TECHNICAL PRACTICE

Cybersecurity for IT Experts

Understand attacker behaviour, harden the systems you run and make sound detection, response and recovery decisions.

In development4 chapters36 lessonsEnglish

INSIDE THE COURSE

Explore the course, chapter by chapter.

This is the current outline of a course in development. Explore the chapters, subchapters and lesson topics below. The programme may change as we develop and review it.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Security objectives and essential concepts

Understand what you protect and how attacker communication works.

1.1

From administrator to defender

Security objectives: become a defender as well as an administrator

Translate familiar administrative tasks into confidentiality, integrity, availability and accountability outcomes.

Topics you will explore

Start with a service you are responsible for
A secure perimeter is only one boundary
Read a security statistic before using it

Includes practical AI use, verification and information risks.

Link to this lesson

1.2

Mechanisms behind the terminology

Understand C2, EDR and hidden communication

Explain command and control through a concrete communication chain and distinguish it from execution and data theft.

Topics you will explore

Understand the control loop
A carrier can look ordinary
Know what EDR observes and what it does not
Follow the chain rather than blocking a label

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 02

Adversarial tactics

Follow attacker objectives through delivery paths that defeat simple inspection.

2.1

Objectives, ATT&CK and reconnaissance

Attacker objectives and the routes to your data

Connect data theft, fraud and disruption to the accounts and systems an attacker would need.

Topics you will explore

The objective determines the useful access
Credentials and host compromise are different routes
Turn an objective into a defensive test

Includes practical AI use, verification and information risks.

Link to this lesson

ATT&CK: turn a behaviour into a defensive question

Use ATT&CK to organise observations and controls without forcing an incident into a fixed sequence.

Topics you will explore

Separate purpose from method
Read the official technique page
A matrix is not a compulsory timeline
Measure a tested behaviour, not a coloured square
Turn a detection suggestion into a local test

Includes practical AI use, verification and information risks.

Link to this lesson

Reconnaissance: see the organisation from outside

Use passive exposure clues to prioritise an authorised asset review.

Topics you will explore

Build an external exposure inventory
Distinguish observation from interaction
Translate the footprint into owned remediation

Includes practical AI use, verification and information risks.

Link to this lesson

2.2

Exploitation and authentication tampering

Exploit kits and vulnerable clients

Distinguish exploitation of software from a user being persuaded to run a file.

Topics you will explore

Separate the delivery chain from the vulnerable component
Check the actual preconditions
Use several independent defensive opportunities

Includes practical AI use, verification and information risks.

Link to this lesson

Skeleton Key: when the authentication authority is compromised

Recognise why authentication-process tampering requires a different response from resetting one password.

Topics you will explore

The authentication authority itself can be tampered with
Collect beyond the suspicious login
Restarting a component is not full recovery
Worked example: the password changed, but the trust problem remains

Includes practical AI use, verification and information risks.

Link to this lesson

Malvertising and fake software delivery

Trace advertising and search redirects to a trustworthy software-installation decision.

Topics you will explore

Advertising can be an entry point without compromising the destination site
Control how software reaches managed endpoints
Investigate what happened after the lure

Includes practical AI use, verification and information risks.

Link to this lesson

2.3

Legitimate-tool abuse, movement and persistence

Living off the land and credential-theft tooling

Investigate legitimate utility abuse using behaviour rather than executable reputation alone.

Topics you will explore

Signed tools can perform unauthorised work
Understand what credential theft changes
Detect a relationship, not merely a tool name
Review generated commands as untrusted proposals

Includes practical AI use, verification and information risks.

Link to this lesson

Lateral movement: follow identity across machines

Build a defensible source-to-destination path and identify where privilege could spread.

Topics you will explore

Follow identity, protocol and target together
Separate local reuse from domain authority
Contain the route and verify alternatives

Includes practical AI use, verification and information risks.

Link to this lesson

Persistent adversaries and proportionate defence

Use the APT concept to plan for persistence and adaptation without unsupported attribution.

Topics you will explore

Persistence is a capability, not an attribution label
Investigate recurrence and access dependencies
Defend proportionately against capability

Includes practical AI use, verification and information risks.

