Cedric Bergermann-Bißlich-IT / Enterprise Architect (Security & Regulatory)

Bachelor of Science in Cyber Security and Cyber Privacy Georgia, USA | August 2021 – September 2024

The Bachelor’s degree program in Cyber Security and Cyber Privacy provided a broad and practice-oriented education in the protection of information, IT systems, networks, applications, and digital identities. The program combined technical cybersecurity disciplines with privacy, governance, risk management, and regulatory requirements, creating a strong foundation for working in complex enterprise and cloud environments.

The curriculum covered the fundamental principles of information security, including confidentiality, integrity, availability, authentication, authorization, accountability, and non-repudiation. A particular focus was placed on understanding how modern cyber threats affect organizations and how technical, organizational, and procedural security measures can be used to reduce risk.

Key areas of study included network and infrastructure security, operating system security, secure system administration, cloud security, application security, identity and access management, cryptography, vulnerability management, incident response, digital forensics, ethical hacking, and security monitoring. The program also addressed the design and evaluation of secure IT architectures, including the implementation of layered security controls and defense-in-depth concepts.

Network security topics included common network protocols, segmentation, firewalls, intrusion detection and prevention systems, virtual private networks, secure remote access, wireless security, and the identification of network-based attacks. The program provided an understanding of how weaknesses in network design, configuration, and access control can be exploited and how these risks can be mitigated through appropriate technical safeguards.

Application and software security were also important components of the degree. This included secure software development principles, common application vulnerabilities, threat modeling, secure coding practices, authentication and authorization mechanisms, input validation, session management, and the protection of application interfaces. Security risks affecting web applications, APIs, databases, and distributed systems were examined from both an attacker’s and a defender’s perspective.

The cloud security component focused on the security challenges associated with modern cloud-based and hybrid IT environments. Topics included shared responsibility models, secure cloud architecture, identity-based access control, encryption, key management, logging, monitoring, secure configuration, and the protection of cloud workloads and data. The program also addressed the importance of governance and standardized security controls when operating services across multiple platforms and environments.

Identity and access management formed another major area of study. The curriculum covered user authentication, authorization models, role-based and attribute-based access control, privileged access, identity lifecycle management, multi-factor authentication, federation, single sign-on, and the principle of least privilege. Particular attention was given to the risks associated with excessive permissions, shared accounts, privileged identities, and insufficient monitoring of access activities.

Cryptography was studied as a fundamental security technology. The program included symmetric and asymmetric encryption, hashing, digital signatures, certificates, public key infrastructures, secure key management, and the practical use of cryptographic mechanisms to protect data both at rest and in transit. Students learned not only how cryptographic techniques work, but also how poor implementation or inadequate key management can undermine otherwise strong security controls.

Cybersecurity risk management and governance were integrated throughout the program. This included identifying assets, threats, vulnerabilities, and potential business impacts; evaluating risks; selecting appropriate controls; and documenting residual risks. Students developed an understanding of how cybersecurity decisions must be aligned with business objectives, legal obligations, operational requirements, and organizational risk appetite.

The Cyber Privacy component focused on the responsible and lawful processing of personal and sensitive information. Areas of study included privacy principles, data minimization, purpose limitation, transparency, consent, retention, access control, privacy by design, privacy by default, and the secure handling of personal data throughout its lifecycle. The program also considered the relationship between privacy, cybersecurity, compliance, ethics, and organizational accountability.

Further topics included security policies, standards, procedures, audits, control frameworks, business continuity, disaster recovery, third-party risk, and security awareness. This provided an understanding of cybersecurity as an organizational responsibility that extends beyond purely technical controls. The course content emphasized the importance of combining people, processes, governance, and technology to establish an effective and sustainable security posture.

Threat analysis and ethical hacking exercises helped develop a practical understanding of common attack methods. These included reconnaissance, social engineering, credential attacks, privilege escalation, exploitation of vulnerabilities, lateral movement, persistence, data exfiltration, and attacks against applications and network services. The objective was to understand attacker behavior in order to design more effective preventive, detective, and responsive security measures.

Vulnerability management topics included asset identification, vulnerability scanning, assessment of technical findings, prioritization based on risk, remediation planning, and verification of implemented measures. Students learned that vulnerability severity alone is not sufficient for effective prioritization and that business criticality, exposure, exploitability, compensating controls, and potential impact must also be considered.

Incident response and digital forensics covered the identification, analysis, containment, eradication, and recovery phases of security incidents. The program addressed the importance of logging, evidence preservation, documentation, communication, and post-incident analysis. Students gained an understanding of how technical evidence can be collected and evaluated while maintaining integrity and traceability.

Security monitoring and detection topics included the collection and analysis of logs, event correlation, identification of suspicious behavior, security information and event management, alert handling, and the development of appropriate detection and response processes. The course content highlighted the importance of visibility, traceability, and reliable audit information in modern IT environments.

The program used practical exercises, laboratories, case studies, research assignments, and project-based work to connect theoretical cybersecurity concepts with real-world scenarios. These activities required the analysis of security problems, evaluation of alternative solutions, documentation of risks and recommendations, and presentation of findings to both technical and non-technical audiences.

Throughout the degree, emphasis was placed on structured analytical thinking, independent research, problem-solving, and the ability to assess security requirements from different perspectives. Technical solutions were evaluated not only in terms of security effectiveness, but also with regard to usability, operational feasibility, scalability, cost, compliance, and business impact.

The program also strengthened communication and documentation skills. Students were required to explain complex technical risks in a clear and understandable manner, create structured reports, justify security decisions, and develop recommendations for different stakeholder groups. This included translating technical findings into business-relevant risks and supporting informed decision-making.

By completing the program, I developed a comprehensive understanding of cybersecurity and privacy across technical, organizational, and regulatory dimensions. The degree prepared me to evaluate security risks, design and assess security architectures, support governance and compliance initiatives, improve identity and access controls, analyze vulnerabilities, and contribute to the protection of enterprise systems, cloud environments, applications, data, and digital identities.

The combination of technical cybersecurity expertise and privacy-focused education provided a strong basis for roles in cybersecurity architecture, cloud security, information security governance, identity and access management, risk management, security engineering, and enterprise IT architecture.