┌─────────────────────────────────────────────────────────────────────────────┐
│                    CYBERSECURITY MATURITY MODEL                           │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  Level 1           Level 2           Level 3           Level 4             │
│  ┌─────────┐      ┌─────────┐      ┌─────────┐      ┌─────────┐          │
│  │ Reactive│      │ Defined │      │ Managed │      │ Proactive│         │
│  └─────────┘      └─────────┘      └─────────┘      └─────────┘          │
│                                                                             │
│  Level 5                                                                   │
│  ┌─────────┐                                                             │
│  │ Adaptive│                                                             │
│  └─────────┘                                                             │
│                                                                             │
│  • Incident      • Policies     • Monitoring    • Threat           • Self- │
│    response        & standards     & metrics      intelligence      healing │
│  • Basic          • Basic         • Regular       • Predictive     • AI-    │
│    controls        training        assessments     analytics       driven  │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

# ===================================================================
# MODULE 5, LESSON 1: THE CYBERSECURITY LANDSCAPE
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime
import hashlib
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("THE CYBERSECURITY LANDSCAPE IN DIGITAL BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: CYBERSECURITY MATURITY ASSESSMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Cybersecurity Maturity Assessment")
print("-"*60)

maturity_dimensions = {
    'Governance & Strategy': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Asset Management': {'Current Score': 3, 'Target Score': 4, 'Priority': 'Medium'},
    'Threat Intelligence': {'Current Score': 2, 'Target Score': 4, 'Priority': 'High'},
    'Identity & Access Management': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Security Operations': {'Current Score': 2, 'Target Score': 4, 'Priority': 'High'},
    'Incident Response': {'Current Score': 3, 'Target Score': 4, 'Priority': 'High'},
    'Data Protection': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Third-Party Risk': {'Current Score': 2, 'Target Score': 4, 'Priority': 'Medium'},
    'Compliance': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'}
}

maturity_df = pd.DataFrame(maturity_dimensions).T
print("Cybersecurity Maturity Assessment:")
print(maturity_df)

# Visualise
fig, ax = plt.subplots(figsize=(10, 8))
dimensions = list(maturity_df.index)
current = maturity_df['Current Score'].tolist()
target = maturity_df['Target Score'].tolist()

x = np.arange(len(dimensions))
width = 0.35

ax.barh(x - width/2, current, width, label='Current', color='blue', alpha=0.7)
ax.barh(x + width/2, target, width, label='Target', color='green', alpha=0.7)

ax.set_yticks(x)
ax.set_yticklabels(dimensions)
ax.set_xlabel('Maturity Score (1-5)')
ax.set_title('Cybersecurity Maturity Assessment')
ax.legend()
ax.grid(True, alpha=0.3, axis='x')

plt.tight_layout()
plt.savefig('security_maturity.png', dpi=300, bbox_inches='tight')
plt.show()
print("Security maturity visualisation saved as 'security_maturity.png'")

# ----------------------------------------------------------------
# PART B: THREAT LANDSCAPE ANALYSIS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Threat Landscape Analysis")
print("-"*60)

# Define threat data
threats = ['Phishing', 'Malware', 'Ransomware', 'DDoS', 'Insider Threats', 
           'Account Takeover', 'API Attacks', 'Supply Chain Attacks', 'AI-Driven Attacks']
likelihood = [5, 4, 4, 3, 3, 4, 3, 2, 2]
impact = [4, 5, 5, 4, 4, 5, 4, 5, 4]

threat_df = pd.DataFrame({
    'Threat': threats,
    'Likelihood (1-5)': likelihood,
    'Impact (1-5)': impact,
    'Risk Score': [l * i for l, i in zip(likelihood, impact)]
}).sort_values('Risk Score', ascending=False)

print("Threat Landscape Analysis:")
print(threat_df.to_string(index=False))

# Visualise
fig, ax = plt.subplots(figsize=(10, 6))
scatter = ax.scatter(threat_df['Likelihood (1-5)'], threat_df['Impact (1-5)'], 
                     s=threat_df['Risk Score'] * 20, alpha=0.7, c='red')
for i, row in threat_df.iterrows():
    ax.annotate(row['Threat'], (row['Likelihood (1-5)'] + 0.1, row['Impact (1-5)'] + 0.1))
ax.set_xlabel('Likelihood (1-5)')
ax.set_ylabel('Impact (1-5)')
ax.set_title('Threat Map: Likelihood vs Impact')
ax.grid(True, alpha=0.3)

plt.tight_layout()
plt.savefig('threat_map.png', dpi=300, bbox_inches='tight')
plt.show()
print("Threat map visualisation saved as 'threat_map.png'")

