In arrivo
Cybersecurity
Diventa la persona che chiamano quando qualcosa entra.
Il corso completo
- moduli
- 71
- argomenti
- 815
- min per lezione
- 15
29%
di crescita prevista dell'occupazione negli USA per gli analisti di sicurezza informatica, 2024–2034.
U.S. Bureau of Labor Statistics, Occupational Outlook 2024–34
Quello che saprai fare.
Fai threat modeling prima del rilascio
Tappa 1 · Foundations & Governance
Blinda identità, chiavi e accessi
Tappa 2 · Cryptography & Identity
Metti in sicurezza Windows, Linux e reti
Tappa 3 · Platform & Network Security
Trova e correggi falle su web e cloud
Tappa 4 · Application & Cloud Security
Rileva le intrusioni e guida la risposta
Tappa 5 · Offense, Detection & Response
Difendi un piano di sicurezza con le prove
Tappa 7 · Practicum & Capstone
Sette tappe.Una salita costante.
Prima il rischio, poi lo stack strato per strato, poi il giorno in cui va tutto storto.
71moduli
in 7 tappe
815argomenti
≈ 11 per modulo
≈204ore
in lezioni da 15 minuti
≈2anni
≈13mesi
≈7mesi
per finire l'intero corso
- 1
Foundations & Governance
Conosci il rischio prima degli strumenti
9 moduli · 95 argomenti · ≈ 24 h
- 2
Cryptography & Identity
Chi entra, e cosa resta segreto
10 moduli · 114 argomenti · ≈ 29 h
- 3
Platform & Network Security
Macchine e reti, messe in sicurezza
9 moduli · 107 argomenti · ≈ 27 h
- 4
Application & Cloud Security
Codice, API e cloud, testati
16 moduli · 189 argomenti · ≈ 47 h
- 5
Offense, Detection & Response
Attacco, rilevamento, indagine, ripristino
17 moduli · 199 argomenti · ≈ 50 h
- 6
Resilience & Security Programs
Sicurezza che regge anche in un brutto giorno
5 moduli · 57 argomenti · ≈ 14 h
- 7
Practicum & Capstone
Un'intera organizzazione, difesa
5 moduli · 54 argomenti · ≈ 14 h
Mesi
0612180369024
MesiTraguardo · ≈ 2 anni · ≈ 13 mesi · ≈ 7 mesi
Ore e mesi sono stime: una lezione da 15 minuti per argomento, ogni giorno.
Ogni modulo.Ogni argomento.
I titoli di moduli e argomenti restano in inglese, la lingua in cui lavora questo settore.
Tappa 1
Foundations & Governance
Conosci il rischio prima degli strumenti
9 moduli · 95 argomenti
1Foundations of Cybersecurity10 argomenti
- Cybersecurity, Information Security, and Digital Resilience
- Confidentiality, Integrity, and Availability
- Authenticity, Accountability, and Nonrepudiation
- Security, Privacy, Safety, and Reliability
- Assets, Threats, Vulnerabilities, and Controls
- Attack Surfaces and Trust Boundaries
- Prevention, Detection, Response, and Recovery
- Security as an Ongoing Engineering Practice
- Technical Controls and Organizational Controls
- Understanding Security Tradeoffs and Residual Risk
2Computing Concepts for Security Analysis10 argomenti
- Processes, Threads, and Execution Contexts
- User Space, Kernel Space, and Privilege Boundaries
- Files, Permissions, and Persistent State
- Memory, Address Spaces, and Isolation
- Network Connections, Ports, and Protocol State
- Requests, Sessions, and Application State
- Identities, Credentials, Tokens, and Secrets
- Encodings, Serialization, and Data Interpretation
- Virtual Machines, Containers, and Shared Resources
- Mapping Technical Behavior to Security Consequences
3Threat Actors and Compromise Patterns11 argomenti
- Adversary Goals, Capabilities, and Constraints
- Cybercrime, Espionage, Disruption, and Fraud
- Opportunistic and Targeted Intrusions
- Insider Threats and Misuse of Legitimate Access
- Initial Access and Establishment of a Foothold
- Privilege Escalation and Expansion of Access
- Lateral Movement and Trust Exploitation
- Command-and-Control and Data Movement Patterns
- Data Theft, Extortion, and Service Disruption
- Tactics, Techniques, Procedures, and Observable Evidence
- Mapping Compromise Patterns with MITRE ATT&CK
4Professional Practice and Authorized Security Work9 argomenti
- Authorization, Ownership, and Defined Assessment Scope
- Rules of Engagement and Testing Constraints
- Production, Staging, and Isolated Lab Environments
- Handling Sensitive Data During Security Work
- Evidence Collection and Minimal Necessary Access
- Coordinated Vulnerability Disclosure
- Research Ethics and Conflicts of Interest
- Escalation, Stop Conditions, and Stakeholder Communication
- Writing Reproducible and Actionable Security Findings
5Security Governance and Policy11 argomenti
- Security Objectives and Organizational Mission
- Security Ownership and Decision Rights
- Policies, Standards, Procedures, and Guidelines
- Governance Through the NIST Cybersecurity Framework
- Govern, Identify, Protect, Detect, Respond, and Recover
- Current-State and Target-State Security Profiles
- Selecting and Tailoring Security Controls
- Legal, Regulatory, and Contractual Requirements
- Policy Exceptions and Compensating Controls
- Risk Acceptance and Management Accountability
- Integrating Security into Organizational Decisions
6Cybersecurity Risk Assessment10 argomenti
- Risk Scenarios and Business Consequences
- Threat Likelihood and Impact Estimation
- Inherent Risk and Residual Risk
- Qualitative and Quantitative Assessment Approaches
- Exposure, Exploitability, and Asset Criticality
- Dependency Risk and Cascading Consequences
- Uncertainty and Limits of Risk Scoring
- Risk Treatment and Prioritization
- Risk Registers, Owners, and Review Cycles
- Communicating Risk Without False Precision
7Asset Inventory and Attack Surface Management11 argomenti
- Hardware, Software, Data, and Identity Inventories
- Business Services and Technical Dependencies
- Internet-Facing Assets and Exposure Discovery
- Shadow IT and Unmanaged Services
- Software Versions and End-of-Life Components
- Data Flow and Trust Relationship Inventories
- External Domains, Certificates, and Public Repositories
