An enterprise security-awareness and control-design case study for Meridian Shield Assurance (MSA), a fictional operating subsidiary of Aegis Quantum Trust, focused on human factors, policy governance, continuous monitoring, insider-risk reduction, and executive communication.
The project placed me in the role of CISO for Meridian Shield Assurance (MSA), a fictional Aegis Quantum Trust subsidiary with a low-maturity security environment where technical weaknesses, human behavior, and organizational practices were reinforcing one another. The objective was to design a security-awareness program that could improve posture without treating every failure as an employee problem.
MSA’s posture, as an operating subsidiary within Aegis Quantum Trust, was low and reactive. The environment lacked visibility, consistent vulnerability review, formal change control, and sufficient data-protection practices.
The design combined technical and organizational controls rather than treating awareness as a once-a-year training event.
| Control Domain | What Was Designed | Evidence |
|---|---|---|
| Security Awareness | Onboarding + annual training, phishing simulations, role-specific learning | Training records, simulation results, assessments |
| Change Management | Approval, testing, rollback planning, post-implementation validation | Change records, approvals, test results |
| Monitoring | Centralized logging, IDS/IPS, alert tuning, documented escalation | SIEM configuration, logs, tuning records, tickets |
| Data Protection | Encryption, integrity validation, media controls, classified data flows | Encryption reports, flow diagrams, exceptions |
| Identity + Insider Risk | Least privilege, access reviews, separation of duties, mandatory leave | Access matrices, reviews, revocation records |
| Vulnerability Management | Quarterly assessment, monthly review, remediation and rescanning | Scan reports, remediation tickets, retest evidence |
A control is not finished when the policy is written. The organization has to be able to show that the control operated, was reviewed, and was improved when it failed.
One of the strongest lessons from the project was that human error is not solved by telling people to “be more careful.” The control environment has to account for how work is actually performed.
The portfolio includes both detailed governance deliverables and the executive communication layer.
Integrated security posture, human-factor analysis, organizational risk, control recommendations, monitoring, and communication.
Open Word artifactTen policies mapped to identified gaps and supported by evidence requirements.
Open artifactGap analysis, policy design, control evidence, governance, risk-based review frequency.
Awareness, social engineering, fatigue, workload, readiness, morale, reporting culture.
Translating technical weaknesses into business, financial, operational, and trust impacts.
This is an academic case study developed for IT-552: Human Factors in Security. MSA is presented here as a fictional operating subsidiary of Aegis Quantum Trust. The work is presented as a portfolio example of security-awareness program design, GRC analysis, control development, continuous monitoring, human-factor risk evaluation, and executive communication.