Security Controls and Testing

This unit focuses on practical security controls, testing methodologies, and operational readiness—including least privilege, zero trust, identity and authentication, cloud validation, social engineering, physical security, and data protection. Students will learn to identify and prioritize assets and vulnerabilities, design mitigation strategies, and prepare organizational programs for continuity, awareness, and professional testing.

Learning Objectives

• Analyze organizational assets, attack surfaces, and threat actor profiles to prioritize systems for testing and produce a documented, risk‑based testing plan using reconnaissance and network mapping techniques
• Evaluate physical, social engineering, and technical vulnerabilities and recommend mitigation strategies that incorporate least‑privilege, authentication controls, password best practices, and appropriate cryptographic hardware (e.g., HSM) where applicable
• Apply continuity, backup, and disaster recovery principles to design and validate a data protection plan for endpoints and cloud services, including procedures for smartphone backups and app/data restoration
• Demonstrate the ability to develop and coordinate a security program by preparing budgets and approvals, creating security awareness initiatives (including gamification elements), and determining when to engage external professionals for penetration testing