Loading audiobook...

Cybersecurity and Compliance Curriculum

11 chapters

1. Lab 2: Running a SCAP Scan

[Verse 1]
Fire up your virtual machine today
RHEL or Ubuntu, either way
Time to scan for security flaws
With OpenSCAP and SCAP laws
Install the tools we need to see
Where vulnerabilities might be
SCAP Security Guide in hand
We'll scan across this testing land

[Chorus]
O-S-C-A-P info command
List the profiles, understand
S-T-I-G scan with eval
HTML report will reveal
Passed and failed and not applied
Security status, nothing to hide
X-C-C-D-F results in XML
SCAP scanning serves us well

[Verse 2]
Navigate to the sharing place
usr share xml scap base
SSG content with your distro name
DataStream file, that's the game
Run oscap info to display
All the profiles you can play
Choose your target, make it clear
STIG compliance drawing near

[Chorus]
O-S-C-A-P info command
List the profiles, understand
S-T-I-G scan with eval
HTML report will reveal
Passed and failed and not applied
Security status, nothing to hide
X-C-C-D-F results in XML
SCAP scanning serves us well

[Verse 3]
Oscap xccdf eval the way
Profile STIG will save the day
Report dot HTML for the view
Results dot XML structured too
DataStream file at the end
Watch the scanning process blend
Every check gets its own test
Pass or fail, we'll see the rest

[Bridge]
Open up that HTML file
Browse the results, stay a while
Green means passed, red means failed
Gray shows checks that weren't detailed
Not applicable, that's okay
Some don't match your system's way
XML holds the structured data
Compliance dreams are getting better

[Chorus]
O-S-C-A-P info command
List the profiles, understand
S-T-I-G scan with eval
HTML report will reveal
Passed and failed and not applied
Security status, nothing to hide
X-C-C-D-F results in XML
SCAP scanning serves us well

[Outro]
Now you've learned to run the scan
SCAP compliance, you're the man
Virtual machine tested clean
Best security you've ever seen

2. Acceptance Is Not Ignorance

[Verse 1]
Sarah clicks the checkbox, marks it "accepted risk"
Files the threat assessment in a dusty disk
CEO asks "What about the server crash?"
She shrugs and says "We chose to let it pass"
But acceptance isn't silence, isn't closing your eyes
It's a calculated verdict with a thorough disguise

[Chorus]
Document and Monitor - that's the golden rule
Acceptance isn't ignorance, don't be a fool
Assess, Record, Review - keep the cycle tight
Black swan preparation needs the spotlight bright
Document and Monitor, make the choice with care
Acceptance means you're watching, always prepared

[Verse 2]
Tom builds his framework, lists each lurking threat
Pandemic shutdowns? "We accept" - but wait, not yet
First he maps the impact, calculates the cost
Weighs the mitigation price against what might be lost
Board approves the verdict with a written decree
Quarterly reviews ensure they're tracking what they see

[Chorus]
Document and Monitor - that's the golden rule
Acceptance isn't ignorance, don't be a fool
Assess, Record, Review - keep the cycle tight
Black swan preparation needs the spotlight bright
Document and Monitor, make the choice with care
Acceptance means you're watching, always prepared

[Bridge]
Risk appetite statement defines your tolerance zone
Governance committee never leaves risks alone
Trigger thresholds signal when the landscape shifts
Active surveillance spots when danger drifts

[Verse 3]
When earthquakes strike or cyber-thieves attack
Companies with real acceptance bounce right back
They knew the consequences, planned for what they'd lose
Had escalation pathways and alternative routes
Not surprised by chaos 'cause they thought it through
Acceptance done correctly gets you safely through

[Chorus]
Document and Monitor - that's the golden rule
Acceptance isn't ignorance, don't be a fool
Assess, Record, Review - keep the cycle tight
Black swan preparation needs the spotlight bright
Document and Monitor, make the choice with care
Acceptance means you're watching, always prepared

[Outro]
Checkbox warriors crumble when the black swans soar
True acceptance warriors planned for so much more