Link to this lesson

2.4

Network and delivery blind spots

Compromised access points and network trust

Explain what an on-path attacker can change and why validated TLS and endpoint trust matter.

Topics you will explore

An access point controls part of the path
Watch for attempts to change the trust model
Collect endpoint and network context

Includes practical AI use, verification and information risks.

Link to this lesson

Defend delivery paths your scanner cannot inspect

Build layered controls for password-protected archives, shortcuts and gated downloads.

Topics you will explore

Follow each stage of the archived delivery example
Inspection is only one opportunity to stop harm
Apply the same reasoning to interactive lures

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 03

Defence strategies

Implement and verify authentication, platform, detection and hunting controls.

3.1

Detection and authentication protection

Attack detection across phones, workstations, servers and devices

Build a detection pipeline matched to the evidence each type of device can actually produce.

Topics you will explore

Different assets need different observation plans
Use Sysmon events in context
Build the whole detection workflow
Review changes that can break the analytic
Worked example: follow one event through the detection pipeline

Includes practical AI use, verification and information risks.

Link to this lesson

Password filters in Active Directory

Explain password-change filtering and plan a supported rollout without confusing it with authentication recovery.

Topics you will explore

Password filtering acts at a particular point
Treat a domain-controller component as sensitive software
Verify enforcement and explain residual risk

Includes practical AI use, verification and information risks.

Link to this lesson

Phishing-resistant administration of critical systems

Protect the privileged workflow, including devices, recovery and consequential automation.

Topics you will explore

Separate administration from everyday exposure
Match the authentication method to the threat
Protect the emergency route too

Includes practical AI use, verification and information risks.

Link to this lesson

3.2

Baselines and zero-trust design

CIS Benchmarks and STIGs: choose and prove a baseline

Apply a role-appropriate security baseline with documented exceptions and operational testing.

Topics you will explore

Choose a baseline for the real platform and role
Pilot allowed and denied behaviour
Keep the baseline alive after rollout

Includes practical AI use, verification and information risks.

Link to this lesson

Zero-trust networks and resource boundaries

Replace implicit internal-network trust with explicit access decisions and tested paths.

Topics you will explore

Inspect the resource boundary
Find the management paths that bypass the obvious boundary
Verify a request through the full route

Includes practical AI use, verification and information risks.

Link to this lesson

3.3

Cloud, workstation and ransomware hardening

Cloud hardening: Microsoft 365 and Google Workspace

Review tenant identity, applications, sharing and audit controls as separate access paths.

Topics you will explore

Start with privileged roles and recovery
Review application and data-sharing paths
Test the logs before the incident

Includes practical AI use, verification and information risks.

Link to this lesson

Cloud hardening: AWS and Google Cloud

Separate deployment, data, logging and recovery authority in cloud infrastructure.

Topics you will explore

Understand the control plane and the workload
Prefer bounded workload access over unmanaged secrets
Protect logs and recovery from the same failure path

Includes practical AI use, verification and information risks.

Link to this lesson

Workstation hardening: browser, Office, applications and management

Design a tested workstation baseline without blindly copying disruptive service-disable commands.

Topics you will explore

Harden the browser, Office and other applications separately
Check effective policy on the endpoint
Make software installation an accountable workflow
Use audit results to refine the rollout
Worked example: harden file sharing without breaking the business

Includes practical AI use, verification and information risks.

Link to this lesson

Prevent ransomware impact across the whole environment

Combine execution controls, identity boundaries and independent recovery instead of relying on one endpoint setting.

Topics you will explore

Prevent more than encryption
Turn a prevention list into tested configuration
Keep a recoverable state outside the easy attack path

Includes practical AI use, verification and information risks.

Link to this lesson

3.4

Identity management, Wazuh and Velociraptor

Access control and identity management

Find privilege-abuse paths and verify least privilege for people and service identities.

Topics you will explore

Review who can grant authority as well as who holds it
Use managed credentials with correct retrieval scope
Make elevation temporary and accountable
Remediate credential exposure as a dependency problem

Includes practical AI use, verification and information risks.

Link to this lesson

Wazuh: vulnerability management and SIEM are different workflows

Validate inventory, prioritise a finding and trace an event into a tested detection.

