Course overview
The Foundation of Cyber Defense is a lab-first introduction to the defensive side of cybersecurity. It starts from how attackers actually approach a target, then works through the everyday controls — hardening, access control, logging, monitoring and incident response — that stop most incidents before they become breaches. Every topic is practised in an isolated environment you can break without consequence.
Who this course is for
This course is designed for the following groups. If you are not sure whether you fit, ask us — a short conversation is more useful than a longer guess.
- Students considering a first role in cybersecurity
- IT support and helpdesk staff moving toward security work
- Career changers with a technical bent and no prior security experience
- Developers and system administrators who want a security foundation
- Anyone responsible for basic security in a small organisation
What you will learn
- How common attack techniques work — from phishing and credential theft to exploitation and lateral movement
- The CIA triad and how to reason about risk in practical terms
- Host hardening on Linux and Windows, with before-and-after comparison
- Identity, authentication and access control fundamentals
- Reading logs from common services and recognising suspicious behaviour
- Endpoint protection and the basics of network monitoring
- First-response steps when an incident is suspected
- Legal and ethical boundaries in defensive security work
Curriculum
The course is taught in the module order below. Each module mixes explanation with hands-on work before moving on to the next.
- Introduction to Security
- Cybersecurity Tools
- Networking Fundamentals
- Web Application Security
- Linux Fundamentals
- Defensive Security
- Windows Fundamentals
- Cloud Security Fundamentals
- Web Security Technologies
- Operations & Career Development
- Security Threats & Attack Techniques
- Capstone Project
Tools and technologies
Everything used in the course is either free, open source, or available on a free tier suitable for learning. You will install and configure each of these during the course, not just watch someone else use them.
- Kali Linux (isolated lab use only)
- Ubuntu Server
- Wireshark
- Nmap
- VirtualBox or VMware Workstation
- Standard Linux and Windows log tools
- Introductory SIEM-style log review tooling
Prerequisites
We would rather you arrive prepared than arrive surprised. These are the things you should already be comfortable with before the first session.
- Comfort using a computer and a web browser
- Basic familiarity with Windows or Linux desktop
- Willingness to work on a command line
- No prior security experience required
Hands-on labs, CTFs and projects
Most of the course is spent on machines. The work below is what turns each topic from something you have read about into something you can actually do.
- Build an isolated lab with attacker and defender virtual machines
- Phishing recognition and analysis exercise using realistic samples
- Log review and alert triage on a simulated endpoint
- Host hardening walkthrough with measurable before-and-after state
- Guided capture-the-flag focused on defensive controls rather than exploitation
Learning outcomes
When you finish this course, these are the things you should be able to do without looking them up. Anything you cannot yet do, the trainer will help you with during the final project review.
- Explain how common attack techniques work in plain, non-sensational terms
- Apply baseline hardening to Linux and Windows hosts
- Read and interpret logs from common services
- Recognise a suspected incident and follow a basic response process
- Use standard defensive tooling with confidence
- Discuss security trade-offs with technical and non-technical colleagues
Career paths
This course supports the roles below. We do not make placement claims or guarantee outcomes — what you do with the skills is up to you — but these are the job titles that most often ask for what this course teaches.
- Entry-level SOC analyst
- IT security support
- Junior security engineer
- Security-aware developer or system administrator
- Technical support for security operations teams
Frequently asked questions
Yes, provided you are comfortable using a computer and are willing to work on a command line. The course starts from the fundamentals and does not assume any prior security knowledge. It is not, however, a course for someone who has never used a computer before — you will need to be able to install software, edit files and follow instructions carefully.
No. The Linux you need for this course is introduced as we go. That said, if you have never opened a terminal, plan to spend some extra time in the first two weeks. Our Foundations of Linux System Administration course is the natural complement if you want to go deeper on that side.
It is a defensive course. You will learn how attacks work, because you cannot defend against what you do not understand, but the focus is on detection, response and hardening rather than on conducting attacks. Offensive techniques are only used inside our isolated lab environment and always within a clear legal and ethical framework.
It is designed as the foundation for more specialised work. Most students follow it with either Foundations of Network Security or Application Security Professional. It also provides the baseline understanding that employers expect for entry-level security roles and for security-aware development and operations work.
Yes, with the caveats we teach in the first session. The course uses virtual machines on an isolated network, so nothing you do can reach the internet or any other machine on your home network. We walk through the safe setup in detail before any hands-on work begins.
