Learn with purpose.
Clear principles, supervised exercises, and documentation you can explain.
What you will learn
- Build and document a controlled learning lab
- Perform basic host and service hardening reviews
- Analyze authentication and network telemetry for suspicious patterns
- Triage an incident, write findings and recommend defensive actions
Before you begin
- Familiarity with operating systems, file paths and terminal basics
- Comfort with IP, DNS, HTTP(S) and access-control concepts
- Cybersecurity Essentials or equivalent foundational knowledge
Inside the curriculum.
Ten structured modules covering the full six-month learning path. Select a module to explore its subjects.
01 Security Lab Architecture & Operations +
Weeks 1–3 · Virtual machines, isolated networks, snapshots and safety boundaries. Linux accounts, permissions, processes, services and logs. Windows security, updates, Defender fundamentals and event logging.
02 Network Analysis & Identity Security +
Weeks 4–5 · TCP/IP, DNS, HTTP(S), packet inspection, network baselines, multifactor authentication, account lifecycle, access policies and privilege reviews.
03 System Hardening & Vulnerability Management +
Weeks 6–8 · Secure configurations, patch assessments, backup verification, OWASP application security risks, sandbox access-control reviews, asset inventory, severity evaluation, remediation and validation.
04 Security Monitoring & Detection Engineering +
Weeks 9–10 · Event collection, timestamp normalization, evidence handling, detection hypotheses, correlation logic, false positives and alert quality.
05 Incident Triage & Phishing Investigations +
Weeks 11–12 · Incident scoping, impact assessment, escalation and containment decisions. Suspicious email headers, controlled URL inspection and defensive response.
06 Endpoint & Network Investigations +
Weeks 13–14 · Process trees, persistence indicators, DNS and network traffic analysis, evidence preservation, and distinguishing suspicious events from expected activity.
07 Cloud Security, Automation & Threat Intelligence +
Weeks 15–17 · Shared responsibility, SaaS identity, audit records, cloud configuration reviews, safe scripts for processing sample logs, threat indicators and intelligence-source reliability.
08 Risk Reporting & Incident Response +
Weeks 18–19 · Business impact, prioritized remediation, technical reporting, tabletop simulations, incident communications, decision records and recovery planning.
09 Digital Forensics & Secure Systems Design +
Weeks 20–21 · Evidence integrity, chain-of-custody principles, limited-scope collection, threat modeling, trust boundaries and least-privilege system design.
10 Defensive Project & Capstone Assessment +
Weeks 22–24 · Investigate a simulated multi-system security event, document evidence and defensive controls, prepare a technical report, and present findings, mitigations and a practical improvement plan.
How we approach labs.
Observe, document, interpret and recommend. Realistic scenarios are conducted in authorized environments.
$ tail -n 3 auth.log 10:14:12 sshd: Failed password for invalid user 10:14:15 sshd: Accepted password for analyst 10:14:18 sudo: analyst executed /usr/bin/id
A staged login-anomaly investigation: examine anonymized SSH authentication logs, validate host context, separate suspicious from normal events, and propose defensive next steps.
One-time program tuition. Course access requires confirmed enrollment and verified payment.
Good to know.
Does this require previous experience? +
Yes. Prior knowledge of operating systems, networking and security fundamentals is recommended.
Are labs performed on public systems? +
No. Exercises are limited to authorized, isolated environments and provided sample data.
Does the course include penetration-testing certification? +
No. The curriculum emphasizes defensive engineering and does not claim third-party certification.
What unlocks paid activities? +
A secure backend must verify purchase, course enrollment and user permissions before providing material.
Reference materials: NIST CSF · CISA · OWASP. These are curriculum references, not affiliations or endorsements.