Networks & Security

You can trace how data travels across the OSI layers and analyze the exact TCP/IP header fields that security monitoring tools inspect.

1. OSI and TCP/IP recap90 min
   • OSI layer encapsulation
   • TCP/IP model mappings
   • Protocol data units (PDUs)
2. IP addressing and ports90 min
   • IPv4 subnetting
   • CIDR notation
   • TCP and UDP port ranges
3. Key protocols revisited90 min
   • ARP requests and tables
   • ICMP echo requests
   • DNS lookup flows
4. How traffic flows90 min
   • Routing tables
   • Default gateways
   • Packet encapsulation
5. Why each layer matters for security90 min
   • Layer-specific vulnerabilities
   • Packet sniffing vectors
   • Stateful inspection boundaries

Hands-on project: Map out a multi-subnet topology document using Wireshark captures, identifying port numbers, broadcast domains, and potential configuration weak points.

You can evaluate system risk profiles using the CIA triad and construct defense-in-depth architecture blueprints for corporate networks.

1. The CIA triad: confidentiality, integrity, availability90 min
   • Confidentiality controls
   • Data integrity guarantees
   • Availability resilience planning
2. Threats, vulnerabilities and risk90 min
   • Risk assessment matrices
   • Vulnerability identification
   • Threat actor taxonomies
3. Attack surfaces90 min
   • Digital footprinting
   • External vs internal surfaces
   • Shadow IT exposure
4. Defense in depth90 min
   • Layered security controls
   • Fail-safe defaults
   • Least privilege enforcement
5. Security policies and the human factor90 min
   • Acceptable use policies
   • Security awareness training
   • Phishing simulation strategies

Hands-on project: Draft a formal security baseline policy document for a mock enterprise network, detailing asset classification, acceptable use rules, and defense-in-depth perimeters.

You can dissect malware behavior, phishing vectors, and network sniffing attacks to identify indicators of compromise in live environments.

1. Malware: viruses, worms, ransomware2 hrs
   • Trojan injection techniques
   • Ransomware encryption loops
   • Worm propagation mechanics
2. Phishing and social engineering2 hrs
   • Spear phishing vectors
   • Credential harvesting pages
   • Business email compromise (BEC)
3. Denial-of-service and DDoS2 hrs
   • SYN flood attacks
   • Amplification techniques
   • Botnet command structures
4. Man-in-the-middle and spoofing2 hrs
   • ARP cache poisoning
   • DNS spoofing attacks
   • SSL stripping methods
5. How attacks chain together2 hrs
   • Kill chain methodology
   • Lateral movement steps
   • Privilege escalation paths

Hands-on project: Analyze a captured malicious PCAP file in a sandbox environment, identifying the exact command-and-control communication channels and generating an IOC report.

You can configure cryptographic ciphers, hash verifications, and digital certificate chains to protect data at rest and in transit.

1. Symmetric and asymmetric encryption2 hrs
   • AES-256 block cipher modes
   • RSA key generation
   • Diffie-Hellman key exchange
2. Hashing and integrity2 hrs
   • SHA-256 collision resistance
   • HMAC verification
   • Digital checksum validation
3. Digital signatures and certificates2 hrs
   • Public-private signing pairs
   • X.509 certificate formats
   • Revocation checking via CRL/OCSP
4. Public key infrastructure (PKI)2 hrs
   • Root and intermediate CAs
   • Trust store management
   • Certificate lifecycle policies
5. Where cryptography is used2 hrs
   • Disk encryption via LUKS
   • Secure messaging protocols
   • Tokenization pipelines

Hands-on project: Generate an internal Certificate Authority using OpenSSL, issue signed TLS certificates for a local server, and verify certificate chain validation.

You can design segmented network topologies and write strict stateful firewall rules to control inter-zone traffic flow.

1. How firewalls work90 min
   • Packet-filtering rules
   • Stateful inspection engines
   • Next-generation firewall features
2. Writing and testing rules90 min
   • iptables syntax and chains
   • Rule ordering logic
   • Log and drop strategies
3. Network segmentation and DMZs90 min
   • VLAN configuration
   • Demilitarized zone placement
   • Internal firewalls
4. NAT and proxies90 min
   • Source and destination NAT
   • Forward proxy caching
   • Reverse proxy gateways
5. Designing a defended network90 min
   • Enterprise zone layouts
   • Bastion host deployment
   • Zero-trust perimeter shifts

Hands-on project: Configure iptables rules on a Linux gateway to isolate a DMZ web server from the internal database network while allowing controlled external HTTP access.

You can establish encrypted tunnels and enforce secure remote access standards using TLS, SSH, and VPN protocols.

1. VPNs and secure tunnels90 min
   • IPsec tunnel and transport modes
   • WireGuard configuration
   • SSL/TLS VPN gateways
2. TLS and HTTPS90 min
   • TLS handshake procedure
   • Cipher suite negotiation
   • HSTS implementation
3. SSH and secure remote access90 min
   • SSH key authentication
   • sshd_config hardening
   • Port forwarding and tunneling
4. Secure email90 min
   • DKIM record setup
   • SPF configuration
   • DMARC enforcement policies
5. Protecting data in transit90 min
   • Transport layer security auditing
   • Mitigating downgrade attacks
   • Perfect forward secrecy

Hands-on project: Deploy an OpenVPN server on a Linux host, provision client configuration profiles, and establish a verified secure encrypted tunnel from an external node.

You can deploy signature-based intrusion detection tools and parse system log streams to uncover anomalous network activity.

