Capstone ePortfolio
CSOL-599-01

JOSHUA WEISS • CYBERSECURITY LEADER

About Me.

INSPIRED BY DIFFERENCE.

I have over twenty years of computer software, computer hardware, computer infrastructure, cybersecurity and other critically-related technology experience. I graduated from Queens College with a Bachelors in Sociology, focusing on data analytics, social psychology and behavior analysis. I am currently enrolled at the University of San Diego to obtain a Masters of Science in Cybersecurity Operations and Leadership, and plan to graduate in May, 2024. Click here to download my resume.

In 2012 I founded TeliApp, which has become an award winning NJ based technology solutions provider that delivers cybersecurity defense and Information Technology services to municipalities, public schools, public libraries, water and sewerage authorities. TeliApp develops meaningful insights and professional recommendations based on actionable data. TeliApp’s most recent awards include NJBIZ 2022 Companies to Watch, and govCIO Top 2022 & 2023 eGovernance Solution Provider. TeliApp is a Rising Star of the NJ Tech Council and is a repeat winner of software design and development awards from Clutch, including Global Leader Company, Clutch 1,000 Company, Leading UX Agencies, Leading Mobile App Developers, Leading NYC and Leading Philadelphia Software Development Firms.

Reference Link Library

A collection of essential online websites, periodicals and books that I feel are important or that I used and/or researched throughout the program.

Experience.

With each encounter, the brain sculpts neural pathways, etching a landscape of insight that guides future judgment.
01. TeliApp.

At TeliApp, my primary function is to help develop new business and recruit and excellent talent to work with us. I started TeliApp in 2012 and have loved going into work every day since. Our services include Cybersecurity Defense Training & Strategic Oversight, Information Technology (IT), Cloud Migrations & Administration for Email, Data & VOIP, Network Engineering, Wired & Wireless Network Infrastructure Installation & Maintenance, as well as Website Development & Content and Management.

02. JW Consulting.

From 2005 through 2011 I managed JW Consulting, where I leveraged my business relationships from my prior work experience to help emerging electronics companies find retail placement at big-box stores, including Walmart, Target, BestBuy, Staples and many others. In this role I was heavily focused on business development and operations, but also had to be on top of the latest consumer electronic trends to ensure a proper product fit.

03. 1-800-TOW-TRUCK.

IDT Corporation (NYSE:IDT) provided investment capital for the founding of this wholly owned subsidiary. As its CEO, from 1997 through 2005 my primary focus was developing new business and technology to help stranded motorists. The company was a national roadside assistance firm providing coverage in US, Canada & Puerto Rico. I provided strategic vision, tactical execution and wide-reaching daily management to drive growth momentum & achieve short & long range goals while meeting & exceeding budget objectives. I successfully launched Prepaid Roadside Assistance Cards in over 7,000 retail locations across the United States.

Cybersecurity Fundamentals

The artifacts presented here demonstrate my understanding of the professional and ethical responsibility of cybersecurity operations and leadership.

  • Cybersecurity Risk Types

    The core of cybersecurity risk lies in the interplay between threats, vulnerabilities, and attack surfaces. This paper focuses on understanding attack surfaces and how different strategies can be applied to manage them. An attack surface refers to all potential entry points for attackers to access, steal, or manipulate data within a system. Cybersecurity leaders have a professional and ethical responsibility to securing their organization’s infrastructure. Identifying and understanding these points is crucial for effective cybersecurity, and is the starting point of a cybersecurity professional’s journey toward achieving these goals.

  • Disaster Recovery Planning & Risk Analysis

    Understanding how Netflix, a giant in its field, faces diverse threats through natural disasters, equipment failures, and even insider issues, highlights the critical need for comprehensive disaster recovery plans. Such plans can shield any company from service disruptions, financial losses, and reputational damage, ultimately safeguarding customer trust and satisfaction. Even minor security breaches can erode customer loyalty, proving that robust cybersecurity infrastructure is non-negotiable for any company seeking long-term success.

Reflections

The artifacts I selected delve into the realm of attack surfaces, offering valuable insights for any cybersecurity professional seeking to effectively manage risk. Examining the intersection of threats, vulnerabilities, and attack surfaces sheds light on where cyber risks reside and empowers us to develop comprehensive mitigation strategies. As we examine potential threats, from natural disasters to insider sabotage, we gain a practical understanding of how cybersecurity fundamentals translate into real-world scenarios. The papers I selected offer valuable insights for any cybersecurity professional, illuminating the multifaceted nature of risk and the necessity of comprehensive security strategies.