Topics you will explore

Know which pipeline answers which question
Prioritise a vulnerability in operational context
A useful SIEM rule needs data and a response
Verify closure from the endpoint to the case
Worked example: turn inventory into a patch decision

Includes practical AI use, verification and information risks.

Link to this lesson

Threat hunting with Velociraptor

Plan a bounded artifact collection and report matches separately from collection coverage.

Topics you will explore

Read the artifact before collecting it
Start with a bounded pilot
A hunt is coordinated collection, not universal visibility
Turn results into a tested hypothesis
Worked example: report hunt coverage honestly

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 04

Response strategies

Investigate, contain and recover through the incident types and evidence sources in the original outline.

4.1

DFIR and incident classification

Digital forensics and incident response: two connected jobs

Separate investigation questions from response actions and connect both to incident authority.

Topics you will explore

Know your first-response authority
Protect the service while preserving useful evidence
Keep a contemporaneous action log

Includes practical AI use, verification and information risks.

Link to this lesson

Classify incidents without locking into the first explanation

Select an initial playbook using impact and evidence, then change it when scope changes.

Topics you will explore

Classify by observed impact and affected surface
Separate technical severity from business urgency
Recognise when apparently separate incidents connect

Includes practical AI use, verification and information risks.

Link to this lesson

4.2

Malware, phishing and ransomware response

Respond to a malware infection

Determine arrival, execution, impact and spread instead of closing a case after quarantine.

Topics you will explore

Determine presence, execution and consequence
Contain without casually destroying the evidence
Verify recovery against the mechanism

Includes practical AI use, verification and information risks.

Link to this lesson

Phishing response: message, identity and application access

Respond to credential, device-code and consent phishing while protecting evidence and confidential content.

Topics you will explore

Find recipients and what they actually did
Choose containment for the actual access path
Use external reports as an additional control

Includes practical AI use, verification and information risks.

Link to this lesson

Handle ransomware without destroying the response

Coordinate containment, evidence, recovery and potential data theft under incident leadership.

Topics you will explore

Check identities and recovery before assuming a host-only incident
Preserve the decisions and representative evidence
Restore in stages with trust checks

Includes practical AI use, verification and information risks.

Link to this lesson

4.3

Drive, network and log forensics

Drive imaging and forensic artifacts

Choose a preservation method and interpret disk artifacts without overstating what they prove.

Topics you will explore

Select acquisition for the question and constraints
Correlate filesystem and application traces
Understand modern storage limits

Includes practical AI use, verification and information risks.

Link to this lesson

Network forensics for the administrator

Interpret captures, flows and DNS with sensor location, time and encryption limits.

Topics you will explore

Map the observation point
Use filters without erasing context
Connect traffic to a business action

Includes practical AI use, verification and information risks.

Link to this lesson

Log forensics: reconstruct a sequence you can defend

Normalise time and correlate stable identifiers while preserving raw records and collection gaps.

Topics you will explore

Verify the source before interpreting absence
Join on stable context, not just a familiar name
Make the analysis reproducible

Includes practical AI use, verification and information risks.

Link to this lesson

4.4

Recovery, limited incidents and crises

Disaster recovery and cybersecurity recovery

Restore service through trusted dependencies and explicit technical/business acceptance.

Topics you will explore

Availability recovery and security recovery are different
Exercise the dependencies that fail together
Use explicit acceptance and monitoring

Includes practical AI use, verification and information risks.

Link to this lesson

Handle a limited-scope incident without missing expansion

Resolve a bounded event with explicit scope checks, verification and escalation triggers.

Topics you will explore

Define why the scope appears limited
Take a proportionate action with verification
Set conditions that change the response

Includes practical AI use, verification and information risks.

Link to this lesson

Handle a crisis and hand over the technical picture

Escalate by business impact and provide a usable decision brief during a changing incident.

Topics you will explore

Create a decision structure when many teams are involved
Give leadership a usable technical picture
Integrate the source’s gated-delivery scenario
Turn the incident into reviewed improvements

Includes practical AI use, verification and information risks.

Link to this lesson

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.