LAYER 09 Human Wetware, Policy & GRC

The human, organizational, and operational layer of computing systems. Master curriculum spanning cognitive biases in social engineering, Open-Source Intelligence (OSINT) reconnaissance, FIDO2/Passkey authentication, Zero Trust Architecture (ZTA), international compliance frameworks (NIST, ISO 27001, GDPR), secure software supply chains (SBOMs, SLSA), and enterprise incident response operations (SIEM, SOAR, MITRE ATT&CK).

6 Core Domains
30 Technical Modules
100% Socio-Technical & Governance Ground Truth

9.1 Human Cognition, Psychology & Social Engineering

5 Modules
9.1.1

Cognitive Biases in Security (Authority, Scarcity, Urgency, Social Proof)

BS - Core

Definition: Predictable psychological deviations from rational judgment where threat actors induce acute stress, invoke executive authority, or manufacture artificial deadlines to override analytical deliberation.

Security & Hardware Application: Exploited by adversaries to force employees into authorizing fraudulent wire transfers or bypassing standard technical change control gates.

9.1.2

Phishing, Spear-Phishing & Business Email Compromise (BEC)

BS - Core

Definition: Deceptive electronic communications ranging from mass credential-harvesting lures to meticulously researched spear-phishing campaigns and executive identity spoofing via forged email headers.

Security & Hardware Application: The primary initial access vector in over 80% of enterprise ransomware intrusions, mitigated by strict DMARC enforcement, SPF/DKIM validation, and security awareness simulations.

9.1.3

AI Voice Cloning, Deepfakes, Smishing & Quishing

BS/MS - Core

Definition: Next-generation multi-modal social engineering utilizing generative AI voice synthesis (Vishing), malicious QR codes (Quishing), SMS lures (Smishing), and real-time deepfake video streams.

Security & Hardware Application: Defeating IT help-desk identity verification to perform unauthorized Multi-Factor Authentication (MFA) resets and bypass voice biometric authentication.

9.1.4

Pretexting, Physical Infiltration & Tailgating

BS - Core

Definition: In-person manipulative scenarios (pretexts) where attackers pose as delivery contractors, fire inspectors, or executives, exploiting human politeness to bypass access-badge doors (tailgating).

Security & Hardware Application: Physical red team operations to drop rogue Wi-Fi/LAN implants (Rubber Ducky, LAN Turtle) directly inside internal data centers and server closets.

9.1.5

Insider Threat Dynamics & Behavioral Analytics (UEBA, DLP)

BS/MS - Core

Definition: Security risks originating from trusted insiders, categorized into malicious saboteurs, careless employees bypassing controls, or compromised employee accounts.

Security & Hardware Application: User and Entity Behavior Analytics (UEBA) and Data Loss Prevention (DLP) systems tracking mass database exports, unauthorized USB insertions, and after-hours access.

9.2 Open Source Intelligence (OSINT) & Attack Surface Management

5 Modules
9.2.1

Passive vs. Active OSINT Reconnaissance (SOCMINT, GEOINT, Dark Web)

BS - Core

Definition: Intelligence gathering conducted without directly connecting to target infrastructure (Passive: social media profiling, geolocation analysis, breach database dumps) versus active scanning probes.

Security & Hardware Application: Adversaries build psychographic employee dossiers for spear-phishing; defenders monitor dark web forums for leaked corporate credentials and stealer logs.

9.2.2

Metadata Extraction, Reverse Search & Public Registry Scraping

BS - Core

Definition: Extracting hidden EXIF geospatial tags, PDF author metadata, querying public WHOIS registries, Certificate Transparency logs, and business incorporation databases.

Security & Hardware Application: Public marketing brochures often leak internal Active Directory usernames, software compiler versions, and network file share paths.

9.2.3

Internet-Wide Asset Scanning & Attack Surface Management (Shodan, Censys)

BS - Core

Definition: Automated continuous banner scanning across all IPv4/IPv6 address spaces to map open network ports, exposed ICS/SCADA controllers, development staging servers, and unsecured cloud storage.

Security & Hardware Application: External Attack Surface Management (EASM) discovers forgotten corporate cloud shadow IT assets before threat actors identify them.

9.2.4

Operational Security (OPSEC), Threat Research Tradecraft & Anonymity

BS/MS - Core

Definition: Behavioral discipline, compartmentalization, hardware isolation, and multi-hop routing (Tor, commercial VPNs, burner infrastructure) designed to protect investigator identity during undercover threat research.

Security & Hardware Application: Prevents sophisticated APT threat groups from counter-reconnoitering and de-anonymizing security researchers or corporate incident responders.

9.2.5

Brand Protection, Impersonation Defense & Typosquatting Monitoring

BS/MS - Core

Definition: Automated detection and domain takedown of lookalike domains (Bitsquatting, Homoglyph Unicode spoofing, Typosquatting) and fraudulent corporate social media profiles.

Security & Hardware Application: Protects enterprise customers from landing on deceptive phishing clones designed to steal session tokens and payment information.

