Protection of Information Assets Course

Lesson 1 • Regulatory and Compliance Foundations

Introduces the functional purpose of data protection regulations and compliance obligations. Establishes why organizations must align security controls with external requirements.

Lesson 2 • Core Security Concepts and Principles

Introduces confidentiality, integrity, and availability as the foundational triad. Connects these principles to real-world protection objectives throughout the course.

Lesson 3 • Information Security Governance Basics

Explains how governance structures direct and oversee security programs. Students connect policy hierarchies to organizational accountability.

Lesson 4 • Threat Landscape Overview

Surveys internal and external threat actors, motivations, and attack vectors. Provides context for understanding why protection controls are necessary.

Lesson 1 • Risk Treatment and Response Strategies

Covers the four treatment options—avoid, mitigate, transfer, accept—with selection criteria. Students match treatment strategies to risk profiles and business constraints.

Lesson 2 • Risk Management Frameworks and Concepts

Introduces structured risk management frameworks and their components. Connects framework selection to organizational size, sector, and risk appetite.

Lesson 3 • Continuous Risk Monitoring and Reporting

Establishes processes for ongoing risk tracking and executive reporting. Connects monitoring outputs to governance oversight introduced in Chapter 1.

Lesson 4 • Asset-Based Risk Identification

Applies asset inventory knowledge to systematic threat and vulnerability identification. Students map threats to specific assets to produce a risk register.

Lesson 1 • Data Loss Prevention Concepts

Introduces DLP strategies for detecting and preventing unauthorized data exfiltration. Students understand how DLP tools enforce classification policies at technical boundaries.

Lesson 2 • Privacy Considerations in Data Handling

Integrates personal data protection principles into classification and handling workflows. Ensures students recognize when privacy obligations elevate standard handling requirements.

Lesson 3 • Data Lifecycle Management

Maps data through creation, storage, use, sharing, archiving, and destruction phases. Students apply classification-appropriate controls at each lifecycle stage.

Lesson 4 • Data Classification Principles and Schemes

Explains classification tiers, labeling standards, and criteria for assigning sensitivity levels. Provides the structure needed to apply differentiated controls in later sections.

Lesson 1 • User Provisioning and Deprovisioning

Establishes lifecycle processes for granting, modifying, and revoking user access rights. Proper deprovisioning prevents orphaned accounts that create residual risk.

Lesson 2 • Privileged Access Management

Addresses elevated-privilege account risks and controls for administrative access. Students apply just-in-time and just-enough-access principles to minimize insider threat exposure.

Lesson 3 • Identity and Authentication Mechanisms

Covers identity proofing, authentication factors, and multi-factor authentication design. Strong authentication directly reduces unauthorized access risk identified in Chapter 2.

Lesson 4 • Access Monitoring and Audit

Teaches log collection, access anomaly detection, and periodic access reviews. Monitoring outputs feed the risk monitoring processes established in Chapter 2.

Lesson 1 • Cryptographic Fundamentals

Explains symmetric, asymmetric, and hybrid encryption along with hashing algorithms. Provides the conceptual base for selecting appropriate cryptographic controls in later sections.

Lesson 2 • Public Key Infrastructure and Certificates

Covers certificate authorities, certificate lifecycle, and PKI trust models. PKI underpins authentication and secure communication across enterprise environments.

Lesson 3 • Cryptographic Controls for Integrity and Non-Repudiation

Uses message authentication codes and digital signatures to verify data integrity and origin. Connects cryptographic assurance to governance and audit requirements.

Lesson 4 • Encryption of Data at Rest and in Transit

Applies encryption standards to stored data and data moving across networks. Students align encryption strength with classification tiers defined in Chapter 3.

Lesson 1 • Wireless and Remote Access Security

Addresses secure wireless protocols, remote access VPNs, and endpoint verification. Remote access expands the attack surface identified in the threat landscape chapter.

Lesson 2 • Network Security Architecture Principles

Introduces segmentation, demilitarized zones, and zero-trust network design. Architecture decisions directly enforce the access control models studied in Chapter 4.

Lesson 3 • Perimeter and Boundary Controls

Covers firewalls, intrusion detection and prevention systems, and secure gateways. Students configure rule sets aligned with asset classification and risk treatment plans.

Lesson 4 • Cloud Network Security Controls

Applies network security principles to cloud environments including virtual networks and security groups. Students adapt on-premises controls to shared-responsibility cloud models.

Lesson 1 • Containment, Eradication, and Recovery

Applies short-term and long-term containment strategies followed by root cause eradication. Recovery procedures restore asset availability while preventing reinfection.

Lesson 2 • Detection and Analysis of Security Incidents

Covers alert triage, incident classification, and forensic evidence preservation. Accurate analysis determines the scope of asset compromise and guides containment decisions.

Lesson 3 • Incident Response Planning and Preparation

Establishes response team structures, communication plans, and playbook development. Preparation reduces response time and decision errors when incidents occur.

Lesson 4 • Post-Incident Review and Lessons Learned

Structures blameless post-mortems to extract actionable improvements from incidents. Findings feed back into risk registers, controls, and training programs.

Lesson 1 • Security Awareness and Culture Building

Designs role-based awareness programs that change employee behavior and reduce human-factor risk. Culture initiatives reinforce technical controls by addressing the human attack surface.

Lesson 2 • Security Program Design and Roadmapping

Guides students through capability maturity assessment and multi-year program planning. Roadmaps translate risk priorities into sequenced, resourced improvement initiatives.

Lesson 3 • Policy and Standards Management

Establishes processes for creating, reviewing, and retiring security policies and standards. Effective policy management ensures controls remain aligned with evolving risks and regulations.

Lesson 4 • Aligning Security with Business Strategy

Connects security investment decisions to business objectives, risk appetite, and competitive positioning. Students communicate security value in business language to gain leadership support.