- Asset Ownership and Criticality Classification
- Ephemeral Assets and Discovery Gaps
- Continuous Exposure Monitoring
- Reconciling Inventory Data with Observed Reality
8Secure Architecture Principles12 argomenti
- Least Privilege and Minimal Functionality
- Defense in Depth and Independent Controls
- Secure Defaults and Fail-Safe Behavior
- Complete Mediation and Consistent Enforcement
- Separation of Duties and Separation of Trust
- Isolation, Segmentation, and Compartmentalization
- Zero Trust as an Architectural Approach
- Explicit Trust Decisions and Contextual Access
- Attack Path Reduction and Blast-Radius Limits
- Designing for Detection and Recovery
- Security Boundaries in Multitenant Systems
- Reviewing Assumptions Behind Architectural Controls
9Threat Modeling and Abuse Cases11 argomenti
- Defining the System and Its Security Objectives
- Data Flow Diagrams and Trust Boundaries
- Identifying Entry Points and Sensitive Operations
- Attacker Goals and Abuse Cases
- STRIDE and Structured Threat Identification
- Attack Trees and Attack Path Analysis
- Threat Modeling Identities and Administrative Access
- Threat Modeling Dependencies and External Services
- Prioritizing Threats by Context and Consequence
- Linking Threats to Controls and Verification
- Updating Threat Models as Systems Change
Tappa 2
Cryptography & Identity
Chi entra, e cosa resta segreto
10 moduli · 114 argomenti
10Cryptographic Foundations12 argomenti
- Security Properties Provided by Cryptography
- Symmetric and Asymmetric Cryptography
- Encryption and Authenticated Encryption
- Cryptographic Hashes and Integrity Checks
- Message Authentication Codes
- Digital Signatures and Their Limits
- Key Exchange and Forward Secrecy
- Cryptographic Randomness and Entropy
- Nonces, Initialization Vectors, and Replay Protection
- Password Hashing and Key Derivation
- Encoding, Hashing, Signing, and Encryption as Different Operations
- Cryptographic Assumptions and Security Strength
11Cryptographic Engineering and Key Management12 argomenti
- Selecting Vetted Cryptographic Implementations
- Algorithm and Protocol Misuse
- Key Generation, Distribution, and Storage
- Key Rotation, Revocation, and Destruction
- Envelope Encryption and Separation of Key Roles
- Hardware Security Modules and Managed Key Services
- Backup and Recovery of Cryptographic Material
- Secret Exposure Through Code, Logs, and Configuration
- Timing and Other Implementation Side Channels
- Cryptographic Inventories and Crypto-Agility
- Post-Quantum Migration Planning
- Validating Cryptographic Controls Across Their Lifecycle
12Public Key Infrastructure and Secure Transport11 argomenti
- Certificates, Public Keys, and Identity Binding
- Certificate Authorities and Trust Stores
- Certificate Chains and Path Validation
- Certificate Issuance and Lifecycle Automation
- Expiration, Revocation, and Compromised Credentials
- TLS Handshakes and Authenticated Connections
- Server Authentication and Mutual TLS
- Hostname Validation and Endpoint Identity
- Downgrade Risks and Insecure Fallbacks
- Encryption Termination and Internal Trust Boundaries
- Diagnosing Certificate and Secure Transport Failures
13Identity Lifecycle Management10 argomenti
- Human, Service, Device, and Workload Identities
- Identity Sources and Authoritative Records
- Account Provisioning and Entitlement Assignment
- Joiner, Mover, and Leaver Processes
- Shared Accounts and Accountability Gaps
- Inactive, Orphaned, and Duplicate Accounts
- Identity Verification and Enrollment Assurance
- Access Reviews and Entitlement Recertification
- Identity Inventory and Ownership
- Deprovisioning Across Connected Systems
14Authentication and Account Security12 argomenti
- Authentication Factors and Assurance Levels
- Password Policies and Compromised Credential Screening
- Multifactor Authentication and Its Failure Modes
- Phishing-Resistant Authentication
- Passkeys, Security Keys, and Credential Binding
- Enrollment, Recovery, and Factor Replacement
- Credential Stuffing and Password Spraying Defenses
- Rate Limiting and Account Lockout Tradeoffs
- Risk-Based Authentication and Context Signals
- Session Creation, Renewal, and Invalidation
- Reauthentication for Sensitive Operations
- Preventing Recovery Flows from Undermining Authentication
15Authorization and Access Control11 argomenti
- Authentication and Authorization as Separate Decisions
- Discretionary and Mandatory Access Control
- Role-Based and Attribute-Based Access Control
- Relationship-Based and Object-Level Authorization
- Policy Decision and Policy Enforcement Points
- Default-Deny and Explicit-Allow Policies
- Horizontal and Vertical Privilege Boundaries
- Delegation and Constrained Authority
- Tenant Isolation and Cross-Tenant Access Prevention
- Time-Bound and Context-Bound Permissions
- Authorization Testing and Policy Change Review
16Federation and Identity Protocol Security12 argomenti
- Federated Identity and Trust Relationships
- Single Sign-On Architecture
- OAuth Authorization and Delegated Access
- OpenID Connect Authentication
- SAML Assertions and Federation Boundaries
- Access Tokens, Identity Tokens, and Refresh Tokens
- Issuer, Audience, Signature, and Lifetime Validation
- Redirect Handling and Authorization Response Binding
- Proof Key for Code Exchange
- Consent, Scopes, and Third-Party Application Access
- Federation Misconfiguration and Trust Expansion
- Token Revocation, Session Revocation, and Logout Limitations
17Privileged Access and Directory Security12 argomenti
- Administrative Identities and Privilege Tiers
- Just-in-Time and Just-Enough Administration
- Privileged Access Workstations and Management Paths
