Cybersecurity

This foundational course equips adult learners with the safety knowledge, technical math skills, professional communication habits, and career-readiness tools required to succeed in a cybersecurity program and enter the workforce. Students complete OSHA 10-Hour General Industry training, basic first aid and CPR awareness, and build the quantitative and literacy skills used daily in security operations. The course is explicitly mapped to the professional and analytical competency areas tested across the CompTIA Security+, CompTIA CySA+, and ISC2 CC credentials.

How the course runs. 7 blocks: Workplace Safety for IT and Data-Center Environments (OSHA 10-Hour General Industry); First Aid Awareness and CPR Fundamentals for the IT Workplace; Trade Math for Cybersecurity: Number Systems, Subnetting, and Data Metrics; Reading Technical Documentation: CVEs, RFCs, Policy Documents, and Security Bulletins; Digital Workplace Tools: Ticketing, Email, File Management, and Version Control Basics; Technical Writing and Oral Communication for Security Professionals; Career Readiness: Resume, Professional Profiles, and Entering the Cybersecurity Workforce.

What competent looks like. Demonstrate OSHA 10-Hour General Industry safety knowledge and identify electrical, ergonomic, and physical hazards common in IT and data-center environments. Apply trade mathematics — including binary/hexadecimal conversion, subnetting arithmetic, and basic statistical reasoning — to solve cybersecurity workplace problems. Read and accurately interpret technical documentation such as RFCs, CVE advisories, policy documents, and vendor security bulletins. Use standard digital workplace tools — including a ticketing system, professional email, and version-controlled file management — to organize and communicate technical work. Produce and deliver clear written and oral technical communications suited to security audiences, including incident summaries and risk briefings. Construct a career portfolio including a resume, LinkedIn profile, and 30-second professional introduction aligned to entry-level cybersecurity roles.

This course builds foundational knowledge of the threat landscape that cybersecurity professionals defend against, covering threat actor categories, attack techniques, vulnerability types, and the reconnaissance and exploitation lifecycle. Students analyze real-world attack scenarios, map threats to the MITRE ATT&CK framework, and practice identifying indicators of compromise using industry-standard tools. Content aligns directly to CompTIA Security+ (SY0-701) Domain 2 (Threats, Vulnerabilities, and Mitigations), CompTIA CySA+ threat and vulnerability management domains, and ISC2 CC Domain 2 (Business Continuity, Disaster Recovery, and Incident Response Concepts) and Domain 3 (Access Controls).

How the course runs. 12 blocks: The Threat Landscape: Actors, Motivations, and the Security Mindset; Social Engineering: Phishing, Pretexting, and Human-Layer Attacks; Malware Types: Viruses, Worms, Trojans, Ransomware, Spyware, and Rootkits; Network-Based Attacks: DoS, DDoS, Man-in-the-Middle, and Replay Attacks; Application-Layer Attacks: Injection, XSS, CSRF, and Buffer Overflow; The Cyber Kill Chain and Attack Lifecycle; MITRE ATT&CK Framework: Tactics, Techniques, and Procedures; Reconnaissance: OSINT, Scanning, and Enumeration Techniques; Vulnerability Scanning and CVSS Scoring; Threat Intelligence: IOCs, Feeds, and Sharing Standards; Insider Threats and Supply Chain Risks; Threat Scenario Capstone: Attack Analysis and Defensive Briefing.

What competent looks like. Classify threat actors by motivation, capability, and typical attack vector, distinguishing nation-state, cybercriminal, hacktivist, insider, and script-kiddie profiles. Identify and explain the stages of the Cyber Kill Chain and MITRE ATT&CK framework tactics, techniques, and procedures (TTPs) for a given attack scenario. Recognize common attack types including phishing, social engineering, malware variants, injection attacks, man-in-the-middle, denial-of-service, and supply-chain attacks. Perform a basic vulnerability scan using an industry-standard tool, interpret the output, and prioritize findings by CVSS score. Analyze indicators of compromise (IOCs) from logs, network captures, and file artifacts to determine likely attack type and affected systems. Document threat intelligence findings in a structured report using standard templates aligned to professional SOC workflows.

