CC case studies
CC · Put your knowledge to work in context.
Certified in Cybersecurity (CC) is ISC2's entry-level cybersecurity certification. ISC2 describes it as proving you have the foundational knowledge, skills and abilities for an entry- or junior-level cybersecurity role, and it requires no work experience - only the passion and drive to enter the field. The CC case studies are 5 cases and about 4,377 words.
1Northwind Freight: Choosing a Control Against a Stated Risk Appetite
Northwind Freight (180 staff, 60M revenue) runs a customer portal backed by a CRM whose data is valued at 2.4M. The risk register estimates a single successful breach would cost 600,000 in response, regulatory penalty, and churn, and that such a breach currently occurs roughly 0.4 times per year.
881 words, about 4 min2Helio Health: A 12-Month Encryption Exception With No CISO
Helio Health Analytics (2,000 staff) processes ePHI for 40 hospital clients under business associate agreements. Policy SEC-07 requires AES-256 encryption at rest with customer-managed keys for any system holding ePHI.
857 words, about 4 min3Caldera Systems: Sequencing Identity Investment After an Acquisition
After acquiring a 300-person rival, Caldera Systems has 1,200 employees across two identity providers. A post-merger review finds: 340 security groups in the legacy tenant, of which 210 grant no effective permission; 62% of accounts reach Domain Admin through nested group membership; 41 enabled accounts belong to leavers; and a terminated contractor kept VPN access for 11 days because contractor records live in the procurement system rather than the HR feed, which syncs to the directory once nightly.
892 words, about 4 min4Retail Platform: Inspection Cost, Latency, and a Peering Mesh
A retail platform runs 40 AWS accounts, each with 3 VPCs in 3 availability zones. Connectivity has grown into a peering mesh between VPCs.
847 words, about 4 min5Saturday Ransomware: Restore Now or Scope First?
At 02:14 on a Saturday, EDR flags a finance workstation for LSASS credential access, then SMB connections to two file servers, then an attempt to run vssadmin delete shadows . The SOC triage runbook auto-closes LSASS alerts tagged with a well-known backup agent's process name, and an analyst closed this one at 02:20 under that rule without checking the parent process.
900 words, about 5 min