TECHNICAL PRACTICE
Cybersecurity for IT Experts
Understand attacker behaviour, harden the systems you run and make sound detection, response and recovery decisions.
After this course, learners will…
What learners can do
- Connect attacker behaviour to the accounts, devices and services they administer, and identify where an attack could spread.
- Choose and test hardening, access and detection controls across endpoints, networks and cloud services.
- Use logs and forensic evidence to scope an incident, preserve useful records and explain what remains uncertain.
- Plan containment and recovery with clear escalation, trusted dependencies and checks before restoring service.
Benefits for your company
- IT teams can prioritise security work by attack paths and business impact, rather than apply settings without context.
- Changes and exceptions can be supported by testing, ownership and evidence that colleagues can review.
- Administrators can give responders clearer handovers and help avoid premature or unsafe service restoration.
INSIDE THE COURSE
Explore the course, chapter by chapter.
4 chapters · 36 lessons3.3 hExercises take additional time.
Build your skills in sequence, practise with the supplied cases and verify your decisions. Explore the chapters and lesson objectives below.
Explore the outline. Open a section to see the lessons and topics inside.
36 lessons shown
Chapter 01Security objectives and essential concepts
0.2 h
Understand what you protect and how attacker communication works.
1.1From administrator to defender
01Security objectives: become a defender as well as an administrator
11 slides · 1 practical activities · Knowledge checks
Translate familiar administrative tasks into confidentiality, integrity, availability and accountability outcomes.
Topics you will explore
- Start with a service you are responsible for
- A secure perimeter is only one boundary
- Read a security statistic before using it
Includes practical AI use, verification and information risks.
Link to this lesson1.2Mechanisms behind the terminology
02Understand C2, EDR and hidden communication
12 slides · 1 practical activities · Knowledge checks
Explain command and control through a concrete communication chain and distinguish it from execution and data theft.
Topics you will explore
- Understand the control loop
- A carrier can look ordinary
- Know what EDR observes and what it does not
- Follow the chain rather than blocking a label
Includes practical AI use, verification and information risks.
Link to this lessonChapter 02Adversarial tactics
1 h
Follow attacker objectives through delivery paths that defeat simple inspection.
2.1Objectives, ATT&CK and reconnaissance
03Attacker objectives and the routes to your data
11 slides · 1 practical activities · Knowledge checks
Connect data theft, fraud and disruption to the accounts and systems an attacker would need.
Topics you will explore
- The objective determines the useful access
- Credentials and host compromise are different routes
- Turn an objective into a defensive test
Includes practical AI use, verification and information risks.
Link to this lesson04ATT&CK: turn a behaviour into a defensive question
13 slides · 1 practical activities · Knowledge checks
Use ATT&CK to organise observations and controls without forcing an incident into a fixed sequence.
Topics you will explore
- Separate purpose from method
- Read the official technique page
- A matrix is not a compulsory timeline
- Measure a tested behaviour, not a coloured square
- Turn a detection suggestion into a local test
Includes practical AI use, verification and information risks.
Link to this lesson05Reconnaissance: see the organisation from outside
11 slides · 1 practical activities · Knowledge checks
Use passive exposure clues to prioritise an authorised asset review.
Topics you will explore
- Build an external exposure inventory
- Distinguish observation from interaction
- Translate the footprint into owned remediation
Includes practical AI use, verification and information risks.
Link to this lesson2.2Exploitation and authentication tampering
06Exploit kits and vulnerable clients
11 slides · 1 practical activities · Knowledge checks
Distinguish exploitation of software from a user being persuaded to run a file.
Topics you will explore
- Separate the delivery chain from the vulnerable component
- Check the actual preconditions
- Use several independent defensive opportunities
Includes practical AI use, verification and information risks.
Link to this lesson07Skeleton Key: when the authentication authority is compromised
12 slides · 1 practical activities · Knowledge checks
Recognise why authentication-process tampering requires a different response from resetting one password.
