Description

The curriculum spans the full lifecycle of breach prevention, detection, response, and governance, reflecting the integrated technical, procedural, and organizational controls found in mature security programs that align with ongoing risk management and compliance operations.

Module 1: Threat Landscape Analysis and Risk Assessment

Conduct asset classification to prioritize systems containing sensitive data for breach risk modeling.
Select and apply threat intelligence feeds to map active adversary tactics relevant to the organization’s sector.
Perform attack surface mapping across cloud, on-premises, and third-party systems to identify exposed entry points.
Implement risk scoring methodologies (e.g., DREAD or CVSS) to quantify likelihood and impact of potential breaches.
Integrate findings from red team exercises into risk assessment updates for accuracy.
Define thresholds for acceptable risk levels in alignment with business unit tolerance and compliance mandates.
Establish review cycles for reassessing threat models following major infrastructure changes.
Document assumptions and limitations in risk models to support audit and executive reporting.

Module 2: Identity and Access Management (IAM) Hardening

Enforce least privilege access through role-based access control (RBAC) with quarterly access recertification.
Implement multi-factor authentication (MFA) for all privileged accounts and remote access vectors.
Disable or remove stale accounts after 90 days of inactivity using automated deprovisioning workflows.
Configure privileged access management (PAM) solutions to enforce just-in-time (JIT) access for admin roles.
Integrate IAM systems with SIEM for real-time alerting on anomalous login behavior.
Define break-glass account procedures with logging and immediate post-use review requirements.
Enforce password rotation policies only when compromise is suspected, per NIST guidelines.
Map identity federation configurations to prevent privilege escalation via SSO misconfigurations.

Module 3: Data Protection and Encryption Strategies

Classify data by sensitivity level and apply encryption controls accordingly (e.g., AES-256 for PII at rest).
Implement key management policies using HSMs or cloud KMS with separation of duties for key access.
Enforce TLS 1.2+ for data in transit and audit cipher suite configurations across endpoints.
Deploy tokenization or masking for non-production environments to reduce exposure of live data.
Define data residency requirements and configure encryption to comply with jurisdictional laws.
Integrate DLP solutions to monitor and block unauthorized transfers of sensitive data via email or USB.
Establish encryption key rotation schedules based on data criticality and regulatory timelines.
Validate encryption coverage across databases, backups, and endpoint storage using automated scanning tools.

Module 4: Security Monitoring and Detection Engineering

Develop custom detection rules in SIEM to identify lateral movement patterns post-initial compromise.
Normalize and ingest logs from endpoints, firewalls, and cloud services into a centralized platform.
Configure alert thresholds to reduce false positives while maintaining sensitivity to high-risk events.
Integrate EDR telemetry with SOAR platforms for automated triage of suspicious process executions.
Conduct purple team exercises to validate detection coverage gaps and tune monitoring rules.
Define retention policies for security logs based on forensic needs and compliance requirements.
Deploy network traffic analysis (NTA) tools to detect command-and-control communications.
Establish escalation paths for Level 1 analysts to engage incident response teams during active alerts.

Module 5: Incident Response Planning and Execution

Develop and maintain an incident response playbook with role-specific action steps for breach scenarios.
Conduct tabletop exercises quarterly to validate communication chains and decision workflows.
Pre-negotiate contracts with forensic firms and legal counsel to reduce response latency.
Define criteria for declaring a breach and activating crisis management protocols.
Preserve volatile data (e.g., memory dumps, active connections) during initial containment.
Coordinate with PR teams to control external messaging without compromising forensic integrity.
Document all response actions in a chain-of-custody format for legal and regulatory review.
Conduct post-incident reviews to update playbooks based on response effectiveness.

Module 6: Third-Party and Supply Chain Risk Management

Require security questionnaires and audit reports (e.g., SOC 2) before onboarding critical vendors.
Enforce contractual clauses mandating breach notification within 24 hours of discovery.
Conduct penetration tests on vendor-facing systems managed by third parties.
Monitor vendor access logs and restrict permissions to least necessary scope.
Map data flows to identify where third parties process or store sensitive information.
Implement vendor risk scoring to prioritize audits and continuous monitoring efforts.
Establish isolation zones (e.g., DMZs) for third-party system integrations to limit lateral risk.
Review software bills of materials (SBOMs) for open-source components with known vulnerabilities.

Module 7: Regulatory Compliance and Breach Reporting

Map data processing activities to GDPR, CCPA, HIPAA, or other applicable regulatory frameworks.
Define data subject rights procedures that include breach notification timelines and opt-out mechanisms.
Conduct data protection impact assessments (DPIAs) for high-risk processing activities.
Implement breach logging systems that capture required details for 72-hour GDPR reporting.
Coordinate with legal teams to determine whether a breach meets materiality thresholds for disclosure.
Prepare regulatory communication templates pre-approved by legal and compliance officers.
Maintain records of consent and data processing activities to demonstrate accountability.
Integrate compliance checks into change management processes to prevent configuration drift.

Module 8: Post-Breach Forensics and Recovery

Deploy write-blockers and forensic imaging tools to preserve evidence from compromised systems.
Reconstruct attack timelines using endpoint, network, and authentication logs.
Identify root cause by correlating IOC data with threat intelligence and system configurations.
Validate system integrity before restoration using cryptographic checksums of clean backups.
Apply patches or configuration changes to eliminate exploited vulnerabilities prior to recovery.
Monitor restored systems for residual malicious activity during a defined observation period.
Archive forensic data securely with access restricted to legal and IR teams.
Update threat models and detection rules based on attacker TTPs observed during the breach.

Module 9: Security Culture and Executive Governance

Present breach risk metrics to the board using business-aligned KPIs (e.g., mean time to detect).
Implement role-based security awareness training with phishing simulations for all employees.
Define escalation protocols for CISO to report material cyber risks to executive leadership.
Align security budget requests with risk reduction outcomes, not compliance checkboxes.
Measure employee adherence to security policies through audit findings and incident root causes.
Establish cross-functional cyber risk committees with legal, IT, and business unit representation.
Conduct executive-level crisis simulations to test decision-making under pressure.
Review insurance policy coverage annually to ensure alignment with current threat exposure.