Description

This curriculum spans the design and operational decisions required to implement a corporate security program comparable to those addressed in multi-workshop risk mitigation engagements, covering technical hardening, cross-system integration, and governance trade-offs across identity, network, endpoint, and application layers.

Module 1: Threat Landscape Analysis and Risk Prioritization

Selecting which threat intelligence feeds to integrate based on industry sector, geographic footprint, and historical incident data.
Determining the scope of critical assets for protection by mapping data flows and identifying high-value systems through business impact analysis.
Deciding on the threshold for acceptable risk when balancing security investments against business operational requirements.
Implementing a repeatable process for updating threat models in response to new attack vectors such as zero-day disclosures.
Choosing between qualitative and quantitative risk assessment methodologies based on data availability and executive reporting needs.
Establishing criteria for escalating risks to executive leadership and board-level cybersecurity committees.

Module 2: Identity and Access Management Hardening

Enforcing just-in-time (JIT) access for privileged accounts using automated approval workflows and time-bound permissions.
Designing role-based access control (RBAC) structures that minimize privilege creep while supporting organizational agility.
Integrating multi-factor authentication (MFA) across legacy systems that lack native support, requiring proxy-based or API-driven solutions.
Deciding whether to federate identity with third-party providers or maintain on-premises identity stores for compliance reasons.
Implementing access certification campaigns with automated reminders and escalation paths for overdue reviews.
Handling orphaned accounts during mergers, acquisitions, or workforce reductions through integration with HR offboarding systems.

Module 3: Endpoint Detection and Response (EDR) Deployment

Selecting EDR agents based on performance impact, compatibility with virtual desktop infrastructure (VDI), and OS coverage.
Configuring detection rules to reduce false positives while maintaining sensitivity to lateral movement and credential dumping.
Establishing isolation protocols for compromised endpoints, including network segmentation and automated quarantine procedures.
Integrating EDR telemetry with SIEM systems using standardized log formats and normalization rules.
Defining response playbooks for common alert types, including memory analysis and disk artifact collection.
Managing agent updates and policy distribution across globally distributed endpoints with intermittent connectivity.

Module 4: Secure Network Architecture and Segmentation

Designing micro-segmentation policies for data centers based on application dependencies and least-privilege communication rules.
Deciding between VLANs, firewalls, and software-defined networking (SDN) for enforcing segmentation at scale.
Implementing DNS filtering to block known malicious domains without disrupting business-critical SaaS applications.
Configuring firewall rules to allow encrypted traffic while enabling SSL/TLS inspection where legally permissible.
Planning for east-west traffic monitoring by deploying network taps or leveraging host-based packet capture.
Responding to network reconnaissance attempts by adjusting access control lists (ACLs) and rate-limiting suspicious sources.

Module 5: Vulnerability Management and Patch Orchestration

Scheduling patching windows to minimize business disruption while adhering to SLAs for critical systems.
Prioritizing vulnerabilities using CVSS scores augmented with internal exploitability and asset criticality data.
Handling unpatched systems due to application incompatibility by implementing compensating controls such as host-based firewall rules.
Automating vulnerability scanning across hybrid environments with consistent credential management and scan frequency policies.
Integrating vulnerability data into ticketing systems with assigned owners and escalation paths for overdue remediation.
Conducting exception management for systems that cannot be patched, requiring documented risk acceptance and periodic review.

Module 6: Security Monitoring and Incident Response

Tuning SIEM correlation rules to detect brute force attacks, unusual logon times, and data exfiltration patterns.
Establishing 24/7 SOC coverage through a mix of in-house analysts and managed security service providers (MSSPs).
Defining incident classification criteria to determine response severity and notification requirements.
Conducting tabletop exercises to validate incident response plans for ransomware, insider threats, and supply chain compromises.
Preserving forensic evidence during live response, including memory dumps and registry hives, in compliance with legal hold policies.
Coordinating disclosure timelines with legal, PR, and regulatory teams following breach identification.

Module 7: Application Security and Secure Development Lifecycle

Integrating SAST and DAST tools into CI/CD pipelines without introducing unacceptable build delays.
Enforcing secure coding standards through automated code review and developer training on OWASP Top 10 vulnerabilities.
Managing third-party library risks by implementing software composition analysis (SCA) and patching open-source dependencies.
Requiring threat modeling for new applications before development begins, with documented data flow diagrams and controls.
Handling API security by enforcing authentication, rate limiting, and input validation across internal and external endpoints.
Conducting penetration tests on production-like environments with defined scope, rules of engagement, and remediation tracking.

Module 8: Governance, Compliance, and Third-Party Risk

Aligning security controls with regulatory frameworks such as GDPR, HIPAA, or PCI-DSS based on business operations.
Conducting vendor security assessments using standardized questionnaires and on-site audits for high-risk suppliers.
Managing cloud service provider (CSP) shared responsibility models by documenting control ownership and verification methods.
Implementing data loss prevention (DLP) policies that balance monitoring with employee privacy expectations.
Reporting security metrics to executives using KPIs such as mean time to detect (MTTD) and patch compliance rates.
Updating security policies annually or after major incidents, ensuring version control and employee attestation processes.