Selection and Implementation of Security Controls

Identify data assets and threats, assess risk, and select and implement cybersecurity controls on an ecommerce web server, using WAF, IPS, vulnerability scanners, and incident response.

Explore tools to identify assets, threats, and vulnerabilities for server risk, including open source scanners like Nmap, Nessus, OpenVAS, ZAP, sqlmap, and threat intel platforms, tested in a lab.

Learn to determine likelihood and impact for web server cyber risks using open source tools, vulnerability data, and threat intelligence, then calculate risk with a risk matrix and impact categories.

Document a cybersecurity risk assessment by compiling a comprehensive, living document that covers executive summary, assets, threats, vulnerabilities, likelihood, impact, risk level, and pragmatic mitigation strategies for a web server.

Explore how to structure a cybersecurity risk assessment report from executive summary through assets, threats, vulnerabilities, and mitigation strategies, and learn to identify, assess, and prioritize risks for effective controls.

Governance shapes policy, risk assessment, and resource allocation to enable effective selection and implementation of cyber security controls, aligning with business goals and ensuring compliance.

Explore the challenges, considerations, and disadvantages of implementing cybersecurity frameworks, including oversimplification, integration, and resource constraints, and learn to tailor a pragmatic, risk-based approach with top controls like MFA.

Navigate the challenges of oversimplifying cybersecurity when adopting security frameworks. Tailor and prioritize controls to your risk profile, assets, and workflows.

Explore when to use industry security frameworks to standardize security practices, meet regulatory requirements, and improve cyber security posture, and when a custom security program better fits unique environments.

Learn how to select and implement cybersecurity controls using the cybersecurity framework, from understanding environments and risk assessment to tailoring, implementing, monitoring, and iterating controls in an organizational context.

Apply the nist csf to select and tailor cybersecurity controls for a fictional organization, mapping risks to core functions, then implement, monitor, document, and iterate for continuous improvement.

Develop and implement a 12-month plan to deploy the selected cybersecurity framework controls. Outline responsibilities, timelines, milestones, and continuous monitoring to guide the implementation across the organization.

Define metrics and goals, establish baselines, and continuously monitor and analyze data from security logs and scanners to measure the effectiveness of implemented controls and improve security posture.

Apply a structured, end-to-end process to select and implement cybersecurity risk controls by assessing context, risks, and assets, aligning with objectives, prioritizing controls, and planning, testing, monitoring, and training.