# ----------------------------------------------------------------
# PART C: THREAT INTELLIGENCE SIMULATION
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Threat Intelligence Simulation")
print("-"*60)

# Simulate threat intelligence feeds
np.random.seed(42)
n_alerts = 50

threat_intel = pd.DataFrame({
    'alert_id': range(1, n_alerts + 1),
    'timestamp': [datetime.now().strftime('%Y-%m-%d %H:%M:%S') for _ in range(n_alerts)],
    'threat_type': np.random.choice(['Phishing', 'Malware', 'Ransomware', 'DDoS', 'Suspicious Login'], n_alerts),
    'severity': np.random.choice(['Low', 'Medium', 'High', 'Critical'], n_alerts, p=[0.3, 0.3, 0.25, 0.15]),
    'source_ip': [f"192.168.{np.random.randint(1,255)}.{np.random.randint(1,255)}" for _ in range(n_alerts)],
    'target': np.random.choice(['Customer Portal', 'Mobile App', 'Internal Network', 'ATM', 'API Gateway'], n_alerts)
})

print("Threat Intelligence Alerts:")
print(threat_intel.head())

# Summarise
alert_summary = threat_intel.groupby(['threat_type', 'severity']).size().unstack(fill_value=0)
print("\nAlert Summary:")
print(alert_summary)

# Visualise
fig, axes = plt.subplots(1, 2, figsize=(14, 5))

# Threat types
ax = axes[0]
threat_counts = threat_intel['threat_type'].value_counts()
ax.bar(threat_counts.index, threat_counts.values, color='teal', alpha=0.7)
ax.set_xlabel('Threat Type')
ax.set_ylabel('Count')
ax.set_title('Threat Intelligence: Threat Types')
ax.tick_params(axis='x', rotation=45)
ax.grid(True, alpha=0.3)

# Severity distribution
ax = axes[1]
severity_counts = threat_intel['severity'].value_counts()
colors = {'Critical': 'red', 'High': 'orange', 'Medium': 'yellow', 'Low': 'green'}
ax.bar(severity_counts.index, severity_counts.values, 
       color=[colors.get(s, 'gray') for s in severity_counts.index], alpha=0.7)
ax.set_xlabel('Severity')
ax.set_ylabel('Count')
ax.set_title('Alert Severity Distribution')
ax.grid(True, alpha=0.3)

plt.tight_layout()
plt.savefig('threat_intelligence.png', dpi=300, bbox_inches='tight')
plt.show()
print("Threat intelligence visualisation saved as 'threat_intelligence.png'")

# ----------------------------------------------------------------
# PART D: CYBERSECURITY RISK REGISTER
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Cybersecurity Risk Register")
print("-"*60)

risk_register = pd.DataFrame({
    'Risk ID': ['R1', 'R2', 'R3', 'R4', 'R5', 'R6', 'R7'],
    'Risk': [
        'Data Breach',
        'Ransomware Attack',
        'Phishing Campaign',
        'Insider Threat',
        'DDoS Attack',
        'API Vulnerability',
        'Third-Party Breach'
    ],
    'Likelihood (1-5)': [3, 4, 5, 3, 2, 3, 2],
    'Impact (1-5)': [5, 5, 3, 4, 4, 4, 4],
    'Risk Score': [15, 20, 15, 12, 8, 12, 8],
    'Mitigation': [
        'Encryption, access controls, DLP',
        'Backup, endpoint protection, employee training',
        'Email filtering, employee awareness',
        'IAM, monitoring, least privilege',
        'DDoS protection, redundancy',
        'API security testing, WAF',
        'Vendor due diligence, contracts'
    ],
    'Owner': ['CISO', 'CISO', 'CISO', 'CISO', 'CISO', 'CISO', 'CISO'],
    'Status': ['Active', 'Active', 'Active', 'Active', 'Active', 'Active', 'Active']
})

print("Cybersecurity Risk Register:")
print(risk_register.to_string(index=False))

