SEC301: Introduction to Cyber Security

Overview

Every strong security program begins with understanding why security matters and how risk actually forms. Day 1 anchors the course with plain-language fundamentals the human, legal, and technical building blocks that make cybersecurity both possible and practical. Students move from abstract ideas (“hackers and firewalls”) to clear reasoning: how threats exploit vulnerabilities, why availability can be as life-critical as confidentiality, and how frameworks turn scattered controls into repeatable habits of trust.

By the end of this section, learners can explain the CIA Triad, apply the Risk = Threat × Vulnerability × Impact model to real situations, and recognize that cyber resilience depends as much on communication and accountability as on technology. The day closes by connecting these ideas to global compliance frameworks GDPR, HIPAA, SOX and showing that security is really about people, process, and proof.

Cybersecurity is not a collection of tools it’s a way of thinking. Section 1 transforms beginners into informed practitioners who can describe why controls exist, how risk evolves, and what accountability looks like when things go wrong. From the first lab forward, learners begin building the confidence to explain, choose, and apply controls that protect both people and mission because trust, once earned, is the true currency of security.

Full Lab Details

• Lab 1.1 - The Risk Equation in Action
• Students explore what cybersecurity really means beyond firewalls and hackers—learning that it’s ultimately about protecting trust. Through real-world hospital scenarios, they apply the Threat × Vulnerability × Impact = Risk formula to reason through how small, everyday actions—like patching or clicking an email—shape organizational risk. The lab builds foundational understanding of the CIA Triad (Confidentiality, Integrity, Availability) and teaches students to see security as balance, not fear.
• Lab 1.2 – The Missing Patch
• In this hospital-based scenario, students examine how delayed updates and “just one more day” decisions create systemic risk. They learn to connect technical vulnerabilities to operational and safety impacts, and to frame risks in business language that leadership understands. The lab highlights that cybersecurity and safety are partners—not opposites—and that effective communication and accountability drive resilience.
• Lab 1.3 – To Report or Not?
• Students step into the role of a compliance lead managing a cross-border incident involving a lost device and potential data exposure. They learn to distinguish between incidents, suspected breaches, and confirmed breaches, and to apply international laws like GDPR, PDPA, and PIPEDA. The exercise emphasizes judgment under time pressure—deciding who to notify, when, and why—and shows how timely, documented decisions convert legal risk into credibility.
• Lab 1.4 – Frameworks in the Wild
• Acting as a GRC advisor for a global airline, students untangle the alphabet soup of GDPR, NIST CSF, ISO 27001, and CIS Controls to design a unified security governance model. They discover that frameworks aren’t red tape—they’re a shared language of accountability that connects strategy, compliance, and daily operations. By the end, students can map frameworks to risk areas and explain how alignment across teams builds organizational trust and consistency.
• Lab 1.5 – Evidence Trail
• Students follow an investigation inside a medical organization to understand how to preserve evidence integrity and maintain a defensible chain of custody. They practice documenting each handoff, applying Legal Holds, and explaining why proper process matters as much as technical skill. The lab reinforces that credibility in cybersecurity comes from proof, not just prevention—and that documentation transforms response into resilience.

Overview

Section 2 moves from why security matters to how digital trust is built and verified. Students explore how cryptography underpins nearly every act of trust in the modern enterprise—from a secure login to a cloud transaction or a digital signature. The day follows the chain of digital trust step by step: first encrypting data for confidentiality and integrity, then proving identity through certificates, and finally enforcing accountability through authentication, authorization, and logging.

Learners discover that cryptography isn’t magic—it’s math that earns trust—and that identity systems don’t just control access; they define responsibility. By the end of the day, students can explain in plain language how encryption, certificates, and identity management combine to make “Zero Trust” possible.