Having explored these concepts, I see their application in my cybersecurity career in many ways. Firstly, I will leverage this understanding of interconnected threats to conduct more comprehensive risk assessments, considering both physical and digital vulnerabilities. Secondly, I will advocate for the development and implementation of robust disaster recovery plans, ensuring my organization is prepared for any eventuality. Furthermore, I will communicate the importance of cybersecurity to stakeholders by highlighting its direct impact on brand reputation and customer trust. Finally, I will actively promote security awareness within my organization, recognizing the human element in information security.

Overall, this content serves as a valuable reminder that cybersecurity fundamentals are not theoretical concepts but practical tools for mitigating real-world risks. By applying these insights to my work, I will strive to contribute to building a more secure and resilient digital landscape for all. In particular, the following highlights any cybersecurity’s journey toward ensuring that one’s professional and ethical responsibilities are always intact and above board.

  • Comprehensive Risk Assessments – I will strive to conduct thorough risk assessments, considering both technical vulnerabilities and social engineering risks posed by various attack vectors.
  • Advocate for Robust Defenses – The importance of comprehensive disaster recovery plans and security awareness training will be emphasized in my work, recognizing the interconnected nature of threats.
  • Effective Communication – Highlighting the impact of cybersecurity on brand reputation and customer trust will be crucial for securing buy-in from stakeholders.
  • Continuous Learning – Recognizing the evolving nature of cyber threats, I will remain committed to continuous learning and upskilling to adapt and mitigate emerging risks.

Cryptography

Cryptography is a crucial tool for keeping information and systems safe. While we explored the core components of cryptography, our main focus was how it helps enforce essential security policies, such as authentication, confidentiality, and data integrity. We learned about essential concepts such as stream and block ciphers, hashing, encryption methods and key exchanges.

  • Group Assignment 7.1 – Final Lab Exercise on Encryption

    Our final assignment in cryptography was a comprehensive example of the Cryptography coursework. Key management remains a significant challenge to effective encryption safeguarding sensitive data. While the traditional solution involves storing these keys on secure, isolated devices, akin to digital vaults, two inherent vulnerabilities remain. Firstly, even the most secure vaults are susceptible to intrusion, and secondly, physical catastrophes or hardware malfunctions can damage or destroy the storage device. Both scenarios result in compromise, rendering the data vulnerable. This laboratory explores an approach for achieving effective key management leveraging the renowned Chinese Remainder Theorem, and served as a potent lens through which I could truly appreciate the essence of cryptography, including its power to solve complex challenges, its reliance on elegant mathematical principles, and the intricate complexities that arise when these principles are applied in real-world scenarios. With this newfound understanding, I am confident in my ability to navigate the fascinating and ethically-charged world of cryptography, serving my clients and my profession with greater responsibility and insight.

Reflections

The exercise exposed me to the elegant beauty and intricate dance between theoretical concepts and practical implementation. The Chinese Remainder Theorem, once a theorem confined to textbooks, took on a new life, its mathematical precision harnessed to tackle the very real problem of key recovery. Witnessing how beautifully precise mathematics could unlock solutions in such a complex and critical domain instilled a profound appreciation for the power of cryptography. Moreover, the exercise served as a potent reminder that the elegance of mathematics doesn’t negate the inherent complexities of its application. The challenges surrounding key management, which include compromise, theft, and storage failures, painted a vivid picture of the delicate balance needed in real-world cryptography. Each theoretical solutions present their own set of ethical and practical considerations, forcing me to think critically about the trade-offs involved.

This newfound understanding will significantly impact my professional trajectory. As I interact with clients in the future, the insights gained from this exercise will empower me to address their cryptographic needs with greater awareness and responsibility. Now, I can delve deeper into the challenges of key management, exploring solutions within their specific contexts while acknowledging ethical and risk-management implications. For instance, when advising a client on data encryption strategies, I can now go beyond simply recommending algorithms and instead discuss the complexities of key escrow and recovery options. I can discuss the potential benefits and drawbacks of each approach, ensuring they understand the trade-offs before making informed decisions. Additionally, I can contribute to internal discussions and policy creation within my organization and that of my clientele, bringing a well-rounded perspective that considers both the technical intricacies and the ethical implications of cryptographic practices.

Security Architecture

Security architecture artifacts serve as invaluable maps and guideposts, ensuring consistency and traceability throughout the intricate journey of security design. These documented representations of the security strategy, like threat models, security requirements, and network diagrams, provide a shared understanding for all stakeholders involved. This shared lens fosters consistency, as everyone utilizes the same blueprint when making security decisions, minimizing the risk of conflicting approaches. Additionally, these artifacts create a clear audit trail, allowing for transparent communication of design rationale and facilitating future modifications based on evolving threats or technology advancements.