Topics you will explore
- The authentication authority itself can be tampered with
- Collect beyond the suspicious login
- Restarting a component is not full recovery
- Worked example: the password changed, but the trust problem remains
Includes practical AI use, verification and information risks.
Link to this lesson08Malvertising and fake software delivery
11 slides · 1 practical activities · Knowledge checks
Trace advertising and search redirects to a trustworthy software-installation decision.
Topics you will explore
- Advertising can be an entry point without compromising the destination site
- Control how software reaches managed endpoints
- Investigate what happened after the lure
Includes practical AI use, verification and information risks.
Link to this lesson2.3Legitimate-tool abuse, movement and persistence
09Living off the land and credential-theft tooling
12 slides · 1 practical activities · Knowledge checks
Investigate legitimate utility abuse using behaviour rather than executable reputation alone.
Topics you will explore
- Signed tools can perform unauthorised work
- Understand what credential theft changes
- Detect a relationship, not merely a tool name
- Review generated commands as untrusted proposals
Includes practical AI use, verification and information risks.
Link to this lesson10Lateral movement: follow identity across machines
11 slides · 1 practical activities · Knowledge checks
Build a defensible source-to-destination path and identify where privilege could spread.
Topics you will explore
- Follow identity, protocol and target together
- Separate local reuse from domain authority
- Contain the route and verify alternatives
Includes practical AI use, verification and information risks.
Link to this lesson11Persistent adversaries and proportionate defence
11 slides · 1 practical activities · Knowledge checks
Use the APT concept to plan for persistence and adaptation without unsupported attribution.
Topics you will explore
- Persistence is a capability, not an attribution label
- Investigate recurrence and access dependencies
- Defend proportionately against capability
Includes practical AI use, verification and information risks.
Link to this lesson2.4Network and delivery blind spots
12Compromised access points and network trust
11 slides · 1 practical activities · Knowledge checks
Explain what an on-path attacker can change and why validated TLS and endpoint trust matter.
Topics you will explore
- An access point controls part of the path
- Watch for attempts to change the trust model
- Collect endpoint and network context
Includes practical AI use, verification and information risks.
Link to this lesson13Defend delivery paths your scanner cannot inspect
11 slides · 1 practical activities · Knowledge checks
Build layered controls for password-protected archives, shortcuts and gated downloads.
Topics you will explore
- Follow each stage of the archived delivery example
- Inspection is only one opportunity to stop harm
- Apply the same reasoning to interactive lures
Includes practical AI use, verification and information risks.
Link to this lessonChapter 03Defence strategies
1.1 h
Implement and verify authentication, platform, detection and hunting controls.
3.1Detection and authentication protection
14Attack detection across phones, workstations, servers and devices
13 slides · 1 practical activities · Knowledge checks
Build a detection pipeline matched to the evidence each type of device can actually produce.
Topics you will explore
- Different assets need different observation plans
- Use Sysmon events in context
- Build the whole detection workflow
- Review changes that can break the analytic
- Worked example: follow one event through the detection pipeline
Includes practical AI use, verification and information risks.
Link to this lesson15Password filters in Active Directory
11 slides · 1 practical activities · Knowledge checks
Explain password-change filtering and plan a supported rollout without confusing it with authentication recovery.
Topics you will explore
- Password filtering acts at a particular point
- Treat a domain-controller component as sensitive software
- Verify enforcement and explain residual risk
Includes practical AI use, verification and information risks.
Link to this lesson16Phishing-resistant administration of critical systems
11 slides · 1 practical activities · Knowledge checks
Protect the privileged workflow, including devices, recovery and consequential automation.
Topics you will explore
- Separate administration from everyday exposure
- Match the authentication method to the threat
- Protect the emergency route too
Includes practical AI use, verification and information risks.
Link to this lesson3.2Baselines and zero-trust design
17CIS Benchmarks and STIGs: choose and prove a baseline
11 slides · 1 practical activities · Knowledge checks
Apply a role-appropriate security baseline with documented exceptions and operational testing.