By the end of Section 2, students can trace how every secure interaction—from encryption to login to audit log—relies on cryptographic proof and disciplined identity management. They learn that the real challenge isn’t technology, but earning and maintaining trust: protecting keys, verifying identity, enforcing least privilege, and proving integrity at every step. Day 2 transforms abstract math into the language of credibility—showing that in cybersecurity, trust is not a feeling; it’s a function.

Full Lab Details

• Lab 2.1 – Secrets, Salts, and the Trust Equation
• Students experience how math creates digital trust by verifying integrity and protecting confidentiality. They compute file hashes, observe how even small changes alter a digital fingerprint, and apply symmetric and asymmetric encryption to protect data. The lab distinguishes hashing (proof of integrity) from encryption (control of visibility)—showing that cybersecurity begins with measurable, mathematical trust, not assumption.
• Lab 2.2 – Keys to the Kingdom: Proving Identity
• Students generate RSA and ECC key pairs, create digital signatures, and verify authenticity using public-key cryptography. They see how private keys sign and public keys verify, proving both integrity and authenticity. Through hands-on tampering tests, learners understand why digital signatures underpin everything from software updates to legal documents—and that trust must be proven, not presumed.
• Lab 2.3 – Lock, Stock, and Certificate
• Students build a small HTTPS website with a self-signed TLS certificate and test how browsers and tools respond. They learn that TLS ensures encryption, not legitimacy, and that HTTPS warnings are signs of protection, not failure. By inspecting certificates and comparing them to real CA-issued versions, learners separate confidentiality (the lock) from authentication (the identity)—understanding why TLS ≠ trust.
• Lab 2.4 – Who Are You? The AAA of Digital Identity
• Students investigate an insider-style data incident and apply the AAA model to pinpoint where trust broke down. Through analysis and discussion, they learn how authentication proves identity, authorization limits actions, and accounting provides visibility and evidence. The lab reinforces that trust is a system, not a setting—and that least privilege, logging, and accountability are inseparable pillars of identity security.
• Lab 2.5 – The Passwordless Pivot
• Students explore how passkeys replace passwords using public/private key pairs for phishing-resistant authentication. They analyze real-world rollout challenges—device recovery, privacy, and legacy systems—and design a hybrid deployment strategy. Beyond technology, they discover that passwordless adoption is about trust and culture: making users feel secure and confident in the systems that protect them

Overview

Section 3 shifts the learner’s focus from individual systems to the pathways that connect them. Every modern attack, investigation, and defense activity relies on understanding how data moves across networks—and how visibility, segmentation, and trust change along the way.

Students start by demystifying network fundamentals: layers, packets, ports, and protocols. They trace what really happens when you load a web page or send an email, seeing how every hop leaves behind clues defenders can use. From there, they explore addressing and routing, DNS resolution, and the difference between metadata and content. The day then expands into how traffic is filtered, logged, and segmented through firewalls, proxies, and DMZs—and how design decisions at these layers shape both performance and security.

The capstone concept, Zero Trust networking, ties it all together: the idea that in modern environments, trust is not a perimeter but a process—one continually verified for every user, device, and packet in motion. By day’s end, students can visualize the full journey of data, explain how it’s protected (or exposed) at each stage, and apply the language of networks to real-world defense decisions.

Data in motion is where visibility, trust, and vulnerability converge. Section 3 transforms abstract network diagrams into a living system of connections, dependencies, and controls. Students walk away able to see the network as defenders do—understanding how information flows, how attacks exploit those flows, and how layered defenses keep operations resilient.