# ----------------------------------------------------------------
# PART E: CYBERSECURITY STRATEGY
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Cybersecurity Strategy")
print("-"*60)

strategy = {
    "1. Zero Trust Architecture": {
        "Actions": [
            "Implement zero-trust network access.",
            "Enforce least-privilege access.",
            "Implement micro-segmentation.",
            "Continuously monitor and verify."
        ],
        "Priority": "High",
        "Timeline": "0-12 months"
    },
    "2. Threat Intelligence": {
        "Actions": [
            "Implement threat intelligence feeds.",
            "Build threat hunting capabilities.",
            "Share intelligence with industry peers.",
            "Automate threat detection."
        ],
        "Priority": "High",
        "Timeline": "0-6 months"
    },
    "3. Data Protection": {
        "Actions": [
            "Encrypt data at rest and in transit.",
            "Implement data loss prevention (DLP).",
            "Classify and label sensitive data.",
            "Implement data masking."
        ],
        "Priority": "High",
        "Timeline": "0-6 months"
    },
    "4. Security Awareness": {
        "Actions": [
            "Conduct regular security training.",
            "Run phishing simulations.",
            "Create a security culture.",
            "Reward secure behaviour."
        ],
        "Priority": "Medium",
        "Timeline": "0-12 months"
    },
    "5. Incident Response": {
        "Actions": [
            "Develop incident response plan.",
            "Conduct regular tabletop exercises.",
            "Establish communication protocols.",
            "Implement automated response."
        ],
        "Priority": "High",
        "Timeline": "0-6 months"
    },
    "6. Compliance": {
        "Actions": [
            "Maintain regulatory compliance.",
            "Conduct regular audits.",
            "Engage with regulators.",
            "Document security controls."
        ],
        "Priority": "High",
        "Timeline": "Ongoing"
    }
}

print("Cybersecurity Strategy:")
for item, details in strategy.items():
    print(f"\n{item}:")
    for action in details['Actions']:
        print(f"  • {action}")
    print(f"  Priority: {details['Priority']}")
    print(f"  Timeline: {details['Timeline']}")

# ----------------------------------------------------------------
# PART F: CYBERSECURITY METRICS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Cybersecurity Metrics Dashboard")
print("-"*60)

security_metrics = pd.DataFrame({
    'Metric': [
        'Security Incidents',
        'Mean Time to Detect (MTTD)',
        'Mean Time to Respond (MTTR)',
        'Security Score',
        'Phishing Click Rate',
        'Patch Compliance',
        'Access Control Compliance',
        'Third-Party Risk Score'
    ],
    'Current Value': [
        '12/month',
        '4.5 hours',
        '2.5 hours',
        '78/100',
        '8.2%',
        '72%',
        '85%',
        '72/100'
    ],
    'Target Value': [
        '< 5/month',
        '< 1 hour',
        '< 30 min',
        '> 90/100',
        '< 3%',
        '> 95%',
        '> 95%',
        '> 85/100'
    ],
    'Status': ['🟡', '🔴', '🔴', '🟡', '🔴', '🔴', '🟡', '🟡']
})

print("Cybersecurity Metrics Dashboard:")
print(security_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART G: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART G: Summary and Recommendations")
print("="*70)

print("""
Cybersecurity in Digital Banking – Key Takeaways:

1. Cybersecurity is critical for protecting digital assets, customer data, and infrastructure.
2. Key threats: phishing, malware, ransomware, DDoS, insider threats, account takeover.
3. CIA Triad: Confidentiality, Integrity, Availability.
4. Maturity levels: Reactive → Defined → Managed → Proactive → Adaptive.
5. Regulatory requirements: GDPR, PCI DSS, NYDFS, FFIEC, EBA, NIST.
6. Risk management: identify, assess, mitigate, monitor.
7. Strategy: zero trust, threat intelligence, data protection, incident response.

Recommendations:
  - Implement zero-trust architecture.
  - Build threat intelligence capabilities.
  - Encrypt sensitive data at rest and in transit.
  - Develop and test incident response plans.
  - Conduct regular security awareness training.
  - Maintain regulatory compliance.
""")

print("="*70)
print("END OF LESSON 1 – MODULE 5")
print("="*70)