The five main SABSA Layers form a hierarchical framework that seamlessly connects business context into actual security implementation. The Contextual Layer establishes the foundation, outlining the organization’s vision, goals, and risk tolerance. This feeds into the Conceptual Layer, which defines the strategic approach to security, aligning it with business objectives. The Logical Layer then translates this approach into concrete architectural elements, such as network diagrams and system specifications. The Physical Layer focuses on tangible components like hardware and software, ensuring that they align with the logical design. Finally, the Management Layer governs the entire process, including policies, procedures, and performance monitoring, ensuring ongoing effectiveness and compliance. This layered structure allows for a top-down, yet interconnected, approach, effectively translating high-level business objectives into practical security controls and practices.

I am truly grateful that for me, this course highlighted the power of applying theoretical knowledge to tangible projects in my professional work, directly impacting the real-world security landscape. It underscores the value of relevant coursework and the serendipitous synergy that can enable immediate and practical value. 

  • Contextual Layer Assignment

    In the SABSA framework, the Contextual Layer sits at the core, establishing the bedrock upon which robust security is built. The Contextual Layer explores the organization’s business goals, risk tolerance, and operating environment, ensuring security seamlessly aligns with strategic objectives and effectively shields its critical assets. The Contextual Layer focuses on the “why” behind security, laying the foundation for a successful and integrated security strategy.

  • Conceptual Layer Assignment

    Building upon the foundation laid by the Contextual Layer, the SABSA Conceptual Layer guides the “how” of security. This layer translates the organization’s unique needs and risk profile into a strategic security vision, defining overarching principles and objectives. The Conceptual Layer focuses on crafting a robust, adaptable security architecture that aligns with business goals and addresses identified threats, paving the way for tangible implementation.

  • Logical Layer Assignment

    From the strategic vision of the Conceptual Layer, the SABSA Logical Layer translates grand plans into concrete blueprints. Here, technical specifications and architectural elements come into play, defining how security controls will be deployed to achieve objectives. From network diagrams and system specifications to access control models and encryption strategies, this layer meticulously designs the security “machine” that will safeguard the organization’s data and infrastructure.

  • Physical Layer Assignment

    In the SABSA framework, the Physical Layer marks the transition from conceptual design to tangible reality. The focus of the Physical Layer shifts to the actual selection and implementation of hardware, software, and security controls outlined in the Logical Layer. This includes deploying firewalls, configuring security software, hardening systems, and implementing encryption mechanisms. The Physical Layer ensures that chosen solutions align with the overarching strategy and effectively address identified vulnerabilities, bridging the gap between theory and practice to create a functioning security ecosystem.

  • Component Security Architecture

    Component security architecture bridges the gap between the Physical and Management layers of the SABSA framework. Component security architecture explores the security characteristics of individual components within the physical layer. It defines granular controls and configurations specifically for servers, applications, databases, and other systems, ensuring they align with overall security strategy and address unique vulnerabilities. This acts as a bridge between the physical implementation (hardware, software) and the overarching management processes (policies, procedures), fostering consistent security posture across all IT components.

  • Management Layer & Putting It All Together

    The final layer, Management, serves as the command center, governing the effectiveness and ongoing adaptation of the entire security architecture. It goes beyond technical controls, encompassing policies, procedures, and processes that orchestrate security implementation and maintenance. This layer oversees tasks such as incident response, security awareness training, and performance monitoring, ensuring compliance with regulations and organizational goals, continuously optimizing the security posture for long-term resilience and responsiveness to evolving threats.

Reflections

The SABSA model defines interconnected layers that guide the development and implementation of an enterprise security architecture. Each layer focuses on a specific aspect of security, and together they provide a comprehensive view of how security should be integrated into an organization’s overall architecture that can be used to build a holistic and integrated security architecture that effectively protects their critical assets and aligns with their business objectives. The SABSA model provides a comprehensive security framework and helps ensure that security is fully integrated into the overall enterprise architecture.

During this course, a unique opportunity arose that perfectly aligned with my professional work. At work, we are developing a novel software platform for local governments, aiming to completely digitize their procurement process. While the framework and functionality were solidified, moving to development hinged upon a key requirement – a comprehensive security architecture document. Fortunately, the course curriculum employed the SABSA framework, focusing on crafting intelligent and adaptable security models. These elements were crucial for our own platform, which needed to not only ensure security but also accommodate future growth and evolving threats. The assignments (and chosen artifacts for this section), centered around crafting security architectures for a fictional government entity, which proved to be serendipitous. The theoretical exercises directly translated into valuable real-world application for my work.

