Cybersecurity Fundamentals

• Classification: viruses, worms, trojans, spyware, adware.
• Ransomware: evolution from simple encryption to double and triple extortion (data theft + encryption + DDoS).
• Fileless malware attacks.

Application and Web Security

• How a hacker “communicates” with a database – introduction to SQL Injection.
• XSS and session hijacking – how an innocent-looking form field can become a gateway to account compromise.
• Patch Management:
  – Importance of updates.
  – How missing patches lead to zero-day exploits and attack chains.

AI and Modern Cyber Threats

• How AI is changing the threat landscape:
  • Generating large-scale, personalized phishing campaigns.
  • Voice and video deepfakes targeting executives and finance teams.
• Risks associated with LLMs:
  • Prompt injection and data leakage.
  • Shadow AI – employees using unauthorized AI tools.
  • Hallucinations as a source of incorrect security decisions.
• Using AI for defense:
  • Assistance in log and report analysis.
  • Support in creating detection rules, scripts, and documentation.

Endpoint and Mobile Security

• Threats: malicious applications, rooting/jailbreaking, device loss.
• BYOD (Bring Your Own Device) – challenges for organizations, policies, and MDM.

Hands-On Workshops

• Analysis of ransomware operations based on a selected CERT report or incident analysis:
  • Mapping to the Cyber Kill Chain and MITRE ATT&CK.
• Demonstration of selected attacks.
• AI-generated phishing content and messages – participants learn how to identify differences and warning signs.

• Firewalls:
  • Packet filtering vs. NGFW (Next-Generation Firewall).
• IDS vs IPS:
  • Detection vs. prevention.
  • Their role in security architecture.
• Security Zones:
  • DMZ, network segmentation.
  • Isolation of critical assets.

Secure Communication and Applied Cryptography

• Encryption in practice: what the browser padlock really means (TLS/SSL).
• Protecting data in transit: VPNs, secure remote access, common user mistakes.
• Cryptography for non-technical audiences:
  • Symmetric vs. asymmetric encryption (public/private keys).
• PKI and digital certificates – how trust is established on the Internet.

Wireless Security

• Evolution of Wi-Fi:
  • Why WEP/WPA are obsolete.
  • WPA2/WPA3 as the minimum standard.
• Rogue AP and Evil Twin threats and how to mitigate them.

Cloud Security Fundamentals

• Service models: IaaS, PaaS, SaaS – the shared responsibility model.
• Common mistakes:
  • Public storage buckets.
  • Excessive permissions.
  • Lack of MFA.
  • Insufficient logging.
• Differences between traditional DMZs and cloud architectures.

Hands-On Workshops

• Designing a secure network architecture for a sample company:
  • Segmentation, DMZ, security zones.
• Analysis of a sample architecture diagram (on-premises + cloud):
  • Participants identify vulnerabilities and configuration errors.
• Configuring a basic secure connection:
  • VPN tunnel, HTTPS, certificate testing.
• Basic network traffic analysis.

• AAA model at the organizational level.
• MFA (Multi-Factor Authentication) – why passwords are not enough.
• SSO and federation – convenience versus security risks.
• Principle of Least Privilege (PoLP), Privileged Access Management (PAM), and toxic combinations of permissions.

Incident Response

• Incident lifecycle according to NIST:
  Preparation, Detection, Containment, Eradication, Recovery.
• Digital Forensics – fundamentals:
  – Preserving evidence.
  – “Do not contaminate your own evidence.”

SOC and Detection in Practice (Introduction)

• What is a SOC? Roles of L1, L2, and Detection Engineer.
• Data sources: logs, EDR, SIEM – where alerts come from.
• Example of a simple Incident Response playbook:
  • Unusual login alert → verification and response steps.

Risk Management and Business Continuity

• Risk analysis:
  • Identification of critical assets.
  • Simple risk matrix (likelihood × impact).
• BCP (Business Continuity Plan) vs. DRP (Disaster Recovery Plan) – differences and examples.
• Backup and redundancy:
  • The 3-2-1 rule and common mistakes.

Hands-On Workshops

• Configuring a basic MFA scenario (test/demo account).
• Permission matrix exercise:
  Identifying toxic combinations (e.g., creating a user account + approving payments).
• SOC mini-case:
  – Analysis of a simple unusual login alert.
  – Decision-making: false positive vs. real incident – what actions should be taken?
• Mini risk assessment for a small organization:
  What is critical? What must remain operational at all costs?