This course builds the hands-on skills needed to operate a security-conscious IT environment, covering network defense, access control, cryptography, vulnerability management, and security monitoring. Students configure and test real controls on live systems and virtual labs, interpreting results against industry frameworks. Lessons map directly to CompTIA Security+ and ISC2 CC exam domains, reinforcing the threat knowledge gained in Course 2.

How the course runs. 12 blocks: Security Operations Foundations and the Defense-in-Depth Model; Identity and Access Management: Concepts and Policies; Authentication Technologies and Multi-Factor Authentication Lab; Cryptography Fundamentals: Encryption, Hashing, and Key Management; PKI and Certificate Management Lab; Network Security Architecture: Firewalls, VLANs, and DMZ Design; Secure Network Protocols and Protocol Hardening; Endpoint Hardening and Patch Management; Physical Security Controls and Environmental Safeguards; Vulnerability Scanning and CVSS-Based Prioritization; Security Monitoring: Logs, Alerts, and Baseline Behavior; Security Operations Capstone Lab: Hardening, Scanning, and Reporting.

What competent looks like. Configure and verify access control mechanisms including authentication, authorization, and account management policies on a live system. Implement and evaluate cryptographic controls such as symmetric/asymmetric encryption, hashing, and PKI certificate management. Perform a structured vulnerability scan, interpret the output, and prioritize remediation using a recognized scoring system such as CVSS. Apply network security controls including firewalls, VLANs, DMZ architecture, and secure network protocols to a lab environment. Demonstrate physical security and endpoint hardening measures consistent with a defense-in-depth strategy. Document security operations activities — including scan results, control configurations, and change records — to a professional standard.

Students develop hands-on proficiency with the Linux command line, file system, user management, and network configuration as applied to cybersecurity roles. Lessons cover hardening, log analysis, permissions, and scripting foundations that directly support Security+, CySA+, and ISC2 CC exam objectives. By course end, students can administer and secure a Linux system in a professional security-operations environment.

How the course runs. 12 blocks: Linux Landscape and Lab Environment Setup; The Linux Command Line: Navigation and File Management; Linux File System Hierarchy and Permissions; User and Group Management; Linux Networking Fundamentals; SSH, Remote Access, and Encryption in Transit; Linux Firewall Configuration with iptables and ufw; System Services, the Boot Process, and Attack Surface Reduction; Linux Log Management and Analysis; Linux Hardening: CIS Benchmark Implementation; Introduction to Bash Scripting for Security Automation; Capstone Lab: Securing and Investigating a Linux Server.

What competent looks like. Navigate the Linux file system and execute essential shell commands to locate, inspect, and manipulate files relevant to security investigations. Configure and enforce Linux user accounts, groups, and file permissions to implement least-privilege access controls. Harden a Linux server by disabling unnecessary services, applying firewall rules with iptables/nftables, and configuring SSH securely. Analyze system logs and use standard Linux tools to detect indicators of compromise on a live host. Write and execute basic Bash scripts to automate repetitive security-administration tasks. Document system configuration and security findings in professional written reports that meet industry standards.

Students learn to write, read, and adapt scripts in Bash and Python to automate security tasks, parse logs, enumerate systems, and respond to threats. Lessons progress from syntax fundamentals through real-world security automation scenarios encountered in SOC and incident-response roles. Scripting competencies support the automation and threat-intelligence objectives tested in CompTIA Security+ and CompTIA CySA+.

How the course runs. 12 blocks: Scripting in a Security Context: Purpose, Risk, and Environment Setup; Bash Fundamentals: Variables, Control Flow, and File Operations; Bash for Security: Log Parsing and User Auditing; Python Fundamentals: Syntax, Data Types, and Functions; Python File and String Handling for Log Analysis; Secure Scripting Practices: Input Validation, Least Privilege, and Credential Handling; Python Networking: Sockets, Requests, and Service Interrogation; Automating Nmap and Other CLI Security Tools with Python and Bash; Version Control with Git: Tracking and Collaborating on Security Scripts; Scripting Incident-Response Tasks: Triage Automation; Scripting for Threat Intelligence: IOC Extraction and Feed Parsing; Capstone Script Project: Automated Security Monitoring Tool.