1. Intrusion detection and prevention90 min
   • Network vs host IDS
   • Inline IPS deployment modes
   • False positive tuning
2. Signatures and anomalies90 min
   • Rule syntax structure
   • Behavioral anomaly baselining
   • Heuristic detection engines
3. Logging and what to capture90 min
   • Syslog forwarding standards
   • Auditd configuration
   • Log retention policies
4. Introduction to SIEM90 min
   • Log ingestion pipelines
   • Normalization and parsing
   • Correlation rule writing
5. Detecting and responding to incidents90 min
   • Alert triage workflows
   • Triage escalation paths
   • Initial containment steps

Hands-on project: Install Snort or Suricata on a Linux machine, write custom detection rules for ICMP tunneling, and test rule triggers against captured traffic.

You can configure robust access control models, multi-factor authentication policies, and enterprise wireless security standards.

1. Authentication and authorization90 min
   • Identification verification
   • Authorization boundaries
   • Principle of least privilege
2. Access control models90 min
   • Discretionary access control (DAC)
   • Mandatory access control (MAC)
   • Role-based access control (RBAC)
3. Passwords, MFA and identity90 min
   • TOTP implementation
   • Password hashing standards
   • Federated identity providers
4. Wireless and Wi-Fi security90 min
   • WPA3 Enterprise authentication
   • Rogue access point detection
   • Captive portal configuration
5. Securing endpoints90 min
   • Endpoint detection agents
   • Disk hardening baselines
   • USB and peripheral controls

Hands-on project: Configure role-based access control (RBAC) and multi-factor authentication constraints on a Linux testing environment with hardened password policies.

You can perform safe network reconnaissance, port scanning, and traffic analysis using industry-standard penetration testing tools.

1. The penetration-testing mindset2 hrs
   • Rules of engagement
   • Reconnaissance methodology
   • Vulnerability validation
2. Reconnaissance and scanning with nmap2 hrs
   • SYN and ACK scan flags
   • OS detection switches
   • NSE scripting engine
3. Traffic analysis with Wireshark2 hrs
   • Display and capture filters
   • Follow TCP stream analysis
   • Detecting cleartext credentials
4. Common tools and Kali Linux2 hrs
   • Kali Linux tool suites
   • Netcat relay creation
   • DNS enumeration utilities
5. Responsible, legal and ethical testing2 hrs
   • Scope limitation boundaries
   • Authorization documentation
   • Responsible disclosure workflows

Hands-on project: Execute an authorized reconnaissance and vulnerability scan against a target lab using nmap and Wireshark, compiling a penetration testing findings report.

You can harden production hosts, establish patch management cadences, and execute structured incident response frameworks.

1. Hardening systems and networks90 min
   • Attack surface reduction
   • Disabling default services
   • CIS benchmark application
2. Patching and configuration90 min
   • Vulnerability remediation cadence
   • Configuration drift detection
   • Automated update verification
3. Incident response basics90 min
   • NIST incident response phases
   • Evidence preservation protocols
   • Post-incident review meetings
4. Compliance and frameworks90 min
   • ISO 27001 standard overview
   • PCI-DSS network requirements
   • Security auditing procedures
5. Building a security culture90 min
   • Developer security integration
   • Peer review for infrastructure
   • Reporting channels for flaws

Hands-on project: Create a comprehensive server hardening script that disables unnecessary services, configures a firewall baseline, and enforces SSH key-only access.

You can run a security incident end to end and hand over evidence that holds up.

1. The incident response lifecycle90 min
   • Preparation and playbooks
   • Containment vs eradication
   • When to pull the plug
2. Evidence handling90 min
   • Order of volatility
   • Disk and memory imaging
   • Hashing and chain of custody
3. Building a timeline90 min
   • Log correlation across sources
   • Filesystem timestamps
   • Indicators of compromise
4. Reporting and improvement90 min
   • Executive vs technical report
   • Root cause
   • Control gaps to close

Hands-on project: Given a compromised host image and its logs, build a timeline of the intrusion, identify the initial access and persistence, preserve evidence with hashes and a chain-of-custody record, and write the containment and eradication plan.

You can replace a flat trusted network with identity-based access and segmented cloud networking.

1. Why the perimeter model failed90 min
   • Flat network blast radius
   • Lateral movement
   • Assume-breach posture
2. Identity as the control plane90 min
   • Identity-aware proxy
   • Device posture checks
   • Conditional access
3. Segmenting cloud networks90 min
   • Security groups vs NACLs
   • Kubernetes network policy
   • Egress control and inspection
4. Verifying the design90 min
   • Flow logs as evidence
   • Least-privilege review
   • Continuous validation

Hands-on project: Redesign the capstone network for zero trust: identity-aware access instead of VPN-wide trust, micro-segmentation with security groups and network policy, centralised egress inspection, and a written justification for every allowed flow.

You can execute an end-to-end security assessment, remediate network vulnerabilities, and present a professional hardening audit for a deployed architecture.

1. Map and assess a network90 min
   • Asset discovery mapping
   • Topology verification
   • Baseline scan execution
2. Identify risks and vulnerabilities90 min
   • Vulnerability correlation
   • Risk rating calculation
   • False positive filtering
3. Apply defenses and harden it90 min
   • Firewall rule tightening
   • Encryption enforcement
   • Access control restriction
4. Document findings and recommendations90 min
   • Executive summary drafting
   • Technical remediation guidance
   • Evidence packaging
5. Portfolio, resume, mock interviews and career prep90 min
   • Security portfolio presentation
   • Technical interview Q&A practice
   • Resume refinement for SOC roles

Hands-on project: Deliver a complete security audit report and hardened configuration blueprint for a simulated vulnerable enterprise network, complete with verified defense controls and mock interview presentation.