Building a continuous exposure management programme
You design an exposure management programme from discovery to closure: you prioritise with business context, receive outside reports, verify exposure, assign work to owners and report measured results to management.
Level 501 · 13 lessons · 12 practice labs
Lessons
The programme framework
- Continuous exposure management: scoping, discovery, prioritisation, validation, mobilisation
- Business context: which asset is critical and why
- Feeding threat intelligence into prioritisation
- Short task: set the first programme scope for an organisation
Process
- Merging finding sources: scans, open sources, reports
- Receiving outside security reports: a disclosure policy and security.txt
- Validating exposure: is it really reachable?
- Mobilisation: assigning work to owners and following up
- Short task: draw the workflow of a finding from discovery to closure
Measuring and reporting
- Programme metrics: exposure time and closure rate
- The exposure report for management
- Bringing supplier and subsidiary surfaces into scope
- Capstone: design an exposure management programme for a fictional holding company
Practice labs
- Define the first programme scope for a company: Write which of Yelkovan Bankası's customer portal, branch network and supplier links enter the first cycle, with reasons.
- Assign business-criticality scores to assets: Score Turnalı Perakende's thirty assets by revenue, data sensitivity and dependency, and mark the critical ones.
- Feed threat intelligence into prioritisation: Match vulnerabilities reported as actively used in the lab threat bulletin against the inventory and re-rank the priority list.
- Add a security contact file to the company site: Publish a security contact file with contact, policy and expiry fields on Ilgıntepe Tekstil's lab site and verify it is reachable.
- Merge scan, open-source and report findings: Map findings from three sources onto common fields, merge duplicates and build a single finding queue.
- Handle an external security report end to end: Validate a researcher's report, assign it to its owner, draft the reply and acknowledgement and complete the closure record.
- Validate whether a finding is truly reachable: Test from the lab network whether five listed exposures are reachable from outside and mark the real ones.
- Open and track a ticket for a validated exposure: Open a dated ticket for the validated open management port, track progress and re-verify once it is closed.
- Map a finding's workflow from discovery to closure: Prepare a flow showing every step, owner and duration for an exposed test site at Selvikent Belediyesi, from discovery to closure.
- Calculate mean exposure time: Calculate how long each finding stayed open from the lab finding records and produce averages by severity.
- Write a one-page exposure report for management: Prepare an executive report from the quarter's data with closure rate, exposure time and the three biggest risks.
- Design an exposure management programme for a fictional holding: Write a programme document with scope, cycle, roles and metrics for Akçakavak Holding, which has subsidiaries and suppliers.
About this course
You design an exposure management programme from discovery to closure: you prioritise with business context, receive outside reports, verify exposure, assign work to owners and report measured results to management.
What you will learn
- The programme framework
- Process
- Measuring and reporting
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.