- Credential Vaulting and Privileged Session Controls
- Directory Services and Authentication Dependencies
- Active Directory Trusts and Delegated Permissions
- Kerberos and Ticket-Based Trust
- Legacy Authentication and Relay Risk
- Service Accounts and Managed Credentials
- Directory Certificate Services and Enrollment Permissions
- Emergency Access and Break-Glass Accounts
- Identifying Privilege Paths and Reducing Identity Exposure
18Data Protection and Information Handling12 argomenti
- Data Classification and Ownership
- Sensitive Data Discovery and Mapping
- Data at Rest, in Transit, and in Use
- Encryption Boundaries and Access Enforcement
- Tokenization, Masking, and Redaction
- Database Permissions and Administrative Separation
- Secure File Sharing and Collaboration Controls
- Data Loss Prevention and Its Limitations
- Retention, Deletion, and Secure Disposal
- Backup Protection and Access Separation
- Preventing Sensitive Data Exposure in Logs and Exports
- Verifying Controls Across the Data Lifecycle
19Privacy Engineering for Security Practitioners10 argomenti
- Privacy Threats and Security Threats
- Data Minimization and Purpose Limitation
- Identifiability, Linkability, and Inference Risk
- Pseudonymization and Anonymization Limits
- Privacy-Aware Logging and Monitoring
- Consent, User Expectations, and Data Access
- Privacy Threat Modeling
- Differential Privacy and Privacy-Preserving Analysis Concepts
- Balancing Investigation Needs with Data Protection
- Reviewing Third-Party Data Flows and Secondary Uses
Tappa 3
Platform & Network Security
Macchine e reti, messe in sicurezza
9 moduli · 107 argomenti
20Platform Trust and Hardware Security12 argomenti
- Hardware Roots of Trust
- Secure Boot and Measured Boot
- Trusted Platform Modules and Device Attestation
- Firmware Integrity and Update Authenticity
- Kernel Isolation and Trusted Computing Bases
- Virtualization Boundaries and Hypervisor Trust
- Trusted Execution Environments and Their Limits
- Direct Memory Access and Peripheral Exposure
- Physical Access and Device Tampering
- Hardware and Firmware Supply Chain Risks
- Side Channels and Fault Injection as Threat Classes
- Mapping Platform Guarantees to Real Security Requirements
21Windows Security and Hardening13 argomenti
- Windows Security Principals and Access Tokens
- File, Registry, and Service Permissions
- Local and Domain Policy Enforcement
- Administrative Rights and User Account Control
- Credential Protection and Authentication Exposure
- Application Control and Script Execution Policies
- Service Hardening and Scheduled Task Permissions
- Host Firewall and Network Profile Controls
- Security Auditing and Relevant Event Sources
- Patch Management and Configuration Baselines
- Remote Administration and Management Interface Exposure
- Protecting Endpoint Security Configuration
- Validating Hardening Without Breaking Required Workflows
22Linux and Unix Security13 argomenti
- Users, Groups, and Permission Models
- Privileged Execution and Sudo Policy
- File Ownership, Capabilities, and Special Permission Bits
- Service Accounts and Daemon Isolation
- Mandatory Access Control with SELinux and AppArmor
- SSH Authentication and Administrative Access
- Service Exposure and Host Firewall Policy
- Package Trust and Security Updates
- Kernel Hardening and Attack Surface Reduction
- Audit Logging and Authentication Records
- Secrets in Files, Environment Variables, and Processes
- Scheduled Jobs and Writable Execution Paths
- Baseline Validation and Configuration Drift
23Endpoint and Remote Workforce Security13 argomenti
- Managed and Unmanaged Device Risk
- Endpoint Protection and Endpoint Detection and Response
- Full-Disk Encryption and Recovery Key Handling
- macOS Code Signing, Gatekeeper, and Notarization
- macOS Privacy Permissions and System Integrity Controls
- Browser, Extension, and Productivity Tool Controls
- Device Compliance and Conditional Access
- Mobile Device Management and Bring-Your-Own-Device Boundaries
- Removable Media and Peripheral Policies
- Remote Support Tools and Administrative Exposure
- Device Loss, Theft, and Secure Decommissioning
- Endpoint Isolation and Response Readiness
- Balancing Usability, Visibility, and Enforceable Controls
24Mobile Application Security11 argomenti
- Mobile Platform Sandboxes and Application Permissions
- Android Application Components and iOS Entitlements
- Secure Local Storage and Device-Bound Secrets
- Application Authentication and Token Handling
- Interprocess Communication and Exported Components
- Deep Links, App Links, and Untrusted Input
- Network Trust and Certificate Validation
- Sensitive Data in Backups, Screenshots, and Logs
- Application Integrity and Tamper-Resistance Limits
- Third-Party SDKs and Mobile Data Flows
- Testing Mobile Applications with Their Backend Services
25Network Security Architecture12 argomenti
- Security Zones and Network Trust Boundaries
- Segmentation and Microsegmentation
- Ingress, Egress, and East-West Traffic Controls
- Firewall Policy Design and Rule Review
- Intrusion Detection and Intrusion Prevention
- Network Access Control and Device Admission
- Management Plane Isolation
- Secure Administrative Paths and Bastion Access
- Encrypted Traffic Visibility and Inspection Tradeoffs
- Denial-of-Service Resilience and Traffic Filtering
- High Availability of Security Enforcement Points
- Validating Network Boundaries with Observed Traffic
26Protocol and Infrastructure Service Security11 argomenti
- Protocol State, Trust Assumptions, and Spoofing Risks
- ARP, Neighbor Discovery, and Local Network Trust
- DHCP Security and Unauthorized Configuration Sources
- DNS Resolution, DNSSEC, and Resolver Protection