3. 1 COSO 2013 Internal Control

[Verse 1]
Twenty-thirteen brought structure to the maze
Internal control with three objectives blazing trails
Reliable reports, compliance checks, operations smooth
While twenty-seventeen expanded what we choose
Strategic vision, appetite for calculated chance
Two frameworks dancing in a governance dance

[Chorus]
Execution layer meets the strategy sphere
COSO frameworks harmonizing crystal clear
Three objectives grounded, five components strong
Taxonomy aligned where both belong
Internal control foundation, ERM elevation
Building bridges through coordinated integration

[Verse 2]
Seventeen components in the IC design
Control environment sets the disciplined baseline
Risk assessment identifies what could derail
Information flows and monitoring never fail
Communication weaves through every structured tier
Control activities make the boundaries appear

[Chorus]
Execution layer meets the strategy sphere
COSO frameworks harmonizing crystal clear
Three objectives grounded, five components strong
Taxonomy aligned where both belong
Internal control foundation, ERM elevation
Building bridges through coordinated integration

[Bridge]
Don't duplicate the governance machinery
Risk taxonomies speaking same vocabulary
Reporting mechanisms streamlined and refined
Entity layer, strategic layer, execution combined
Portfolio perspective meets operational precision
Coherent architecture drives every decision

[Verse 3]
Operational effectiveness keeps the engine running
Compliance adherence, no regulatory shunning
Financial reporting builds the trusted narrative
While ERM selects the strategic alternative
Appetite boundaries guide the entity course
Two frameworks unified become a stronger force

[Chorus]
Execution layer meets the strategy sphere
COSO frameworks harmonizing crystal clear
Three objectives grounded, five components strong
Taxonomy aligned where both belong
Internal control foundation, ERM elevation
Building bridges through coordinated integration

[Outro]
Implementation wisdom knows the vital truth
Align the structures, integrate the proof
COSO twenty-thirteen and seventeen
Working together in the risk machine

4. Poisoned Dependencies

[Verse 1]
Sarah downloads a parsing library
Version two point one looks clean and bright
But hidden in the nested code tree
A backdoor waits to steal her data overnight
The maintainer sold his access key
To hackers with a different appetite

[Chorus]
Check your deps, trace the source
Malicious code can shift the course
Typosquatting waits to strike
Registry mirrors might not be alike
Scan the chain, verify each name
Before your system goes up in flame

[Verse 2]
Build environments seem secure at first
Docker images pulled from trusted hubs
But embedded scripts can break the trust
When CI pipelines run those tainted subs
A single compromised toolchain burst
Can poison every binary that's dubbed

[Chorus]
Check your deps, trace the source
Malicious code can shift the course
Typosquatting waits to strike
Registry mirrors might not be alike
Scan the chain, verify each name
Before your system goes up in flame

[Bridge]
Package substitution attack patterns bloom
When attackers register similar strings
React becomes Reactt in registry rooms
One letter changed breaks everything
Hash validation saves you from the gloom
Cryptographic signatures spread their wings

[Verse 3]
Dependency confusion strikes the core
When private packages meet public names
Internal tools get swapped for something more
Malevolent as external hackers play their games
Version numbers soar beyond your store
While poisoned modules rewrite all the claims

[Chorus]
Check your deps, trace the source
Malicious code can shift the course
Typosquatting waits to strike
Registry mirrors might not be alike
Scan the chain, verify each name
Before your system goes up in flame

[Outro]
Pin your versions, lock them down
Audit trails keep threats from town
Supply chain vigilance saves the day
When poisoned dependencies come to play

5. When ACE Breaks Down

[Verse 1]
ACE excels at static rules and roles
But temporal needs expose the holes
When deadlines matter, hours tick away
Recovery objectives won't obey
Simple logic can't capture time's demands
RTOs and RPOs slip through ACE's hands

[Chorus]
When ACE breaks down, the cracks appear
Temporal, procedural, deontic sphere
No timestamps, no sequences, no obligation's weight
Static rules crumble at complexity's gate
When ACE breaks down, you need something more
Richer languages to unlock that door

