Unit 6: Cyber Defence Management

This unit describes skills and knowledge required to identify and solve an organisations cyber security problems through assessing current cyber security measures, developing a programme in consultation with others and guiding, leading and monitoring the execution of the programme.

It applies to individuals, employed or contractors who are working in positions of authority and are approved to implement change within a department or across the organisation. They will have responsibility for directly supervising others.

No occupational licensing, certification or specific legislative requirements apply to this unit at the time of publication.

1.1 Establish cyber security goals in consultation with senior management or client

1.2 Conduct research using organisational and industry information to establish potential attackers

1.3 Assess and establish critical vulnerabilities faced by the organisation

1.4 Review strengths and weaknesses of current software in the business and establish cyber security risks

1.5 Establish likelihood of risk occurring, potential consequence of compromise, consequence if risk occurs

1.6 Prioritise identified risks and develop mitigation solutions

2.1 Develop a programme detailing goal, strategy, objectives, tasks to be completed and frequency, tactics to be employed, and tools for execution

2.2 Establish human, technological, equipment and time resource requirements to execute cyber defence plan

2.3 Conduct a capabilities analysis of existing employees to determine human resource requirements to meet goals

2.4 Establish roles and responsibilities of internal team members and external suppliers

2.5 Detail monitoring strategies to measure performance of internal team members and external suppliers and effectiveness of programme in achieving desired goals

2.6 Establish reporting requirements for ongoing communication with senior management and key stakeholders

2.7 Obtain approval from senior management or the client to source resources and execute cyber security activities

3.1 Plan and participate in recruitment activities to select team members for execution of the plan

3.2 Establish training needs and nominate training providers to develop team members

3.3 Define selection criteria for external suppliers of goods and service

3.4 Assess and select preferred suppliers of goods and services

3.5 Allocate tasks and objectives to individual team members and external suppliers

3.6 Collect and review monitoring data and identify and implement corrective action

3.7 Comply with reporting requirements as documented in the defence programme

Evidence of the ability to complete tasks outlined in elements and performance criteria of this unit in the context of the job role, and:

• Effective use of verbal and non verbal communication to extract information from range of people and clearly communicate with senior management, clients, stakeholders and team members
• Language skills to translate technical findings to be understood by business and lay persons
• Develop, manage execute and report on a minimum of one cyber defence programme including demonstration of the ability to:
  • Deploy security solutions across the enterprise network
  • Use data-driven security principles to demonstrate the effectiveness of security controls

The learner must be able to demonstrate essential knowledge required to effectively do the task outlined in elements and performance criteria of this unit, manage the task and manage contingencies in the context of the work role.

This includes knowledge of:

• Legal and ethical boundaries
• Effective use of verbal and nonverbal communication to extract information from range of people and clearly communicate with senior management, clients, stakeholders and team members
• Language skills to translate technical findings to be understood by business and lay persons
• Security controls:
  • Application whitelisting
  • Anti-virus protection
  • Intrusion detection and prevention
  • Restricting administrative privileges
  • Security patching
  • OS hardening
  • Firewall and network segmentation
  • Logging and capturing network traffic
  • Transport layer encryption
  • DNS security
  • Auditing, monitoring and securing local and domain user accounts
  • Securing Active Directory
• Kill Chain and the Adversarial Tactics, Techniques & Common Knowledge Metrix
• Security requirements contained in contracts and activities of third parties (e.g., joint ventures, outsourced providers, customers) to maintain the enterprise’s security baseline

Assessment may be in the form of:

• work samples
• written assignments
• theoretical examination
• observation

Both practical skills and knowledge must be assessed.

Assessor requirements

No specialist vocational competency requirements for Assessors apply to this unit.