Course 3 : Technical implementation and practical cases

1. Introduction and Course Objectives

1.1. Context:

Importance of technical implementation for compliance with NIS2 and CYfun. Specific challenges related to technical implementation.

1.2. Objectives:

Provide practical tools and methodologies for successful implementation & Test organizational resilience through concrete exercises.

2. Technical Planning of Implementation

2.1. Current Situation Assessment:

o Critical assets analysis: Identify priority systems, data, and infrastructures.

o Risk assessment: Example tools: vulnerability scanning (e.g., Nessus) - Risk assessment model based on NIS2 criteria.

2.2. Choosing Tools and Technologies:

o Access management solutions (IAM) - Backup and disaster recovery tools - Threat detection solutions (SIEM, EDR).

Example: Presentation of a fictitious case choosing a SIEM tool for an SME.

2.3. Detailed Planning with Checklists:

o Developing an implementation plan:

• Key steps: prioritization, required resources, timelines.
• Checklist examples to ensure compliance with CYfun technical requirements.

Practical example: Group discussion to complete a checklist based on a scenario.

3. Incident Management and Response

3.1. Detection and Response Procedures:

o Establishing protocols:

• Detection: setting up alerts (via SIEM).
• Response: example of a structured ransomware response plan.

o Coordination with Authorities: Incident notification process in Belgium via Safeonweb@Work.

3.2. Incident Simulation Exercises:

o Objectives of simulations: Test responsiveness & Identify weaknesses in existing procedures.

o Practical scenario: Exercise based on a targeted phishing attack (simulation) - Post-exercise analysis: strengths and areas for improvement.

4. Feedback and Adjustments

 4.1. Post-Implementation Analysis:

o Internal audit: evaluation of implemented measures.

o Identification of persistent gaps.

4.2. Continuous Improvement:

o Feedback process (RETEX):

• Organizing internal workshops to adjust processes.
• Using incident reports to prioritize future actions.

Example: Discussion of a fictitious RETEX after a simulated attack.

4.3. Maintaining Compliance:

o Planning regular audits & Updating documentation based on new requirements or threats.

5. Conclusion and Q&A

5.1. Summary of Key Points:

o Importance of initial assessment & Role of exercises and adjustments in continuous improvement.

5.2. Interactive Discussion:

o Participant questions & Sharing experiences and best practices.