Hands‑On Labs — Chapters 1 to 4

Define Information Security for executives (scope, purpose, accountability). Contrast with cybersecurity.

Pick 6 principles (Defense-in-Depth, Least Privilege, Secure by Default, etc.) and explain how they constrain a cloud migration.

Explain why “tools make us secure” is a flawed belief.

Identify assets, vulnerabilities, threats, attacks, risks. Propose controls and explain the chain.

Classify your controls by category (technical, managerial, operational, physical) and type (preventive, detective, etc.).

Explain the Asset–Threat–Vulnerability–Risk–Control model as a system.

For a remote access system, propose 6 decisions and map each to CIA with trade-offs.

Describe Identification → Authentication → Authorization → Accounting for the same system.

What belongs to Strategic vs Tactical vs Operational?

Select guidance for planning, incident handling, logging, configuration, measurement, and a sector need. Justify each.

Explain how guidance supports decisions rather than becoming compliance theater.

Map your selected guidance to governance, operations, and technical layers.