Legacy Haven University

Category: Uncategorized

  • How to Build a PKI Hierarchy from Scratch

    Public Key Infrastructure (PKI) delivers the cryptographic foundation that enforces trust, confidentiality, integrity, and non-repudiation across systems. A properly designed hierarchy isolates risk, scales issuance, and supports Zero Trust principles. Practitioners build these hierarchies to control certificate lifecycles, enforce policy, and contain breaches. Design the Hierarchy First Define clear roles before touching any system. The…

  • Designing Resilient Systems: Zero Trust Architecture (ZTA) Deep Dive

    Veteran practitioners design resilient systems by rejecting implicit trust. Zero Trust Architecture (ZTA) delivers exactly that foundation. It treats every access request as potentially hostile, regardless of origin, and enforces continuous verification. This approach shrinks the attack surface, contains breaches, and sustains operations even under active compromise. ZTA Core Principles Drive Every Decision Architects start…

  • Third-Party Risk: Auditing Your Supply Chain

    Veteran security architects treat third-party dependencies as extensions of their own attack surface. Organizations rely on vendors for cloud services, software components, hardware, and critical operations. Attackers exploit these connections. Effective auditing turns visibility into actionable defense and keeps the supply chain from becoming the weakest link. Define the Core Risks with Precision Supply chain…

  • Lab: Generating & Auditing SBOMs with Syft and Grype

    Master Software Supply Chain Visibility and Vulnerability Management You generate precise Software Bills of Materials and audit them for vulnerabilities. This hands-on lab builds production-grade skills using Syft for SBOM creation and Grype for accurate vulnerability scanning. Security teams rely on this exact workflow to satisfy compliance requirements, secure CI/CD pipelines, and mitigate software supply…

  • Building a Dynamic Risk Register Template

    Security leaders maintain a living risk register that drives enterprise decisions. They capture identified risks, quantify exposure through metrics like ALE, SLE, and ARO, prioritize responses according to organizational risk appetite, and track remediation progress in real time. CompTIA SecurityX (CAS-005) practitioners treat this register as a core governance artifact that aligns security efforts with…

  • Quantitative vs. Qualitative Risk Assessment: Mastering ALE, SLE, and ARO

    Seasoned practitioners balance speed and precision when they assess risk. They choose qualitative methods to rank threats rapidly and quantitative methods to translate uncertainty into financial terms that executives grasp immediately. CompTIA SecurityX (CAS-005) emphasizes both approaches because organizations need them at different stages of the risk management lifecycle. Qualitative Risk Assessment Delivers Speed and…

  • Tutorial: Auditing AI Guardrails and Permissions

    Tutorial: Auditing AI Guardrails and Permissions using the AWS ASF 1. Introduction: The AWS AI Security Framework (ASF) The AWS Artificial Intelligence Security Framework (ASF) establishes a structured methodology for protecting machine learning workloads, aligning directly with enterprise security architectures and CAS-005 objectives. Traditional IT audits evaluate deterministic systems with predictable inputs and outputs. Generative…

  • The New Security Challenge: AI Adoption Risks (Objective 1.5)

    Veteran security architects watch organizations rush generative AI into production environments and recognize the pattern immediately: speed outpaces governance. Enterprises deploy large language models for code generation, threat intelligence summarization, and customer interaction, yet they often overlook how these systems fundamentally alter the attack surface. Objective 1.5 of the CAS-005 demands that practitioners master these…

  • Senior Interview: Pitching a Risk Register to a CFO

    Senior security leaders translate technical risks into financial exposure that executives understand. They build and present risk registers that drive budget decisions and strategic alignment. A well-crafted risk register connects threats to business outcomes, quantifies potential losses, and outlines cost-effective controls. Executives respect practitioners who deliver this clarity during high-stakes interviews or boardroom discussions. Build…

  • Threat Modeling for Architects: STRIDE vs. ATT&CK

    Architects who master threat modeling transform abstract risks into concrete defenses that withstand real attacks. They select frameworks that match their design phase and operational needs. STRIDE and MITRE ATT&CK deliver distinct yet complementary power. STRIDE drives early design security. ATT&CK sharpens detection and response against live adversaries. STRIDE: Categorize Threats During Design Architects apply…