9.3 Identity, Access Management (IAM) & Zero Trust Architecture

5 Modules
9.3.1

Authentication Factors & Biometric Inherent Systems

BS - Core

Definition: Verifying identity via Something You Know (Passwords), Something You Have (Hardware tokens), or Something You Are (Biometrics: Fingerprint, FaceID), governed by False Acceptance (FAR) and False Rejection (FRR) rates.

Security & Hardware Application: Single-factor password systems are compromised via automated credential-stuffing; biometric templates must be stored in hardware Secure Enclaves.

9.3.2

FIDO2 / WebAuthn & Phishing-Resistant Hardware Credentials (Passkeys)

BS/MS - Architecture

Definition: Public-key cryptographic authentication standards bound directly to the browser's origin URL and verified via hardware security chips (YubiKeys, TPMs, Secure Enclaves).

Security & Hardware Application: Completely eliminates credential harvesting and Adversary-in-the-Middle (AitM) reverse-proxy phishing attacks (Evilginx) by cryptographically verifying origin binding.

9.3.3

Federated Identity & Single Sign-On (SSO: OAuth 2.0, OpenID Connect, SAML)

BS/MS - Architecture

Definition: Token-based identity protocols delegating authentication to centralized Identity Providers (IdPs: Okta, Entra ID), issuing signed JSON Web Tokens (JWT) or XML SAML assertions.

Security & Hardware Application: Centralizes enterprise access management; JWT signing misconfigurations (`alg: none` or public-key confusion) allow attackers to forge administrative identities.

9.3.4

Zero Trust Architecture (ZTA: NIST SP 800-207 & Continuous Verification)

MS - Architecture

Definition: Enterprise security paradigm operating on "Never Trust, Always Verify," enforcing continuous evaluation of user identity, device compliance posture, geolocation risk, and time of day for every request.

Security & Hardware Application: Replaces broad corporate VPN network perimeters with identity-aware proxies, preventing lateral movement if an attacker breaches an endpoint.

9.3.5

Privileged Access Management (PAM) & Just-In-Time (JIT) Credential Elevation

MS - Advanced

Definition: Enterprise vaults brokering and auto-rotating administrative passwords, enforcing ephemeral Just-In-Time (JIT) privilege elevation and session recording for root operations.

Security & Hardware Application: Eliminates static "Domain Admin" accounts; compromised admin credentials expire automatically within hours, denying persistent access to attackers.

9.4 Governance, Regulatory Compliance & Data Privacy

5 Modules
9.4.1

Enterprise Cybersecurity Frameworks (NIST CSF 2.0, ISO/IEC 27001, CIS)

BS/MS - Core

Definition: Standardized institutional governance taxonomies structuring security into core functions (Govern, Identify, Protect, Detect, Respond, Recover) and prioritized defensive controls (CIS Top 18).

Security & Hardware Application: Provides verifiable cybersecurity maturity baselines required to achieve ISO 27001 certification and pass institutional third-party security audits.

9.4.2

Global Privacy Regulations & Sovereign Mandates (GDPR, CCPA, HIPAA, DORA)

BS/MS - Core

Definition: Legal frameworks mandating consumer data privacy, right to erasure, 72-hour breach notification windows (GDPR), protected health information handling (HIPAA), and financial resilience (DORA).

Security & Hardware Application: Inadequate technical safeguards result in massive regulatory fines (up to 4% of global annual turnover under GDPR) and corporate executive liability.

9.4.3

Payment & Industry Security Standards (PCI-DSS v4.0, SOC 2 Type II, FedRAMP)

BS/MS - Core

Definition: Strict operational standards for securing payment card processing environments (PCI-DSS), independent trust service criteria audits (SOC 2 Type II), and US federal cloud authorizations (FedRAMP).

Security & Hardware Application: Mandatory prerequisites for operating SaaS businesses, processing credit card transactions, and selling enterprise software to government entities.

9.4.4

Cyber Risk Quantification (FAIR Model, Financial Loss Expectancy, Monte Carlo)

MS - Advanced

Definition: Mathematical risk frameworks (Factor Analysis of Information Risk FAIR) utilizing Monte Carlo probability simulations to translate technical vulnerabilities into concrete dollar loss distributions (ALE: Annualized Loss Expectancy).

Security & Hardware Application: Enables CISOs and executive boards to make data-driven budget allocation decisions based on calculated Return on Security Investment (ROSI).

9.4.5

Third-Party Vendor Risk Management (TPRM) & Security Questionnaires

BS/MS - Core

Definition: Due-diligence governance programs continuously evaluating the security posture of third-party vendors, suppliers, and SaaS integrations via standardized questionnaires (SIG, CAIQ) and security rating services.

Security & Hardware Application: Neutralizes indirect supply-chain compromises where adversaries breach small third-party contractors to pivot into primary enterprise networks.

