formats across systems using schema enforcement (e.g., CEF, JSON) for consistent parsing in SIEM.
Configure log retention durations based on regulatory requirements and forensic investigation needs (e.g., 180+ days).
Develop detection rules for lateral movement indicators (e.g., pass-the-hash, WMI execution) using behavioral analytics.
Suppress false positives by tuning correlation thresholds based on baseline activity for user and entity behavior.
Integrate EDR telemetry with SIEM to enrich alert context with process lineage and file reputation.
Validate log source coverage for critical systems (e.g., domain controllers, firewalls, cloud APIs) during audits.
Implement anomaly detection for unusual data transfer volumes (e.g., >5GB outbound in 5 minutes) from non-backup systems.
Design alert escalation paths based on severity, ensuring critical incidents trigger immediate response workflows.

Module 5: Incident Response Orchestration and Containment

Activate predefined incident runbooks for breach types (e.g., ransomware, data exfiltration) within 15 minutes of confirmation.
Isolate compromised systems using automated network segmentation (e.g., SDN, firewall rule updates).
Preserve volatile memory and disk images from affected endpoints before disconnecting.
Coordinate legal and PR teams only after technical containment to avoid premature disclosure.
Deploy network tarpits or honeypots to delay attacker progress during forensic analysis.
Document all response actions in a centralized audit trail for regulatory and post-incident review.
Freeze user accounts associated with compromised credentials and initiate forced password resets.
Validate backup integrity before initiating system restoration to prevent reinfection.

Module 6: Cloud Infrastructure Security and Breach Exposure

Enforce S3 bucket policies to block public access by default and audit configurations via CSPM tools.
Monitor cloud storage access logs for anomalous geographic requests (e.g., data access from high-risk jurisdictions).
Implement workload identity federation instead of static IAM keys for containerized applications.
Restrict cross-account roles to least privilege and log all assume-role activities.
Scan container images in CI/CD pipelines for known vulnerabilities before deployment.
Configure cloud-native firewalls (e.g., AWS Security Groups, GCP Firewall Rules) with egress filtering.
Enable detailed CloudTrail or Audit Logs with log integrity validation and export to immutable storage.
Automate remediation of misconfigurations (e.g., open RDP ports) using Infrastructure-as-Code drift detection.

Module 7: Third-Party Risk and Supply Chain Exposure

Require security questionnaires and audit reports (e.g., SOC 2) before onboarding critical vendors.
Enforce contractual clauses mandating breach notification within 24 hours of discovery.
Monitor vendor IP ranges for unexpected access to internal systems using netflow analysis.
Segment vendor access networks using zero-trust principles and micro-segmentation.
Conduct penetration testing of vendor-facing applications annually or after major changes.
Inventory software bill of materials (SBOM) for critical applications to assess third-party library risks.
Validate that third-party backups are encrypted and access-controlled to prevent indirect data exposure.
Implement DNS filtering to block known malicious domains used by compromised vendor software.

Module 8: Regulatory Compliance and Breach Disclosure Management

Map data processing activities to GDPR, CCPA, or HIPAA requirements using a data inventory matrix.
Establish breach triage criteria to determine reportability (e.g., likelihood of harm, data sensitivity).
Document breach timelines from detection to containment for regulatory submissions.
Coordinate with legal counsel to assess notification obligations across jurisdictions with overlapping laws.
Prepare breach notification templates with jurisdiction-specific language and contact details.
Conduct internal tabletop exercises to validate compliance with 72-hour GDPR reporting deadlines.
Archive all breach-related communications for potential litigation or regulatory inquiry.
Update privacy impact assessments (PIAs) following breach root cause findings.

Module 9: Post-Incident Review and Security Posture Optimization

Conduct root cause analysis using the 5 Whys or Fishbone method to identify systemic failures.
Update detection rules to prevent recurrence of the same attack vector (e.g., new YARA rule for malware variant).
Revise access control policies based on excessive permissions identified during forensic analysis.
Measure mean time to detect (MTTD) and mean time to respond (MTTR) to benchmark improvement.
Publish internal post-mortem reports with actionable recommendations, redacting sensitive details.
Reconfigure network segmentation to limit lateral movement paths exposed during the breach.
Retrain affected user groups on phishing awareness using real examples from the incident.
Validate control effectiveness through red team exercises simulating the original attack chain.