Full Lab Details

• Lab 3.1 – Ports and Protocols
• Students learn how to “read” network behavior by exploring how ports, protocols, and services define communication. Through hands-on tests with DNS, HTTP, and HTTPS, they discover how ports signal purpose and intent — and how unusual or non-standard activity can reveal misconfiguration or attack. The lab builds intuition for interpreting metadata as meaningful evidence, teaching that knowing what normal looks like is the first step in detection.
• Lab 3.2 – HopbyHop
• Students use traceroute to follow packets hop by hop across internal and external networks. They analyze what each router reveals, where visibility stops, and how encryption alters what defenders can observe. The lab reinforces that every network path represents both a dependency and a trust relationship—teaching learners to recognize where control ends, why encryption is non-negotiable, and how network visibility shapes real-world defense.
• Lab 3.3 – DNS Detective
• In this investigative lab, students dig into DNS to uncover how domains resolve, compare results across multiple resolvers, and trace the root-to-authoritative chain of trust. They examine record types (A, MX, TXT, NS, DNSKEY) and see how attackers exploit them. By the end, students understand that DNS isn’t just a naming service — it’s an early-warning system for integrity and visibility, central to Zero Trust and digital accountability.
• Lab 3.4 – Encrypted, Not Invisible
• Students confront the paradox of encryption: it protects users and hides threats. Working through a simulated TLS 1.3 incident, they learn how to balance privacy and inspection, distinguishing between encryption and trust. The exercise emphasizes that modern defenders rely on metadata, governance, and context—not decryption alone—to detect hidden risks. The key takeaway: encryption protects information, but visibility protects people.
• Lab 3.5 – Zero Trust, Zero Assumptions
• Learners step into the role of an advisor helping an enterprise evolve from perimeter-based security to Zero Trust architecture. They apply identity verification, least privilege, microsegmentation, and continuous monitoring to stop a ransomware-style incident. This lab transforms “Zero Trust” from buzzword to blueprint—showing that trust isn’t removed; it’s earned, verified, and renewed through context.

Overview

Day 4 moves from defense to offense—not to make students hackers, but to help them think like one. By understanding how attackers choose their targets, exploit trust, and chain together small weaknesses into major compromises, learners develop the mindset needed to anticipate, detect, and disrupt modern attacks.

The day begins with the human side of exploitation—phishing, social engineering, and credential abuse—before expanding into the technical realities of wireless compromise, malware behavior, and living-off-the-land attacks. Students learn how adversaries bypass firewalls, manipulate trust, and weaponize legitimate tools like PowerShell or cloud services.

From there, the course explores how AI is reshaping both sides of the battlefield: automating phishing, voice cloning, malware generation, and disinformation campaigns. Learners conclude the day by mapping attacker behavior using MITRE ATT&CK and D3FEND, translating complex intrusions into a structured model that connects offensive tactics to defensive countermeasures.

By the end of Section 4, students can recognize not just what an attacker did, but why—and use that understanding to design defenses that stay one step ahead.

Full Lab Details

• Lab 4.1 – The Many Doors In
• Students trace a realistic multi-vector intrusion where phishing, smishing, vishing, USB drops, and credential reuse combine into a cascading breach. They learn how attackers chain social engineering with technical exploits and how small human decisions either close or open attack paths. The lab reinforces that defense succeeds when awareness, architecture, and culture intersect—turning every employee into a part of the security perimeter.
• Lab 4.2 – Rogue Signal
• Students investigate a rogue Wi-Fi “Evil Twin” scenario to understand how attackers impersonate trusted networks and intercept data. They explore man-in-the-middle tactics, credential theft, and the limitations of encryption when authenticity is faked. Through response and reflection, learners connect these lessons to Zero Trust principles, emphasizing continuous verification, VPN auto-connect, and human vigilance as the real wireless defense.
• Lab 4.3 – Name That Malware
• Through a series of short, realistic case studies, students identify and analyze common malware types—worms, Trojans, RATs, keyloggers, ransomware, and fileless attacks. Each scenario reveals behavioral patterns and propagation methods, helping learners distinguish between code types by intent and action, not file name. The lab builds analytic reasoning, showing how visibility and layered defenses turn detection into understanding.
• Lab 4.4 – The AI Arms Race: Who’s Winning?
• Students step into the role of a security governance team evaluating an AI-driven SOC pilot. They interpret operational data, financial outcomes, and staff sentiment to balance automation with human oversight. The exercise highlights that speed without trust creates fragility, and the strongest defense model keeps humans in the loop — pairing automation with explainability, transparency, and cultural alignment.
• Lab 4.5 – ATT&CK & D3FEND
• Learners use the MITRE ATT&CK and D3FEND frameworks to connect offensive tactics to defensive actions. They map phishing and PowerShell abuse to specific ATT&CK techniques, then identify corresponding D3FEND controls like content filtering and executable allowlisting. By the end, students can translate raw alerts into structured intelligence—turning investigation findings into clear, actionable reporting that bridges technical analysis and business communication.

