Career capstone: security engineer
As the security engineer of a mid-sized company you take responsibility for a quarter: assessing risk, running hardening, monitoring and vulnerability management projects and measuring the results.
Level 501 · 12 lessons · 12 practice labs
Lessons
Assessment
- Risk assessment: assets, threats, controls
- Control gap analysis
- The quarterly roadmap and prioritisation
- Short task: pick the projects for the first 90 days and justify them
Projects
- Project: Linux and Windows baseline
- Project: connecting critical log sources to the SIEM
- Project: setting up the vulnerability management cycle
- Project: shrinking privileged accounts
- Short task: complete one of the projects through change management
Evidence
- Validating with red team findings
- Security metrics for management
- Capstone: the end-of-quarter security posture presentation
Practice labs
- Place assets, threats and controls in a risk table: Match the likeliest threat and the existing control to ten given assets and flag the rows left without a control.
- Run a control gap analysis with evidence: Verify twenty baseline controls on the lab servers with commands, mark each present, partial or absent and attach the evidence output.
- Pick the projects for the first 90 days and justify them: Score the gap analysis by risk reduction, effort and dependencies, choose four projects and explain to management the risk of what you left out.
- Compare one Linux and one Windows server with the baseline: Run the ready audit scripts and list the top five failed items for each server.
- Connect critical log sources to the SIEM and verify: Forward domain controller, web server and firewall logs to the SIEM and show a correctly parsed record from each source.
- Take the baseline live through change management: Write the change request with impact and rollback plan, apply to a pilot server first, fix the service that breaks and roll out to the rest.
- Set the steps and owners of the vulnerability management cycle: Assign an owner and a time limit to discovery, scanning, prioritisation, remediation and verification.
- Run the first scan cycle and hand the work to owners: Run an authenticated scan of the lab network, prioritise the findings and log the first ten work items with owner and date.
- Shrink the privileged accounts and measure the result: Inventory admin rights in CORP.LAB and on the Linux servers, remove the unneeded ones, confirm nothing broke and report the before and after counts.
- Put the security metrics on a one-page table: Tabulate patch compliance, log coverage and privileged account count with start-of-quarter and end-of-quarter values.
- Map red team findings to your controls: Verify from the logs which control blocked, detected or missed each of six findings in a given assessment report.
- Prepare the end-of-quarter security posture presentation: Bring together project outcomes, metric trends, remaining risks and next quarter’s ask with evidence in a five-slide outline.
About this course
As the security engineer of a mid-sized company you take responsibility for a quarter: assessing risk, running hardening, monitoring and vulnerability management projects and measuring the results.
What you will learn
- Assessment
- Projects
- Evidence
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.