Loading module…
Loading module…
Module 1 of 13
Rung one · the lens — security read as a system
Security looks like a shopping list: a firewall, antivirus on every laptop, a VPN for remote staff, a backup job that runs every night, a certificate on the wall from the last audit. Most organisations that are badly hurt by an attack had most of that list. What they did not have was a picture of how the items fit together — which of their assets would hurt most to lose, every way someone could reach them, how the people who attack companies like theirs usually behave, where the controls overlap and where they leave a gap, how fast anyone would notice, and who would decide what to do. Security is not a property of any one product; it is a property of the system: the assets, the ways in, the people, the suppliers, the controls and the habits of the organisation acting on one another. A shared administrator password is a small thing on its own; a flat network is a small thing on its own; backups kept on the same network are a small thing on its own. Put them in one organisation and they become a single path from one stolen password to a stopped factory. Serious incidents are rarely one failure; they are a chain of ordinary weaknesses that nobody looked at together. This course teaches you to look at them together. It is the discipline of security as a system, taught from the defender's and the decision-maker's point of view: reading an organisation well enough to tell the people who own its risk what it must protect, how exposed it is, what to fix first and with what budget — and to keep that picture current. The method rests on six elements present in every organisation from a ten-person workshop to a listed group. The assets are what must be protected — data, systems, operations, people and reputation — and above all the few crown jewels whose loss would hurt most. The exposure is every way in: internet-facing services, remote access, email, identities, suppliers, staff devices and people. The adversaries are who would act, why, and how they typically behave, read at the level of public frameworks and advisories. The controls are the preventive, detective and corrective measures, and above all how they are arranged. Detection and response is seeing, deciding, containing and recovering when the controls are not enough. And governance is where risk decisions, budget, accountability, culture and learning live. Every security read in the course answers four questions: what must we protect, and what would losing it cost? how could someone get to it? who would try, and how do they usually behave? what would we see, and what would we do? One fictional organisation carries the whole course. Kestrel Motion, the servo-motor and drive maker you may know from Courses 007 and 009–013, has plants at Aldren and Brask in the Meridian Union, about 1,100 employees (illustrative), and an IT team of 9 that includes 2 security staff — a security lead and an analyst — reporting to the CFO; the COO owns the plants, and the board has an audit & risk committee. Kestrel also now owns Brenholt Foundry (~210 staff), acquired in Course 013, whose IT has not yet been integrated. In Week 0, after a peer firm's ransomware attack has made the trade press, the committee asks the CFO: "How exposed are we — and what should we fix first, with what budget?" The security lead runs a posture assessment, due to the committee in Week 8. This module lays out the security system map, the transformation the course produces and the thirteen-rung method — and it names the boundary up front. This is a defender's course: it never teaches attack technique — no exploitation steps, no payloads, no tool use for attacking, nothing on evading, persisting or escalating — and it describes adversary behaviour only at the level of MITRE ATT&CK tactic categories and public incident reports and government advisories: what a defender must recognise, detect and block. Scans, simulations and tests happen only with written authorisation and an agreed scope, and privacy and data-protection law are respected. Every claim is labelled fact, assessment or speculation with its provenance; every judgement carries a probability from the course's seven-band yardstick and a separate confidence; every money and time figure is a range, marked illustrative where it is; and there is no fear-selling. The security team itself works on least privilege and need-to-know, and when something goes wrong the organisation learns without blame and discloses honestly.
