Cybersecurity

A single free lesson covering all nine cybersecurity domains. Required before unlocking any sub-track.

First lesson: Overview of All Cybersecurity Domains

Passwords, MFA, RBAC, SSO, Privileged Access Management, hands-on Entra ID / AWS IAM / OAuth flows / Zero Trust.

First lesson: What is IAM?

CVEs, CVSS, Nmap scanning, hands-on OpenVAS, enterprise patch management, and continuous vulnerability programs.

First lesson: What is Vulnerability Management?

OWASP Top 10 (hands-on in DVWA and WebGoat), injection, XSS, secure code review, bug bounty, and WAFs.

First lesson: What is Application Security?

NIST IR lifecycle, detection, containment, eradication, recovery, SIEM with Splunk, and tabletop exercises.

First lesson: What is Incident Response?

Data classification, encryption, DLP tools, insider threats, and compliance regulations.

First lesson: What is Data Leakage?

Ethics-first legal frame, full PTES methodology, exploitation, web app testing, post-exploit, HTB Starting Point passion project, and professional reporting.

First lesson: Ethics and the Law (Mandatory First)

Risk assessment, security policies, compliance frameworks, and business continuity.

First lesson: What is Risk Management?

OS hardening, endpoint protection platforms, MDM, patch management, and IoT security.

First lesson: What is Endpoint Security?

Threat actors, IoCs vs IoAs, OSINT toolkit (Shodan, Censys, VirusTotal, URLscan), MITRE ATT&CK Navigator, threat-report writing, and ISACs.

First lesson: What is Threat Intelligence?

An in-depth study of the NIST CSF. Understand how each function maps to real controls and other frameworks.

First lesson: Introduction to the NIST Framework

AI-powered threat detection, SOC automation, vulnerability assessment, pen testing augmentation, and securing AI systems. Optional sub-track within Cybersecurity.

First lesson: AI in Cybersecurity: The Landscape

The networking foundation for the whole Cybersecurity track: OSI and TCP/IP, TCP vs UDP, Wireshark, ARP spoofing, man-in-the-middle, SYN floods and DDoS, DNS attacks, and wireless attacks. Hands-on labs in isolated environments. Prerequisite knowledge for Penetration Testing and Incident Response.

First lesson: Networking for Security: Why Protocols Are the Battleground

How attackers brute force, crack, and stuff credentials (Hydra, hashcat, John), the online-vs-offline distinction, and the defensive side: password managers, passkeys, and credential hygiene for users and developers. Hands-on DVWA lab.

First lesson: Credentials: The Keys to the Kingdom

The practical foundation for every hands-on lab: install VirtualBox and Kali Linux, configure isolated networking, use snapshots, add a vulnerable target VM, and learn the Kali tool categories you will use throughout the track. Take this before any lab that requires Kali.

First lesson: Setting Up a Kali Linux Lab

Symmetric and asymmetric encryption, hash functions and HMAC, key exchange and digital signatures, TLS 1.3 in depth, and practical cryptography for developers (which primitive to use, which library, and what never to implement yourself).

First lesson: What Cryptography Protects

Android and iOS security models, the OWASP Mobile Top 10, static analysis (jadx, APK decompilation), dynamic analysis (Frida, Burp proxy), and common mobile vulnerabilities. Hands-on with a deliberately vulnerable app.

First lesson: The Mobile Security Landscape

The shared responsibility model, IAM misconfigurations and least privilege, cloud attack techniques (metadata SSRF, privilege escalation), cloud security tooling (Prowler, ScoutSuite, Trivy), and secrets management. Hands-on with CloudGoat.

First lesson: Cloud Security and the Shared Responsibility Model

An advanced subtrack: static analysis (file formats, PE/ELF), disassembly and decompilation with Ghidra, dynamic analysis and safe handling, malware categories, sandbox analysis, and YARA rules. No real malware is ever used in labs.

First lesson: What Reverse Engineering Is

Active Directory structure, Kerberos and NTLM authentication, common AD attacks (Pass-the-Hash, Kerberoasting, AS-REP Roasting, Golden Ticket), BloodHound attack-path mapping, and AD defense and monitoring. Hands-on with a lab AD environment.

First lesson: Active Directory: The Enterprise Attack Surface

The industry-standard web application security testing tool, from never having opened it to working as a professional tester. Four mini-tracks (Setup and Core Concepts, Repeater and Manual Testing, Intruder and Automated Attacks, Advanced Techniques) plus a portfolio passion project and job readiness. Labs use the free PortSwigger Web Security Academy. Prerequisite: Networking and Protocol Security.

First lesson: What is Burp Suite and Why Do Security Professionals Use It?