[Verse 2]
Incident response needs ordered steps
First contain, then analyze what's left
ACE can't model "do this, then do that"
Procedural workflows fall completely flat
Step-by-step protocols need sequence flow
But ACE sees rules, not the path to go

[Chorus]
When ACE breaks down, the cracks appear
Temporal, procedural, deontic sphere
No timestamps, no sequences, no obligation's weight
Static rules crumble at complexity's gate
When ACE breaks down, you need something more
Richer languages to unlock that door

[Bridge]
Must versus may versus forbidden acts
Deontic logic deals in legal facts
Obligations binding, permissions free
Prohibitions block what cannot be
But ACE sees access, not the moral weight
Of duties that regulation creates

[Verse 3]
Business stakeholders need readable text
Not cryptic symbols leaving them perplexed
Training requirements for every user
Make ACE adoption a guaranteed loser
When humans can't parse your policy prose
Your formal language just decompose

[Chorus]
When ACE breaks down, the cracks appear
Temporal, procedural, deontic sphere
No timestamps, no sequences, no obligation's weight
Static rules crumble at complexity's gate
When ACE breaks down, you need something more
Richer languages to unlock that door

[Outro]
Know your limits, choose your tool with care
ACE has boundaries, use it where it's fair
But when time matters or procedures count
Find languages built for that amount

6. 1 Defining Active-Active

[Verse 1]
When systems fail we need a plan
To keep our services alive
Active-passive means one takes the stand
While backup waits to come online
Active-standby keeps resources cold
Until disaster strikes our door
But active-active breaks the mold
Both systems serve forevermore

[Chorus]
Active-active means both sides are live
Two times the cost but systems thrive
RPO zero, RTO low
Consistency trade-offs you should know
CAP theorem makes you choose your way
Partition tolerance every day
Pick consistency or availability
That's the active-active way

[Verse 2]
Recovery Point Objective talks
About the data you might lose
Recovery Time is how long it walks
Before your service is in use
Negotiate with stakeholders clear
What downtime they can tolerate
Minutes, seconds, or the year
These numbers seal your system's fate

[Chorus]
Active-active means both sides are live
Two times the cost but systems thrive
RPO zero, RTO low
Consistency trade-offs you should know
CAP theorem makes you choose your way
Partition tolerance every day
Pick consistency or availability
That's the active-active way

[Bridge]
Don't think it's one-point-five the price
Double your infrastructure twice
Network splits will test your plan
Eventual consistency or strong
Choose your model all along
Build the system that will span

[Verse 3]
In practice most apps can survive
With eventually consistent state
But if you need strict data live
Strong consistency seals your fate
Active-passive costs much less
One primary does all the work
Active-active handles stress
But complex conflicts often lurk

[Chorus]
Active-active means both sides are live
Two times the cost but systems thrive
RPO zero, RTO low
Consistency trade-offs you should know
CAP theorem makes you choose your way
Partition tolerance every day
Pick consistency or availability
That's the active-active way

[Outro]
When networks split and systems break
Choose the model for your sake
Active-active pays the price
For resilience that's precise

7. Adaptive Management Principles

[Verse 1]
Crisis strikes without rehearsal, chaos writes its own script
While others freeze in boardrooms, smart teams pivot quick
Move faster than disaster, beat the breakdown's rhythm
Decentralize decisions, trust your people's wisdom

[Chorus]
Sixty percent is good enough, don't wait for crystal facts
Course-correct and pivot hard when evidence reacts  
Plan to scrap your blueprint when black swans attack
Keep your options breathing room, never paint yourself in black

[Verse 2]
Military minds discovered what emergency responders know
Perfect intel's phantom luxury when catastrophes unfold
Empower every captain to navigate their sector
Within your central framework, make each leader a protector

[Chorus]
Sixty percent is good enough, don't wait for crystal facts
Course-correct and pivot hard when evidence reacts
Plan to scrap your blueprint when black swans attack
Keep your options breathing room, never paint yourself in black

[Bridge]
Build checkpoints in your strategy, interrogate your wins
Ask what proof would show you're wrong before the avalanche begins
Preserve reversibility, dodge the permanent mistake
Flexibility's your lifeline when foundations start to shake

