Cybersecurity Foundations

6 months duration

8 modules

Updated Jul 30, 2026

Infrastructure & Security

Course Overview

Get to know what this course is all about and what you'll learn

Course Description

Cybersecurity Foundations is a seven-week grounding in how security works in practice. You'll build the essential base — networking, operating systems, and the security mindset — then get hands-on with the fundamentals of finding and understanding vulnerabilities in a safe lab.

What you'll learn

Explain core networking concepts relevant to security
Operate Linux and Windows systems for security tasks
Describe the threat landscape and common attack types
Perform reconnaissance and network scanning with standard tools
Identify and safely demonstrate common vulnerabilities in a lab
Recognise the OWASP Top 10 web application risks
Complete and document a guided penetration-testing lab exercise

How it's delivered

Weekday lessons are on-demand (Monday–Thursday); live weekend sessions apply each week's topic with a mentor. The course ends with a capstone project. Submit every exercise and your capstone through your workspace.

What You'll Learn

Understand how systems are attacked — and defended. Cybersecurity Foundations covers networking, operating systems, and the hands-on basics of reconnaissance, vulnerabilities, and web security — ending with a guided lab exercise you document.

Course Curriculum

8 modules • Instructor-led • Hands-on projects

Course Curriculum

Prerequisites

Curiosity about how systems work and comfort with a computer; command-line exposure helps. No security background required. A laptop able to run virtual machines, plus an internet connection. (This is a foundations-and-awareness program; advanced offensive topics such as privilege escalation and DevSecOps are covered in the full program.)

Learning Objectives

Explain core networking concepts relevant to security
Operate Linux and Windows systems for security tasks
Describe the threat landscape and common attack types
Perform reconnaissance and network scanning with standard tools
Identify and safely demonstrate common vulnerabilities in a lab
Recognise the OWASP Top 10 web application risks
Complete and document a guided penetration-testing lab exercise

Course Modules

Master the fundamental tool that every professional developer uses daily. Learn to track changes, collaborate with others, and manage your code like a pro from the very beginning of your development journey.

What you'll learn

Understand version control concepts and why Git is essential for modern software development
Use GitHub effectively for remote repositories, collaboration, and showcasing your work to potential employers
Master Git basics including repositories, commits, branches, and merging for effective code management.

The foundation every cybersecurity professional must master. From the OSI model and TCP/IP stack to subnetting, DNS, NAT, routing, switching, and security devices like firewalls and IDS/IPS — with a first hands-on look at packet analysis in Wireshark. Hands-on project: Configure a simulated network topology in Cisco Packet Tracer with segmented VLANs, assign IP ranges, and document the network map.

What you'll learn

OSI Model and TCP/IP stack — layers, protocols, and how data flows
IP addressing, subnetting, CIDR blocks, and VLANs
DNS, DHCP, ARP, NAT — how the internet actually works
Routing and switching fundamentals (routers, switches, hubs)
Network topologies: LAN, WAN, MAN, and cloud networking
Firewalls, proxies, IDS/IPS — network security devices overview
Packet analysis introduction using Wireshark

Command the operating system that runs the cloud and cybersecurity tools. Filesystem layout, essential CLI, permissions, shell scripting, scheduled tasks, package management, and log-driven system monitoring. Hands-on project: Write a shell script that performs automated server backups on a schedule, sends alert emails on failure, and logs all activity.

What you'll learn

Linux filesystem hierarchy: /, /etc, /var, /proc, /home
Essential CLI commands: ls, cd, chmod, chown, grep, find, curl
Users, groups, permissions, and sudo privilege management
Shell scripting: variables, loops, conditionals, and automation
Cron jobs, background processes, and systemd services
Package management: apt, yum, and pip
Log files and system monitoring (/var/log)

Master the OS that runs most enterprise environments. Windows architecture, Active Directory, file system permissions, PowerShell administration, and the built-in defensive tooling every analyst needs at hand. Hands-on project: Set up a Windows Server VM, create user accounts with role-based permissions, and apply Group Policy restrictions.

What you'll learn

Windows architecture: kernel, registry, services, and processes
Active Directory basics — users, groups, and policies (GPO)
File system permissions: NTFS, ACLs, and sharing
Windows CLI and PowerShell essentials for administration
Task Manager, Event Viewer, and built-in diagnostic tools
Windows Firewall and Defender configuration

Build the defender's mindset before picking up offensive tools. The CIA triad, threat taxonomies, security frameworks, authentication models, cryptography basics, and risk-driven prioritisation. Hands-on project: Perform a basic threat model on a fictional company and present a risk matrix with recommended mitigations.

What you'll learn

CIA Triad: Confidentiality, Integrity, Availability
Types of threats: malware, social engineering, insider threats, APTs
Security frameworks: NIST CSF, ISO 27001, CIS Controls
Authentication models: MFA, SSO, and Zero Trust
Cryptography basics: symmetric, asymmetric, hashing, PKI
Risk management: threat modeling and vulnerability prioritization

Learn to think like an attacker — before the first packet is sent. Passive vs. active recon, OSINT tooling, DNS and certificate-transparency enumeration, social-media profiling, and the legal/ethical guardrails. Hands-on project: Conduct a full passive OSINT report on an assigned target domain — map subdomains, identify exposed employees, technologies, and potential attack vectors.

What you'll learn

Passive vs. active reconnaissance techniques
OSINT: Google dorking, Shodan, Maltego, and TheHarvester
WHOIS, DNS enumeration, and certificate transparency logs
Social media profiling and employee information gathering
Footprinting a target: subdomains, emails, and technologies
Legal and ethical boundaries of reconnaissance

From finding weaknesses to proving they can be exploited. Nessus + OpenVAS scanning, CVE and CVSS literacy, Metasploit modules and payloads, manual exploitation, and the post-exploitation basics that decide whether a finding is academic or actionable. Hands-on project: Exploit a vulnerable machine (e.g., Metasploitable), document all findings with CVE references, and write a full assessment report with remediation recommendations.

What you'll learn

Vulnerability scanning with Nessus and OpenVAS
CVE, CVSS scoring, and vulnerability databases (NVD, Exploit-DB)
Metasploit Framework: modules, payloads, and sessions
Manual exploitation: buffer overflows, unpatched services
Post-exploitation fundamentals: persistence, lateral movement basics
Writing a professional vulnerability assessment report

Attack and defend the web — the most targeted surface in modern security. OWASP Top 10 end to end, manual + automated SQLi, XSS variants, broken auth and session hijacking, IDOR, SSRF, path traversal, Burp Suite tradecraft, and REST + GraphQL API testing. Hands-on project: Complete the PortSwigger Web Security Academy labs for SQL Injection and XSS. Write up findings in professional bug bounty format for each vulnerability exploited.

What you'll learn

OWASP Top 10 — theory, exploitation, and remediation for each
SQL Injection: manual and automated (sqlmap), blind SQLi
Cross-Site Scripting (XSS): reflected, stored, DOM-based
Broken authentication, session hijacking, and CSRF
IDOR, path traversal, and SSRF vulnerabilities
Burp Suite: intercepting, modifying, and repeating requests
API security testing: REST and GraphQL