Overview

Day 5 brings the course full circle—from individual awareness to organizational resilience. Students move from understanding how attacks happen to mastering how modern defenses work together. They’ll see how technologies like SIEM, EDR, IDS/IPS, IAM, and SOAR form the nervous system of a security program—collecting, correlating, and responding to threats across networks, endpoints, and cloud environments.

The day opens with the web itself, where most attacks still begin. Students dissect web application vulnerabilities like XSS, SQL injection, and clickjacking, learning how insecure input, weak validation, and missing controls turn trusted sites into attack platforms. They explore HTTPS, security headers, and OWASP Top 10 risks—and see how even secure connections don’t guarantee secure applications.

From there, the focus shifts to the tools and teams that power cybersecurity in practice. Learners step inside the SOC to experience how alerts become action, how automation supports humans (not replaces them), and how roles from GRC to Red and Purple Teams combine for continuous improvement. They then move beyond the SOC—into the cloud, IoT, and OT—to understand shared responsibility, configuration risk, and how digital and physical systems are increasingly connected.

Finally, students look ahead to the future of defense, exploring how AI is reshaping security operations, decision-making, and ethics. They learn to separate hype from value, balancing automation with oversight, and discovering why the most resilient organizations are human-led but machine-accelerated.

By the end of this section, learners can explain, evaluate, and communicate how all these technologies, teams, and trends fit into a single goal: protecting data, people, and trust—wherever they live.

Full Lab Details

• Lab 5.1 – The Web We Built: Layers of Trust
• Students analyze a real-world web security incident to see how misplaced trust, weak validation, and missing controls combine into compromise. They explore how vulnerabilities like XSS, SQL Injection, and insecure headers arise from everyday development shortcuts and organizational pressure. The lab emphasizes that secure web design is a shared responsibility—spanning users, developers, administrators, and leadership—and that encryption alone doesn’t equal safety.
• Lab 5.2 – Inside the Glass Box
• Learners step into a live Security Operations Center (SOC) scenario to experience detection, automation, and collaboration in action. They follow alerts through SIEM, EDR, and SOAR, practicing triage, escalation, and communication under pressure. The lab shows that effective defense depends not on tools, but on coordination, clarity, and trust between teams—turning chaos into confidence during incidents.
• Lab 5.3 – The Cloud Breach That Wasn’t
• Through six short case studies, students uncover how shared responsibility defines cloud security success or failure. They analyze SaaS, PaaS, and IaaS contracts to pinpoint where customer misconfigurations—not provider flaws—caused data exposure. The lab reinforces that cloud security is a partnership, not a handoff, and that resilience depends on clear ownership, visibility, and continuous governance.
• Lab 5.4 – The Factory Floor Goes Dark
• Students investigate how a well-intentioned IT security update shut down an entire factory floor, exploring the clash between data protection and physical safety in converged IT/OT networks. They identify failures in segmentation, change control, and collaboration, learning that real resilience requires balance between confidentiality, integrity, and availability. The lab highlights the principle of shared fate — where cybersecurity and operational safety depend on coordination, not control.
• Lab 5.5 – Human + Machine
• Learners design the SOC of the future, comparing automation-driven and human-centered defense models. They build strategies that blend AI efficiency with human judgment, emphasizing training, ethics, and adaptability. By the end, students can articulate how future-ready security programs will learn faster than attackers by combining machine precision with human wisdom — creating a culture of trust, resilience, and continuous improvement.