NOTES

This certificate’s first three courses lay a comprehensive foundation in cybersecurity

fundamentals, risk management, and network security. They target entry‑level cyber roles
(e.g. cybersecurity analyst, SOC analyst). Course 1 introduces the cybersecurity field,
history of attacks, security domains, frameworks (like CISSP domains and the CIA triad),
ethics, and basic analyst tools. Course 2 focuses on threats/vulnerabilities, risk
management (NIST, OWASP, CIA triad), security controls, SIEM-based monitoring, and
incident response playbooks. Course 3 covers networking basics (LAN/WAN, TCP/IP,
protocols), network security measures (firewalls, VPNs, proxies), common network attacks
(DoS, sniffing, IP spoofing), and hardening of systems and cloud networks. Each course
includes dozens of videos/readings plus hands-on labs (e.g. designing a LAN, analyzing
packet captures, conducting a security audit). These build practical skills using tools like
Linux CLI, packet analyzers (tcpdump/Wireshark), SIEM platforms, firewall/VPN tools, and
scripting (Python/SQL).

Course 1: Foundations of Cybersecurity

Course 1 introduces the cybersecurity profession and core concepts. Learners review
landmark cyberattacks (e.g. Brain virus, Morris worm) to see how real incidents shaped
security practices. The CISSP eight security domains (such as access control, security
architecture, asset security) are outlined, along with security frameworks and controls
(e.g. NIST framework). Key concepts include the CIA triad – Confidentiality (keeping data
secret), Integrity (preventing tampering), and Availability (ensuring access) – and how these
underpin all security controls. The course also covers security ethics (professional
conduct, responsible disclosure) as a fundamental duty in cybersecurity.

• Cybersecurity Roles & Skills: Defines the role of an entry‑level cybersecurity

analyst (monitoring, incident response, policy implementation) and essential soft
skills (communication, teamwork). Examines how security incidents affect
business operations and why defense is crucial.
• Historical Attacks & Evolution: Studies early cyber incidents (e.g. Brain virus,
Morris worm) to illustrate evolving threats Learners analyze case studies of past
breaches to understand attack vectors and industry responses, providing context
for modern defenses.
 • CISSP Security Domains: Introduces the CISSP’s eight domains (like Network
Security, Asset Security) and explains how these broad areas organize security
knowledge. For example, Security Architecture covers designing secure networks,
while Security Operations covers monitoring and incident handling.
• Security Frameworks & Controls: Explains industry frameworks (e.g. NIST
Cybersecurity Framework, ISO controls) and how organizations apply controls
(technical and administrative) to manage risk. For instance, it shows how an
organization uses NIST’s RMF steps (Identify, Protect, Detect, Respond, Recover) to
structure its security program.
• CIA Triad & Risk Concepts: Defines confidentiality, integrity, availability in detail,
with examples (e.g. encryption for confidentiality, checksums for integrity).
Differentiates threats (potential harmful events), vulnerabilities (weaknesses), and
risk (likelihood/impact of threats exploiting vulnerabilities).
• Security Ethics: Discusses ethics principles (privacy, fairness, disclosure) and
real‑world dilemmas (e.g. gray‑hat research). Emphasizes professional codes (like
ISACA/ISC² ethics) that guide analysts' behavior.
• Tools & Programming: Surveys common analyst tools. For example, SIEM
platforms (e.g. Splunk, Elasticsearch SIEM) aggregate and correlate logs to detect
incidents. Packet analyzers (e.g. Wireshark, tcpdump) let analysts capture and
inspect network traffic. The course also covers basics of SQL and Python for
querying logs or scripting simple automation.
• Hands-On Activities: Guided labs let learners experiment with security tools and
scenarios. Activities include using network simulation tools (designing a LAN),
exploring SIEM dashboards, and building a personal cybersecurity roadmap. A key
portfolio project is drafting a professional statement (a resume-style summary of
one’s security skills).

Course 2: Play It Safe: Manage Security Risks

Course 2 deepens knowledge of threats, risk management, and defenses. It starts with
security domains and threat landscape: learners review primary threats (malware,
phishing, DDoS) and the common vulnerabilities (e.g. unpatched software, weak
passwords) that security analysts guard against. The course then covers security
frameworks and controls: it explains the CIA triad again and examines NIST (CSF, RMF)
and OWASP principles for secure system design. Students learn how businesses use these
frameworks and controls (firewalls, access controls, encryption) to mitigate risk. For
example, the NIST Risk Management Framework (RMF) process is introduced as a
structured way to assess and manage risk.

