CSPI case studies
CSPI · Put your knowledge to work in context.
CSPI is a professional certification in security practice, and this page is an independent study companion for candidates preparing for it. The credential is aimed at practitioners who need to combine day-to-day security work with the risk, governance and engineering judgement that surrounds it: analysts moving into broader responsibilities, engineers who increasingly own control decisions, and managers who must defend those decisions to auditors, clients and executives. The CSPI case studies are 5 cases and about 4,151 words.
1The Patch That Costs More Than the Breach
Northbridge Health Administrators processes 3,400 claims a day on a claims engine running Windows Server 2012 R2. The vendor has declared end of support and will not issue fixes; migration is quoted at 1.9M over 18 months.
850 words, about 4 min2The Founder's Emergency Changes
Vantage Learn is a 220-person Series B education SaaS company. Six weeks into your first SOC 2 Type II audit, the auditor's sample shows 40 of 60 production changes had no documented approval, and 31 of those were "emergency" changes made by the CEO - who is also the founder, keeps production database credentials in a saved browser session, and has MFA disabled on that account because it "slows incident response." The CEO signs the audit engagement letter and controls your budget.
827 words, about 4 min3The Flat Network That Cannot Be Split
Meridian Fabrication runs four plants on a flat /16 carrying both corporate IT and plant-floor traffic. Last month a contractor laptop with commodity malware was plugged into a floor switch and reached the corporate print server in nine minutes; nothing else happened only because the malware was untargeted.
765 words, about 4 min4Contain or Eradicate Under Uncertainty
At 02:10 on a Tuesday, ransomware is detected on 2 of roughly 400 servers. The encryptor is slow and appears to be driven by a stolen domain administrator account that also runs the nightly backup service.
921 words, about 5 min5The Finding You Were Asked to Bury
You are a senior penetration tester. On an authorized test of a patient portal you found that the API accepts any record ID and returns the full record to any logged-in user.
788 words, about 4 min