This fortuitous overlap allowed me to seamlessly bridge the gap between academic pursuit and professional needs. The knowledge and skills gained through the course, specifically the expertise in utilizing the SABSA framework, were immediately put to use in crafting the vital security architecture document for our platform. This document forms the bedrock upon which our secure and adaptable software could be built, ultimately serving the critical needs of local governments. My work in this course not only demonstrates my technical skills but also reflects my commitment to professionalism and ethical practices in security architecture, ensuring responsible and sustainable security measures for our groundbreaking platform and future endeavors.

Cybersecurity Law & Policy

Cybersecurity law and policy are the foundation for protecting information systems, data, and critical infrastructure from cyberattacks. They establish guidelines for data privacy, breach notification, and security standards. Policies translate these legal requirements into actionable steps for organizations. Understanding and implementing them is crucial because they ensure that organizations comply with legal mandates, avoiding regulatory fines and reputational damage, and also because they minimize security risks by outlining best practices for data protection, access controls, and incident response. 

  • The Guccifer Case – Enforcement

    Guccifer, a pseudonym for Marcel Lehel Lazăr, gained notoriety for hacking into the email accounts of high-profile individuals (such as Hillary Clinton) and organizations. By exploiting weak passwords and inadequate access controls, he accessed sensitive information – not with sophisticated hacking software – but simply by using his brain and incredible persistence. Studying the legal repercussions of Guccifer’s crimes is an important reminder of the critical role of strong passwords, multi-factor authentication, and robust access controls to prevent similar breaches and to safeguard sensitive data.

  • The 2016 Bangladesh Bank Hack – Compliance Challenges

    The 2016 Bangladesh Bank Heist of 2016 exposed a critical vulnerability: poor communication within and between organizations that all share a Duty of Care. The Duty of Care doctrine mandates that organizations take reasonable steps to protect their data. The case also highlighted the “failure to act” doctrine, in which cybersecurity inaction has significant legal consequences. What we can learn from the Bank Heist beyond strong internal cybersecurity controls and culture, is that information security is a shared responsibility between the client, the InfoSec professionals who are entrusted to protect and defend, and also organizational leadership, even when the scope of that protection appears to be beyond the confines of the organization’s internal operations. The people from varying organizations who work together entrusted with information security responsibilities must learn to proactively communicate when in doubt, work together, and become a community, instead of finger pointing after a cybersecurity breach in an attempt to avoid liabilities.

  • MGM Hack – Legal Implications

    The recurring attacks and exploited vulnerabilities against MGM emphasize the importance of prioritizing security measures. Examining the legal ramifications revealed MGM’s gross negligence and that MGM failed to meet their duty of care, exhibited a repeated failure to act, and failed to provide reasonable security measures. Implementing zero-trust and least privilege security, continuing mandated employee cybersecurity training, patching systems promptly, and fostering open communication between IT and InfoSec are critical to prevent similar incidents.

Reflections

My Cybersecurity Law & Policy class has been an eye-opening experience. Analyzing real-world cases such as the MGM hack (2023), the Guccifer case (2016), and the Bangladesh Bank Heist (2016) highlighted the crucial connection between legal requirements and effective cybersecurity practices. Weaknesses in access controls and incident response, as seen in the MGM hack, can have devastating consequences. Poor communication between IT and InfoSec can create vulnerabilities that threat actors can exploit, as we learned while analyzing the Bangladesh Bank Heist. This class emphasized the importance of mapping every aspect of an organization’s cybersecurity strategy, from policies to procedures, to a legal foundation.

Analyzing current and past cybersecurity litigation offers invaluable lessons, because we can identify potential weaknesses in our own defenses and prevent similar vulnerabilities from being exploited by understanding the legal reasoning behind judgements. Tracking evolving cybersecurity legislation, encompassing data privacy laws (federal, state, and international), and local and international cybersecurity regulations, ensures our organization remains compliant. This proactive approach minimizes legal risks and potential penalties. Understanding digital forensics best practices becomes vital in the unfortunate event of litigation. Following proper evidence collection and preservation procedures prevents evidence spoliation, which could otherwise weaken an organization’s legal standing and potentially disqualify expert witnesses.

Both the class’s subject matter and my incredible instructor instilled in me the importance of tailoring cybersecurity frameworks to an organization’s specific mission and legal obligations. Frameworks such as NIST CSF provide a strong foundation, however, true effectiveness comes from customization. This knowledge will make me a more effective cybersecurity professional in several ways. I can now advocate for robust defenses that address compliance needs and minimize risk. I’m committed to promoting ethical practices that respect user privacy and adhere to legal frameworks. I also learned how to bridge the gap between legal and technical teams by effectively communicating compliance requirements, fostering a more comprehensive security posture across the organization. Cybersecurity Law & Policy class has educated me with the legal knowledge and strategic perspective I require to navigate the evolving cybersecurity landscape as a more effective professional and ethical cybersecurity leader.