Key topics and concepts in Course 2 include:

• Threats, Risks, and Vulnerabilities: Defines each term and shows examples. For
instance, a threat could be a phishing campaign, a vulnerability might be an open
port or missing patch, and risk is the potential loss (e.g. data theft) if exploitation
occurs. Exercises have learners classify scenarios (e.g. “Unencrypted credit card
storage = vulnerability leading to high risk”).
• Security Frameworks (CIA/NIST/OWASP): Explains the CIA triad (again, to ground
all security work) and overviews NIST frameworks. Learners explore NIST CSF’s core
functions (Identify, Protect, Detect, Respond, Recover) and OWASP’s top 10
security principles (like least privilege, input validation) as baseline controls.
• Security Controls & Auditing: Covers technical and procedural controls (network
firewalls, intrusion prevention, policies). Learners practice a security audit: a
systematic review of a mock company’s policies and systems against a security
framework. (A graded portfolio activity guides learners to conduct a security audit
and document findings).
• SIEM and Log Management: Introduces Security Information and Event
Management (SIEM) tools (e.g. Splunk, Elastic SIEM). Students learn how these
tools collect logs from devices and use dashboards/alerts to spot anomalies. For
example, a lab might show how a SIEM alerts on repeated failed logins (indicating a
brute-force attack). Learners also practice analyzing sample event logs to find
security issues.
• Incident Response & Playbooks: Teaches the phases of incident response
(Identify, Contain, Eradicate, Recover). Emphasis is on playbooks – pre-defined
response procedures for common incidents. Learners examine a simulated
incident and apply a playbook step-by-step. For example, if a malware outbreak
occurs, the playbook guides them through isolating affected systems, eradicating
malware, and recovering data.
• Hands-On Labs: Course 2 includes interactive challenges: analyzing SIEM alerts,
performing mock audits, and walking through incident response scenarios. The
Portfolio Lab is a mini audit: students review a case study and draft an audit report.
A plugin lab “Practice: Respond to a SIEM alert” has learners follow a playbook in a
realistic scenario.
Course 3: Connect and Protect: Networks and Network
Security
Course 3 builds on prior topics by teaching networking fundamentals and defense
techniques. It starts with network architecture: students learn how devices interconnect
via LANs, WANs, and cloud networks. Key models are introduced – for example, the four-
layer TCP/IP model (Application, Transport, Internet, Link) and the seven-layer OSI model.
Modules cover IP addressing/subnetting and basic device roles: routers, switches, hubs.
For instance, students may design a simple network diagram showing how a router
connects an office LAN to the Internet and where firewalls sit in that diagram.

Next, network operations and protocols are explored. Learners study core protocols
(TCP, UDP, IP, DNS, DHCP, HTTPS, etc.) and understand how data is packaged and routed.
The course compares wired vs wireless protocols (e.g. 802.11 Wi-Fi security standards)
and discusses subnetting/CIDR notation for IP ranges. It also details network devices
(modems, access points) and concepts like VLANs and cloud-based software-defined
networks (SDN).

The security focus then moves to network defense measures:

• Firewalls: Students learn both hardware and software firewalls. For example, a lab
might show how to configure iptables rules on Linux to block unwanted traffic.
Topics include stateful vs. stateless firewalls and creating security zones (DMZ for
public servers, internal trusted zones).
• Virtual Private Networks (VPNs): Covers how VPNs (e.g. Wire Guard, IPSec)
encrypt network traffic between sites or remote users. The course explains
tunneling and demonstrates secure remote access solutions.
• Proxy Servers & Network Filtering: Introduces proxies that filter web traffic and
protect internal resources. Students learn how proxies and network policies can
block malicious domains or restrict outgoing connections.

Students then study common network attacks and analysis techniques:

• Denial-of-Service (DoS/DDoS): Covers volumetric and protocol attacks that

overwhelm networks. E.g. the course examines a real-world DDoS incident and how
volume-based flooding crippled a site.
• Packet Sniffing & Man-in-the-Middle: Explains how attackers can eavesdrop on
unencrypted traffic. Learner's practice using packet-capture tools: e.g. they might
 run tcpdump on a network link and decode the capture to find credentials or
session cookies.
• IP Spoofing & ARP Spoofing: Shows how malicious actors fake IP/MAC addresses
to intercept traffic. Students might analyze log excerpts to identify signs of a
spoofing attack. Hands-on plugins ask learners to “Identify: Network attacks” by
looking at packet data.

Finally, hardening techniques are taught to prevent future attacks. This includes:

• Operating System Hardening: Steps like closing open ports, applying patches,
enforcing strong authentication, and using host-based firewalls. For example, a lab
walkthrough demonstrates disabling unneeded services on a Linux server.
• Network Hardening: Measures such as secure VLAN design, network
segmentation, and intrusion detection/prevention systems (IDS/IPS). Students see
how placing critical servers behind additional firewalls reduces exposure.
• Cloud Network Security: Basics of cloud networking (e.g. VPCs in AWS/GCP), plus
challenges like multi-tenant security. The course explains encryption for data in
transit (TLS) and at rest (AES) as part of hardening.
• Cryptography Fundamentals: Covers the role of encryption and key management.
For instance, students learn that HTTPS (TLS) uses public-key crypto to secure web
traffic.

Hands-On Projects: Course 3 includes numerous labs. Learners design and diagram a
LAN, set up basic firewall rules, and analyze real traffic captures. A notable lab is “Identify:
Functions of network tools” (e.g. ping, traceroute, netstat). For network attacks, activities
have students inspect tcpdump logs and use them to diagnose issues. The portfolio
activity asks students to perform a “network structure and security analysis”: using the
NIST Cybersecurity Framework, they respond to a scenario requiring recommendations on
network design and defenses.

Each of these courses progressively builds the learner’s capabilities. By mid-2025

standards, the material is up to date with modern tools and frameworks, ensuring the
foundations learned align with current industry practice.