- Domain Administration and Registrar Account Security
- Routing Security and Route-Origin Validation
- IPv6 Exposure and Security Control Parity
- Time Synchronization and Security Dependencies
- Secure Remote Management Protocols
- Legacy and Unauthenticated Infrastructure Services
- Identifying Protocol Abuse Through Traffic and Configuration Evidence
27Wireless and Remote Access Security11 argomenti
- Wireless Trust Boundaries and Shared Medium Risks
- Enterprise Wireless Authentication
- Certificate Validation in Wireless Access
- Rogue Access Points and Evil-Twin Detection
- Guest Networks and Client Isolation
- Bluetooth and Short-Range Wireless Exposure
- VPN Authentication and Device Trust
- Split Tunneling and Traffic Visibility
- Remote Access Gateways and Administrative Separation
- Zero Trust Network Access and Application-Level Access
- Reviewing Remote Access Under Compromised-Device Assumptions
28Email, Browser, and Collaboration Security11 argomenti
- Email Trust Boundaries and Message Authentication
- SPF, DKIM, and DMARC
- Phishing, Impersonation, and Business Email Compromise
- Attachment Handling and Content Inspection
- Malicious Links and Browser-Based Delivery Paths
- Mailbox Delegation, Forwarding, and Access Rules
- Domain Lookalikes and Brand Impersonation Monitoring
- Browser Isolation and Download Controls
- Collaboration Invitations and External Sharing
- Suspicious Message Reporting and Investigation
- Validating Controls Against Real Communication Workflows
Tappa 4
Application & Cloud Security
Codice, API e cloud, testati
16 moduli · 189 argomenti
29Secure Software Design12 argomenti
- Security Requirements and Misuse-Resistant Interfaces
- Security Acceptance Criteria in Product Development
- Trust Boundaries in Application Architecture
- Server-Side Enforcement of Sensitive Decisions
- Secure Defaults and Minimal Exposed Functionality
- Input Validation and Output Handling Responsibilities
- Error Handling and Information Disclosure
- Security of State Transitions and Concurrent Operations
- Abuse Resistance and Resource Consumption Limits
- Security Design Reviews and Architectural Findings
- Translating OWASP ASVS Requirements into Verification Goals
- Maintaining Security Assumptions Through Product Changes
30Browser and Web Client Security13 argomenti
- Browser Origins and the Same-Origin Policy
- Cross-Origin Resource Sharing and Trust Configuration
- Reflected, Stored, and DOM-Based Cross-Site Scripting
- Contextual Output Encoding and Safe DOM Operations
- Content Security Policy and Its Limits
- Cross-Site Request Forgery and Request Authenticity
- Cookie Security Attributes and SameSite Behavior
- HTTPS Enforcement and Mixed-Content Risks
- Clickjacking and Framing Controls
- Third-Party Scripts and Browser Supply Chain Exposure
- Cross-Window Messaging and Origin Validation
- Browser Storage, Caching, and Sensitive Data
- WebSocket and Persistent Client Connection Security
31Injection, Parsing, and File Processing Vulnerabilities12 argomenti
- Data-Code Separation and Injection Root Causes
- SQL and NoSQL Injection
- Operating System Command Injection
- Server-Side Template Injection
- Path Traversal and File Access Boundaries
- File Upload Validation and Content Handling
- Server-Side Request Forgery and Outbound Access Controls
- Unsafe Deserialization and Object Reconstruction
- XML External Entities and Parser Configuration
- HTTP Request Smuggling and Inconsistent Parsing
- Canonicalization, Encoding, and Validation Mismatches
- Parser Isolation and Safe Processing of Untrusted Content
32Application Identity and Business Logic Vulnerabilities12 argomenti
- Authentication Bypass and Inconsistent Identity Checks
- Session Fixation and Session Lifecycle Errors
- Insecure Password Reset and Account Recovery
- Object-Level Access Control Failures
- Function-Level and Administrative Authorization Failures
- Cross-Tenant Data and Action Exposure
- Mass Assignment and Unauthorized Property Changes
- Workflow Bypass and Invalid State Transitions
- Race Conditions in Security-Sensitive Operations
- Replay, Duplicate Requests, and Idempotency Failures
- Abuse of Credits, Entitlements, and Approval Workflows
- Validating Security Invariants Across Complete User Journeys
33API and Service-to-Service Security12 argomenti
- API Inventories and Undocumented Endpoints
- API Authentication and Credential Scope
- Request-Level and Object-Level Authorization
- Schema Validation and Unexpected Fields
- REST, GraphQL, and RPC Security Boundaries
- GraphQL Complexity and Field-Level Access
- Service Identities and Mutual Authentication
- Rate Limits, Quotas, and Expensive Operations
- Webhooks, Callbacks, and Message Authenticity
- Third-Party API Trust and Response Validation
- API Versioning, Deprecation, and Forgotten Exposure
- Protecting Asynchronous Messages and Event Consumers
34Memory Safety and Low-Level Vulnerabilities12 argomenti
- Memory Corruption and Trust Boundary Failures
- Stack and Heap Buffer Overflows
- Use-After-Free and Double-Free Errors
- Integer Overflow and Incorrect Size Calculations
- Out-of-Bounds Reads and Information Disclosure
- Type Confusion and Unsafe Object Interpretation
- Format String Vulnerabilities
- Race Conditions and Time-of-Check-Time-of-Use Errors
- Address Randomization, Nonexecutable Memory, and Control-Flow Protection
- Memory-Safe Languages and Unsafe Interoperability Boundaries
- Sanitizers and Runtime Error Detection
- Distinguishing Vulnerability, Exploitability, and Practical Impact
35Security Code Review and Application Testing12 argomenti
- Reviewing Code from Sources to Sensitive Sinks
- Security-Relevant Data Flow and Trust Assumptions
