Cybersecurity line, station 1 of 4
Security Foundations
How attacks work and how organisations defend: threats, identity, cryptography, networks, cloud and the human side.
- 6lessons
- 3.5 hto read and do
- Beginnerlevel
- 6podcast episodes
- 6checked exercises
Tools you'll use in this course
The lessons open these with a template ready. They work for your own job too, no course needed.
About this course
Every role in tech needs to understand security, and every security career starts with the same foundations. This course explains how attackers think, the controls that stop them, and the language security teams use, without assuming any prior knowledge.
You will look at Mangrove Market as a target: its app, stores, payments and staff accounts. You will map what is worth protecting, see how phishing and stolen passwords lead to breaches, learn how encryption and passkeys work, secure a small network and cloud account, and walk through what happens in the first hour after an attack is spotted. The course covers much of the ground of entry-level security certifications.
Each lesson has a podcast episode, quick checks, flashcards and hands-on SQL or JavaScript exercises that run in your browser. The capstone is a short security review of the Partner app that you could hand to a leadership team.
What you will be able to do
- Explain confidentiality, integrity and availability, threats, risks and controls
- Describe common attacks such as phishing, credential stuffing and ransomware
- Explain how hashing, encryption, certificates and passkeys protect data
- Apply basic network, endpoint and cloud security controls
- Follow the basics of risk management, compliance and incident response
Syllabus
6 stops, about 3.5 h in total. Each stop fills in when you complete the lesson.
Thinking like an attacker
Before you can defend anything, you need to know what is worth protecting, who might come for it and how they would get in. This lesson teaches the basic language of security (assets, threats, vulnerabilities, risk and controls) by looking at Mangrove Market the way an attacker would, and turns what you find into a risk register you can act on.
Threat modelling basicsRisk managementSecurity controls
How breaches really happen
Most breaches start in ordinary ways: an email someone trusted, a password reused from another site, a server nobody patched. From there they move through a few predictable steps. This lesson shows you those steps, the traces each one leaves, and where a defender can break the chain.
Threat modelling basicsIdentity and MFAIncident response basics
Identity: passwords, MFA and passkeys
Most breaches now start with someone signing in as somebody else. This lesson shows you how to protect accounts the modern way: passwords that follow current guidance, second factors ranked by how well they resist phishing, passkeys, and the recovery and leaver processes that attackers aim for when the front door is locked.
Identity and MFAPassword policyAccount recovery
Cryptography without the maths
Hashing, encryption, signatures and TLS each protect something different, and most real failures come from using the wrong one or losing the key. This lesson explains what each tool guarantees in plain words, how HTTPS proves who you are talking to, and why key management and certificate expiry cause more outages and breaches than broken algorithms.
Cryptography basicsTLS certificatesKey management
Networks, endpoints and the cloud
Attackers who get one foothold try to move to everything else. This lesson shows the controls that stop that spread: networks split into segments behind default-deny firewalls, patching driven by an asset list and real-world exploitation, endpoints that record what runs on them, and a cloud account where you know exactly which half of the security job is yours.
Network securityCloud securityVulnerability managementEndpoint security
Risk, compliance and the first hour of an incident
Security is also a management job: someone has to decide which risks to fix, which rules apply, and what happens when an attack gets through anyway. This lesson gives you the language security teams use for that job (policies, risk treatment, NIST CSF 2.0, CIS Controls, ISO 27001, PCI DSS) and a calm, ordered first hour for the morning a ransom note appears on a screen.
Risk managementIncident response basicsSecurity frameworks
Capstone: Security review of the Partner app
A realistic project with a rubric and a model answer.
Final exam and certificate
10 questions drawn at random, 70% to pass.
Capstone project
Security review of the Partner app
Mangrove's leadership wants to know how exposed the Partner app and its 1,800 partner shops are before the busy festival season. About 62% of partner orders are placed in the app and the rest by phone to about 40 sales reps; invoices are paid in the app; the app is built and supported by an outside agency, Lagoon Digital. Produce a short security review that a non-specialist managing director can act on: what matters, who would attack it and how, the top ten risks scored for likelihood and impact, and the ten controls to fund first with a 90-day plan.
You will hand in
- An asset and threat list: what is worth protecting (with its confidentiality, integrity or availability need) and who would attack it
- A risk register with the top ten risks, each with likelihood, impact, score, owner and treatment
- A prioritised control plan: ten controls with rough cost, the risks each one reduces, and a 90-day plan
- A one-page summary for the managing director in plain language
Check what you know
Already know some of this? Answer 6 quick questions, one from each lesson, and we will mark the lessons you can skim. It takes about 3 minutes and nothing is graded.
Questions
Do I need any security background?
No. The course starts from what is worth protecting and explains every term the first time it appears. If you have never thought about how a web request works, take How the Web Works first.
Is this course for hackers?
It is for anyone starting in security, defensive or offensive. Offensive Security: Ethical Hacking and Pentesting goes deeper into attacks, always on practice systems you are allowed to test.
Does it prepare me for Security+?
It covers much of the same ground as entry-level certificates such as CompTIA Security+, but it is not an exam prep course. Use the official exam objectives to fill the gaps.
What do I need to do the exercises?
Only a browser. SQL and JavaScript exercises run in the page, and the capstone is a document you write.
Is it really free?
Yes. Every lesson, podcast episode, exercise, quiz, final exam and certificate is free. The labs and their templates for real work are free too. Plus and Premium add every lab challenge, weekly extras and a mentor on top, and they never lock the tools or the courses.
How long does it take?
Each lesson shows an honest time for reading and doing. Most people finish a course in two to four weeks at three or four hours a week.
How does the final exam work?
You get 15 questions drawn at random from a larger bank. You need 70% to pass. If you do not pass, you can try again after 24 hours. The exam is graded on the server and you never see the answer key.