Cybersecurity Defense Professional (Foundation Certificate)

"A short orientation. What defensive ("blue team") security is, the CIA triad, the defender's job across protect / detect / respond, how blue and red team work relate, and the ethics and law that bound the work. How the three levels build and where the pathway leads."

"You cannot defend a network you do not understand. TCP/IP and the protocols, reading packets in Wireshark, how the common network attacks look on the wire, and how normal-vs-abnormal traffic is the first signal of a compromise."

"The endpoint is where most attacks land. Windows and Linux internals for defenders -- users and privileges, processes, services, the registry and the filesystem, and the logs that matter -- then persistence mechanisms, endpoint hardening, and what EDR does."

"The security principles and the cryptography a defender must be able to reason about -- not implement. Authentication vs authorization, hashing vs encryption, symmetric vs asymmetric, PKI and certificates, TLS, password storage and cracking, and the crypto mistakes that become vulnerabilities."

"You defend better when you understand the attack. The attack lifecycle -- reconnaissance, initial access, execution, persistence, privilege escalation, lateral movement, exfiltration -- mapped to the MITRE ATT&CK framework, with the defensive control that counters each stage. Thinking like an attacker, to defend."

"Defending the network in practice. Firewalls and rule design, network segmentation and zero-trust segmentation, VPNs and secure remote access, IDS/IPS deployment and tuning, and network security monitoring -- the sensors, the traffic, and what to alert on."

"Turning logs into detections. Log sources and collection, a SIEM in practice (searching, correlating, dashboards), writing and testing detection rules against ATT&CK techniques, alert triage and prioritisation, and the discipline of tuning so the signal survives."

"Finding the weaknesses before an attacker does, and driving them down. Scanning with a real scanner (Nessus / OpenVAS), reading and validating results, CVSS and risk-based prioritisation, patch and remediation management, and running a vulnerability-management cycle that actually closes findings."

"Understanding the adversary. OSINT technique and tooling, mapping your own external attack surface the way an attacker would, threat-actor profiling, tracking vulnerabilities relevant to your stack, and turning it into threat intelligence a defender can act on."

"A hands-on practicum in a virtual lab. Wireshark, Nmap, a SIEM (Splunk or ELK), Suricata / Snort, and an endpoint agent -- used together on a realistic scenario: a simulated intrusion, from first alert to a written finding. The course where the Applied skills come together before the Project."

"From "we need a firewall" to "what are we protecting, from whom, and what does the defense actually need to do?" Threat modelling, risk assessment, eliciting security requirements from a business context, and producing a defensible security design a team could implement and you could justify to a decision-maker. First in-program vehicle for the two Solution Architecture competencies."

"Defense at organisational scale. Defense in depth and zero-trust architecture, identity as the perimeter, the standard frameworks (NIST CSF, ISO 27001, CIS Controls) and how to use them without drowning, security policy, and threat modelling a whole environment rather than one system."

"When prevention fails. The incident-response lifecycle (prepare, detect, contain, eradicate, recover, learn), evidence collection and chain of custody, disk and memory forensics fundamentals, timeline analysis, post-incident reporting, and running a tabletop exercise."

"How defensive security runs as a function, not a project. The SOC and its tiers, on-call and shift handover, runbooks and playbooks, the metrics that show whether the programme is working, security awareness, and the governance and compliance work that keeps it aligned with the business."