- Static Application Security Testing
- Dynamic Application Security Testing
- Interactive Testing and Runtime Instrumentation
- Fuzz Testing and Input Space Exploration
- Property-Based Security Tests and Invariants
- Reviewing Authentication and Authorization Implementations
- False Positives, False Negatives, and Manual Validation
- Reproducing Findings in Controlled Test Environments
- Remediation Verification and Security Regression Tests
- Selecting Tests by Threat Model and Application Context
36Software Supply Chain Security12 argomenti
- Dependency Inventories and Software Bills of Materials
- Direct, Transitive, and Optional Dependencies
- Package Provenance and Maintainer Trust
- Dependency Confusion and Package Impersonation Risks
- Malicious Packages and Installation-Time Behavior
- Dependency Pinning, Lockfiles, and Update Policies
- Open-Source Component Evaluation
- Third-Party Libraries, Plugins, and Extensions
- Artifact Signatures and Integrity Verification
- Build Provenance and Verifiable Release Evidence
- Vulnerability Applicability and Reachability
- Coordinating Dependency Remediation Across Products
37Build Pipeline and Delivery Security12 argomenti
- CI/CD Systems as Privileged Infrastructure
- Protecting Repositories and Branch Policies
- Untrusted Contributions and Workflow Execution Boundaries
- Runner Isolation and Ephemeral Build Environments
- Build Secrets and Short-Lived Workload Credentials
- Separation of Build, Approval, and Deployment Authority
- Artifact Registries and Release Access Controls
- Signing, Attestation, and Verification at Deployment
- Infrastructure-as-Code Security Review
- Policy-as-Code and Security Gates
- Preventing Sensitive Data Leakage Through Build Outputs
- Recovering Trust After a Pipeline Compromise
38Cloud Security Architecture12 argomenti
- Shared Responsibility Across Cloud Service Models
- Cloud Accounts, Organizations, and Administrative Boundaries
- Identity Policies and Effective Permissions
- Control Plane and Data Plane Security
- Resource Policies and Public Exposure
- Network Boundaries and Private Connectivity
- Cloud Encryption and Key Ownership Choices
- Organization-Wide Guardrails and Policy Enforcement
- Audit Logging and Security Visibility
- Configuration Drift and Continuous Posture Assessment
- Cross-Account Access and Trust Relationships
- Designing Cloud Controls Around Business-Critical Paths
39Cloud Workload and Data Protection11 argomenti
- Securing Virtual Machine Images and Runtime Configuration
- Workload Identity and Credential Delivery
- Instance Metadata and Credential Exposure
- Object Storage Access and Data Sharing Controls
- Managed Database Security and Administrative Access
- Serverless Permissions and Event Source Trust
- Secret Stores and Runtime Secret Access
- Managed Service Integrations and Permission Expansion
- Cloud Backups, Snapshots, and Recovery Copies
- Tenant Isolation and Shared Service Dependencies
- Responding to Exposed Cloud Resources and Credentials
40Container and Orchestration Security12 argomenti
- Image Trust, Minimal Images, and Package Exposure
- Container Isolation and Shared Kernel Risk
- Rootless Execution and Privilege Reduction
- Capabilities, Seccomp, and Mandatory Access Controls
- Host Mounts and Container Runtime Interfaces
- Kubernetes Authentication and Role-Based Access Control
- Service Accounts and Workload Identity
- Admission Policy and Workload Configuration
- Network Policies and Namespace Boundaries
- Secrets and Sensitive Configuration in Clusters
- Control Plane, Node, and Registry Protection
- Runtime Detection and Container Incident Evidence
41Enterprise SaaS Security10 argomenti
- SaaS Shared Responsibility and Administrative Control
- Tenant Configuration and Security Baselines
- Identity Federation and Lifecycle Integration
- Connected Applications and OAuth Grants
- External Sharing and Guest Access
- Data Export, Synchronization, and Retention
- SaaS Audit Logs and Detection Coverage
- Administrator Roles and High-Risk Configuration Changes
- Backup, Recovery, and Service Exit Constraints
- Detecting and Remediating SaaS Misconfiguration
42IoT and Edge Device Security11 argomenti
- Device Identity and Secure Enrollment
- Default Credentials and Provisioning Risks
- Secure Boot and Firmware Update Chains
- Device Interfaces and Exposed Management Services
- Embedded Secrets and Credential Reuse
- Network Segmentation for Constrained Devices
- Secure Device-to-Service Communication
- Physical Access and Hardware Debug Interfaces
- Telemetry, Inventory, and Fleet Visibility
- Device Support Lifetimes and Update Constraints
- Product Vulnerability Handling and Coordinated Remediation
43Operational Technology and Cyber-Physical Security11 argomenti
- Operational Technology Assets and System Dependencies
- Safety, Availability, and Process Integrity Priorities
- IT-OT Boundaries and Industrial Network Segmentation
- Industrial Protocol Trust and Legacy Constraints
- Engineering Workstations and Controller Access
- Remote Vendor Access and Maintenance Paths
- Passive Discovery and Monitoring Constraints
- Change Management and Testing in Operational Environments
- Incident Response with Physical Process Consequences
- Recovery Planning with Engineering and Operations Teams
- Assessing Cyber Risk in the Context of Physical Operations
44AI, Model, and Agent Security13 argomenti
- Security Boundaries in AI-Enabled Applications
- Model and Training Data Supply Chain Integrity
- Data Poisoning, Evasion, and Model Extraction as Threat Classes
- Direct and Indirect Prompt Injection
- Retrieved Content and Untrusted Instruction Sources
- Sensitive Data Exposure Through Model Inputs and Outputs
