Most security incidents begin with human factors. Participants examine this layer from social engineering psychology to malware analysis and data protection.

Topics

• Psychology of social engineering
• Six decision triggers commonly exploited by attackers
• Phishing:
  • Spear phishing
  • Business Email Compromise (BEC)
  • Vishing
  • Deepfake attacks
• Warning signs and attack indicators
• Pretexting and impersonation
• Malware taxonomy:
  • Viruses
  • Worms
  • Trojans
  • Ransomware
  • Rootkits
  • Fileless/LOTL attacks
  • Botnets
• Ransomware attack lifecycle
• Defense-in-Depth model
• Data classification
• Data states:
  • At Rest
  • In Transit
  • In Use
• Data Loss Prevention (DLP)
• Physical security

Laboratory

• Phishing analysis:
  • Email headers
  • SPF, DKIM, and DMARC records
  • Indicators of Compromise (IoCs)
• Malware behavior analysis:
  • Processes
  • Network connections
  • File system artifacts

KIRA Project

• STRIDE-based Threat Model

Participants learn the three core technical pillars required to understand attacks and defensive mechanisms.

Topics

• Symmetric and asymmetric encryption
• Hashing and password protection
  • Secure algorithms
  • Dictionary attacks
  • Rainbow tables
  • Salting
• Digital signatures
• Public Key Infrastructure (PKI)
• Digital certificates
• TLS negotiation
• Post-quantum cryptography and emerging NIST standards
• Passkeys and FIDO2/WebAuthn authentication
• Next-generation firewalls
• DMZ architecture
• IDS/IPS systems
• VPN technologies
• Authentication evolution:
  • SMS OTP
  • TOTP
  • Passkeys
• Privileged Access Management (PAM)
• Single Sign-On (SSO)
• Identity federation protocols
• Access control models
• Microsegmentation

Laboratory

• Key and certificate generation
• Network scanning and service documentation
• Network traffic analysis:
  • HTTP
  • HTTPS
  • DNS

KIRA Project

• Initial Infrastructure Findings:
  • TLS configuration
  • Open ports
  • IAM configuration

The most practical day of the training. Participants attack a web application and an LLM-powered chatbot within a controlled environment.

OWASP Top 10 Topics

• Broken Access Control
• Security Misconfiguration
• Software Supply Chain Failures
• Cryptographic Failures
• Injection:
  • SQL Injection
  • XSS
  • Command Injection
• Insecure Design
• Authentication Failures
• Software and Data Integrity Failures
• Security Logging Failures
• Mishandling of Exceptional Conditions

OWASP Top 10 for LLM Applications

• Prompt Injection:
  • Direct
  • Indirect
• Sensitive Information Disclosure
• Excessive Agency
• System Prompt Leakage
• Embedding and vector database vulnerabilities
• RAG architecture attacks

Laboratory

• Minimum five web vulnerability exercises
  • Payload documentation
  • Results
  • Remediation recommendations
• LLM attacks:
  • Prompt Injection
  • System prompt extraction
  • Excessively privileged agent scenarios

KIRA Project

• Complete Application Findings sections:
  • Web Security
  • AI Security
• Proof of Concept (PoC)
• CVSS assessment

Automation Topics

• The 2026 philosophy of working with code:
  • Logic and debugging over syntax memorization
• Bash scripting:
  • Log analysis
  • IoC extraction
• Python scripting:
  • Data parsing
  • Automated IoC enrichment via APIs

Threat Intelligence Topics

• Strategic, operational, tactical, and technical intelligence
• IoC enrichment
• Open-source TI platforms
• Public threat intelligence feeds
• MITRE ATT&CK framework
• Mapping incidents to tactics and techniques
• Threat Hunting methodologies

SOC Topics

• SIEM architecture
• Detection rule creation
• Alert triage
• SOC Tier 1 / Tier 2 / Tier 3 responsibilities
• Playbook automation
• AI-assisted false-positive reduction

Laboratory

• Bash script:
  • Extracting the Top 10 attacking IP addresses from logs
• Python script:
  • IoC enrichment with CSV export
• PCAP analysis and MITRE ATT&CK mapping

KIRA Project

• Risk Register
• 5×5 Risk Matrix
• Initial POA&M Remediation Plan

Participants learn the business, legal, and financial impacts of cybersecurity vulnerabilities and build actionable remediation strategies.

Risk Management

• Risk calculations:
  • SLE
  • ARO
  • ALE
• Four risk treatment strategies
• Residual risk
• Finalizing the POA&M plan
• Business continuity metrics:
  • BIA
  • RTO
  • RPO
• Supply chain security

Regulations and Compliance

• NIS2
  • Essential entity obligations
  • Incident reporting
    • 24-hour initial notification
    • 72-hour full report to CERT
  • Financial penalties
• DORA
  • ICT risk management in financial services
  • Resilience testing
  • Third-party oversight
• GDPR
  • Technical and organizational measures
  • 72-hour breach notification
  • Data Protection Officer responsibilities

Cloud Security and Incident Response

• Shared responsibility models:
  • SaaS
  • PaaS
  • IaaS
• Current cloud threats
• Digital forensics fundamentals
  • Chain of custody
  • Evidence integrity
• Incident response frameworks

Laboratory

• Finalizing the KIRA Project report
• Completing the POA&M
• Calculating ALE values
• Preparing an Executive Summary for senior management

Final Presentation (approximately 3 hours)

Each participant or team presents their complete assessment report to a panel simulating an executive board.

The panel evaluates:

• Financial exposure
• Regulatory compliance
• Remediation priorities
• Risk-based decision making