The six elements are the periodic table of this course — the complete alphabet from which every security decision is built — and the map is those six drawn in the one arrangement that shows how they act on each other. Read it as a mechanism, not a list. The crown jewels sit at the centre because everything else is defined by distance from them: a weakness matters in proportion to how directly it leads to something whose loss would hurt. Crown jewels are chosen by business impact, not by how much IT equipment they occupy — the server that holds twenty years of motor designs may be one modest machine, and the plant line controllers may not appear in the IT asset list at all. The exposure ring is drawn as a ring with doors because exposure is not one perimeter wall but a set of specific ways in, and the modern ones are easy to forget: an identity is a door (an account that can log in from anywhere is an entrance), a supplier with remote access is a door, and every person who reads email is a door — not because people are the weak link, but because email is how much of the outside world reaches the inside. The adversary pressure arrows come from outside and press on particular doors, and they are labelled the way defenders share knowledge about attackers: by the tactics of MITRE ATT&CK, the public knowledge base that names what an adversary is trying to achieve at each stage — initial access, credential access, lateral movement, exfiltration, impact — so that a security lead, a supplier and a government advisory can talk about the same behaviour in the same words. This course stays at that level: the tactic tells a defender what to watch for and where to put a control; it never tells anyone how to perform it. Between the ring and the core run the control bands, drawn as concentric layers because the purpose of layering is that one failure should not reach the core — defence in depth. A band can be preventive (it stops something), detective (it notices something) or corrective (it restores something), and what matters most is not how many bands exist but where their gaps line up. On the right sits the detection & response loop — log, detect, decide, contain, recover, learn — because every band will fail sometimes, and the question that then decides the damage is how fast someone sees it and how surely they can contain it and recover; the loop follows the incident-handling cycle of NIST SP 800-61, and its two clocks, time to detect and , are the measures that matter. And around everything is the , because every gap on the map is in the end a decision someone took or did not take: what to fund, what risk to accept, who is accountable, how the organisation learns. The frame is why the (2024) added to its earlier functions — Identify, Protect, Detect, Respond and Recover — and the map can be read against those six functions directly: Govern is the frame, Identify is the core and the ring, Protect is the bands, and Detect, Respond and Recover are the loop. The completeness argument is simple: to defend an organisation you must know what matters and what losing it would cost, every way it can be reached, who would try and how they usually behave, and what you would see and do — and the four questions are exactly those parts of the map. The central idea follows from the drawing. Security is an : it lives in the interactions between the parts, so a list of controls that are each "in place" can still leave a straight path to the core, and a defender who examines the parts one at a time will never see it. Every later module lights one part of the map: Module 3 the loops and delays that run through it, Module 4 the core and the ring, Module 5 the pressure arrows, Module 6 the control bands, Module 7 the response loop, Module 8 a cascade path from IT into the plant, Module 9 the people doors, Module 10 the supplier doors, Module 11 the governance frame, Module 12 the whole map as an assessment, and Module 13 the whole map for Kestrel's incident.
Traced instance: Kestrel's map, nine findings and one path. The security lead fills the map from evidence, and every finding carries its basis; all figures in this universe are illustrative. First, the scope and the core: with the CFO and the COO, the lead names the four crown jewels — the motor and drive design files on the engineering file server and in the PLM system, the ERP that runs orders, production planning and payments, the plant control systems at Aldren and Brask (line controllers and the HMIs operators use to run them), and customer and employee personal data. Then the ring. Discovery scans run by Kestrel's own IT, with written authorisation, find that the asset inventory covers only about 70% of devices, and that Brenholt's network is not inventoried at all (F1, fact). The remote-access VPN, used by staff and by two suppliers, accepts a password alone, with no multi-factor authentication (MFA) (F2, fact). About 40 services face the internet, and 3 of them carry critical patches more than 90 days old (F6, fact). An authorised phishing simulation, run under a policy staff had been told about, finds a 14% click rate and 4% of staff entering credentials (F7, fact). Then the bands. Office IT and the Aldren plant OT can reach each other across a flat network, while Brask is segmented (F3, fact). One shared domain-administrator account is used by 4 IT staff and by the managed-service provider Corvane IT Services (F4, fact). Backups run nightly to a server on the same network and domain, with no offline or immutable copy, and a full restore has never been tested (F5, fact). Then the loop: firewall and email logs are kept for 30 days, endpoint logs are not centralised, and nobody reviews alerts at night or at weekends (F8, fact). Finally the pressure: a national CERT advisory (illustrative), graded on the A–F / 1–6 system from Course 011, reports a ransomware group targeting through and the (). A checklist would score each of the nine as a separate item, each of medium severity, and the report would end with a long table. The map shows something the table cannot: the findings line up. An adversary of the kind the advisory describes, gaining initial access through a VPN password or Corvane's remote access (F2, F9), would meet a shared administrator account that opens every system (F4), a flat network that carries it from the office into the Aldren plant (F3), endpoints whose logs nobody collects and alerts nobody reads at night (F8), and backups on the same domain that can be destroyed in the same event (F5). That is the assessment's bottom line, delivered in Week 8: — confidence. Two numbers on the map must not be confused. An within two years is likely; an attack that actually is, in a given year, , with an impact of (two to three weeks of lost production, recovery, response and customer penalties). Six fixes break the chain at several links at once — MFA on the VPN, email and all admin access; named, least-privilege admin accounts in place of the shared one; segmenting office IT from the Aldren OT with a controlled path; immutable or offline backups with quarterly restore tests; patching the 3 critical services within 14 days, then a patch SLA; centralised logs kept 90 days and a service with 24/7 coverage — joined by , a brokered, logged, MFA-protected path for supplier remote access, and , an awareness programme with a payment-change verification process. With K1–K6 in place, the likelihood of a plant stop falls to and its impact to , for a programme of about and . The committee approves the programme and its budget in Week 8. None of the nine findings was hidden; all of them were findable by an authorised look at Kestrel's own systems. What was missing was the drawing that showed them as one path — and the course will follow what happened next, including a real attempt in , through Modules 7, 12 and 13.
