<!DOCTYPE html>
This module provided a comprehensive overview of cyber security principles, secure system design, and professional standards. I implemented foundational concepts, regulatory frameworks, and ethical considerations in practical scenarios using portfolio artefacts. Throughout the process, I emphasised quantifiable results, effective communication, and systematic evaluation to foster ongoing enhancements.
Core competencies developed throughout this foundational module
Exhibit a comprehensive grasp of essential cyber security concepts (least privilege, defence-in-depth, secure-by-design, Zero Trust) and their foundational role in the development of resilient systems.
Implement security techniques (threat modelling, risk assessment, control selection) to guide design and operational decision-making within organisations.
Assess the efficacy of control frameworks (e.g., ISO/IEC 27001, NIST CSF 2.0) for aligned recommendations.
Appraise and communicate security findings to diverse audiences on risks and assurance.
Practical implementations and peer review throughout the module
Introduced the Log4j case to frame economic, legal (GDPR), and reputational impacts of cyber security; advocated for proactive investment over reactive spending and underlined the relationship between compliance and trust.
📁 Evidence: Initial Post.pdf
✓ Feedback: Formative comments suggested including specific case examples and clearer connections from risk to control to outcome in future posts.
Consolidated insights from the Log4j discussion, highlighting economic impacts, regulatory obligations (GDPR Art. 32), and reputational effects, with peer-suggested real-world examples.
📁 Evidence: Summary Post.pdf
✓ Feedback: Involvement of peers enhanced the justification for implementing patching and monitoring, while the precision of the recommendations was improved.
Key considerations for an e-commerce backup and recovery plan include risk assessment, layered controls, failover, redundancy, RTO/RPO alignment, integrity checks, log monitoring, and routine recovery validation, highlighting governance and testing for resilient service continuity.
📁 Evidence: Essay9.pdf
✓ Feedback: Prioritise risk-to-control traceability and include dashboardable metrics for executives.
Created a secure backup prototype using secure-by-design and Zero Trust principles: TLS transport, credential authentication, encryption at rest and in transit, and integrity checks. The README covers assumptions, threat model, and testing methods.
📁 Evidence folder: assets/LauchingIntoCybersecurity/unit12
🗂️ Key files:
secure_backup.py •
requirements.txt •
README.md •
TestData/ResultsScreenshots.pdf
✓ Feedback: Test plan and integrity verification received positive feedback. Next steps include secret management, key rotation, and automated restoration tests.
During the Log4j analysis and backup/recovery efforts, I focused on practical risk management over theoretical catalogues. Decisions were driven by regulatory requirements (notably GDPR Article 32), service-continuity objectives (including Recovery Time Objectives and Recovery Point Objectives), and validated controls such as Transport Layer Security, encryption, credential verification, and integrity checks.
📁 Evidence: Initial Post.pdf (p.1); Summary Post.pdf (p.1); Essay9.pdf (pp.1–3); Unit 12 README
Self-evaluation of capabilities and development areas
Concrete steps to address weaknesses and capitalise on opportunities
Steps: Subscribe to CVE/ENISA/NCSC feeds; weekly review and log one relevant vulnerability/TTP mapped to current controls.
Steps: Develop scenario models (ransomware vs insider breach) and dashboards of assumptions/impacts; define action thresholds.
Steps: Study for CISSP/CISM; join a study group; apply governance patterns in projects; attempt exams; integrate new controls.
Steps: Practise narrative slide walkthroughs; collect peer feedback on clarity; present Unit 12 to a non-technical audience.
Steps: Publish three short posts on threat modelling and backups; track engagement.
I entered confident in my technical skills and learned that resilience and ethics are central. I improved my ability to express risk in business terms while deepening governance and ethical awareness. I view security as an ongoing process requiring continuous threat assessment, collaboration, and evidence-based decisions.
Reflection produced concrete next steps that I'll apply in future projects to ensure security measures positively impact the organisation. I'm committed to lifelong learning, sharing best practice, and addressing emerging cybersecurity challenges.
ISO/IEC (2022) ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Geneva: International Organization for Standardization.
ISO/IEC (2011) ISO/IEC 27031:2011 Information technology — Security techniques — Guidelines for information and communication technology readiness for business continuity. Geneva: International Organization for Standardization.
National Institute of Standards and Technology (2024) The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. Gaithersburg: NIST. Available at: https://doi.org/10.6028/NIST.CSWP.29
OWASP Foundation (2021) OWASP Top Ten. Available at: https://owasp.org/www-project-top-ten/
Council of the European Union (2016) Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). Brussels.