CCIS case studies
CCIS · Put your knowledge to work in context.
The Certified in Cybersecurity Specialist (CCIS) is a vendor-neutral credential aimed at practitioners who want to demonstrate working competence across the operational side of security: governance, network defense, identity, endpoints, cryptography, threat handling, risk, and day-to-day monitoring including cloud. It suits security analysts, administrators, and IT generalists moving into a dedicated security role, as well as early-career professionals who already hold foundational knowledge and want a structured, breadth-first validation of it. The CCIS case studies are 5 cases and about 4,161 words.
1The Exception That Outlives Its Deadline
Northlane Components is a 4,200-employee manufacturer that acquired a smaller German supplier nine months ago. The supplier's ERP vendor insists on inbound SFTP over TLS 1.0/1.1 using a shared account with no MFA, which the acquired company's finance team uses to exchange payment files worth about €2.1M per quarter.
864 words, about 4 min2MFA Fatigue and the Token That Survived the Reset
Meridian Health Partners runs a hybrid identity estate: on-premises Active Directory synced to Entra ID, 2,400 staff, password-only VPN for contractors, and push-based MFA for everyone else. The service desk resets roughly 300 passwords a week and verifies callers by asking for their employee ID and manager name.
820 words, about 4 min3Twelve Beacons and Four Hundred Servers
Arclight Logistics has 3,000 Windows workstations, 420 servers, and a 180-device OT segment running an automated parcel sorter. EDR was bought four months ago and covers 75% of endpoints - the gap is mostly Windows Server 2012 R2 (about 60% of the server fleet) and everything in OT.
855 words, about 4 min4Ransomware at a Regional Hospital, Hour Six
At 02:10 on a Sunday, a 220-bed regional hospital loses its electronic health record, imaging, and laboratory systems. Four of roughly 900 servers show encrypted files with a .locked extension, and the backup server - domain-joined, online, and using the same privileged account for nightly jobs - is encrypted too.
804 words, about 4 min5The Bucket, the Log Gap, and the Board's Question
Yewstack is a 500-person SaaS company running 42 AWS accounts under an organization formed by two acquisitions. CloudTrail is enabled in 30 accounts; GuardDuty in 12; S3 Block Public Access is enforced at the root but two acquired accounts were never enrolled.
818 words, about 4 min