Cyber Security Foundations

1. How the internet moves data

Every attack on a network is an attack on one of the layers that carry data: a forged address at the link layer, a spoofed route at the network layer, a hijacked connection at the transport layer, a poisoned name at the application layer. This lesson builds the mental model that the rest of the security curriculum depends on. It covers the layered models, what happens to a message as it is wrapped and unwrapped, how IP addressing and subnets divide the world, and how to watch all of this happen on a real machine.

2. Protocols, ports, firewalls and scanning

Knowing that data moves is not enough; a security practitioner must know which doors are open, why they are open, and how to find out without guessing. This lesson covers the protocols that run over TCP and UDP and the ports they conventionally use, how firewalls decide which packets to allow, how DNS and DHCP add their own trust problems, and how a port scanner such as nmap works. The practical has you map the services of a machine you control and judge which of them should exist.

1. The shell and the filesystem

Almost every server on the internet runs Linux, and almost every security tool is built for it. The shell is the language you use to ask the system questions and change its state, and the filesystem is the map of where configuration, logs, secrets and programs live. This lesson teaches the layout of a Linux system, the commands for moving through it and searching it, how to read and redirect output, and how to find the evidence that matters when something goes wrong.

2. Users, permissions and hardening

Linux is a multi-user system, and most of its security comes down to a small set of questions: who is this, what may they touch, and what is running on their behalf. This lesson covers user accounts and groups, the permission model and its octal notation, the special bits that quietly change behaviour, privilege escalation through sudo, and the baseline hardening that every internet-facing server should have on day one.

1. Python for security work

Security work is repetitive and evidence-driven: check a hundred hosts, parse ten thousand log lines, verify a file against a published hash, test an endpoint with a hundred inputs. Python is the common language for this because it is readable, has a large standard library and has mature packages for networking and cryptography. This lesson sets up a safe working environment, introduces the parts of Python a security practitioner uses daily, and shows how to build small, reliable checks rather than one-off hacks.

2. Parsing logs and building tools

Logs are the evidence trail of every system, and they are written by programs that do not care whether a reader can make sense of them. This lesson teaches how to parse semi-structured text safely with regular expressions and structured formats, how to write a command-line tool that others can run, how to test it, and the habits that stop a parser from becoming a vulnerability when it meets hostile input. The practical builds a small but real log analyser.