Risk Management

The National Institute of Standards and Technology (NIST) developed the Risk Management Framework (RMF) to address the need of proactive cybersecurity risk management within the US government. RMF provides a systematic process for translating theoretical risk management principles into a practical approach for cybersecurity professionals by identifying, assessing, and mitigating cybersecurity risks. Information security professionals utilize RMF to prioritize efforts by systematically identifying potential weaknesses in computer systems and networks, and by analyzing the likelihood and impact of potential threats exploiting those weaknesses.

  • Risk Management Assignment

    In cybersecurity, risk management translates to a practical approach in which threats and vulnerabilities are prioritized. Information security professionals can allocate resources effectively by systematically identifying potential weaknesses and analyzing their likelihood and impact, which allows them to focus on patching critical vulnerabilities and implementing controls to mitigate the most probable and damaging attacks. Balancing cost with security can be challenging, ensuring that deployed measures are both effective and fiscally responsible. The risk management process in cybersecurity requires careful professional and ethical considerations. For example. ethical considerations may arise when determining the appropriate level of vulnerability disclosures. While transparency is important, revealing certain flaws may enable threat actors to exploit them before a solution (patch) is made available. Information security professionals always must approach risk management with a delicate balance between practicality, professionalism, and ethical responsibility, proactively communicating with and taking direction from organizational leadership.

Reflections

This course shatters any naive illusions that hardware alone can properly defend an organization from cybersecurity threats. People play a major role. Cybersecurity risk management is an ongoing balance between proactive preparation and reactive response with far-reaching consequences. Risk management is not a one-time audit or checklist; rather, it is a dynamic process that requires continuous monitoring and adaptation. Identifying and prioritizing vulnerabilities is never enough. In addition, information security professional must translate those findings into actionable steps, allocating resources effectively to mitigate the most probable and damaging threats.

This course emphasized to me that effective risk management necessitates clear and proactive communication and collaboration across all levels of an organization. Information security professionals must translate complex technical jargon into actionable plans for management to understand and endorse. Equally important is educating staff about cybersecurity best practices to foster a culture of security awareness.

I see myself incorporating this knowledge into my professional life in several ways. First, I will prioritize ongoing risk assessments, using frameworks like NIST’s RMF to systematically identify and address vulnerabilities. Second, I will champion a culture of risk awareness within my team, fostering open communication and encouraging everyone to report suspicious activity. Third, I will advocate for a balanced approach to security spending, ensuring we have the necessary resources without becoming wasteful.

Ethical considerations must always remain at the forefront of my decision-making. When vulnerabilities are discovered, I will strive for a balance between transparency and responsible disclosure, working with vendors to develop timely patches before information regarding vulnerabilities can be weaponized. This commitment to ethical conduct reflects my understanding that cybersecurity is more than just protecting systems; rather, it is about safeguarding the privacy and well-being of individuals and organizations alike. This knowledge empowers me to become a more effective cybersecurity professional, one who actively manages risk and properly defends against threats.

Management & Cybersecurity

While cybersecurity professionals identify and address technical vulnerabilities, strong management practices ensure these efforts are successful. In this course, I learned about the fundamental principles that bridge this gap, exploring the economic considerations of cyber threats, strategic staffing decisions, resource allocation strategies, effective communication channels, and responsible acquisition practices. By understanding these key areas, managers can empower security teams and build a more resilient organization to combat against threats.

  • RFP for Cybersecurity Awareness Training – BioHuman

    Our final assignment in this class was to develop a Request for Proposal (RFP) issued by a fictional company, which I named BioHuman Corporation. BioHuman is a Fortune 500 pharmaceutical company, seeking a vendor to develop and deliver a cybersecurity awareness training program for its employees, clients, partners, distributors, and vendors. The RFP details project goals, the scope of work, timelines, and budgetary and resource constraints. It also explains to potential bidders the evaluation criteria, submission requirements, and what BioHuman is seeking from the vendor. It also includes a “Questions for Bidders” section, which is designed to determine based on their responses viable, capable candidates.

    The RFP explained the significance of proactive cybersecurity measures, recognizing the escalating cyber threats and the potential consequences of an attack. This vulnerability extends to any organization that interacts with sensitive data. The RFP emphasized the importance of a preventative approach; building a culture of cybersecurity awareness before a breach occurs. This highlighted the responsibility of management to prioritize cybersecurity and not simply react to incidents after the fact.

