Running an in-house assessment programme
You turn an organisation’s security assessments into a yearly programme: you plan goals and coverage, track metrics, work with the defence team and set up governance.
Level 501 · 15 lessons · 12 practice labs
Lessons
Setting up the programme
- Programme goals: compliance or risk reduction?
- The coverage plan: how often each system is assessed
- In-house team, external provider and a mixed model
- Choosing an external assessment provider: competence and report quality
- Short task: prepare the yearly assessment calendar of a fictional company
Measuring and improving
- Programme metrics: time to fix, recurring findings, coverage
- Trend reporting: security posture over the years
- Working with the defence team: closing detection gaps together
- Continuous security validation: regular control scenarios
- Short task: design a dashboard for the programme metrics
Governance
- The security testing policy and approval flow
- Risk acceptance: documenting a finding that cannot be fixed
- Budget, staffing and skills plan
- Regulatory expectations: testing duties in finance, healthcare and critical infrastructure
- Capstone: write a two-year assessment programme proposal for an organisation
Practice labs
- Set an assessment programme's goal in terms of compliance and risk: Read Yakamoz Telekom's management notes, decide whether the programme is compliance- or risk-led and write three measurable goals.
- Prepare a fictional company's yearly assessment calendar: Classify systems by importance and produce a calendar showing how often and with which type each class is assessed per year.
- Score external assessment offers on competence and report quality: Score three fictional offers and their sample reports against criteria and write your choice and the clauses to add to the contract.
- Calculate mean time to remediate from finding data: Calculate mean time to remediate by severity from the given finding records and flag those exceeding the target.
- Find recurring findings and suggest their root cause: Identify repeating findings in three years of assessment data and write a note explaining the process root cause.
- Design a dashboard for programme metrics: Prepare a one-page dashboard draft for management with coverage, time to fix and recurring finding metrics and a trend commentary.
- Match assessment findings to whether they were detected: Compare the assessment activity list with defence alerts and list the steps that raised no alert as detection gaps.
- Write control scenarios for regular validation: Write safe, monthly control scenarios with a defined expected result for three critical security controls.
- Set up a check that regularly validates one security control: Set up a scheduled check on the lab server that confirms a firewall rule still holds and reports when it fails.
- Find the missing step in a security test approval flow: Compare the given approval flow with policy clauses, add missing steps such as system owner approval and redraw it.
- Prepare a risk acceptance record for a finding that cannot be fixed: Write a risk acceptance record for a finding on a legacy system with compensating controls, expiry date and approver.
- Write a two-year assessment programme proposal for an organisation: Prepare a two-year programme proposal for Erguvan Sigorta that accounts for regulatory expectations, budget and team skills.
About this course
You turn an organisation’s security assessments into a yearly programme: you plan goals and coverage, track metrics, work with the defence team and set up governance.
What you will learn
- Setting up the programme
- Measuring and improving
- Governance
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.