[Verse 3]
No battle plan survives the enemy's first punch
Black swans demolish diagrams, devour your best hunch
So question your responses with systematic doubt
What evidence screams failure? Plan your fallback route

[Final Chorus]
Sixty percent is good enough, don't wait for crystal facts
Course-correct and pivot hard when evidence reacts
Plan to scrap your blueprint when black swans attack
Keep your options breathing room, adaptability's your track

[Outro]
When certainty's a fairy tale and chaos calls the shots
Adaptive management saves you from catastrophic plots

8. 4 Dual-Environment Workflow

[Verse 1]
Open lab connects you wide, unclassified domain
Where prototypes take shape and algorithms learn to reign
Full internet at your disposal, AI assists the code
Research flows like rivers here, ideas freely explode
But CUI waits across the bridge in GovCloud's guarded space
Production lives in fortress walls, restricted interface

[Chorus]
Two worlds spinning, dual-environment dance
Open prototype, restricted advance
Port your artifacts, mind the gap between
Mirror dependencies, keep the pipeline clean
Hauler packs the bundles, Zarf deploys offline
Dual-environment workflow, crossing every line

[Verse 2]
What transfers smooth as silk across the boundary divide?
Static files and images make the crossing without guide
But dynamic links will shatter when the internet's denied
Database connections snap, external calls collide
Pre-download every package, container images too
Helm charts need their mirrors in the vault that waits for you

[Chorus]
Two worlds spinning, dual-environment dance
Open prototype, restricted advance
Port your artifacts, mind the gap between
Mirror dependencies, keep the pipeline clean
Hauler packs the bundles, Zarf deploys offline
Dual-environment workflow, crossing every line

[Bridge]
Air-gap patterns save the day when networks disconnect
Defense Unicorns built the tools that architects protect
Bundle up your software stack, compress it tight and neat
Sneakernet the payload where secure and open meet

[Verse 3]
In the lab you innovate with cloud APIs so bright
But restricted zones need local stores, no packets take to flight
Every library, every tool must cross the digital moat
Package managers can't reach out from that isolated boat
So stage your whole environment in bundles premade
Synchronize the mirror sites where dependencies are laid

[Chorus]
Two worlds spinning, dual-environment dance
Open prototype, restricted advance
Port your artifacts, mind the gap between
Mirror dependencies, keep the pipeline clean
Hauler packs the bundles, Zarf deploys offline
Dual-environment workflow, crossing every line

[Outro]
From prototype to production, the bridge you'll learn to build
Defense infrastructure flows when dual workflows are skilled

9. The Organizational Relationship After Compliance

[Verse 1]
The audit's done, the pressure fades
That leverage we had just evaporates
No more urgent deadlines forcing hands
InfoSec stands alone again
The crisis gave us temporary clout
Now we must build trust without the shout
Transform from watchdog into guide
Make security our shared pride

[Chorus]
Partner not police, embed the need
Build champions who can take the lead
Definition done includes our gate
Roadmap visible, don't isolate
After compliance, change the game
Shared ownership, not shifting blame

[Verse 2]
Weave security into quality's thread
No separate review, bake it in instead
Each story needs its safety clause complete
Before the team can mark it fleet
Train developers to catch the flaws
Give them knowledge, not just laws
Routine questions they can solve alone
InfoSec for complex zones

[Chorus]
Partner not police, embed the need
Build champions who can take the lead
Definition done includes our gate
Roadmap visible, don't isolate
After compliance, change the game
Shared ownership, not shifting blame

[Bridge]
Show the roadmap to engineering leads
Security investment plants the seeds
Not reactive scrambling anymore
Planned protection at the core
Champions scattered through each crew
Scaling knowledge, scaling you

[Chorus]
Partner not police, embed the need
Build champions who can take the lead
Definition done includes our gate
Roadmap visible, don't isolate
After compliance, change the game
Shared ownership, not shifting blame

[Outro]
When the audit leverage disappears
Build relationships that last for years
Embedded, championed, visible plan
Security woven by every hand

