Postgraduate courses

Postgraduate courses are held in partnership with the Federal State-Funded Educational Institution of Higher Education «Siberian State University of Geosystems and Technologies». The institute offers the following training courses:

Today the postgraduate courses are available only for enterprises and organized groups. We apologize, but personal enrollment is suspended due to the scientists’ occupation

1. Practical Infrastructure Protection according to ISO/IEC 27001 and ISO/IEC 27002

A technical course on the implementation and maintenance of modern security controls within corporate IT infrastructure. The program covers asset inventory, developing a Role-Based Access Control (RBAC) model, applying the Principle of Least Privilege (PoLP) and Zero Trust, protecting administrative accounts, Multi-Factor Authentication (MFA), PAM/PIM approaches for privileged access management, ZTNA for secure remote connectivity, and account lifecycle management. A dedicated technical module focuses on network segmentation and microsegmentation, firewall configuration, secure configuration of servers and workstations, operating system hardening, patch management, vulnerability management, EDR/XDR endpoint monitoring, backup and recovery, security event logging, centralized log collection, baseline SIEM use case configuration, suspicious activity monitoring, and incident response. Additionally, the course addresses the preparation of technical regulations, access control matrices, vulnerability reports, audit logs, and the compilation of evidentiary artifacts for internal or external audits. The program is designed in strict alignment with the requirements and guidelines of ISO/IEC 27001 and ISO/IEC 27002.

Course Topics:
- Overview of ISO/IEC 27001 and ISO/IEC 27002: Requirements structure, security controls, and their alignment with technical infrastructure.
- Asset Inventory and Classification: System classification and identification of critical services.
- Access Management: RBAC, MFA, account lifecycle, and user rights control.
- Privileged Access Protection: PAM/PIM, administrative accounts, and session monitoring.
- Zero Trust and ZTNA: Modern approaches to secure access within the corporate network.
- Network Security: Network segmentation and microsegmentation, firewall configuration, and network policies.
- Secure Configuration of Servers and Workstations: Windows/Linux OS hardening and baseline configurations.
- Vulnerability Management: Scanning, prioritization, remediation, and remediation verification.
- Monitoring and Detection: EDR/XDR, centralized log collection, and baseline SIEM monitoring use cases.
- Business Continuity: Backup, recovery, and infrastructure resilience testing.
- Incident Response: Triage, escalation, event logging, and initial investigation.
- Audit Preparation: Preparing the technical evidence base (artifacts) for an ISO/IEC 27001 audit.

2. Cloud Infrastructure Security according to ISO/IEC 27017 and ISO/IEC 27018

A technical course on securing cloud and hybrid infrastructures, focusing on the practical security of IaaS, PaaS, SaaS, container platforms, and managed services. The program covers the Shared Responsibility Model between the customer and the cloud service provider (CSP), building a secure cloud architecture, designing a landing zone, configuring tenant isolation, organizing network segmentation, private endpoints, security groups, firewall rules, bastion host access, VPN/Direct Connect channels, and secure administrative perimeters. A dedicated module focuses on Identity and Access Management (IAM) and configurations in the cloud: setting up IAM, role-based models, service accounts, workload identity, federated access, MFA, the Principle of Least Privilege (PoLP), and monitoring privileged activities via PAM/PIM approaches. The course examines cloud hardening, secure configuration of virtual machines, managed databases, Kubernetes clusters, container registries, serverless functions, API Gateways, object storage, backup services, and logging systems. Special attention is given to data protection in cloud environments: data encryption at rest and in transit, management of keys, secrets, and certificates, KMS/HSM, secrets management, controlling public access to storage, protection of Personally Identifiable Information (PII) in the cloud, implementation of DLP/DCAP/DSPM approaches, anomaly monitoring, and the detection of insecure configurations. The course also explores CSPM, CWPP, CNAPP, Cloud SIEM, cloud-native logging, audit trails, vulnerability management, image scanning, runtime protection, threat detection, cloud incident response, and the compilation of evidentiary artifacts for audits. The program is designed in strict alignment with the requirements and guidelines of ISO/IEC 27017 and ISO/IEC 27018 regarding cloud service security and PII protection in cloud environments.

Course Topics:
- ISO/IEC 27017 and ISO/IEC 27018: Security requirements for cloud services and PII protection.
- Shared Responsibility Model: Delineation of responsibilities between the customer, the provider, and third-party contractors.
- Cloud Architecture: Designing a secure cloud landing zone and baseline cloud architecture.
- Network Security: Tenant isolation, network perimeters, private endpoints, security groups, and firewall rules.
- Secure Administrative Access: Bastion hosts, VPN, Direct Connect, and jump servers.
- Cloud IAM: Roles, service accounts, workload identity, federated access, and MFA.
- Privileged Access: PAM/PIM for cloud environments and oversight of privileged operations.
- Hardening Cloud Resources: Secure configuration of virtual machines, managed databases, object storage, and API Gateways.
- Modern Workload Security: Securing Kubernetes, container registries, serverless functions, and managed services.
- Cryptographic Management: Key and secret management, KMS, HSM, secrets management, and certificates.
- Posture & Workload Protection: CSPM, CWPP, and CNAPP for identifying insecure configurations and controlling the cloud attack surface.
- Cloud Monitoring: Cloud SIEM, audit trails, cloud-native logging, and suspicious activity monitoring.
- Cloud Data Protection: DLP, DCAP, DSPM, public access control, and data encryption.
- Incident Response & Compliance: Cloud incident response and preparation of audit evidence.

