Job role: security assessor
You do a security assessor’s job end to end: you take the fictional Yelkovan Bank’s request, prepare the proposal and rules, run the external and internal assessment, report an urgent finding, write the report and close with a retest.
Level 501 · 16 lessons · 15 practice labs
Lessons
Getting to know the role
- What a security assessor does: the flow of a week
- The skills matrix: technical, written and spoken skills
- Client communication: expectations, bad news and boundaries
- Short task: fill in your own skills matrix and identify your gaps
End-to-end engagement: Yelkovan Bank
- Intake: Yelkovan Bank’s assessment request
- Writing the proposal and scope
- Preparing the rules of engagement for sign-off
- The external assessment phase
- The internal network and identity phase
- Validating critical findings with the least impact
- Urgent finding notice: a critical issue found mid-test
- Short task: prepare and present the interim status report
Closing
- The final report and the executive presentation
- Retest and closure
- The post-engagement review: what went well
- Capstone: run the Yelkovan Bank engagement from proposal to closure
Practice labs
- Fill in your skills matrix and identify the gaps: Score yourself on the technical, written and verbal skills matrix and write a development plan for your three weakest areas.
- Tell a client about a critical finding clearly and calmly: Prepare the critical finding email to Yelkovan Bankası's IT manager and notes for a five-minute phone call.
- Plan an assessment specialist's week: Plan a week with two parallel assessments, a debrief and a retest by priority and resolve the clashes.
- Extract needs and uncertainties from an assessment request: List the goals, constraints and questions to ask from Yelkovan Bankası's request email.
- Write the offer and scope proposal: From the request and questionnaire, prepare an offer with phases, effort estimate, deliverables and out-of-scope items.
- Prepare the rules of engagement for signature: Fold the bank's extra security requirements into the rules document and complete the signature page and emergency contact list.
- Inventory and validate the bank's external surface: Find the bank's domains, addresses and open services on the lab external network, check them against scope and produce a validated inventory.
- Identify priority findings in the internal network and identity layer: Audit privileged groups, stale accounts and the password policy in the lab domain and rank the top five findings.
- Validate a critical finding with the least impact: Validate the critical misconfiguration with read-only steps, prove its impact and show from monitoring data that service was not affected.
- Write an urgent notice for a critical flaw found during testing: Prepare the short notice to the emergency contact with the finding, evidence, interim measure and next step.
- Prepare and present the interim status report: Prepare the interim report with completed phases, first findings and remaining work plus five presentation points.
- Verify the interim measure for the urgent finding works: Retest the interim rule the bank team applied on the lab, prove whether the hole is closed and update the notice.
- Write the post-assessment internal review: Prepare an internal review note listing in concrete items what went well, what slipped and what will change next time.
- Draw out the key messages for the final executive briefing: Prepare the titles, key messages and decision requests for a five-slide executive briefing from the final report.
- Close the Yelkovan Bankası assessment with a retest: Retest the fixed findings on the lab, request risk acceptance or a new date for the rest and complete the closure letter.
About this course
You do a security assessor’s job end to end: you take the fictional Yelkovan Bank’s request, prepare the proposal and rules, run the external and internal assessment, report an urgent finding, write the report and close with a retest.
What you will learn
- Getting to know the role
- End-to-end engagement: Yelkovan Bank
- Closing
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.