Description

This curriculum spans the breadth of a multi-workshop security transformation program, addressing the same technical, procedural, and governance challenges encountered in enterprise-wide disruption mitigation efforts, from architecture design and incident orchestration to third-party risk and executive communication.

Module 1: Threat Landscape Analysis and Strategic Prioritization

Conducting sector-specific threat modeling using MITRE ATT&CK to align detection capabilities with adversary TTPs prevalent in the organization’s vertical.
Deciding between internal threat intelligence development versus third-party subscription based on data sensitivity and resource constraints.
Integrating geopolitical risk assessments into threat prioritization when operating across multiple jurisdictions with varying cyber conflict exposure.
Establishing thresholds for elevated threat levels that trigger predefined response playbooks without executive approval.
Weighting likelihood versus impact in risk matrices to avoid over-investment in low-probability, high-impact scenarios at the expense of persistent threats.
Managing stakeholder expectations when de-prioritizing high-visibility but low-risk threats promoted by media coverage.

Module 2: Architecture Resilience and System Hardening

Selecting between microsegmentation and traditional VLAN-based segmentation based on application interdependencies and operational overhead tolerance.
Enforcing secure boot and firmware integrity checks on critical infrastructure, balancing security with patch deployment complexity.
Designing failover mechanisms for identity providers to prevent authentication outages during DDoS or compromise events.
Implementing just-in-time (JIT) privileged access to reduce standing privileges while ensuring operational continuity during outages.
Choosing between full-disk encryption and file-level encryption for endpoint devices based on performance impact and data residency requirements.
Introducing deception technology (e.g., honeytokens) in production environments without introducing false positives in monitoring systems.

Module 3: Incident Response Orchestration and Escalation

Defining escalation paths that bypass normal management hierarchies during active breaches while maintaining chain-of-command accountability.
Integrating SOAR platforms with existing ticketing systems without creating redundant workflows that delay response.
Establishing criteria for declaring a security incident versus a routine anomaly to prevent response fatigue.
Coordinating containment actions across hybrid cloud and on-premises environments with differing access controls and tooling.
Documenting forensic data collection procedures that preserve chain of custody for potential legal proceedings.
Managing communication between technical teams and legal counsel during incident response to avoid premature disclosure.

Module 4: Third-Party Risk and Supply Chain Integrity

Requiring software bill of materials (SBOM) from vendors and integrating it into vulnerability management workflows.
Conducting on-site assessments of critical suppliers versus relying on questionnaire-based audits based on data access level.
Implementing runtime application self-protection (RASP) to mitigate risks from third-party libraries with known vulnerabilities.
Negotiating contractual clauses for breach notification timelines and forensic data access from cloud service providers.
Monitoring open-source component repositories for typosquatting and dependency confusion attacks in CI/CD pipelines.
Enforcing multi-party approval for onboarding vendors with access to crown jewel assets.

Module 5: Identity and Access Governance at Scale

Designing role-based access control (RBAC) models that minimize role explosion while supporting least privilege.
Implementing access recertification campaigns with automated deprovisioning for non-responders, balanced against business disruption.
Introducing risk-based authentication step-up challenges without degrading user experience for high-frequency operations.
Managing service account lifecycle in containerized environments where ephemeral instances complicate credential rotation.
Enforcing privileged session recording and monitoring while complying with regional privacy regulations.
Integrating identity governance tools with HR systems to automate access changes during employee transfers and terminations.

Module 6: Secure Development Lifecycle Integration

Embedding security champions in development teams versus centralized security review based on team maturity and velocity.
Configuring SAST tools to minimize false positives in CI pipelines without reducing scan coverage.
Enforcing pre-commit hooks for secrets detection while allowing legitimate configuration files through allowlisting.
Requiring threat modeling for new features with direct customer data exposure, even under aggressive release timelines.
Managing dependency updates in long-term support (LTS) applications where patching introduces regression risks.
Conducting red team exercises on staging environments without disrupting performance testing or data integrity.

Module 7: Regulatory Compliance and Audit Preparedness

Mapping control implementations to multiple regulatory frameworks (e.g., GDPR, HIPAA, CCPA) to avoid redundant audits.
Generating audit trails that capture both technical events and administrative decisions for compliance evidence.
Responding to regulator inquiries while preserving legal privilege and avoiding over-disclosure.
Implementing data retention policies that satisfy both operational needs and deletion rights under privacy laws.
Preparing for unannounced audits by maintaining real-time compliance dashboards accessible to internal oversight.
Reconciling control gaps identified in audits with risk acceptance processes that include documented executive sign-off.

Module 8: Crisis Communication and Executive Engagement

Developing pre-approved messaging templates for different breach scenarios while allowing for situational customization.
Conducting tabletop simulations with C-suite executives to align technical response with business continuity priorities.
Establishing a single source of truth for incident status to prevent conflicting information from different teams.
Deciding when to involve public relations teams versus managing communications internally based on incident severity.
Translating technical impact into business metrics (e.g., revenue at risk, customer exposure) for executive briefings.
Managing board-level reporting frequency during prolonged incidents to maintain oversight without micromanagement.