Reflections

The Request for Proposal (RFP) project for BioHuman Corporation’s cybersecurity awareness training program served as a critical learning experience, highlighting the profound interconnection between effective management and robust cybersecurity. While I initially viewed these areas as separate entities, this course revealed how their synergy is paramount.

This project shed light on the economic considerations of cybersecurity, and elucidates the need for management to conduct cost-benefit analyses when evaluating cybersecurity investments. Balancing security needs with budgetary constraints will be a crucial aspect of my future professional endeavors. The project also teaches that a one-size-fits-all approach to cybersecurity awareness is ineffective. Cybersecurity awareness training programs must target not only employees but also clients, partners, and vendors – anyone – with access to their systems. This recognizes that an organization’s security posture is only as strong as its weakest link. Incorporating this knowledge into my professional life means advocating for training programs that cater to diverse audiences with varying levels of technical expertise. Developing this RFP also reminded me about the importance of clear communication and collaboration between management and security teams. Effective communication will be essential in ensuring alignment between internal goals and the chosen vendor’s capabilities.

Beyond technical considerations, this course reinforced in me the importance of ethical conduct in both management and cybersecurity practices. Emphasis on data security, ownership, and responsible use aligns with core ethical principles. As a professional, I acknowledge the ethical implications of managing sensitive data and the importance of adhering to relevant regulations and frameworks, such as HIPAA or NIST SP 800-39.

Finally, the RFP development process itself served as a valuable exercise in professionalism. Following specific formatting and submission guidelines, meeting deadlines, and presenting information in a clear and concise manner are all hallmarks of professional conduct. Applying these principles to future projects, reports, and client interactions will demonstrate professionalism and enhance credibility.

Secure Software Design & Development

Robust cybersecurity strategies are critical safeguards for any organization. A cornerstone of this strategy is the Information Systems Security Plan (ISSP), which outlines an organization’s comprehensive approach to protecting its information systems and data. Developing, implementing, and actively utilizing an ISSP includes technical security measures, but also encouraging a culture of professional and ethical conduct around cybersecurity practices, ensuring everyone within the organization understands their role in mitigating cyber risks.

  • Enterprise Information Security Risk Assessment & Management Plan

    Our final assignment was an enterprise information risk assessment and management plan for a fictitious company that specializes in developing local government software. It is a comprehensive plan that includes identifying all organization assets, identifying potential consequences, identifying threats and their respective levels, identifying vulnerabilities and determining the likelihood of their exploitation, assessing risk and developing a risk management plan. The plan illustrates the creation and execution of an ISSP, exploring its vital role in securing sensitive information and fostering a responsible, professional approach with ethical considerations to cybersecurity.

Reflections

Prior to exploring secure software design and development (SSDD), I viewed software creation as a functional endeavor. This course reveals the critical role SSDD plays in safeguarding systems and data, and how simply writing code that works is insufficient; rather, building secure code from the ground up is paramount. This course will significantly impact my professional approach to software development. Implementing a structured framework ensures that security is built into the development process. This commitment to a secure SSDD not only reflects professionalism but also demonstrates an ethical obligation to create trustworthy software.

One of the most impactful insights has been the concept of threat modeling. Identifying potential vulnerabilities early in the development lifecycle is crucial for mitigating risks proactively. By considering how attackers might exploit weaknesses, we can design software with built-in defenses. This proactive approach not only strengthens the final product but also saves time and resources compared to fixing vulnerabilities after deployment.

The emphasis on secure coding practices also resonated. Understanding common coding errors that create security vulnerabilities allows me to focus on making sure that our team writes clean, secure code. Utilizing static code analysis tools and adhering to secure coding principles will become an integral part of my frm’s software development process.

The ethical considerations of secure software development are so important. Software vulnerabilities can have far-reaching consequences. Releasing insecure software not only exposes users to risk but also erodes trust in developers and the software development community as a whole. By prioritizing SSDD principles, we take responsibility for the potential impact of our work. Building secure software demonstrates respect for users’ privacy and data security. Secure software development is just as much about building functional code as it is about building trust, ensuring reliability, and safeguarding the code that we release.

