Description

This curriculum spans the design and implementation of organisation-wide security controls, comparable in scope to a multi-phase internal capability build or a technical advisory engagement across governance, infrastructure, and application security domains.

Module 1: Establishing a Security Posture Baseline

Define and document acceptable risk thresholds for critical assets based on business impact analysis and regulatory requirements.
Select and deploy vulnerability scanning tools across hybrid environments, ensuring coverage of cloud workloads, containers, and legacy systems.
Conduct a gap analysis between current security controls and industry frameworks such as NIST CSF or ISO 27001.
Negotiate access to system logs and configuration data from third-party vendors managing outsourced infrastructure.
Implement asset inventory automation to track hardware, software, and cloud instances with ownership and classification metadata.
Develop and enforce a data classification schema that aligns with access control policies and retention schedules.

Module 2: Identity and Access Management Governance

Design role-based access control (RBAC) structures that minimize privilege escalation paths while supporting business workflows.
Enforce multi-factor authentication for all administrative and privileged accounts, including break-glass emergency access procedures.
Automate user provisioning and deprovisioning across integrated systems using identity lifecycle management tools.
Conduct quarterly access reviews for privileged roles, documenting justification for continued access.
Integrate privileged access management (PAM) solutions to control and monitor use of administrative credentials.
Implement just-in-time (JIT) access for cloud environments to reduce standing privileges.

Module 3: Endpoint and Device Security Hardening

Standardize endpoint detection and response (EDR) agent deployment across all corporate-owned devices, including remote workstations.
Enforce disk encryption and secure boot policies on all laptops and mobile devices through mobile device management (MDM) platforms.
Configure host-based firewalls to restrict inbound and outbound traffic based on application and network zone policies.
Disable unnecessary services and ports on servers and workstations using automated configuration management tools.
Implement application allow-listing on critical systems to prevent execution of unauthorized binaries.
Establish procedures for secure handling and wiping of decommissioned devices in compliance with data protection laws.

Module 4: Network Security Architecture and Segmentation

Design and enforce network segmentation using VLANs and micro-segmentation to isolate high-risk systems and data stores.
Deploy network intrusion detection and prevention systems (NIDPS) at key ingress and egress points, including cloud VPCs.
Configure firewall rules to follow least-privilege principles, with regular audits to remove obsolete rules.
Implement DNS filtering and secure web gateways to block access to known malicious domains and phishing sites.
Establish encrypted tunnels (IPsec or TLS) for data in transit between data centers and cloud environments.
Monitor and log all lateral movement attempts across internal network segments using network traffic analysis tools.

Module 5: Secure Software Development and Supply Chain Controls

Integrate static and dynamic application security testing (SAST/DAST) into CI/CD pipelines for all internally developed applications.
Enforce code signing for all production software releases and verify signatures during deployment.
Establish a software bill of materials (SBOM) requirement for third-party vendors and conduct vulnerability assessments on components.
Restrict use of public code repositories and open-source libraries based on security risk scoring and maintain approved lists.
Implement secure configuration management for development, testing, and production environments to prevent credential leaks.
Conduct threat modeling sessions during design phases for new applications handling sensitive data.

Module 6: Logging, Monitoring, and Threat Detection

Centralize log collection from all critical systems into a SIEM platform with normalized event formats.
Develop and tune detection rules to reduce false positives while identifying indicators of compromise (IOCs) and suspicious behaviors.
Ensure log retention periods comply with legal and regulatory requirements, including chain-of-custody procedures.
Configure real-time alerting for high-severity events with defined escalation paths and response playbooks.
Implement user and entity behavior analytics (UEBA) to detect anomalous activity indicative of insider threats.
Conduct regular red team exercises to validate detection coverage and response effectiveness.

Module 7: Security Policy Enforcement and Compliance

Draft and maintain enforceable security policies covering acceptable use, remote access, and data handling practices.
Conduct internal audits to verify compliance with security policies and document remediation for findings.
Coordinate with legal and privacy teams to ensure policies align with GDPR, HIPAA, or other applicable regulations.
Implement technical controls to enforce policy requirements, such as blocking unauthorized cloud storage uploads.
Deliver mandatory security awareness training with role-specific content and track completion rates.
Manage exceptions to security policies through a formal risk acceptance process with executive sign-off.

Module 8: Third-Party Risk and Vendor Security Management

Develop a vendor risk assessment framework based on data sensitivity and criticality of services provided.
Require third parties to provide evidence of security certifications or audit reports (e.g., SOC 2, ISO 27001).
Negotiate contractual clauses that mandate breach notification timelines and security control requirements.
Conduct on-site or remote security assessments for high-risk vendors with access to core systems.
Monitor vendor security posture continuously using automated risk rating platforms and threat intelligence feeds.
Establish exit strategies and data recovery plans for terminating relationships with critical vendors.