What competent looks like. Write functional Bash and Python scripts that automate at least three distinct security tasks such as log parsing, user auditing, and network scanning. Read and explain unfamiliar scripts, identifying logic flow, data handling, and potential security risks within the code. Use Python libraries including os, subprocess, re, and requests to collect, filter, and report security-relevant data from a live Linux system. Apply safe scripting practices including input validation, least-privilege execution, and secure credential handling to all scripts produced in the course. Integrate scripts with command-line security tools such as nmap, grep, awk, and curl to build automated reconnaissance and monitoring workflows. Produce documented, version-controlled scripts stored in a local Git repository with clear README files and inline comments.

Students learn to deploy, configure, and operate SIEM platforms to collect, normalize, correlate, and alert on security events across an enterprise environment. Hands-on labs use industry-representative tooling to build dashboards, tune detection rules, and investigate alerts through a structured analyst workflow. Lesson content maps directly to CompTIA Security+ (domain: Security Operations) and CompTIA CySA+ (domains: Security Operations, Vulnerability Management, Incident Response) exam objectives.

How the course runs. 12 blocks: SIEM Fundamentals and the Security Operations Workflow; Log Sources, Data Collection, and Normalization; Searching, Filtering, and Query Languages; Dashboards, Visualizations, and Reporting; Correlation Rules and Use-Case Development; MITRE ATT&CK Framework and Alert Mapping; Threat Intelligence Integration; Alert Triage and Investigation Workflow; Log Retention, Data Privacy, and Responsible Handling; SIEM Health Monitoring and Performance Tuning; Capstone Scenario: End-to-End SIEM Investigation; Exam Alignment Review: SIEM Topics in Security+ and CySA+.

What competent looks like. Configure a SIEM platform to ingest and parse log sources including Windows event logs, Linux syslogs, firewall logs, and web server logs. Write and tune correlation rules to detect common attack patterns such as brute-force, lateral movement, and data exfiltration with a measurable reduction in false positives. Build dashboards and scheduled reports that communicate security posture to both technical and non-technical audiences. Investigate a SIEM-generated alert end-to-end using a repeatable triage workflow, document findings, and escalate or close the ticket with written justification. Demonstrate safe and responsible handling of sensitive log data in compliance with data-retention and least-privilege principles. Map SIEM alert categories to the MITRE ATT&CK framework and identify relevant tactics, techniques, and procedures (TTPs).

Students learn to detect, contain, eradicate, and recover from cybersecurity incidents using industry-standard frameworks and tools. The course covers the full incident response lifecycle, digital forensics fundamentals, and post-incident reporting aligned to CompTIA Security+ and CySA+ exam domains. Hands-on labs simulate realistic breach scenarios so students can practice triage, evidence handling, and stakeholder communication under time pressure.

How the course runs. 12 blocks: Incident Response Fundamentals and NIST SP 800-61 Lifecycle; Preparation: Building an Incident Response Plan and Team; Detection and Analysis: Log Review and Alert Triage; Digital Forensics Principles and Evidence Handling; Memory and Disk Imaging Lab; Containment Strategies: Network Isolation and System Quarantine; Malware Analysis Basics and Eradication; Recovery Procedures and System Restoration; Legal, Regulatory, and Notification Requirements; Incident Documentation and Post-Incident Reporting; Threat Intelligence Integration and IOC Sharing; Full Incident Response Simulation Capstone Lab.

What competent looks like. Execute a structured incident response process following the NIST SP 800-61 lifecycle phases: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity. Collect and preserve digital evidence using accepted forensic procedures that maintain chain of custody. Use SIEM alerts, log analysis, and endpoint telemetry to classify and prioritize security incidents. Apply containment and eradication techniques—including network isolation, malware removal, and credential resets—without destroying evidence. Produce a complete incident report and lessons-learned document suitable for technical and executive audiences. Identify legal, regulatory, and notification obligations that apply when a breach involves personal or regulated data.

Students design, build, and defend a comprehensive cybersecurity solution for a simulated small-to-medium enterprise environment, integrating skills from networking, Linux administration, scripting, SIEM configuration, and incident response. The project culminates in a formal technical documentation package and an oral defense panel review, mirroring real-world security analyst deliverables. All work is mapped to CompTIA Security+, CompTIA CySA+, and ISC2 CC competency domains.