Network Visualization & Vulnerability Detection

Network Visualization and Vulnerability Detection are two critical tools used by Network Defenders. Network Visualization acts as a digital map by offering a comprehensive view of all connected devices and their interactions within a network, which enables security professionals to identify potential weaknesses, optimize network performance, and troubleshoot issues efficiently. Vulnerability Detection, on the other hand, takes a more proactive approach, by actively scanning networks for exploitable weaknesses in software, hardware, or configurations. By pinpointing these vulnerabilities, security teams can then prioritize remediation efforts and prevent attackers from exploiting these weaknesses. Both Network Visualization and Vulnerability Detection tools can be used ethically for penetration testing, a process in which authorized security professionals attempt to exploit vulnerabilities to assess the effectiveness of existing security measures. This proactive approach helps organizations identify and address weaknesses before malicious actors do.
  • Network Visualization & Vulnerability – Final Project

    Protecting an organization’s network is a full-time job, and involves protection from deliberate, accidental or incidental threats. To properly protect an organization’s digital assets and ensure network security, a cybersecurity professional must understand the network. This includes but is not limited to a detailed network map with hardware installed, software used, and other vertical-specific details such as department use case scenarios and staff, Internet speed requirements, permitted website usage, and even obtaining current lists of partners, distributors and vendors. Understanding and having this information readily available enables cybersecurity professionals to assess potential insider threats and risk levels, which could be an organization’s greatest attack-surface. This experience is a critical component in any cybersecurity specialists’ journey from student to master.

    In this course, we experienced a hands-on approach to learning network security and visualization methodologies using Kali Linux and virtualized systems. We learned some of the tools used to secure a virtual network against some of the more common penetration strategies, including the detection and monitoring of vulnerabilities, as well as securing wireless devices and transmission.

Reflections

Network Visualization and Vulnerability Detection are powerful tools that, when used ethically and professionally, form the cornerstone of a robust cybersecurity strategy. This course provided many insightful revelations about technology systems and the professional cybersecurity challenges that lay ahead. Every cybersecurity software tool will likely have its own unique characteristics, and the challenges encountered may likely be a result of variables such as the operating systems used, and a myriad of networking parameters. The challenges that I encountered were mostly technical, learning about the nuanced characteristics of each software tool and the variables that create challenges. 

The goal of any educational endeavor is not merely the pursuit of knowledge for the sake of knowledge, but rather to gain knowledge not possible to acquire in the work environment, and/or to obtain the academic background required to properly perform certain job functions in the workplace (Biesta, 2009). Perhaps the most significant milestone, discovery and revelation moment for this emerging cybersecurity professional was to lean into these technical challenges. This lesson can be applied to any circumstance in which the professional is otherwise tempted to choose a path of least resistance.

The power of network visualization and vulnerability detection tools comes with significant professional and ethical responsibilities. Professionally, we have a duty to leverage these tools effectively to create a comprehensive picture of the network landscape, which requires ongoing analysis and adaptation to keep pace with evolving threats and network configurations. Prioritizing vulnerabilities based on risk and implementing appropriate remediation strategies demonstrates responsible use of these tools. Ethically, the principle of trust is paramount. The data gleaned from network visualization and vulnerability detection tools grants us visibility into the very core of an organization’s digital infrastructure. This trust necessitates using this information solely for legitimate cybersecurity purposes. Transparency in vulnerability disclosure to vendors and responsible authorities is crucial. Utilizing Network Visualization and Vulnerability Detection ethically and professionally strengthens trust within the organization and fosters a strong and proactive cybersecurity posture.

Cyber Threat Intelligence

Reactive defense is not sufficient to protect technology infrastructure. Organizations require a proactive approach to anticipate attacker strategies and bolster their defenses. Cyber Threat Intelligence embodies proactive cybersecurity, encompassing the collection, analysis, and dissemination of actionable intelligence on potential cyber threats. By understanding the motivations, tactics, and techniques (TTPs) of cyber adversaries, organizations can proactively identify vulnerabilities, prioritize remediation efforts, and implement targeted defenses.

  • Cyber Threat Intelligence Plan (CTIP)

    Our final assignment was to develop a Cyber Threat Intelligence Plan for a fictitious organization. A CTIP serves as a roadmap for gathering, analyzing, and disseminating actionable intelligence about potential cyber threats, empowering organizations to anticipate attacker tactics, prioritize vulnerabilities, and implement targeted defenses. The plan illustrates the creation and execution of a CTIP, exploring its vital role in securing sensitive information and fostering a responsible, professional approach with ethical considerations to cybersecurity.

  • Cyber Threat Intelligence Presentation

    This presentation is the companion to the CTIP. Our final assignment required students to develop this visual presentation with a captivating script that could be used as an artifact for the meeting attendees. Cybersecurity Operations & Leadership requires us to be excellent written and verbal communicators, and this exercise provided students with an excellent opportunity to hone their presentation and public speaking skills.

Reflections

The professional and ethical application of cyber threat intelligence cannot be understated. Professionally, security teams leverage CTI to make informed decisions about resource allocation and security investments, which empowers them to focus on the threats that pose the greatest risk to the organization’s specific assets and objectives. However, the ethical considerations are equally important. Gathering and utilizing CTI responsibly requires adherence to legal and ethical frameworks, respecting intellectual property rights and data privacy regulations. Responsible disclosure practices in which discovered vulnerabilities are reported to vendors and authorities, are essential for mitigating threats to the broader cybersecurity ecosystem. A well-developed CTI program, applied with both professional expertise and ethical grounding, empowers cybersecurity specialists to transform the organizations they defend from reactive victims to proactive defenders in the cyber realm.

