Cybersecurity Fundamentals

Malware Ecosystem

• Malware classification: viruses, worms, trojans, spyware, and adware.
• Ransomware: evolution from simple encryption to double/triple extortion (data theft + encryption + DDoS).
• Fileless malware attacks.

Attacks on Applications and the Web (Web Security)

• How hackers “talk” to databases – the concept of SQL Injection.
• XSS and session hijacking – how an innocent-looking form field can become a gateway to account compromise.
• Patch Management:
  • The importance of updates.
  • How missing patches lead to zero-day exploits and attack chains.

AI and Modern Cyber Threats

• How AI Is Changing the Attack Landscape

• Generating large-scale, personalized phishing campaigns.
• Voice/video deepfakes targeting executives and finance teams.

• Risks Associated with LLMs

• Prompt injection and data leakage.
• Shadow AI – employees using unauthorized AI tools.
• Hallucinations as a source of poor security decisions.

• AI for Defense

• Supporting log and report analysis.
• Assisting in the creation of detection rules, scripts, and documentation.

Endpoint and Mobile Security

• Threats: malicious applications, rooting/jailbreaking, device loss.
• BYOD (Bring Your Own Device) – organizational challenges, policies, and MDM.

In Practice (Workshops)

• Analysis of ransomware behavior based on a selected CERT report or incident analysis:
  • Mapping to the Cyber Kill Chain and MITRE ATT&CK frameworks.
• Demonstration of selected attacks.
• AI-generated phishing content and communications – participants learn how to recognize the differences.

• Firewalls

Packet filtering vs. Next-Generation Firewalls (NGFW).

• IDS vs. IPS

• Detection vs. prevention.
• Their role within a security architecture.

• Security Zones

• DMZ.
• Network segmentation.
• Isolation of critical assets.

Secure Communications and Applied Cryptography

• Encryption in Practice

What the browser “padlock” really means (TLS/SSL).

• Protecting Data in Transit

VPNs, secure remote access, and common user mistakes.

• Cryptography for Non-Technical Audiences

Symmetric vs. asymmetric encryption (public/private key cryptography).

• PKI and Digital Certificates

How trust is established on the Internet.

Wireless Security

• Wi-Fi Evolution

• Why WEP and WPA are obsolete.
• WPA2 and WPA3 as the minimum acceptable standard.

• Wireless Threats

Rogue Access Points, Evil Twin attacks, and mitigation strategies.

Cloud Security Fundamentals

• Cloud Service Models

IaaS, PaaS, SaaS, and the shared responsibility model.

• Common Misconfigurations

• Public storage containers.
• Excessive permissions.
• Lack of MFA.
• Lack of logging.

• Traditional DMZ vs. Cloud Architecture

Key architectural differences.

In Practice (Workshops)

• Designing a secure network architecture for a sample company:
  • Segmentation.
  • DMZ.
  • Security zones.
• Analyzing a sample architecture diagram (on-premises + cloud):
  • Identifying vulnerabilities and configuration errors.
• Configuring a basic secure connection (VPN tunnel / HTTPS / certificate validation).
• Basic network traffic analysis.

Identity and Access Management (IAM)

• AAA Model at the Organizational Level

• MFA (Multi-Factor Authentication)

Why passwords alone are no longer sufficient.

• SSO and Federation

Convenience versus security risks.

• Least Privilege and Privileged Access

• Principle of Least Privilege (PoLP).
• Privileged Access Management (PAM).
• Toxic combinations of permissions.

Incident Response

• NIST Incident Response Lifecycle

• Preparation.
• Detection.
• Containment.
• Eradication.
• Recovery.

• Digital Forensics Fundamentals

• Preserving evidence.
• “Don’t step on your own footprints.”

SOC and Detection in Practice (Introduction)

• What Is a SOC?

SOC roles: L1 Analyst, L2 Analyst, Detection Engineer.

• Data Sources

Logs, EDR, and SIEM – where alerts come from.

• Example Incident Response Playbook

Unusual login alert → verification and response steps.

Risk Management and Business Continuity

• Risk Analysis

• Identifying critical assets.
• Simple risk matrix (likelihood × impact).

• BCP vs. DRP

Business Continuity Planning versus Disaster Recovery Planning – differences and examples.

• Backup and Redundancy

The 3-2-1 backup rule and common mistakes.

In Practice (Workshops)

• Configuring a simple MFA scenario (test/demo account).
• Permissions matrix exercise:
  • Identifying toxic combinations (e.g., user creation + payment approval).
• SOC mini-case:
  • Analysis of a simple unusual login alert.
  • Decision-making: false positive vs. real incident – what actions should be taken?
• Mini risk assessment for a small organization:
  • What is critical?
  • What must continue operating “at all costs”?