Cybersecurity Fundamentals, GRC & Cryptography

Security Architecture, Risk Assessment, NIST CSF 2.0, AES/RSA PKI & Audit Readiness

6 modules, 28 lessons: Core Security Principles; Governance, Risk & Compliance; Applied Cryptography & Keys; Data Protection & Privacy; Resilience & Disaster Recovery; Enterprise Strategy & Audit.

Beginner · 3 hours · 28 lessons · 97 labs

Who it is for

Beginner level.

For anyone starting out in security or moving into risk, compliance or audit work: analysts, project managers, IT staff and new engineers who want to answer with evidence.

What you don't need yet:

What helps:

Before you start:

Take next:

Learning paths:

Nobody needs to know everything before they start. Each course builds on the one before, so a learning path takes you there step by step.

Labs

97 labs, 81 of them graded: you write the code, it runs, and graded labs check the result. The outline lists each lesson's labs.

What is free

Start free: First module free with an account. Pro: Every course, lab, handbook, practice exam and certificate.

Course outline

Core Security Principles

  1. CIA Triad, Non-Repudiation & Parkerian Hexad (3 labs): You can name which security property an incident broke, show why a shared key cannot give non-repudiation while a signature can, and trace identification, authentication, authorisation and accountability through a real auth.log.
  2. Threat Actors, Motivations & Cyber Kill Chain (3 labs): You can tell threat actors apart by resources, skill and motive, spot a targeted visitor among scanner noise in a web log, and place incident evidence on the seven steps of the Cyber Kill Chain to see where it could have been stopped.
  3. Social Engineering, Phishing & Human Defense (4 labs): You can name the common attack vectors and social engineering techniques, read a suspicious email's raw headers and authentication results, spot lookalike domains, and judge a phishing awareness programme by how fast people report.
  4. Defense-in-Depth & Security Control Categories (4 labs): You can sort any control by category and type under both the ISC2 and Security+ schemes, and test one layer of a real defence in depth design, a fail2ban jail, against an auth.log to find the attacks it misses.
  5. Security Governance vs Security Management (4 labs): You can separate governance decisions from management work, place a document correctly among policy, standard, procedure and guideline, name the governance roles and external obligations, and produce compliance evidence that reflects how a system really behaves.

Governance, Risk & Compliance

  1. Security Baselines, Policies & Hardening Standards (3 labs): You can trace a security policy down to a testable baseline, prove what a server really enforces, and put changes to that baseline through version-controlled change management.
  2. Risk Assessment: Qualitative vs Quantitative (3 labs): You can score risks on a likelihood and impact matrix, calculate SLE, ARO and ALE to compare a risk with the cost of treating it, and track a key risk indicator against tolerance.
  3. Security Frameworks: NIST CSF 2.0, ISO 27001 & CIS (2 labs): You can explain how NIST CSF 2.0, ISO 27001 and the CIS Controls differ, use a crosswalk to find evidence gaps across all three, and test a Kubernetes pod against the restricted Pod Security Standard.
  4. Regulatory Compliance: SOC 2, HIPAA, GDPR & PCI-DSS (3 labs): You can tell which of SOC 2, HIPAA, GDPR and PCI DSS applies and why, find card data that has leaked into scope, and work out the breach notification deadlines one incident triggers.
  5. Vendor & Third-Party Risk Management Programs (4 labs): You can tier vendors by the risk they bring, choose the evidence and contract terms each tier needs, check a vendor's SBOM against advisories, and verify their SLA with your own data.

Applied Cryptography & Keys

  1. Symmetric Encryption: AES-GCM & ChaCha20 (3 labs): You can explain what AES-GCM and ChaCha20-Poly1305 add to a plain cipher, show a bit-flip attack failing against a tag, and spot the nonce reuse that breaks both.
  2. Asymmetric Cryptography: RSA, ECC & Diffie-Hellman (3 labs): You can show two parties agreeing a key in public with Diffie-Hellman and X25519, compare RSA and elliptic curve key and signature sizes, and explain why authentication and forward secrecy still matter.
  3. Cryptographic Hashing: SHA-256, SHA-3 & Passwords (4 labs): You can show what SHA-256 and SHA-3 guarantee, use HMAC where a bare hash is forgeable, store passwords with salt and a slow function, and explain how a hash chain makes a ledger tamper-evident.
  4. Public Key Infrastructure: X.509 Certificates & CAs (3 labs): You can build a CA, turn a CSR into an X.509 certificate, predict how a client's chain, name and date checks will fail, and revoke a certificate with a CRL and OCSP.
  5. Post-Quantum Cryptography & Key Lifecycles (4 labs): You can explain what a quantum computer would break, run ML-KEM and ML-DSA and weigh their sizes, plan a hybrid migration, and rotate keys with envelope encryption.

Data Protection & Privacy

  1. Data Classification Schemes & Sensitivity Labeling (3 labs): You can choose a classification label for a dataset, store it where it survives copying, and enforce it where data is shared or stored.
  2. Data States: Security at Rest, in Transit, and in Use (4 labs): You can say which state a piece of data is in, which attacker that state invites, and which protection method fits it.
  3. Privacy Principles, GDPR Subject Rights & Minimization (3 labs): You can tell a controller from a processor, find everything held about one person, and answer an access or erasure request without breaking another law.
  4. Asset Lifecycle Management & Media Sanitization (4 labs): You can reconcile an asset inventory against what is really on the network and pick a sanitisation method that matches the media and the data on it.
  5. Data Loss Prevention & Egress Monitoring (5 labs): You can explain how a DLP rule decides that outbound content is sensitive, tune it against false positives, and spot bulk exfiltration in connection logs.

Resilience & Disaster Recovery

  1. Business Impact Analysis, RTO & RPO Modeling (4 labs): You can turn a business impact analysis into RTO and RPO targets, test them against real restore times and backup schedules, and work out what redundancy does to availability.
  2. Disaster Recovery Sites: Hot, Warm & Cold (3 labs): You can choose between hot, warm and cold recovery sites by working out their real recovery time and data loss against a system's RTO and RPO, and plan how to test the choice.
  3. Backup Architectures: 3-2-1, Immutability & Air-Gaps (4 labs): You can design a backup scheme that survives ransomware, explaining incremental and differential chains, 3-2-1-1-0, immutability and air gaps, and prove a restore is intact.
  4. Incident Roles, Escalation & Crisis Comm (4 labs): You can staff an incident with clear roles, apply a written escalation policy, and run crisis communication that meets regulatory deadlines.

Enterprise Strategy & Audit

  1. Security Architecture Gap Analysis (3 labs): You can compare exported security configuration against a written target architecture, find the gaps with a script, and rank them for a plan.
  2. Enterprise Risk Registers & Treatment Plans (3 labs): You can write risk register entries with a cause, an owner and a treatment, score inherent and residual risk, and check that every decision is authorised and in date.
  3. Internal Audits, Sampling & Evidence Chains (4 labs): You can draw a repeatable audit sample from a complete population, test it against a control statement, seal the evidence with hashes, and write up the finding.
  4. Security Capstone Review & Certification (3 labs): You can gather certificate and backup evidence, test it against written targets, turn the gaps into owned register entries, and choose a sensible next certification.

Certification courses