3. Practical Personal Data Protection: GDPR, ISO/IEC 27701, and Other Regulatory Frameworks

A practical course on the design and technical implementation of personal data protection processes. The program covers data flow inventory, maintaining Records of Processing Activities (RoPA), personal data classification, defining the roles of operators, controllers, processors, and sub-processors, configuring lawful bases for processing, consent management via Consent Management Platforms (CMP), fulfilling Data Subject Access Requests (DSARs), and conducting Data Protection Impact Assessments (DPIA) and privacy risk assessments. The technical module includes data minimization and masking, pseudonymization and anonymization, encryption at rest and in transit, access control at the application, database, and file storage levels, logging of operations involving personal data, data export controls, DLP and DCAP mechanisms, data retention management, secure data erasure, and the application of Data Security Posture Management (DSPM) approaches to identify sensitive data within the infrastructure. Additionally, the course addresses cross-border data transfers, vendor/processor oversight, preparation of evidence packs for regulatory inspections, analysis of common non-conformities, and the implementation of Privacy by Design and Privacy by Default principles in products and business processes. The program is designed in alignment with the requirements and guidelines of the GDPR, ISO/IEC 27701, and other applicable personal data protection laws.

Course Topics:
- Regulatory Landscape: Key requirements of the GDPR, ISO/IEC 27701, and other regulatory frameworks: roles, duties, and areas of responsibility.
- Data Mapping: Personal data inventory: sources, systems, data flows, and transfer points.
- Documentation: Records of Processing Activities (RoPA) and personal data classification.
- Lawfulness of Processing: Lawful bases for processing, user consent, and consent withdrawal management.
- Data Subject Rights: Fulfilling DSARs: access, rectification, erasure (right to be forgotten), and restriction of processing.
- Risk Management: DPIA and privacy risk assessments: methodology, criteria, and documentation of results.
- Engineering Privacy: Privacy by Design and Privacy by Default in product and business process development.
- Data Protection Techniques: Data minimization, masking, pseudonymization, and anonymization.
- Technical Controls: Encryption, access control, and logging of personal data processing activities.
- Data Discovery & Control: DLP, DCAP, and DSPM: discovery, classification, and control of sensitive data.
- Data Lifecycle: Retention management, archiving, and secure data erasure.
- Third-Party Risk: Cross-border data transfers and vendor/processor oversight.
- Audit Preparation: Compiling evidence materials for regulatory inspections or internal audits.
- Remediation: Common non-conformities and practical remediation scenarios.

4. AI Systems and AI Agents Security according to ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM Applications, and OWASP Agentic AI Threats and Mitigations

A technical course on securing artificial intelligence systems, LLM applications, and agentic solutions across the entire lifecycle: from model selection and data preparation to corporate system integration, operation, and monitoring. The program covers AI risk management, use case classification, control over training and fine-tuning data, protection against sensitive data leaks, prompt injection, prompt leaking, model abuse, data poisoning, insecure output handling, and insecure integration with external services. A dedicated technical module focuses on the security of AI agents: restricting agent permissions and scope of action, controlling connected tools, APIs, and external commands, sandboxing, human-in-the-loop for critical operations, access control to corporate systems, protection of agent memory, context management, logging of agent actions, monitoring call chains (execution traces), and preventing unauthorized command execution. The course also explores guardrails, policy enforcement, AI system red teaming, resilience testing against adversarial prompts, AI service provider oversight, and the preparation of evidentiary artifacts for internal or external audits. The program is designed in alignment with the requirements and guidelines of ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM Applications, and OWASP Agentic AI Threats and Mitigations.

