ECF Cybersecurity (Core) study materials
ECF Cybersecurity (Core) study resources

ECF Cybersecurity (Core) case studies

ECF Cybersecurity (Core) · Put your knowledge to work in context.

The ECF Cybersecurity (Core) is an entry-to-intermediate level credential for people who want to demonstrate practical, cross-cutting security competence rather than deep specialization in a single tool or vendor stack. It suits career changers entering IT or security, junior analysts and administrators, and non-security technologists such as developers or help-desk staff who need to reason about risk, controls, and incidents in their daily work. The ECF Cybersecurity (Core) case studies are 5 cases and about 5,229 words.

1

The Escrow Platform: ALE, Appetite and a Competing Control

Northbridge Title & Escrow is a 420-employee title insurance agency running a single on-premises data centre. Its risk register holds 31 entries, all scored on a 5×5 heat map.

962 words, about 5 min
2

Flat Plant: OT Segmentation Versus a New Perimeter Firewall

Halden Precision operates a 640-employee automotive parts plant. Its 1,100 IT endpoints and 24 production PLCs sit behind a single firewall that permits any-to-any traffic between the front office, the MES servers and the line control network.

1,058 words, about 5 min
3

Orphaned Accounts and a 24-Hour Contractual Clock

Cygnus Health Analytics processes claims for three regional health insurers with 1,150 employees and 400 contractors. Single sign-on through an identity provider covers 46 of its 60 applications; the remaining 14, including the claims adjudication console, use local accounts with passwords that never expire.

1,083 words, about 5 min
4

Eleven Days to Expiry: TLS, Kiosks and Tape Keys

Fairhaven Mutual is a 380-employee credit union. Its member portal terminates TLS on a load balancer whose profile still offers TLS 1.0 and 1.1, RSA key exchange and CBC cipher suites, kept "for compatibility".

1,082 words, about 5 min
5

03:12 Exfiltration Alert on a Finance Workstation

At 03:12 on a Tuesday, Redwood Logistics' SIEM raises a single alert: 41 GB outbound from FIN-WS-114, a finance analyst's workstation, to an unfamiliar IP address over 443. The analyst is on leave until Monday.

1,044 words, about 5 min