Cyber CapstoneTM
Defense by design simulations for real-world cybersecurity practice.
You will think like the attacker, build like an engineer, and prove your work.
Join architects and engineers worldwide shaping the future of cybersecurity through technical concepts, models, and our Defensible 10 Standards.
Cyber Capstones in the Mission Pack Model
ISAUnited Cyber Capstones (ICC) are structured simulation assignments delivered within the Cyber Academy's Learning Management System (LMS). Each Cyber Capstone assigns a defined cyber problem, requires participants to build a Tactical Battle Map, and evaluates the architecture, engineering, Security by Design, or Red Team Engineering decisions they produce.
Cyber Capstones are completed inside the LMS. Participants use ISAUnited’s Blue Team and Red Team resources to support their work, including:
-
Intrusion Vault: threat actors, threat vectors, and threat tools that help define how compromise may progress.
-
Defense Toolbox: Defensible 10 Standards and Defensible Engineering Catalog components used to design and justify the defense.
Each Cyber Capstone is designed to evaluate practical decision making, architecture level reasoning, threat mapping, defensible design, and the ability to produce evidence that withstands review.
Cyber Capstone Samples
Cyber Capstones focused on architecture and engineering trusted systems, identity paths, insider risk, and compromised trust relationships.
The Broken Trust Mission Pack domain challenges participants to study how compromise can move through systems, identities, applications, and integrations that were assumed to be safe. These Cyber Capstones emphasize trust boundaries, identity misuse, partner exposure, and defensible monitoring.
ICC-ARC-01: Cloud Landing Zone and New SaaS
Design a defensible architecture for a new SaaS environment with tenant separation, partner access, and identity risk.
ICC-ARC-02: Partner Integration and Trust Boundary Exposure
Map trusted connections, application programming interface exposure, and cross organization access paths that could expand compromise.
ICC-ENG-01: Identity Federation and Token Misuse Risk
Engineer controls that reduce identity abuse, token misuse, and unauthorized movement through trusted access paths.
Cyber Capstone Samples
Cyber Capstones focused on Security by Design before deployment across systems, applications, and infrastructure.
The Launch Shield Mission Pack domain focuses on planning, architecture, engineering, and design decisions before production deployment. These Cyber Capstones evaluate how participants identify exposure early, define requirements, place safeguards, and prove readiness before launch.
ICC-SbD-01: Product Launch Security Readiness
Apply Security by Design to a new product launch before production release.
ICC-SbD-02: Application Deployment and Exposure Review
Identify exposure early and define safeguards before a new application moves into production.
ICC-SbD-03: Industrial Platform Launch and Safety Aligned Security
Apply Security by Design to a connected industrial or operational environment where safety, resilience, and access control must be proven before deployment.
Cyber Capstone Samples
Cyber Capstones focused on Red Team Engineering, controlled adversarial practice, and governed exercise conditions.
The Red Recon Mission Pack domain introduces disciplined red team engineering through an authorized scope, reconnaissance logic, threat mapping, and defensible reporting. These Cyber Capstones help participants study adversary behavior while connecting Red Team activity to Blue Team readiness and to the outcomes of governed exercises.
ICC-RTE-01: Authority, Scope, and Mission Brief
Define lawful authority, boundaries, objectives, and rules of engagement for a controlled red team exercise.
ICC-RTE-02: Threat Profile Selection and Vector Mapping
Select the threat profile and map likely entry paths, exposure conditions, and adversary movement.
ICC-RTE-03: Architecture Exposure and Detection Objectives
Connect red team activity to architecture exposure, blue team detection goals, and defensible reporting.