10. Exercise 3: Framework Mapping

[Verse 1]
Sarah pulls the access control domain from the shelf
Cross-referencing frameworks, mapping by herself
SOC 2 demands authentication logs pristine and clear
CMMC wants multi-factor, make those threats disappear
HIPAA screams encryption for every patient file
ISO twenty-seven-oh-one builds defense with style

[Chorus]
Map the matrix, find the gaps
Four frameworks in your lap
SOC-CMMC-HIPAA-ISO
Where they overlap, that's where you go
Cross-pollinate, eliminate
Redundancy you calculate
Framework mapping shows the way
Coverage gaps won't lead astray

[Verse 2]
Password complexity hits three frameworks at once
CMMC level three aligns with ISO's monthly hunt
But HIPAA's silent on rotation frequency rules
While SOC 2 Type Two sharpens auditor tools
Green cells show where requirements intersect and blend
Red cells scream attention to controls you must defend

[Chorus]
Map the matrix, find the gaps
Four frameworks in your lap
SOC-CMMC-HIPAA-ISO
Where they overlap, that's where you go
Cross-pollinate, eliminate
Redundancy you calculate
Framework mapping shows the way
Coverage gaps won't lead astray

[Bridge]
Privileged access management spans every regulation
But session timeout varies across each implementation
CMMC wants fifteen minutes, ISO says risk-based choice
HIPAA stays technology-neutral, lets you find your voice
SOC 2 trusts your judgment if controls are operating
Framework mapping reveals where compliance is debating

[Verse 3]
Network segmentation shows a patchwork quilt design
HIPAA mentions minimum necessary by design
ISO controls eleven-thirty-one draws network lines
CMMC architecture rules through access control defines
But SOC 2 logical boundaries need your interpretation
Map these nuances to build your documentation

[Chorus]
Map the matrix, find the gaps
Four frameworks in your lap
SOC-CMMC-HIPAA-ISO
Where they overlap, that's where you go
Cross-pollinate, eliminate
Redundancy you calculate
Framework mapping shows the way
Coverage gaps won't lead astray

[Outro]
Single domain, multiple lenses
Mapping reveals your defenses
Overlap efficiency, gap urgency
Framework mapping mastery

11. IP Licensing Risk Management

[Verse 1]
Sarah's tech startup signed a patent deal
Thought the handshake meant the danger wasn't real
But hidden clauses lurked beneath the shine
Cross-licensing traps and territorial lines
The licensor promised peaceful coexistence
But their audit team brought swift resistance

[Chorus]
Check the scope, watch the clock
Monitor or face the shock
Infringement knocks when you forget to knock
Due diligence saves the block
License clean, audit keen
Keep your usage squeaky clean
Risk mitigation's what it means
To lead the legal tech machine

[Verse 2]
Third-party patents creep through backdoor ways
Employees bring their former workplace's maze
Of trade secrets mixed with open source code
Creating liability that could explode
Compliance tracking needs systematic eyes
Before the cease-and-desist letter arrives

[Chorus]
Check the scope, watch the clock
Monitor or face the shock
Infringement knocks when you forget to knock
Due diligence saves the block
License clean, audit keen
Keep your usage squeaky clean
Risk mitigation's what it means
To lead the legal tech machine

[Bridge]
Escrow agreements for the source code vault
Termination clauses aren't the licensor's fault
Field of use restrictions draw the battle lines
While indemnification clauses guard the signs
Portfolio analysis reveals the gaps
Before competitor litigation traps

[Verse 3]
Geographic boundaries shift with global scale
Jurisdiction shopping tells a different tale
When patent trolls emerge from shadow firms
Your licensing strategy must weather their terms
Defensive patents build the moat you need
While cross-licenses plant the peaceful seed

[Chorus]
Check the scope, watch the clock
Monitor or face the shock
Infringement knocks when you forget to knock
Due diligence saves the block
License clean, audit keen
Keep your usage squeaky clean
Risk mitigation's what it means
To lead the legal tech machine

[Outro]
Technology leadership demands the skill
To navigate the intellectual minefield still
From patent prosecution to the licensing game
Risk management keeps your reputation's flame

Back to Home

Cybersecurity and Compliance Curriculum | 93