Wrap-up and resources
Key Takeaways
- 1. Zero Trust architecture and threat modelling: Zero Trust is not a product you buy but an architecture: every request passes an enforcement point, every decision is made by a policy engine from live signals, and the session is re-checked all the time. Threat modelling makes security part of the design: draw the system, ask what can go wrong with STRIDE, and decide the cure before building.
- 2. Securing the cloud, containers and the supply chain: In the cloud you are always responsible for settings, identities and data. Give every identity the least privilege with temporary keys, watch settings automatically, run containers at the Restricted level, and know what is in your software (SBOM) and who built it (SLSA and signing).
- 3. Purple teaming and adversary emulation: A red team tests your ability to detect and respond, not the number of flaws. Purple turns every attack technique into a proven detection: run it, watch, fix, run it again. Measure progress by the share of your relevant adversaries' techniques you actually detect, not by the number of rules.
- 4. Leading a security programme: risk in numbers and major incidents: Management understands money and business risk, not flaw names. Turn every risk into an expected yearly loss, and compare every spend with how much it cuts. And when the major incident hits, one commander decides, the roles are written in advance, and the legal reporting clock starts the moment you know.
- 5. The senior's road: the capstone, roles and a one-year plan: Pick one role, and build the capstone as proof that you design, detect and lead, not just run tools. The advanced certificate follows the experience: OSCP+ for hands-on testing, GIAC for technical depth, and CISSP or CCSP for design and leadership after years of work.
Glossary
| Term | Definition | Part |
|---|---|---|
| PE / PA / PEP | An engine that decides, an administrator that acts, an enforcement point before the resource. | 1 |
| CISA model v2.0 | Five pillars and four stages: traditional, initial, advanced, optimal. | 1 |
| Step-up | Asking for stronger proof when risk rises. | 1 |
| Shared responsibility | The provider protects its layer; you protect your data, identities and settings. | 2 |
| CSPM | Continuous checks of cloud settings against standards. | 2 |
| Pod Security Standards | Privileged, Baseline and Restricted. | 2 |
| Red team | A simulated attack with a goal and stealth to test detection and response. | 3 |
| Purple team | Red and blue together: run, check, fix, rerun. | 3 |
| Emulation plan | A specific adversary's techniques ordered as they do it in reality. | 3 |
| ALE | Annualised loss expectancy = SLE × ARO. | 4 |
| FAIR | A quantitative risk model with ranges and simulation, an Open Group standard. | 4 |
| ROSI | (cut in ALE − cost) ÷ cost. | 4 |
| OSCP+ | A 24-hour practical exam from OffSec, renewed every 3 years. | 5 |
| GIAC | Deep technical certificates such as GCIH and GCFA, renewed every 4 years. | 5 |
| CISSP | ISC2, eight domains, five years' experience. | 5 |
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
reference8
NIST SP 800-207: Zero Trust ArchitectureThe reference that defined the architecture's parts and deployment models.nist.govCISA Zero Trust Maturity Model v2.0The five pillars and four maturity stages with examples for each.cisa.govKubernetes: Pod Security StandardsThe three levels and every setting each level checks.kubernetes.ioSLSA: Supply-chain Levels for Software ArtifactsA framework of build integrity levels and what each requires.slsa.devMITRE ATT&CKThe knowledge base of attacker tactics and techniques, with detection and mitigation for each.attack.mitre.orgNIST SP 800-61 Rev. 3Incident response recommendations tied to CSF 2.0.
Done with this lesson?
Sign in to save your progress.