The gap between the two defenders is the whole value of the course, and each of the checkbox defender's habits fails in a different way. The first is buying tools and passing audits. Tools and certificates are real goods — the CIS Critical Security Controls are a sound prioritised list, and an ISO/IEC 27001 certificate shows that a management system for information security exists and is operated — but a checklist confirms that controls are present, not that they are arranged so that their gaps do not line up, and Kestrel could tick "VPN", "firewall", "backups" and "admin accounts managed" while every one of them sat on the path in the map. The second is counting alerts instead of reading them: a dashboard that reports how many alerts fired says nothing about whether anyone looked at the one that mattered, and an alert at 2 a.m. on a Saturday that no one reviews (F8) is not detection. The third is patching whatever is loudest rather than whatever sits on a path to a crown jewel: the public record of the Equifax breach of 2017 traces it to a web-application vulnerability that had not been patched, which is a lesson about knowing which of your exposed services matter and closing their gaps on a deadline, not about any single product. The fourth is treating security as IT's problem, which leaves the doors that IT does not own — suppliers, people, plants — unmapped. The Target breach of 2013 is widely reported to have begun with credentials belonging to an HVAC contractor; and in the Colonial Pipeline ransomware attack of 2021, which led the company to shut its pipeline, the initial access was reported to be a legacy VPN account without MFA. Both are doors the map would have drawn. The fifth is listing findings one by one and never as a path, so that nine medium-sized items never add up to the one serious risk they form together. The sixth is discovering the cascade during the incident. NotPetya in 2017 spread worldwide through connected networks and badly disrupted the shipping company Maersk among many others; WannaCry, the same year, disrupted parts of the UK's NHS; and the SolarWinds compromise of 2020 travelled inside trusted software updates. In each case the damage was shaped less by the first foothold than by how far the connections, shared trust and missing breaks let it travel — which is exactly what a map of bands and gaps is drawn to show before the incident rather than during it. The seventh is : a backup that has never been restored is a hope, not a recovery capability, and a backup on the same network and domain as everything else (F5) can be lost in the same event as the systems it is meant to restore. And the eighth is — red, amber and green squares with no ranges, no probability, no cost and no decision attached — which feels like reporting and gives the board nothing to decide with. The replaces each habit with a discipline. It and what losing each would cost, so Kestrel's design files, ERP, plant OT and personal data define what "serious" means. It , people and suppliers included, so Corvane's remote access and Brenholt's unmapped network appear on the map before an adversary finds them. It — the F9 advisory names the tactic and the door, and that is enough to put MFA on the VPN and a broker in front of supplier access without anyone needing to know how the attack is carried out. It , so that one stolen password reaches one account and one segment, not the whole company. It , which is why K6 buys 24/7 eyes rather than another dashboard. It : K4 makes the backups immutable and tests a restore every quarter, and the linchpin assumption of the assessment — that Kestrel can restore from the immutable copy within — is something the security lead plans to test, not trust. It : "an attempt within two years is likely (55–80%), moderate confidence; six fixes would cut both the likelihood and the impact of a plant stop by roughly half or more, for about €0.6m in year 1" is a sentence a committee can approve, reject or challenge. And it : , hit by ransomware in , switched parts of its operations to manual working and was widely praised for communicating openly while it recovered — a reminder that what an organisation does after the first hour is part of its security. At Kestrel the systems defender's read was tested sooner than anyone wished. In an employee at Brenholt entered credentials on a phishing page; the attempted VPN login was (K1), and a second attempt through Corvane's old remote tool on a Brenholt server was and contained, with no data taken and nothing encrypted. The blameless review that followed found its own lesson — the old tool had not been removed at Brenholt, so the isolation was incomplete — which is how a systems defender treats even a success: as evidence about where the map was still wrong.