- Unsafe Output Handling in Downstream Systems
- Agent Identities, Tool Permissions, and Delegated Authority
- Connector and Model Context Protocol Trust Boundaries
- Human Approval and Independent Policy Enforcement
- Agent Memory, Retrieval Stores, and Cross-Session Contamination
- Security Evaluation, Monitoring, and Incident Investigation
- Separating Model Behavior Controls from System Security Guarantees
Tappa 5
Offense, Detection & Response
Attacco, rilevamento, indagine, ripristino
17 moduli · 199 argomenti
45Vulnerability and Exposure Management13 argomenti
- Vulnerability Discovery and Asset Context
- CVE Identifiers and CWE Weakness Categories
- Authenticated and Unauthenticated Assessment
- Scanner Coverage and Blind Spots
- Validating Findings and Removing False Positives
- Severity Scores and Their Interpretation Limits
- Exploit Likelihood and Evidence of Active Exploitation
- Asset Criticality and Reachable Attack Paths
- Patch Prioritization and Remediation Deadlines
- Mitigation, Isolation, and Compensating Controls
- Exceptions, Ownership, and Escalation
- Retesting and Verification of Remediation
- Product Security Response and Vulnerability Disclosure Intake
46Authorized Penetration Testing12 argomenti
- Assessment Objectives and Scope Design
- Black-Box, Gray-Box, and White-Box Approaches
- Reconnaissance Within Approved Boundaries
- Service Discovery and Configuration Assessment
- Manual Vulnerability Validation
- Controlled Demonstration of Exploitability
- Testing Privilege Boundaries in Isolated Environments
- Combining Findings into Supported Attack Paths
- Assessing Impact Without Unnecessary Data Access
- Recording Evidence and Reproduction Conditions
- Remediation-Focused Reporting and Debriefing
- Cleanup, Retesting, and Engagement Closure
47Red Teaming and Purple Team Validation11 argomenti
- Red Team, Blue Team, and Purple Team Objectives
- Threat-Informed Adversary Emulation
- Scenario Selection and Business Impact Objectives
- Emulation Plans and Exercise Control
- Mapping Techniques to Expected Telemetry
- Testing Preventive and Detective Controls Together
- Coordinating Identity, Endpoint, and Network Observations
- Simulated Social Engineering Within Agreed Scope
- Measuring Detection Gaps and Response Delays
- Distinguishing Exercise Success from Organizational Risk Reduction
- Converting Exercise Findings into Control Improvements
48Security Logging and Telemetry Design12 argomenti
- Logging Requirements Derived from Threat Models
- Authentication, Authorization, and Administrative Events
- Endpoint, Network, Application, and Cloud Telemetry
- Event Schemas and Consistent Field Definitions
- Time Synchronization and Event Ordering
- Collection Agents, Forwarders, and Pipeline Reliability
- Log Integrity and Tamper Resistance
- Sensitive Data Minimization in Security Logs
- Retention, Searchability, and Storage Tradeoffs
- Telemetry Gaps and Collection Health Monitoring
- Access Controls for Security Data
- Verifying That Critical Actions Produce Usable Evidence
49Network Traffic Analysis11 argomenti
- Packet Captures, Flow Records, and Network Metadata
- Reconstructing Connections and Protocol Conversations
- DNS Activity and Suspicious Resolution Patterns
- HTTP, TLS, and Encrypted Connection Metadata
- Unusual Outbound Connections and Beacon-Like Behavior
- Scanning, Service Discovery, and Lateral Movement Indicators
- Data Transfer Patterns and Possible Exfiltration
- Network Baselines and Environmental Context
- Packet Loss, Sampling, and Visibility Limitations
- Distinguishing Suspicious Patterns from Benign Automation
- Combining Traffic Evidence with Identity and Endpoint Context
50Endpoint and Identity Threat Detection12 argomenti
- Process Creation and Parent-Child Relationships
- Command-Line, Script, and Module Execution Evidence
- Persistence-Related Configuration Changes
- Suspicious Credential Access Indicators
- Privilege Changes and Administrative Group Membership
- Unusual Authentication and Session Activity
- Remote Execution and Lateral Access Evidence
- Service, Scheduled Task, and Startup Changes
- Endpoint Security Tool Health and Tampering Signals
- Correlating User, Device, and Workload Identities
- Detecting Misuse of Legitimate Administrative Tools
- Evaluating Indicators in Their Operational Context
51SIEM and Security Analytics11 argomenti
- SIEM Architecture and Data Ingestion
- Parsing, Normalization, and Enrichment
- Search, Aggregation, and Event Correlation
- Time Windows and Sequence-Based Analysis
- Entity Resolution Across Data Sources
- Rules, Thresholds, and Baseline-Based Analytics
- Alert Context and Evidence Presentation
- Query Performance and Data Availability
- Analytics Access Controls and Sensitive Evidence
- Validating Results Against Original Events
- Managing Retention and Investigation Cost
52Detection Engineering12 argomenti
- Detection Objectives and Required Observables
- Behavior-Based and Indicator-Based Detection
- Mapping Detection Coverage to Threat Scenarios
- Detection Logic and Explicit Assumptions
- Test Data, Replay, and Controlled Validation
- Precision, Recall, and Base-Rate Effects
- False Positive Analysis and Tuning
- Detection Latency and Telemetry Dependencies
- Detection-as-Code and Version Control
- Peer Review and Controlled Deployment
- Regression Testing and Coverage Drift
- Documenting Known Blind Spots and Response Guidance
53Cyber Threat Intelligence10 argomenti
- Intelligence Requirements and Stakeholder Needs
- Strategic, Operational, and Technical Intelligence
- Source Reliability and Information Credibility
- Indicators of Compromise and Behavioral Context
- Campaigns, Infrastructure, and Intrusion Patterns
