A full body of security knowledge, taught the way CompTIA Security+ teaches it: five domains from the core vocabulary and cryptography, through threats and secure architecture, to day-to-day operations and the governance that ties it together. Heavy reading where the ideas live, and hands-on labs on an isolated bench wherever a concept can be touched with your own hands.
Status: Under construction — the first domain, General Security Concepts, is written in full; the four remaining domains are being built out. Three offensive labs (reconnaissance, SQL injection, password cracking) already run on a closed network with no route to the internet, so the tooling stays where it belongs.
The vocabulary the whole field is built on — the CIA triad, AAA, security controls, zero trust and the cryptography that underpins all of it.
Before any tool or attack, a shared language. The three properties every security measure protects, the three questions every access decision answers, and the idea that makes a signature mean something. Everything else in this course is built on these words.
A control is any measure that reduces risk — but they are not all the same kind of thing. Sort them two ways at once: by who implements them (technical, managerial, operational, physical) and by what they do to a threat (prevent, deter, detect, correct, compensate, direct). The grid you build here is on every exam and every audit.
The engine under almost every control in this course. Symmetric and asymmetric encryption and why you always need both; hashing and what makes a hash fit for passwords; digital signatures that deliver integrity, authenticity and non-repudiation at once; and the key-exchange trick that lets two strangers agree a secret in the open.
Public keys solve secrecy but raise a new question — how do you know a public key really belongs to your bank and not an impostor? The answer is a chain of signatures rooted in a handful of authorities your device already trusts. Certificates, CAs, the TLS handshake end to end, and how a certificate is revoked when a key is stolen.
The castle-and-moat model — hard perimeter, soft trusted interior — fails the moment an attacker gets inside, and they always eventually do. Zero Trust throws out the trusted interior entirely: every request is authenticated and authorised on its own merits, every time. The control and data planes, policy engines and enforcement points, and microsegmentation.
Who attacks and why, the shape of the attacks themselves, and the weaknesses they exploit — from social engineering to injection and password attacks.
Before you can defend against an attack you have to know who is behind it. This reading sorts the adversaries — nation-states, organised crime, hacktivists, insiders, script kiddies — by their resources, sophistication and motivation, and explains why "who" changes everything about "how" you defend.
Every way in is a vector, and the sum of all of them is your attack surface. This reading maps the common vectors — email, the web, removable media, the supply chain, wireless, stolen credentials — and the two ideas that run through all of them: reduce the surface, and distrust every path in.
Malware is not one thing — it is a whole zoo, and the exam and the job both expect you to tell the animals apart. Viruses, worms, trojans, ransomware, spyware, rootkits, logic bombs, botnets and more, sorted by how they spread, how they hide and what they are for — plus the indicators that give an infection away.
The cheapest way past a firewall is to ask someone inside to open it. Social engineering attacks the person, not the machine — phishing and its cousins, pretexting, business email compromise, and the levers of influence that make them work. Learn the techniques and the defences that actually hold.
A login form and a search box on a real running web app. Neither one keeps the user's input separate from the query it builds — so you will log in with no password, then read a table you were never meant to see. Then you will fix it in a single line, the way it should have been written all along.
A "network tools" web page runs ping and nslookup for you — by pasting your input straight into a shell command. You will turn its ping box into a shell on the server, read a file it never meant to show, and learn why the fix is to never build a command from a string in the first place.
Two stolen files — a web app's hash column and a server's shadow file — and a wordlist. Some of these hashes fall in milliseconds, some take real work, and one refuses. By the end you will know exactly which properties of a hashing scheme decide which is which, and why the answer is never "the algorithm is secret".
The running of security day to day — hardening, monitoring, vulnerability management, identity and access, and responding when something goes wrong.
You are given one thing — a subnet — and a closed bench with no way out. Turn it into a full map: which hosts are alive, which ports are open, which services and exact versions answer, and the three flags hidden where only real enumeration will find them. The phase where every attack, and every defence, begins.