Day 1: Cyber Threat Landscape & Defensive Strategies Training Outlines 

Module 1: Introduction to Cyber Threats 

• Types of threats: malware, phishing, ransomware, insider threats 

• Global vs. regional threat trends (ASEAN focus) 

• Real-world case studies: breaches and lessons learned 

Module 2: Threat Actors & Attack Vectors 

• Nation-state, hacktivist, cybercriminal profiles 

• Social engineering, supply chain compromise, cloud vulnerabilities 

• MITRE ATT&CK framework overview 

Module 3: Defensive Architecture & Response 

• Endpoint protection, SIEM, EDR, and threat intelligence 

• Incident response lifecycle and playbooks 

• Hands-on: Simulated phishing analysis or log review exercise 

Module 4: Cybersecurity Governance 

• Roles and responsibilities across departments 

• Risk-based approach to security controls 

• Mapping threats to ISO/IEC 27001 Annex A controls 

Day 2: ISO/IEC 27001 Policy Framework & Implementation 

Module 5: ISO/IEC 27001 Overview 

• Purpose and scope of an ISMS 

• Key clauses: Context, Leadership, Planning, Support 

• ISO 27001:2022 updates and implications 

Module 6: Policy Development & Documentation 

• Writing effective security policies (access control, data classification, etc.) 

• Policy lifecycle: creation, approval, review, retirement 

• Hands-on: Drafting a sample Acceptable Use Policy 

Module 7: Risk Assessment & Treatment 

• Identifying assets, threats, vulnerabilities 

• Risk matrix and treatment plans 

• Mapping to ISO 27005 methodology 

Module 8: Audit, Compliance & Continuous Improvement 

• Internal audit planning and execution 

• Nonconformity handling and corrective actions 

• Preparing for certification: Malaysian regulatory alignment (e.g., PDPA, MyCC) 

Training Approach/Methodology 

• Structured modules with real-world case studies and regional relevance 

• Interactive labs, group exercises, and policy drafting sessions 

• Tools and templates you can take back and apply immediately 

• Understand current and emerging cyber threats, especially in ASEAN contexts 

• Map threat vectors to ISO/IEC 27001 controls and governance structures 

• Develop and evaluate security policies aligned with ISO standards 

• Apply practical tools for risk assessment, incident response, and audit readiness