- Vulnerability Intelligence and Exploitation Evidence
- Confidence Levels and Attribution Limits
- Intelligence Enrichment and Expiration
- Sharing Information with Appropriate Handling Restrictions
- Converting Intelligence into Defensive Decisions
54Threat Hunting11 argomenti
- Hypothesis-Driven Hunting
- Intelligence-Led and Anomaly-Led Hunts
- Defining Scope and Available Evidence
- Establishing Baselines and Peer Comparisons
- Querying Across Endpoint, Network, Identity, and Cloud Data
- Following Leads and Testing Alternative Explanations
- Identifying Telemetry Gaps During a Hunt
- Recording Negative Findings and Uncertainty
- Escalating Hunt Findings into Incident Response
- Turning Repeatable Findings into Detections
- Measuring Hunt Value Beyond the Number of Alerts
55Security Operations and Alert Triage11 argomenti
- SOC Roles and Operational Responsibilities
- Alert Queues and Triage Priorities
- Severity, Confidence, and Business Impact
- Case Enrichment and Initial Scoping
- Escalation Criteria and Ownership
- Investigation Notes and Evidence Continuity
- Shift Handoffs and Operational Communication
- Playbooks and Analyst Decision Support
- Automation, Approval Boundaries, and Rollback
- Alert Fatigue and Sustainable Analyst Workflows
- Reviewing Cases for Detection and Process Improvements
56Incident Response Preparation12 argomenti
- Events, Alerts, Incidents, and Crises
- Incident Response Policy and Decision Authority
- Integrating Response with Cybersecurity Risk Management
- Incident Categories and Severity Definitions
- Roles Across Security, IT, Engineering, Legal, and Leadership
- Contact Lists and Out-of-Band Communication
- Response Access, Tools, and Evidence Readiness
- Playbooks for Identity, Endpoint, Cloud, and Data Incidents
- External Service Providers and Escalation Agreements
- Tabletop Exercises and Readiness Validation
- Reporting Obligations and Decision Tracking
- Measuring Preparedness Before an Incident Occurs
57Incident Investigation, Containment, and Recovery12 argomenti
- Initial Assessment and Incident Declaration
- Establishing Scope and Affected Assets
- Building and Updating Incident Hypotheses
- Preserving Evidence While Reducing Harm
- Host, Identity, Network, and Cloud Containment Options
- Credential and Session Invalidation
- Identifying Persistence and Remaining Access Paths
- Eradication and Remediation of Root Causes
- Coordinating Operational and Business Decisions
- Recovery Validation and Heightened Monitoring
- Incident Timelines and Stakeholder Updates
- Post-Incident Review and Tracked Improvement Actions
58Digital Forensics and Evidence Handling12 argomenti
- Forensic Objectives and Investigation Questions
- Evidence Relevance, Integrity, and Provenance
- Order of Volatility and Acquisition Priorities
- Live Response and Offline Examination Tradeoffs
- Forensic Imaging and Integrity Verification
- Chain of Custody and Evidence Access
- Timezones, Clock Drift, and Timestamp Interpretation
- Collection Scope and Data Minimization
- Preservation of Cloud and Third-Party Evidence
- Reproducible Analysis and Tool Limitations
- Separating Observations, Inferences, and Conclusions
- Preparing Technical Findings for Different Audiences
59Host and Cloud Forensic Artifacts13 argomenti
- File System Metadata and File Activity
- Deleted Data and Recovery Limitations
- Windows Execution and User Activity Artifacts
- Linux Authentication, Service, and Command History Evidence
- Browser, Download, and Application Artifacts
- Memory Evidence of Processes, Connections, and Loaded Code
- Registry, Configuration, and Persistence Artifacts
- Cloud Audit Trails and Administrative Actions
- Identity Provider Events and Token-Related Evidence
- SaaS Activity and Mailbox Audit Records
- Container and Ephemeral Workload Evidence
- Timeline Reconstruction Across Multiple Sources
- Identifying Gaps That Prevent a Definitive Conclusion
60Malware Analysis and Reverse Engineering13 argomenti
- Malware Categories and Behavioral Objectives
- Safe Sample Handling and Isolated Analysis Environments
- File Identification, Hashing, and Initial Triage
- Static Analysis of Strings, Imports, and Structure
- Dynamic Analysis and Behavioral Observation
- Disassembly and Decompilation Concepts
- Control Flow and Relevant Execution Paths
- Persistence, Communication, and Data Access Behavior
- Packed, Obfuscated, and Script-Based Samples
- Recognizing Anti-Analysis Behavior
- Extracting Defensive Indicators and Detection Opportunities
- Relating Sample Behavior to Incident Evidence
- Reporting Capabilities, Confidence, and Analysis Limits
61Ransomware and Data Extortion Response11 argomenti
- Encryption, Data Theft, and Extortion as Distinct Impacts
- Initial Access and Pre-Impact Warning Signs
- Rapid Scoping of Affected Systems and Identities
- Protecting Backups and Recovery Infrastructure
- Containing Spread Across Trust Relationships
- Assessing Data Access and Possible Exfiltration
- Decision Authority and Communication During Extortion
- Coordinating Executive, Legal, Insurance, and Response Teams
- Recovery Sequencing for Critical Business Services
- Validation of Restored Systems and Credentials
- Addressing the Conditions That Enabled the Incident
Tappa 6
Resilience & Security Programs
Sicurezza che regge anche in un brutto giorno
5 moduli · 57 argomenti
62Business Continuity and Cyber Recovery12 argomenti
- Business Impact Analysis and Critical Service Dependencies
- Recovery Time and Recovery Point Objectives
- Backup Architecture and Administrative Separation
- Offline and Immutable Recovery Copies
- Restoration Testing and Evidence of Recoverability