The course is thirteen modules, and the structure follows the four questions and the map. After this orientation, Module 2, The Defender's Discipline & Boundary, installs the six commitments that govern everything else, tagged B1–B6 and cited by those tags throughout: defence, not offence — the course never teaches how to attack, evade, persist or escalate (B1); authorisation and the law — scans, simulations and tests only with written permission and scope, privacy and data-protection law respected, and legal questions handed to counsel (B2); fact, assessment and speculation with provenance on every claim, threat intelligence graded and vendor claims treated as interested sources (B3); calibrated language — the seven-band probability yardstick from almost no chance (1–5%) through roughly even chance (45–55%) to almost certain (95–99%), a separate confidence of high, moderate or low, or not known where the gap is real, and ranges instead of false precision, with no fear-selling (B4); least privilege and need-to-know for the security function itself, with personal data in logs and investigations kept to what is needed (B5); and blameless learning with honest disclosure and open correction (B6). Module 2 is a gate: the rest of the course assumes it. Modules 3 to 5 read the system and its terrain. Systems Thinking for Security gives the toolkit — stocks and flows (vulnerabilities, alerts, privileges, security debt), feedback loops such as alert fatigue and the patch backlog, the delays that explain why breaches are found late, the boundary of "our" system (suppliers, cloud, staff devices), the leverage points where small changes move the whole, and the systems map as a working tool — drawing on Donella Meadows' Thinking in Systems (2008) and her essay on leverage points (1999). Assets & Attack Surface answers what must we protect, and how could someone get to it?: the asset inventory, classifying by business impact to find the crown jewels, the external surface, identities as surface, the human and supplier surface, and measuring and shrinking the surface over time. Adversaries & Threat Modelling answers who would try, and how do they usually behave?: adversary types and motives, behaviour read at the level of ATT&CK tactics, graded threat intelligence, threat-modelling methods such as Microsoft's STRIDE and attack trees at the defender's level, likelihood and impact as ranges, and the threat model as a living document. Modules 6 and 7 answer what would we see, and what would we do? Defence Architecture covers defence in depth, preventive, detective and corrective controls, identity-centred security and least privilege, segmentation and blast-radius design, zero trust as a principle, and control frameworks — NIST CSF 2.0, the CIS Controls, ISO/IEC 27001 — used as checklists rather than strategies. covers what to log and why, detection and the tuning of alerts, the incident-response cycle of NIST SP 800-61, backups and recovery that actually work, crisis communication and notification duties, and the two clocks: time to detect and time to contain. ask where the system breaks. follows how one failure spreads through dependencies, trust relationships and shared credentials, finds single points of failure, reads the boundary between IT and the plant's OT (with , the standards family for industrial automation security, at a general level), traces supplier and software supply-chain cascades, designs breaks into the chain and plans for operating while degraded. covers the human layer of error, pressure and trust, social-engineering patterns at awareness level — signs to spot and processes that stop them, never how to craft a lure — awareness that changes behaviour, secure processes for payment changes, access requests and offboarding, culture and incentives, and the fair handling of insider risk. covers the supplier map and concentrations of trust, what due diligence and questionnaires can and cannot show, contract clauses to raise with counsel, the software supply chain, managed services and cloud shared responsibility, and monitoring suppliers over time. turn the read into decisions. builds risk registers that drive action, quantifies loss in ranges (frequency times magnitude, using — Factor Analysis of Information Risk — at a general level), chooses what to fix first, treats the security budget as a portfolio, reads what cyber insurance does and does not cover, and reports to the board. assembles the model, writes the posture assessment bottom line first, states key judgements with probability and confidence, builds the 30-, 90- and 365-day roadmap, tests the model through tabletop exercises and authorised assessments, and keeps it current through review and calibration. runs the whole method on Kestrel, from the Week 0 tasking to the Month 12 review. Every module from 2 to 12 is built the same way — six , the sub-techniques of its rung, each with a tag (Module 4's atoms are A1–A6, Module 7's R1–R6, and so on) and each dissected through six fixed fields: it is, its (drawn on the security system map), the as a numbered procedure, its and failure modes, to use it and when not, and it connects to the rest. Kestrel is traced through every atom: the Week 0 tasking, the Week 8 assessment and the committee's decision, the 30-, 90- and 365-day roadmap, the Month 4 tabletop exercise, the Month 5 attempt and the Month 12 review. The world is fictional so that the method can be shown whole without exposing anyone's real systems, and its people are named by role only — the CFO, the COO, the security lead, the analyst, the board's audit & risk committee. Where the course uses real-world material — public frameworks and standards and a handful of well-documented incidents — it stays at the level the public record supports.
