What Doesn’t Kill You Makes You Stronger

The Security Research & Implementation team operates as a separate mini-department within the InfoSec department. Its specialists research toolsets available on the market, compare them with our own tools, and manage security configurations in those tools. For example, within the Office 365 console settings, we configured it in such a way that an individual can only share a file with specific addresses instead of a link, available for everyone, even outside of our company. Another good example is advanced configurations on top of our identity services, which automatically block access to the internal systems and information in case of cyber anomalies like suspicious IP addresses, atypical geo-location, etc.

We have an expert handling the Vulnerability Management process daily: scanning and reporting newly seen vulnerabilities to the relevant stakeholders. We also control the time it takes to fix vulnerabilities within the defined SLAs.

Also, there is a specific process in the company, which involves annual penetration tests with external companies to assess our ability to withstand attacks. 

We practice various types of tests in accordance with global standards, including “black box” testing, where ethical hackers assess our defenses from the outside without having internal access; “red teaming” tests, where they have internal access, and “purple teaming”, where ethical hackers

perform an activity comparing visibility with internal cybersecurity operations center (“Blue team”). That helps us identify potential gaps in our defense, compare the steps of the attacking party with the reaction of our unit, and improve visibility and reaction.

We also have a sub-team that utilizes Breach Attack Simulation service. It helps constantly run the simulation of newest attacks against our environment and identify potential gaps on different levels. We can select what to test on any given day, whether it’s email systems, workstations, or networks, depending on the predefined scenarios. These scenarios are non-harmful to the organization as they do not extract data or make a negative impact on our infrastructure. This approach is also used to assess the quality and effectiveness of our security controls.

Additionally, we have a Leadership and Coordination tier, which includes several security coordinators and InfoSec business partners. These individuals manage the day-to-day operations within the team, coordinate the team’s activities in case of cybersecurity incidents, initiate investigations as needed, and prepare incident reports. They also assist businesses with security-related tasks, review and approve security architecture for new products, explain our security structure to the clients, and provide support for specific decisions. I lead this direction and report directly to the C-level executives regarding the security status based on specific criteria.

Universities often struggle to maintain a laboratory with the necessary toolkit and all the required software because universities don’t have a separate large IT department dedicated solely to this task. In this regard, it is more convenient for us to adopt some SaaS solutions. We chose the RangeForce SAAS education platform. Our sponsors covered the licenses for students. A student doesn’t need to have a super-powerful computer or laptop; they only need access to a browser.

Unfortunately, there are indeed complex issues in education. One of the critical challenges is the lack of motivation for young, talented individuals to pursue a career in teaching. On average, teachers receive a salary of about $200-300, which is inadequate for meeting their basic needs. In my opinion, this is unacceptable. I currently have no idea how to address this problem at the level of tech companies, as it requires fundamental changes at the state level. For example, for comparison, similar salaries in Europe are at least 10-20 times higher.

We are trying to solve this problem in different ways, for example, by offering various public grants for teachers who have interesting programs but lack the means to implement them.

For example, recently we were offering grants in the range of $2,000. However, these were one-time things.

Speaking of a more permanent basis, we collaborate with international universities. Last week, I had a conversation with a Swedish university that has a well-developed cybersecurity program, and they agreed to share their experience and provide our students with a dual degree. Also, our students were enrolled in the Swedish student team and participated in Capture the Flag (CTF) cybersecurity competition that is used to test and develop cybersecurity skills.

We offer courses that fall into four categories. The first category – GRC (Governance, risk management, and compliance), includes courses that provide a general understanding of cybersecurity and IT. We are also exploring frameworks such as ISO27001, ISO27002, NIST 800-53, MITRE ATT&CK and OWASP frameworks.

The second direction, SecOps, encompasses programs and tools for log collection and analysis, scanning, vulnerability detection and many other technical solutions for “Blue team.”

A specific direction is penetration testing. We train students in ethical hacking techniques based on Mitre, OWASP, Metasploit and other frameworks. We study the path a hacker goes through the whole attack kill chain. This covers techniques and tactics for compromising systems, but it should only be practiced in isolated laboratory environments and should never be attempted on other companies’ websites, as it could be considered a potential crime. 

The fourth category focuses on secure software development, known as the software development lifecycle. We teach programs and techniques for checking code security, and various software that assists in code review.

We have incorporated the maximum number of subjects possible into the curriculum. The next question is how effectively teachers deliver this information. Whenever possible, we hold sessions with teachers every year to review their syllabi and provide recommendations for improvement. I organize internships for students within our company. In collaboration with our Academy we assist in organizing lectures and practical assignments for them.

One of the most interesting and productive disciplines is “Team work”. We introduced it in collaboration with the Lviv IT Cluster, which helps us find mentors who are working in tech companies. Our students split into groups of five to six people, and use practices similar to teams in technological companies. This ensures that they not only understand certain methodologies and practices but can also implement them in conditions closely resembling real-world scenarios. For example, someone in the team takes on the role of a project manager, someone – QA, someone – a developer, someone – an analyst, depending on the assigned tasks. Together with the mentor, they work on very interesting projects and learn to collaborate in a team. Students defend their projects in front of teachers and representatives of the tech industry in the office of a tech company.

We also organize summer internships where students have an active practical intensive for 1-2 months with daily activities. Talented students are hired, and they may go into the different directions: SecOps or GRC analysts, ethical hackers, DevOps, developers, etc.