9.5 Threat Modeling, Secure SDLC & Software Supply Chain

5 Modules
9.5.1

Architectural Threat Modeling Methodologies (STRIDE, PASTA, Attack Trees)

BS/MS - Architecture

Definition: Structured engineering methodologies decomposing system architectures to discover flaws early: STRIDE (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege) and risk-centric PASTA.

Security & Hardware Application: Identifies structural design flaws before code is written, drastically reducing the cost of fixing architectural vulnerabilities in production.

9.5.2

Secure Software Development Lifecycle (SSDLC, NIST SSDF, Shift-Left)

BS/MS - Core

Definition: Embedding security gates across all development phases (NIST Secure Software Development Framework SSDF), enforcing secure coding standards, peer code reviews, and threat modeling during design.

Security & Hardware Application: Prevents common software vulnerabilities (OWASP Top 10) from reaching deployment by automating security controls directly in developer IDEs and PR reviews.

9.5.3

Software Supply Chain Security & SBOMs (CycloneDX, SPDX, Sigstore)

BS/MS - Architecture

Definition: Generating verifiable machine-readable Software Bills of Materials (SBOMs) listing all nested dependencies, paired with cryptographic build provenance attestation (SLSA framework, Sigstore/Cosign).

Security & Hardware Application: Rapidly assesses vulnerability exposure during global zero-day supply chain emergencies (e.g., Log4Shell, XZ Utils backdoor) and detects poisoned packages.

9.5.4

Vulnerability Management & Disclosure (CVSS v4.0, EPSS Scoring, Bug Bounties)

BS/MS - Core

Definition: Systematic identification, triage, and patching of software flaws using Common Vulnerability Scoring System (CVSS v4.0), Exploit Prediction Scoring System (EPSS), and managed Bug Bounty programs.

Security & Hardware Application: Prioritizes patching vulnerabilities with high real-world EPSS weaponization probabilities rather than reacting solely to theoretical CVSS scores.

9.5.5

DevSecOps Automation (SAST, DAST, SCA, Secrets Scanning & Container Linting)

BS/MS - Architecture

Definition: Automated CI/CD security pipelines combining Static Application Security Testing (SAST), Dynamic testing (DAST), Software Composition Analysis (SCA), secrets detection (TruffleHog), and container scanning.

Security & Hardware Application: Automatically blocks pull requests containing leaked API keys, vulnerable packages, or misconfigured Dockerfile permissions prior to artifact compilation.

9.6 SecOps, Incident Response & Threat Intelligence

5 Modules
9.6.1

The Cyber Kill Chain & The MITRE ATT&CK Framework Mapping

BS - Core

Definition: Comprehensive tactical intrusion models mapping attacker lifecycle phases (Recon → Weaponization → Delivery → Exploitation → Lateral Movement → C2 → Impact) and adversary Tactics, Techniques, and Procedures (TTPs).

Security & Hardware Application: Enables SOC analysts to map active alerts directly to specific MITRE techniques (e.g., `T1059` Command Interpreter) to predict and intercept an adversary's next move.

9.6.2

Security Operations Center (SOC) Architecture (SIEM, SOAR, EDR/XDR)

BS/MS - Core

Definition: Defensive monitoring ecosystems aggregating gigabytes of event logs (SIEM: Splunk, Elastic), executing automated containment playbooks (SOAR), and analyzing process telemetry on endpoints (EDR: CrowdStrike, SentinelOne).

Security & Hardware Application: Detects anomalous process spawning (e.g., `powershell.exe` spawned by Word macro) and automatically isolates the compromised host from the network within seconds.

9.6.3

The Incident Response Lifecycle & Digital Forensics (NIST SP 800-61, SANS)

BS/MS - Core

Definition: The formal six-phase operational lifecycle for managing enterprise security breaches: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned, backed by forensically sound RAM and disk capture.

Security & Hardware Application: Minimizes financial damage during active ransomware emergencies, preserves evidence for law enforcement, and guarantees clean offline recovery.

9.6.4

Cyber Threat Intelligence (CTI: STIX/TAXII, Diamond Model, IOC vs. TTP)

MS - Advanced

Definition: Collecting, analyzing, and standardizing intelligence on Advanced Persistent Threat (APT) threat groups using structured machine-readable formats (STIX/TAXII) and relational Diamond Models of intrusion analysis.

Security & Hardware Application: Enables proactive perimeter blocking of C2 infrastructure and informs threat hunting teams about specific adversary tooling before campaigns begin.

9.6.5

Red, Blue & Purple Team Operations & Breach and Attack Simulation (BAS)

MS - Advanced

Definition: Adversarial validation exercises where Red Teams emulate real-world APTs, Blue Teams defend and hunt, and Purple Teams collaborate to immediately engineer detection rules for observed gaps.

Security & Hardware Application: Continuously validates that multi-million dollar defensive tooling and human SOC analysts can successfully detect and block real-world cyberattacks.

← Back to 9-Layer Systems Architecture HEXDEF SYSTEMS ARCHITECTURE TAXONOMY