Course Topics:
- Frameworks & Standards: ISO/IEC 42001, NIST AI RMF, and OWASP approaches to AI security management.
- AI Lifecycle Security: Model selection, data preparation, deployment, operation, and monitoring.
- Risk Assessment: Classification of AI use cases and evaluation of risks to the business, data, and users.
- Training Data Security: Safeguarding training and fine-tuning data against data poisoning, leaks, and ensuring source control.
- LLM Application Security: Defending against prompt injection, prompt leaking, insecure output handling, and model abuse.
- Secure Integration: Safe integration of LLMs with APIs, databases, internal systems, and external services.
- Guardrails & Policy Enforcement: Restricting undesirable responses, model actions, and external tool calls.
- AI Agent Security: Managing agent permissions, scope of action, connected tools, APIs, plugins, and external commands.
- MCP Security & Hardening: Secure configuration of the Model Context Protocol (MCP), resource access control, restricting MCP server permissions, connector isolation, input/output validation, and management of tokens, secrets, and access rights.
- Agent Tool Hardening: Allowlists/denylists for available tools, read/write access separation, restriction of hazardous operations, control over shell/API/database/file-system actions, protection against tool poisoning, and prevention of unauthorized command execution.
- Critical Operations: Sandboxing, human-in-the-loop, and approval workflows for high-risk agent actions (e.g., sending emails, modifying data, executing commands, handling payments, and interacting with CRM/ERP and internal systems).
- Context & Memory Protection: Securing agent memory, context windows, interaction history, and connected data sources.
- Observability: Logging, tracing, and monitoring of AI agent actions: tool calls, MCP requests, reasoning chains, and access to data and external systems.
- Adversarial Testing: Red teaming AI systems and testing resilience against malicious prompts, including indirect prompt injection via documents, web pages, knowledge bases, and connected sources.
- Third-Party Risk Management: Oversight of AI service providers, external models, MCP servers, API connectors, and third-party tools.
- Audit Preparation: Compiling evidentiary artifacts for internal or external AI system audits, including architectural diagrams, access matrices, tool usage policies, agent action logs, test results, and risk reports.

5. Payment Infrastructure Security according to PCI DSS and Central Bank Requirements

A technical course on securing payment infrastructure, payment data processing systems, and services related to the acquiring, transmission, storage, and processing of card data and financial transactions. The program covers PCI DSS requirements for the Cardholder Data Environment (CDE), CDE segmentation, PAN (Primary Account Number) protection, and the configuration of network perimeters, firewalls, WAF, and IDS/IPS. It also explores access management, MFA, security event logging, vulnerability management, and regular scanning and penetration testing. A dedicated technical module focuses on Central Bank requirements for information security in financial institutions. This includes operational risk management, securing remote banking channels, user and administrator activity monitoring, incident monitoring, anti-fraud mechanisms, payment API security, cryptographic key management, ensuring high availability, and compiling evidentiary artifacts for internal or external audits. The program is designed in strict alignment with PCI DSS requirements and guidelines, as well as the regulatory and methodological documents of the Central Bank regarding information security and cyber resilience in the financial sector.

Course Topics:
- PCI DSS and Central Bank Requirements: Approaches to securing payment infrastructure, payment data, and financial services.
- Payment Architecture and the CDE: Defining the card data processing environment, payment perimeter boundaries, PAN data flows, and critical components.
- CDE Segmentation: Network zones, firewall rules, VLANs, microsegmentation, DMZs, and restricting access to the payment perimeter.
- PAN and Sensitive Payment Data Protection: Masking, tokenization, encryption, storage control, and preventing insecure data transmission.
- Secure Configuration of Payment Systems: Hardening servers, POS/e-commerce components, payment gateways, API Gateways, and administrative interfaces.
- Access Management in Payment Infrastructure: RBAC, MFA, PAM/PIM, the Principle of Least Privilege (PoLP), and privileged operation control.
- Cryptographic Protection and Key Management: HSM, KMS, TLS, certificates, key rotation, and access control to cryptographic materials.
- Payment API Security: API Security, OAuth2/OIDC, mTLS, rate limiting, request signing, replay attack protection, and integration control.
- WAF, IDS/IPS, and Perimeter Protection: Traffic filtering, attack detection, and securing e-commerce platforms and public payment services.
- Vulnerability Management: ASV (Approved Scanning Vendor) scanning, internal assessments, vulnerability prioritization, patch management, and remediation verification.
- Penetration Testing and Security Validation: Testing segmentation, payment APIs, web applications, infrastructure, and critical attack scenarios.
- Logging and Monitoring of Payment Operations: Audit logs, SIEM use cases, event correlation, administrative action monitoring, and anomaly detection.
- Anti-Fraud and Transaction Monitoring: Suspicious transaction detection, risk scoring, velocity checks, device fingerprinting, and behavioral analytics.
- Remote Banking Security: Client session control, securing remote banking channels, transaction confirmation, and Account Takeover (ATO) prevention.
- Incident Response for Payment Infrastructure: Triage, investigation, and coordination with acquiring banks, payment brands, and regulators.
- Business Continuity and Resilience: Redundancy, backup/restore, Disaster Recovery (DR), RTO/RPO metrics, and recovery testing.
- Third-Party Risk Management (TPRM): Oversight of processing centers, payment aggregators, cloud providers, contractors, and service organizations.
- Audit Evidence Preparation: Compiling CDE diagrams, access matrices, firewall rules, ASV/PT reports, SIEM logs, cryptographic key policies, and segmentation validation results.

All programs are designed in alignment with current international standards and regulatory requirements in the field of information security.

Leave a software development request

Apply for courses