search menu icon-carat-right cmu-wordmark

Managing Enterprise Information Security: A Practical Approach for Achieving Defense-in-Depth

This three-day course begins with a brief review of the conceptual foundations of information security. Next, students will be introduced to the CERT Defense-in-Depth Framework: eight operationally focused and interdependent management components which will be synergistically applied to a fictitious organization's Information Technology (IT) enterprise (see "Topics" below). Through lectures, demonstrations, scenario-based exercises, small group activities, and open discussions, students will learn high-level best practices for effectively integrating each of these eight components into all aspects of IT operations. Further, the course scenario is used extensively to reinforce these best practices with technical information security implementations.

This course is designed for individuals charged with implementing information security throughout the IT enterprise. Therefore, this course is an ideal pursuit for IT and Security managers, and/or system administrators and IT security personnel who would like to step up to the management level.


Technical staff members who manage or support networked information systems and have

  • two years of practical experience with networked systems or equivalent training/education
  • some degree of specific familiarity with the ISO/OSI 7- layered reference model as well as Ethernet, TCP/IP, and major network operating systems such as Windows NT/2000/ XP and Unix


Successful completion of this course will enable participants to

  • describe the CERT Defense-in-Depth framework and its components
  • holistically examine IT operations for IA threats and vulnerabilities
  • apply the framework to improve the overall security posture of IT operations


  • Foundations of Information Assurance
  • The CERT Defense-in-Depth Framework
  • Components of Defense-in-Depth
    • Compliance Management
    • Risk Management
    • Identity Management
    • Authorization Management
    • Accountability Management
    • Availability Management
    • Configuration Management
    • Incident Management


Participants will receive a course notebook and a downloadable copy of course materials.


This course has no prerequisites.


This three-day course meets at the following times:

Days 1 & 2: 9:00 a.m.-5:00 p.m.
Day 3: 9:00 a.m. - 2:30 p.m.

This course may be offered by special arrangement at customer sites. For details, please email or telephone at +1 412-268-1817.

Course Questions?

Phone: 412-268-7388
FAX: 412-268-7401

Training courses provided by the SEI are not academic courses for academic credit toward a degree. Any certificates provided are evidence of the completion of the courses and are not official academic credentials. For more information about SEI training courses, see Registration Terms and Conditions and Confidentiality of Course Records.