How the course runs. 4 blocks: Capstone Scoping, Architecture Design, and Risk Planning; Environment Build, Hardening, and Automation; Vulnerability Assessment, Incident Simulation, and After-Action Documentation; Capstone Defense Preparation and Oral Presentation.

What competent looks like. Design a layered enterprise security architecture that addresses confidentiality, integrity, and availability for a given threat scenario, documenting all design decisions with rationale aligned to recognized security frameworks. Implement and harden a multi-component lab environment including a Linux server, firewall rules, and a SIEM instance, demonstrating configuration accuracy verified by instructor review and automated scan results. Develop and execute a Python or Bash automation script that ingests log data, detects at least two simulated attack patterns, and generates an alert report requiring no manual correction to run. Produce a professional documentation package including a network diagram, security policy, risk register, incident response runbook, and after-action report that meets the formatting and content standards of a junior security analyst role. Conduct and document a structured vulnerability assessment of the capstone environment using an industry-standard scanner, correctly classifying findings by severity and recommending prioritized remediation steps. Present and defend all design and implementation decisions to a panel of evaluators, responding accurately to technical follow-up questions and demonstrating understanding of the credential domains covered throughout the program.

Students complete 324 supervised hours at an approved employer site in a cybersecurity-related role, applying classroom knowledge to live or near-live environments under the direct guidance of a credentialed industry mentor. Work may include security operations center (SOC) support, IT security administration, vulnerability management, or incident response assistance. A structured employer evaluation and a reflective log document professional growth and technical competency across all externship phases.

How the course runs. 4 blocks: Externship Orientation and Site Integration; Operational Security Support Tasks; Applied Security Project or Assigned Initiative; Externship Completion, Employer Evaluation, and Professional Debrief.

What competent looks like. Perform assigned cybersecurity tasks—such as log monitoring, alert triage, user account administration, or vulnerability scanning—under employer supervision, meeting the quality standards set by the host site. Demonstrate professional conduct, punctuality, and communication skills consistent with cybersecurity workplace norms across all 324 externship hours. Apply security policies, access-control principles, and data-handling procedures that align with the host organization's security program. Identify and report potential security incidents or anomalies through the proper escalation channels established by the host employer. Maintain a detailed reflective work log that documents tasks completed, tools used, and lessons learned during each externship phase. Receive a satisfactory or above rating on the employer's end-of-externship evaluation rubric covering technical skills, professionalism, and readiness for entry-level employment.

This course systematically reviews every exam domain covered by the CompTIA Security+, CompTIA CySA+, and ISC2 CC credentials, closing knowledge gaps identified through diagnostic testing and spaced-repetition practice. Learners work through mapped domain content, timed question sets, and full-length simulated exams that mirror the format, item types, and difficulty of each actual certification exam. The course ends with a comprehensive mock-exam session and a personalized final study plan so every student enters the testing center prepared and confident.

How the course runs. 4 blocks: Diagnostic Assessment and Domain Mapping; Domain-by-Domain Content Review: Security+, CySA+, and ISC2 CC; Performance-Based Questions, Test Strategy, and Exam Logistics; Full Mock Exam Day: Security+, CySA+, and ISC2 CC Simulation.

What competent looks like. Correctly answer practice questions drawn from all domains of the CompTIA Security+ exam at or above the minimum passing standard on at least two consecutive timed practice sets. Correctly answer practice questions drawn from all domains of the CompTIA CySA+ exam at or above the minimum passing standard on at least two consecutive timed practice sets. Correctly answer practice questions drawn from all domains of the ISC2 CC exam at or above the minimum passing standard on at least two consecutive timed practice sets. Demonstrate test-taking strategies—including elimination technique, performance-based question (PBQ) approach, and time management—by completing a full-length timed mock exam within the allotted window for each credential. Produce a personalized gap-analysis study plan that maps weak domains to targeted resources for continued self-study after the course ends. Complete a cumulative full mock-exam day simulating real testing-center conditions for all three credentials and score at or above the passing threshold on each.