Description

This curriculum spans the design and governance of a threat analysis function aligned to ISO 27001, comparable in scope to a multi-phase internal capability build or a technical advisory engagement supporting continuous risk-informed decision-making across security operations, compliance, and executive management.

Module 1: Aligning Threat Analysis with ISO 27001 Risk Assessment Framework

Selecting appropriate risk assessment methodologies (qualitative vs. quantitative) based on organizational risk appetite and audit requirements.
Integrating threat analysis outputs into Statement of Applicability (SoA) justifications for control exclusions or modifications.
Defining risk criteria that reflect both business impact and likelihood influenced by current threat intelligence.
Mapping threat scenarios to asset-value assignments in the risk register to ensure consistent prioritization.
Establishing thresholds for acceptable residual risk that trigger control enhancements or executive escalation.
Coordinating with internal audit to ensure threat analysis methods satisfy ISO 27001:2022 clause 6.1.2(e) requirements.
Documenting assumptions in threat likelihood scoring to support repeatability and third-party review.
Aligning threat analysis frequency with management review cycles and significant business changes.

Module 2: Establishing Threat Intelligence Integration Processes

Configuring automated ingestion of STIX/TAXII feeds into existing GRC platforms without introducing false positives.
Validating external threat intelligence relevance against industry-specific attack patterns (e.g., ICS-CERT for OT environments).
Assigning ownership for triaging and contextualizing threat indicators within the security operations team.
Setting retention policies for threat data to comply with privacy regulations and storage constraints.
Developing playbooks that link IOCs (Indicators of Compromise) to specific ISO 27001 controls like A.12.6.1 (Management of Technical Vulnerabilities).
Assessing cost-benefit of commercial threat intelligence subscriptions versus open-source alternatives.
Creating feedback loops from incident response findings to refine intelligence collection priorities.
Enforcing access controls on threat intelligence repositories to prevent unauthorized disclosure.

Module 3: Asset-Centric Threat Modeling for Information Security

Identifying critical information assets based on data classification and business process dependencies.
Applying STRIDE or PASTA frameworks selectively to high-value systems without over-engineering low-risk assets.
Documenting data flow diagrams for cloud-hosted applications to expose exposure points not evident in network topology.
Assigning threat actors (e.g., insider, APT, script kiddie) based on asset visibility and value to refine attack surface analysis.
Updating threat models after system changes such as API integrations or third-party data sharing.
Using attack trees to quantify path complexity for privilege escalation scenarios involving multiple controls.
Linking identified threats to specific control objectives in Annex A, such as A.9.2.3 (Access to System and Application).
Conducting threat model reviews with system owners to validate assumptions and gain buy-in for mitigations.

Module 4: Threat Scenario Development and Prioritization

Generating realistic threat scenarios using MITRE ATT&CK techniques mapped to organizational infrastructure.
Weighting scenarios by business impact severity (e.g., regulatory fines, operational disruption) rather than technical exploitability.
Using historical incident data to calibrate likelihood ratings and avoid over-reliance on generic threat feeds.
Excluding low-impact, high-effort attack paths that do not justify control investment under cost-benefit analysis.
Documenting scenario assumptions for challenge during internal audit or certification assessment.
Establishing a review cadence to retire or update threat scenarios based on control effectiveness monitoring.
Reconciling conflicting threat priorities between IT, OT, and third-party environments.
Presenting prioritized threat scenarios to senior management using business-aligned risk language.

Module 5: Control Selection and Gap Analysis Based on Threat Exposure

Identifying missing or underperforming controls by mapping threat scenarios to ISO 27001 Annex A.
Justifying compensating controls when full compliance with a control objective is operationally infeasible.
Assessing control overlap to avoid redundant investments (e.g., multiple logging tools fulfilling A.12.4).
Using threat-based scoring to prioritize control implementation in phased rollout plans.
Documenting control gaps in the SoA with explicit references to applicable threat scenarios.
Engaging legal and compliance teams to validate control choices against regulatory obligations.
Conducting technical validation of control efficacy (e.g., firewall rule testing) versus theoretical design.
Updating control ownership assignments when threat analysis reveals new operational dependencies.

Module 6: Operationalizing Threat-Driven Vulnerability Management

Adjusting vulnerability scanning frequency based on asset criticality and active exploitation trends.
Integrating exploitability metrics (e.g., EPSS scores) into patch prioritization workflows.
Defining SLAs for remediation based on threat severity and compensating controls in place.
Managing exceptions for unpatched systems by documenting risk acceptance with evidence of monitoring controls.
Coordinating patch deployment windows with business units to minimize operational disruption.
Validating fix effectiveness through retesting rather than relying on patch installation logs.
Tracking vendor response timelines for zero-day disclosures affecting critical systems.
Enforcing configuration baselines to reduce attack surface exposed by misconfigurations.

Module 7: Threat-Informed Security Monitoring and Detection Engineering

Designing SIEM correlation rules based on TTPs from recent threat scenarios rather than generic alerts.
Adjusting detection thresholds to balance false positives with threat coverage for high-risk assets.
Validating detection coverage by conducting purple team exercises aligned with threat models.
Updating log retention policies to support forensic investigation of advanced threats.
Integrating EDR telemetry into threat dashboards to improve visibility into endpoint compromise.
Assigning detection ownership across SOC shifts to ensure 24/7 coverage for critical alerts.
Documenting detection gaps for threats with low observability (e.g., living-off-the-land binaries).
Using threat-hunting playbooks derived from intelligence to proactively search for undetected activity.

Module 8: Incident Response Planning Based on Threat Profiles

Customizing IR playbooks for specific threat actors (e.g., ransomware vs. data exfiltration).
Pre-staging forensic toolkits and legal hold procedures for systems identified as high-risk targets.
Establishing communication protocols for notifying regulators based on threat impact classification.
Conducting tabletop exercises that simulate multi-stage attacks derived from threat models.
Integrating IR plans with business continuity processes for threats causing operational outages.
Defining criteria for engaging external incident response firms based on threat complexity.
Mapping IR roles to organizational structure to avoid ambiguity during crisis response.
Updating IR contact lists quarterly to reflect personnel and vendor changes.

Module 9: Measuring Effectiveness of Threat Analysis Activities

Defining KPIs such as mean time to detect (MTTD) for threats identified in scenario models.
Tracking control effectiveness by measuring reduction in threat exposure post-implementation.
Conducting post-incident reviews to assess whether threat analysis anticipated the attack vector.
Using red team results to validate the completeness of threat modeling assumptions.
Reporting threat coverage gaps to management with proposed remediation timelines.
Aligning threat analysis maturity with ISO 27001 internal audit findings over time.
Comparing threat detection rates across business units to identify training or tooling deficiencies.
Updating threat analysis processes based on lessons learned from control failures.

Module 10: Governance and Continuous Improvement of Threat Analysis

Scheduling quarterly threat analysis reviews with the information security steering committee.
Updating threat registers in response to changes in business strategy, technology, or threat landscape.
Ensuring threat analysis documentation meets ISO 27001 requirements for auditability and traceability.
Integrating threat analysis outputs into supplier risk assessments for third-party service providers.
Conducting competency assessments for staff performing threat modeling and analysis.
Managing version control for threat models and scenarios to support change tracking.
Establishing escalation paths for unresolved high-risk threats that exceed organizational tolerance.
Archiving outdated threat analysis records in compliance with records management policies.