Cybersecurity Fundamentals
Think like a defender: network attack surface, threat modeling, the OWASP Top 10, core controls, identity, cryptography, frameworks and the rules of ethical testing.
Leads to: Cybersecurity Engineer, Systems Analyst, Cloud Engineer, DevOps / Site Reliability Engineer, IT Support Specialist
Before you start
This course builds on Networking Fundamentals. Take it first if you are new to the topic.
About this course
Security is everyone's problem, but cybersecurity engineers, systems analysts and cloud engineers are the people who think about it for a living. Building on Networking Fundamentals, this intermediate course teaches the defender's view of the systems you already know. The first module revisits packets, ports, DNS, HTTP and TLS as attack surface: what is exposed, how it gets abused, and what the abuse looks like in logs. The second module covers the attacker mindset: threat modeling with STRIDE, the OWASP Top 10 web risks, and a hands-on exercise where you find and fix a cross-site scripting flaw. The third module builds defensive foundations: the CIA triad and control types, identity and access management with MFA and least privilege, and cryptography basics with a Python hashlib exercise. The last module covers governance and careers: the NIST Cybersecurity Framework and CIS Controls, the legal and ethical rules of security testing, and a plan for CompTIA Security+ study and a safe home lab. Throughout, you only test systems you own or have written permission to test.
Course content
Module 1
Networks for Defenders
3 lessons · 1h 16mPackets, ports, DNS, HTTP and TLS seen as attack surface: what is exposed, how it is abused, and what the abuse looks like in logs.
- 25mPackets, ports, and protocolsReading
Look at packets, ports and protocols the way a defender does: every listening service is part of your attack surface.
- 24mDNS and HTTP in 6 minutesReading
Recognise how attackers abuse DNS and HTTP, and spot the patterns those attacks leave in logs.
- 27mWhy TLS mattersReading
Explain what TLS protects (confidentiality, integrity, server identity in transit) and what it does not protect.
Module 2
Attacker Mindset
3 lessons · 1h 55mThreat modeling with STRIDE, the OWASP Top 10, and finding and fixing a cross-site scripting flaw.
- 46mThreat modeling for beginnersReading
Threat-model a small app: draw its data flows and trust boundaries, then find threats with STRIDE and choose fixes.
- 30mOWASP Top 10 explainedReading
Name and explain the OWASP Top 10 web application risks, with a plain-English example and fix for each.
- 39mFind the flaw in this appReading
Find a cross-site scripting (XSS) flaw in a small comment board and fix it by treating user input as text.
Module 3
Defensive Foundations
3 lessons · 1h 10mThe CIA triad and control types, identity and access management, and cryptography basics.
- 22mThe CIA triad and controlsReading
Use the CIA triad to describe what a control protects, and classify controls by category and type.
- 21mIdentity and accessReading
Apply authentication, MFA and least privilege so each person and service gets only the access it needs.
- 27mCryptography basicsReading
Explain the difference between encoding, hashing and encryption, and use Python's hashlib to check integrity and store passwords safely.
Module 4
Governance and Careers
3 lessons · 1h 29mThe NIST Cybersecurity Framework and CIS Controls, legal and ethical hacking, and planning certifications and a home lab.
- 10mFrameworks: NIST CSF and CISReading
Map everyday security controls to the six NIST Cybersecurity Framework functions and the CIS Critical Security Controls.
- 25mLegal and ethical hackingReading
Explain why written authorisation is what separates security testing from crime, and how responsible disclosure works.
- 54mCertifications and labsReading
Plan your CompTIA Security+ study and build a safe, isolated home lab for hands-on practice.