Description

This curriculum spans the design and execution of threat assessment practices across operational technology and business processes, comparable in scope to a multi-phase organisational readiness program addressing cyber-physical risks in regulated industrial environments.

Module 1: Defining Threat Landscapes in Operational Contexts

Selecting threat taxonomies (e.g., STRIDE, MITRE ATT&CK) based on industry-specific operational risks such as manufacturing supply chains or financial transaction systems.
Mapping threat actors (insiders, third-party vendors, nation-states) to specific operational units based on access privileges and data sensitivity.
Integrating physical security threats (e.g., unauthorized facility access) with cyber threat models in hybrid operational environments.
Adjusting threat definitions when operational processes span regulated and non-regulated jurisdictions.
Documenting threat assumptions for audit trails when automated detection systems are deployed in production lines.
Deciding whether to classify human error as a threat or vulnerability in safety-critical operations like energy grid management.
Updating threat profiles in response to M&A activity that introduces new IT/OT systems into existing operations.
Establishing thresholds for when emerging threats (e.g., AI-driven social engineering) trigger formal reassessment of operational controls.

Module 2: Integrating Risk Assessment Frameworks with Operational Workflows

Choosing between qualitative (DREAD) and quantitative (FAIR) risk models based on data availability in legacy industrial control systems.
Embedding risk scoring into change management processes for operational technology (OT) patch deployments.
Aligning NIST SP 800-30 with ISO 27005 to support dual compliance in multinational operations.
Calibrating risk likelihood estimates using historical incident data from SCADA system logs.
Defining risk appetite thresholds for automated process deviations in pharmaceutical batch production.
Integrating risk treatment decisions into standard operating procedures (SOPs) for logistics and distribution centers.
Assigning ownership of residual risk validation to process engineers in continuous manufacturing environments.
Designing feedback loops from incident response outcomes to refine future risk assessments in real-time operations.

Module 3: Threat Modeling for Process-Centric Systems

Conducting data flow mapping for batch processing systems to identify interception points in automated workflows.
Selecting attack surface reduction techniques for legacy systems that cannot be decommissioned (e.g., Windows XP in medical devices).
Applying process-level decomposition to isolate high-risk nodes in automated inventory reconciliation systems.
Using sequence diagrams to model privilege escalation risks in ERP workflow approvals.
Identifying trust boundaries between human operators and robotic process automation (RPA) bots in finance operations.
Validating threat model assumptions through red team exercises on simulated production environments.
Updating threat models when integrating IoT sensors into cold chain logistics monitoring.
Documenting model limitations when third-party APIs lack transparency in order fulfillment systems.

Module 4: Governance of Third-Party and Supply Chain Threats

Requiring threat assessment evidence from suppliers during procurement for critical raw material delivery systems.
Enforcing contractual SLAs for vulnerability disclosure timelines from SaaS providers supporting HR operations.
Assessing geopolitical risks when sourcing components from regions with high cyber espionage activity.
Mapping supplier access levels to internal operational networks using least privilege principles.
Conducting on-site audits of logistics partners' cybersecurity controls for warehouse management systems.
Implementing continuous monitoring of third-party API behavior in real-time inventory updates.
Deciding whether to block or monitor anomalous data transfers from joint venture partners.
Establishing incident escalation paths with outsourced call centers handling customer order processing.

Module 5: Real-Time Threat Detection in Operational Environments

Configuring SIEM correlation rules to distinguish between equipment failure and cyber intrusion in power plant telemetry.
Deploying network taps in air-gapped production networks to monitor OT protocol anomalies.
Setting thresholds for alert fatigue reduction in 24/7 monitoring centers managing global distribution.
Integrating EDR agents on engineering workstations that access programmable logic controllers (PLCs).
Validating detection logic using synthetic attack simulations in staging environments.
Designing alert handoff procedures between security operations and plant floor supervisors.
Adjusting detection sensitivity during scheduled maintenance to avoid false positives.
Preserving raw log data from robotic assembly lines for forensic reconstruction after incidents.

Module 6: Risk-Based Control Selection and Implementation

Selecting compensating controls when encryption cannot be applied to real-time sensor data in chemical processing.
Implementing role-based access control (RBAC) for shift workers in multi-site manufacturing operations.
Deploying application allowlisting on HMIs to prevent unauthorized software execution.
Choosing between network segmentation and micro-segmentation for legacy SCADA systems.
Configuring multi-factor authentication for remote access to operational databases without disrupting workflows.
Justifying control investments using cost-of-incident avoidance models for board reporting.
Integrating physical access logs with logical access reviews for audit compliance in data centers.
Deferring control implementation when operational downtime costs exceed projected risk exposure.

Module 7: Incident Response Planning for Operational Continuity

Defining RTO and RPO for batch processing systems in food and beverage production lines.
Designing manual override procedures when automated systems are compromised in water treatment plants.
Conducting tabletop exercises with operations staff to validate response playbooks for ransomware events.
Pre-staging backup control system images for rapid restoration in semiconductor fabrication.
Establishing communication protocols between IT security and plant managers during crises.
Identifying critical spare parts inventory needed to resume operations after physical sabotage.
Documenting regulatory reporting obligations for safety system compromises in aviation maintenance.
Testing failover mechanisms for cloud-based inventory management during denial-of-service attacks.

Module 8: Regulatory Alignment and Audit Preparedness

Mapping GDPR data protection requirements to customer order processing workflows in e-commerce.
Documenting threat assessment methodologies for SOX compliance in financial reporting systems.
Preparing evidence packages for NERC CIP audits in bulk electric system operations.
Aligning threat logs with HIPAA requirements for access monitoring in hospital pharmacy systems.
Responding to regulator inquiries about unpatched vulnerabilities in safety instrumented systems.
Conducting internal audits of risk treatment plans before external certification assessments.
Reconciling conflicting control requirements between PCI DSS and internal change management policies.
Updating compliance documentation when operational processes are migrated to hybrid cloud environments.

Module 9: Continuous Threat and Risk Monitoring

Establishing KPIs for threat landscape evolution in global supply chain operations.
Integrating threat intelligence feeds into automated risk scoring for procurement decisions.
Scheduling periodic reassessment of threat models after major process automation upgrades.
Using control effectiveness metrics to justify decommissioning outdated security tools.
Conducting post-incident reviews to update threat profiles based on attacker TTPs.
Automating vulnerability scanning for OT systems during planned production downtimes.
Reporting residual risk trends to executive leadership using operational downtime metrics.
Adjusting monitoring scope when new regulatory requirements impact process design.