Topics you will explore
- Choose a baseline for the real platform and role
- Pilot allowed and denied behaviour
- Keep the baseline alive after rollout
Includes practical AI use, verification and information risks.
Link to this lesson18Zero-trust networks and resource boundaries
11 slides · 1 practical activities · Knowledge checks
Replace implicit internal-network trust with explicit access decisions and tested paths.
Topics you will explore
- Inspect the resource boundary
- Find the management paths that bypass the obvious boundary
- Verify a request through the full route
Includes practical AI use, verification and information risks.
Link to this lesson3.3Cloud, workstation and ransomware hardening
19Cloud hardening: Microsoft 365 and Google Workspace
11 slides · 1 practical activities · Knowledge checks
Review tenant identity, applications, sharing and audit controls as separate access paths.
Topics you will explore
- Start with privileged roles and recovery
- Review application and data-sharing paths
- Test the logs before the incident
Includes practical AI use, verification and information risks.
Link to this lesson20Cloud hardening: AWS and Google Cloud
11 slides · 1 practical activities · Knowledge checks
Separate deployment, data, logging and recovery authority in cloud infrastructure.
Topics you will explore
- Understand the control plane and the workload
- Prefer bounded workload access over unmanaged secrets
- Protect logs and recovery from the same failure path
Includes practical AI use, verification and information risks.
Link to this lesson21Workstation hardening: browser, Office, applications and management
13 slides · 1 practical activities · Knowledge checks
Design a tested workstation baseline without blindly copying disruptive service-disable commands.
Topics you will explore
- Harden the browser, Office and other applications separately
- Check effective policy on the endpoint
- Make software installation an accountable workflow
- Use audit results to refine the rollout
- Worked example: harden file sharing without breaking the business
Includes practical AI use, verification and information risks.
Link to this lesson22Prevent ransomware impact across the whole environment
11 slides · 1 practical activities · Knowledge checks
Combine execution controls, identity boundaries and independent recovery instead of relying on one endpoint setting.
Topics you will explore
- Prevent more than encryption
- Turn a prevention list into tested configuration
- Keep a recoverable state outside the easy attack path
Includes practical AI use, verification and information risks.
Link to this lesson3.4Identity management, Wazuh and Velociraptor
23Access control and identity management
12 slides · 1 practical activities · Knowledge checks
Find privilege-abuse paths and verify least privilege for people and service identities.
Topics you will explore
- Review who can grant authority as well as who holds it
- Use managed credentials with correct retrieval scope
- Make elevation temporary and accountable
- Remediate credential exposure as a dependency problem
Includes practical AI use, verification and information risks.
Link to this lesson24Wazuh: vulnerability management and SIEM are different workflows
13 slides · 1 practical activities · Knowledge checks
Validate inventory, prioritise a finding and trace an event into a tested detection.
Topics you will explore
- Know which pipeline answers which question
- Prioritise a vulnerability in operational context
- A useful SIEM rule needs data and a response
- Verify closure from the endpoint to the case
- Worked example: turn inventory into a patch decision
Includes practical AI use, verification and information risks.
Link to this lesson25Threat hunting with Velociraptor
13 slides · 1 practical activities · Knowledge checks
Plan a bounded artifact collection and report matches separately from collection coverage.
Topics you will explore
- Read the artifact before collecting it
- Start with a bounded pilot
- A hunt is coordinated collection, not universal visibility
- Turn results into a tested hypothesis
- Worked example: report hunt coverage honestly
Includes practical AI use, verification and information risks.
Link to this lessonChapter 04Response strategies
0.9 h
Investigate, contain and recover through the incident types and evidence sources in the original outline.
4.1DFIR and incident classification
26Digital forensics and incident response: two connected jobs
11 slides · 1 practical activities · Knowledge checks
Separate investigation questions from response actions and connect both to incident authority.