This is a dissection course, not a survey of security products: every technique is broken down to its mechanism and its procedure, so you finish not with a shopping list but with a repeatable method for telling the people who own an organisation's risk how exposed it is, what to fix first and what it will cost. Three things to hold onto as you go. First, start from the crown jewels and read the path, not the parts: decide what matters most and what losing it would cost before you count a single vulnerability, then ask how each door, gap and missing clock connects to that core — Kestrel's nine findings meant little as a list and a great deal as one path from a VPN password to a stopped plant. Second, grade everything and speak in ranges: every claim carries its basis — fact, assessment or speculation, with its source and grade — every judgement a probability from the yardstick and a separate confidence, and every money and time figure is a range marked illustrative where it is, so that a CERT advisory graded B2 and a vendor's marketing claim are never weighed as the same kind of evidence, and so that the board hears "unlikely (20–45%) a year, €4–9m" rather than either "we are fine" or "we are doomed". Fear sells products; it does not produce good decisions. Third, stay on the defender's side of the line: this course reads adversaries at the level of ATT&CK tactics and public reports, enough to recognise, detect and block, and never at the level of how to act (B1); anything you scan, simulate or test, you do only with written authorisation and an agreed scope, and with personal data handled lawfully and minimally (B2, B5) — Kestrel's discovery scans and phishing simulation were authorised, scoped and announced in policy before they ran. One note on scope: the course teaches method on a fictional universe and on public frameworks and well-documented incidents; it is not legal advice on notification duties, contracts or data-protection law in any real jurisdiction, and wherever a question turns on the law, the course's answer is to hand it to counsel. Hold those three and the rest is detailed machinery. Module 2 makes the discipline explicit first, because a method built to protect an organisation is only trustworthy when it is held to a strict standard of restraint and honesty.
Before the first door is mapped, the course installs the discipline that governs the whole method. Module 2 is the defender's boundary, in six commitments tagged B1–B6: defence, not offence — adversary behaviour read only at framework and advisory level, never how to attack, evade, persist or escalate (B1); authorisation and the law — scans, simulations and tests only with written permission and scope, privacy and data-protection law respected, and legal questions handed to counsel (B2); fact, assessment and speculation with provenance on every claim, threat intelligence graded and vendor claims treated as interested sources (B3); calibrated language — the seven-band probability yardstick, a separate high / moderate / low confidence with not known for real gaps, and ranges in place of false precision or fear (B4); least privilege for the security function itself, with personal data in logs and investigations minimised (B5); and blameless learning and honest disclosure, with corrections made in the open (B6). The security system map is a powerful instrument; Module 2 is what keeps it accurate, lawful and honest.
The signature image of the course: one organisation's security drawn as a system, here Kestrel Motion as the security lead sees it at the end of the posture assessment. At the centre, the crown jewels: design files and the PLM system, the ERP, the plant control systems (OT) at Aldren and Brask, and personal data. Around them, four control bands — identity, network segments, endpoint, backup — each drawn with the gap the assessment found. Outside them, the exposure ring with its six doors, and beyond it the adversary pressure, labelled only by ATT&CK tactic category. On the right, the detection & response loop with its weak points, Brenholt Foundry not yet integrated, and the risk in illustrative ranges. Around everything, the governance frame: the board committee, the CFO, the risk register and the budget. The dashed red line is the assessment's most likely serious incident: one path from the VPN or a supplier's door through every gap into the core. All figures are illustrative; the four questions are keyed to the parts of the map.
The transformation the course produces. The checkbox defender answers "we are covered": it buys tools and passes audits, counts alerts instead of reading them, patches whatever is loudest, treats security as IT's problem, lists findings one by one, discovers the cascade during the incident, has backups nobody has restored and answers the board with a heat map. The systems defender knows the crown jewels and what their loss would cost, maps every door including people and suppliers, reads adversaries at framework level, arranges controls to limit the blast radius, measures time to detect and contain, rehearses recovery, takes risk decisions in ranges with the board and learns blamelessly. At Kestrel the nine findings become one path and six fixes for about €0.6m in year 1 (illustrative). Same organisation, same findings; one sees parts, the other sees the system.
How the course is built. Phase 1 sets the lens and the line (Modules 1–2). Phase 2 reads the system and its terrain — the systems toolkit, the assets and surface, the adversaries (Modules 3–5). Phase 3 asks how to defend, see and recover (Modules 6–7). Phase 4 asks where the system breaks — cascades, people, suppliers (Modules 8–10). Phase 5 turns the read into decisions, an assessment and an end-to-end run (Modules 11–13). Under every rung run the six commitments of Module 2, B1–B6: defence not offence, authorisation and the law, graded claims, calibrated ranges, least privilege for the security team itself, and blameless learning with honest disclosure.