2026 Semiconductor Cybersecurity Academy | Enterprise Blue Team Defense Series

Why blue team practice matters

Many companies already run firewalls, EDR and SIEM, yet under attack they may still not know which assets are exposed, which weaknesses to fix first, or whether an alert is a real attack. What matters is a complete cycle of inventory, hardening, monitoring, detection and validation.

Course 1: foundations and hardening

Maps defensive capability with the Cyber Defense Matrix and reviews the external attack surface from an attacker's view; hands-on Windows and Linux reviews, CIS Benchmarks, application and data security, mobile and IoT/OT protection, and vulnerability management prioritized by exploitability.

Course 2: monitoring and detection

Covers SOC, SIEM, threat intelligence, EDR/NDR, MITRE ATT&CK, detection engineering and adversary emulation, linking attack behavior to validated detection.

Approach

Defense reviewed from the attacker's side; judgment over tools; hands-on packet analysis, detection rules and Atomic Red Team emulation, grounded in real incidents.

Course overview: who it is for and what it covers

The enterprise blue team series, run by the Semiconductor Cybersecurity Academy, has two days of six hours each. It is written for security, SOC and IT operations staff. It starts with system hardening and moves on to security monitoring and threat detection, so that participants leave with methods they can run and check in their own company.

The two days took place on 22 September and 29 October 2026 in Zhongzheng District, Taipei, and have been held. Attendance was free, and each company was provisionally limited to two people. This page sets out the design, the outline and the terms, for companies that may join later sessions.

The series addresses a common gap: companies own security tools but may lack the judgement and testing to use them well. A companion series, Purple Team Threat Hunting, covers the attacker's side; see its own page. Readers who want the attacker's view in more depth may wish to read both outlines together.

Why blue team skills matter

Many companies already run firewalls, antivirus, EDR and SIEM. Under attack, six problems still arise. They do not know which assets and services they expose. They do not know how far system configuration is from a recommended baseline. They have many vulnerabilities and no way to rank them.

Three more problems lie on the detection side. Logs are collected without detection logic. Alerts arrive and nobody can tell quickly whether an attack is real. Detection rules are written but never tested. Together these six problems set the course design.

The organisers' view is that good defence depends less on which equipment is installed than on a complete cycle: inventory, hardening, monitoring, detection and validation. The first day covers the first half of that cycle and the second day the rest.

Day one: foundations and system hardening

Day one, on 22 September 2026, starts with the whole picture of blue team defence. Participants map existing controls with the Cyber Defense Matrix and identify gaps. They then look at the company from the attacker's side, reviewing public-facing services and published information to find the real external attack surface.

The hands-on part reviews Windows and Linux systems and uses the CIS Benchmarks to show how configuration baselines apply. It extends to application and data security, and to mobile, IoT and OT environments. Real incident cases illustrate the usual management difficulties and how teams respond.

Vulnerability management is a central theme. Patching order follows exploitability, not a single severity score. The day also explains how common security testing services differ in scope and timing, so that participants can plan and buy with a clear idea of what each one delivers, and not mistake one type of test for another.

Day two: monitoring and threat detection

Day two, on 29 October 2026, begins from a simple point: preventive controls cannot cover every attack. Whether a company notices an anomaly depends on whether it collects the right security data, has effective detection logic, and can combine information from different sources.

The content opens with how a SOC and a SIEM operate. MITRE ATT&CK and D3FEND then link attack techniques, defensive measures, data sources and detection capability. Participants learn the basics and interpretation of threat intelligence and indicators of compromise, and the concepts and tools of endpoint (EDR) and network (NDR) detection and response.

Practical work covers malicious traffic analysis and the writing of detection rules in detection engineering. The day ends with the Atomic Red Team adversary emulation tool: participants trigger the matching attack behaviour and check that their rules fire. The route runs from technique to data, rule and validation.

Teaching approach

Four design choices shape the series. It reviews defence from the attacker's viewpoint. It runs from hardening to detection validation so that prevention and detection form one chain. It teaches judgement as well as tools. And it combines hands-on work with real cases, so that each idea becomes a method that can be operated and tested.

Judgement is taught through concrete tasks, not general advice: the order in which to fix vulnerabilities, reading indicators of compromise, analysing malicious traffic and designing detection rules. The aim is to teach the reasoning behind the tools, so that participants can apply it in their own environment, with other products.

The instructor is a security technology consultant whose expertise covers enterprise defence, penetration testing, web security, DevSecOps, container security and enterprise blue team practice, with experience in security services, attack-and-defence testing and training.

Terms of attendance and how registration worked

Each day ran from 10:00 to 17:00, six hours including a one-hour lunch break, in the ITTraining computer lab at 143 Section 1, Chongqing South Road, Zhongzheng District, Taipei. Registration closed two days before each class, earlier if seats filled, and was confirmed by an email once registration succeeded.

Attendance was free, with a provisional limit of two people per company. The organisers advised companies to send suitable staff: information security and information management staff, SOC and security monitoring analysts, systems, network and IT operations staff, people in charge of vulnerability management, and DevOps or DevSecOps practitioners.

Both days have been held, and dates for later sessions are not yet announced. Interested companies can check the Events and Registration page for current sessions, or leave their organisation and needs through the contact page, and the National Innovation and Entrepreneurship Association, R.O.C. (the Association) will pass them to the organiser.