Topics you will explore
- Know your first-response authority
- Protect the service while preserving useful evidence
- Keep a contemporaneous action log
Includes practical AI use, verification and information risks.
Link to this lesson27Classify incidents without locking into the first explanation
11 slides · 1 practical activities · Knowledge checks
Select an initial playbook using impact and evidence, then change it when scope changes.
Topics you will explore
- Classify by observed impact and affected surface
- Separate technical severity from business urgency
- Recognise when apparently separate incidents connect
Includes practical AI use, verification and information risks.
Link to this lesson4.2Malware, phishing and ransomware response
28Respond to a malware infection
11 slides · 1 practical activities · Knowledge checks
Determine arrival, execution, impact and spread instead of closing a case after quarantine.
Topics you will explore
- Determine presence, execution and consequence
- Contain without casually destroying the evidence
- Verify recovery against the mechanism
Includes practical AI use, verification and information risks.
Link to this lesson29Phishing response: message, identity and application access
11 slides · 1 practical activities · Knowledge checks
Respond to credential, device-code and consent phishing while protecting evidence and confidential content.
Topics you will explore
- Find recipients and what they actually did
- Choose containment for the actual access path
- Use external reports as an additional control
Includes practical AI use, verification and information risks.
Link to this lesson30Handle ransomware without destroying the response
11 slides · 1 practical activities · Knowledge checks
Coordinate containment, evidence, recovery and potential data theft under incident leadership.
Topics you will explore
- Check identities and recovery before assuming a host-only incident
- Preserve the decisions and representative evidence
- Restore in stages with trust checks
Includes practical AI use, verification and information risks.
Link to this lesson4.3Drive, network and log forensics
31Drive imaging and forensic artifacts
11 slides · 1 practical activities · Knowledge checks
Choose a preservation method and interpret disk artifacts without overstating what they prove.
Topics you will explore
- Select acquisition for the question and constraints
- Correlate filesystem and application traces
- Understand modern storage limits
Includes practical AI use, verification and information risks.
Link to this lesson32Network forensics for the administrator
11 slides · 1 practical activities · Knowledge checks
Interpret captures, flows and DNS with sensor location, time and encryption limits.
Topics you will explore
- Map the observation point
- Use filters without erasing context
- Connect traffic to a business action
Includes practical AI use, verification and information risks.
Link to this lesson33Log forensics: reconstruct a sequence you can defend
11 slides · 1 practical activities · Knowledge checks
Normalise time and correlate stable identifiers while preserving raw records and collection gaps.
Topics you will explore
- Verify the source before interpreting absence
- Join on stable context, not just a familiar name
- Make the analysis reproducible
Includes practical AI use, verification and information risks.
Link to this lesson4.4Recovery, limited incidents and crises
34Disaster recovery and cybersecurity recovery
11 slides · 1 practical activities · Knowledge checks
Restore service through trusted dependencies and explicit technical/business acceptance.
Topics you will explore
- Availability recovery and security recovery are different
- Exercise the dependencies that fail together
- Use explicit acceptance and monitoring
Includes practical AI use, verification and information risks.
Link to this lesson35Handle a limited-scope incident without missing expansion
11 slides · 1 practical activities · Knowledge checks
Resolve a bounded event with explicit scope checks, verification and escalation triggers.
Topics you will explore
- Define why the scope appears limited
- Take a proportionate action with verification
- Set conditions that change the response
Includes practical AI use, verification and information risks.
Link to this lesson36Handle a crisis and hand over the technical picture
12 slides · 1 practical activities · Knowledge checks
Escalate by business impact and provide a usable decision brief during a changing incident.
Topics you will explore
- Create a decision structure when many teams are involved
- Give leadership a usable technical picture
- Bring the gated-delivery scenario together
- Turn the incident into reviewed improvements
Includes practical AI use, verification and information risks.
Link to this lessonNo lessons match your search. Try another topic or clear the search.
AI
Practical AI use, with human judgement.
This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.
AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.