The continued growth of cyber-related attacks on critical infrastructure requires a strong cyber security culture to be a part of any organization’s cyber defense strategy (Pătrașcu, P. 2019, p. 273). The goal of any CTIP is to introduce, discuss, and review cyber threat intelligence and to incorporate it into the operations of the InfoSec team, as part of a holistic approach to information security designed to protect an organization from a cybersecurity incident, such as a ransomware attack. Resolving cybersecurity concerns is not a ‘one size fits all’ or ‘one and done’ process. To properly protect an organization’s technology infrastructure, its data, email and personnel from cyber-related threats, its cybersecurity posture will need to continue to evolve, just as the cyber threat landscape continues to evolve. This is only made possible through the development of a strong and practical cyber threat intelligence plan.

On a personal note, the world of cyber threat intelligence isn’t all about dry reports and technical jargon. I will admit that there is an undeniable thrill unraveling the mind of a cyber attacker. By meticulously analyzing past attacks, malware code, and online chatter, CTI professionals become digital detectives, piecing together the motivations, tactics, and tools used by adversaries. I find this type of intellectual challenge, akin to solving a complex puzzle, highly rewarding. Predicting an attacker’s next move based on historical patterns and emerging trends adds another layer of excitement. Imagine successfully anticipating a phishing campaign or identifying a vulnerability before it can be exploited, and the satisfaction felt after outsmarting cybercriminals. It is important to remember though that CTI is not a game. This intellectual pursuit has real-world consequences. By understanding attacker behavior, CTI professionals can safeguard critical infrastructure, protect sensitive data, and ultimately contribute to a more secure digital landscape.

Incident Response & Computer Network Forensics

Incident response focuses on containing an attack, minimizing damage, and eradicating the threat, which involves identifying the breach point, isolating compromised systems, and restoring functionality. Following the initial response, computer network forensics meticulously examines digital evidence to reconstruct the attack timeline, identify the culprit, and gather potential legal evidence. This meticulous work helps organizations understand attacker methods, improve future defenses, and potentially hold malicious actors accountable. Together, incident response and computer network forensics enable organizations to not only recover from an attack but also learn from the attack, which strengthens the organization’s cybersecurity posture. 

  • Forensics Report – Final Project

    In this assignment, we were challenged to conduct a digital forensic analysis of artifacts, and then to generate a forensics report submitted to a fictitious organization. Mastering digital forensics and report writing are important skills to effectively respond to cyber incidents and mitigate potential future damage. Mastering digital forensics and report writing equipped us to not only respond to breaches, but also to learn from them, which strengthens our collective defense against cyber threats.

Reflections

The final project on incident response and network forensic investigation provided a deeper understanding of crucial cybersecurity practices, and also highlighted the significance of professional and ethical conduct in their application. By continuing to hone my ability to collect, analyze, and preserve digital evidence, I become more adept at reconstructing attack timelines, identifying the culprit’s methods, and gathering potential legal evidence. Our training emphasized the development of clear, concise, and defensible reports that can be understood by both technical and non-technical audiences; this can be challenging. These reports are instrumental in informing remediation efforts, implementing stronger security controls, and potentially prosecuting cybercriminals.

This course helped solidify my grasp of the incident response lifecycle and emphasized the vital role of network forensics in post-incident analysis. Learning to collect, analyze, and preserve digital evidence will be instrumental in reconstructing attack timelines, identifying attacker methods, and potentially gathering legal evidence. These skills are essential for mitigating future risks and holding malicious actors accountable. This course also dealt with serious professional and ethical considerations surrounding incident response and network forensics. The importance of maintaining a chain of custody for digital evidence and adhering to data privacy regulations became abundantly clear. Understanding the legal implications of these practices ensures responsible handling of sensitive information. I plan to continuously update my skills using digital forensics tools and techniques, because staying abreast of evolving technologies and methodologies will ensure the ability to effectively investigate even the most sophisticated cyberattacks.

This course equipped me with the practical skills of incident response and network forensics while clearly expressing the professional and ethical considerations that accompany their application. I am confident that I can leverage this knowledge to contribute to a more secure digital environment, both in my professional endeavors and by advocating for best practices within the organizations I serve.

Contact.

LET’S TALK.

Whether you have cybersecurity questions, or want to talk about me or my experience, please feel free to contact me!