- Clean Recovery Environments and Trusted Baselines
- Identity and Key Management Dependencies in Recovery
- Service Degradation and Manual Workarounds
- Disaster Recovery and Cyber Recovery Differences
- Supplier and Infrastructure Failure Scenarios
- Recovery Exercises and Dependency Validation
- Measuring Resilience Through Demonstrated Recovery
63Third-Party and Supplier Security11 argomenti
- Supplier Inventories and Risk Classification
- Due Diligence Based on Access and Business Criticality
- Security Requirements in Procurement
- Questionnaires, Audit Reports, and Technical Evidence
- Supplier Identity and Remote Access Controls
- Shared Data and Subprocessor Dependencies
- Incident Notification and Response Coordination
- Concentration Risk and Critical Provider Dependencies
- Ongoing Monitoring and Material Supplier Changes
- Offboarding, Access Removal, and Data Return
- Managing Exceptions When Replacement Is Impractical
64Security Assurance and Control Assessment11 argomenti
- Control Design and Operating Effectiveness
- Security Frameworks and Control Mapping
- Audit Scope, Criteria, and Evidence Requirements
- Sampling and Limits of Point-in-Time Assessments
- Technical Validation and Documentary Evidence
- Independent Assurance and Conflicts of Interest
- Continuous Control Monitoring
- Findings, Root Causes, and Corrective Actions
- Tracking Remediation to Verified Closure
- Distinguishing Compliance Evidence from Security Outcomes
- Maintaining Assurance as Systems and Threats Change
65Human Factors and Security Culture12 argomenti
- Human Behavior Within Security Systems
- Social Engineering and Manipulated Trust
- Physical Access, Visitor Verification, and Tailgating Risks
- Verification of Payment and Account-Change Requests
- Usable Authentication and Recovery Processes
- Role-Specific Security Education
- Reporting Culture and Psychological Safety
- Phishing Exercises and Meaningful Learning Outcomes
- Insider Risk with Appropriate Oversight and Privacy
- Security Champions and Team-Level Ownership
- Reducing Friction That Encourages Unsafe Workarounds
- Measuring Behavior Change and Control Usability
66Security Program Management and Measurement11 argomenti
- Program Goals and Risk-Based Roadmaps
- Security Operating Models and Team Interfaces
- Staffing, Skills, and Service Ownership
- Build, Buy, and Managed Service Decisions
- Budget Allocation and Control Coverage
- Outcome Metrics, Activity Metrics, and Leading Indicators
- Exposure Reduction and Remediation Performance
- Detection and Response Metrics in Context
- Executive Reporting and Decision-Oriented Communication
- Tracking Security Debt and Accepted Risk
- Reviewing Program Effectiveness as the Organization Changes
Tappa 7
Practicum & Capstone
Un'intera organizzazione, difesa
5 moduli · 54 argomenti
67Threat Modeling and Architecture Practicum10 argomenti
- Mapping a System's Assets, Identities, and Data Flows
- Identifying Trust Boundaries and Sensitive Operations
- Building Abuse Cases and Attack Trees
- Reviewing an Authentication and Recovery Design
- Designing Object-Level and Tenant-Level Authorization
- Evaluating Network and Administrative Segmentation
- Selecting Controls for a Cloud-Based Service
- Assessing Agent Tool Permissions and Data Boundaries
- Defining Verification Criteria for Architectural Controls
- Presenting a Prioritized Security Design Review
68Platform and Identity Hardening Practicum10 argomenti
- Assessing Windows and Linux Configuration Baselines
- Reviewing Local and Directory-Based Privileges
- Finding Unmanaged Accounts and Excessive Entitlements
- Evaluating Multifactor Authentication and Recovery Paths
- Reviewing Firewall Rules and Management Exposure
- Assessing Cloud Policies and Public Resource Access
- Reviewing Container Workload Permissions
- Validating Secret Storage and Credential Rotation
- Confirming Security Log Coverage
- Documenting Exceptions and Testing Remediation
69Application Security Assessment Practicum11 argomenti
- Planning an Assessment for an Intentionally Vulnerable Application
- Mapping Endpoints, Roles, Objects, and Trust Boundaries
- Reviewing Code for Injection and Unsafe Data Handling
- Testing Authentication, Sessions, and Account Recovery
- Validating Object-Level and Function-Level Authorization
- Examining Business Logic and Concurrent Requests
- Evaluating API Input Validation and Resource Limits
- Reviewing Dependency and Build Pipeline Findings
- Demonstrating Impact Within the Approved Lab Scope
- Writing Findings with Reproducible Evidence
- Retesting Fixes and Adding Security Regression Checks
70Detection, Forensics, and Incident Response Practicum11 argomenti
- Reconstructing an Incident from a Curated Evidence Set
- Correlating Endpoint, Network, Identity, and Cloud Events
- Writing and Validating a Detection Hypothesis
- Investigating Suspicious Authentication and Administrative Activity
- Triaging a Malware Sample in an Isolated Environment
- Establishing Scope and Evaluating Alternative Explanations
- Selecting Containment Actions and Recording Tradeoffs
- Building a Forensic Timeline with Explicit Confidence Levels
- Planning Recovery and Verification of Restored Trust
- Preparing Technical and Executive Incident Reports
- Converting Lessons Learned into Tested Improvements
71Integrated Cybersecurity Capstone12 argomenti
- Defining an Organization, Service, and Threat Context
- Building an Asset Inventory and Dependency Map
- Assessing Risk and Prioritizing Security Outcomes
- Designing Identity, Data, Platform, and Network Controls
- Threat Modeling Applications and External Integrations
- Establishing a Security Testing and Remediation Program
- Planning Telemetry, Detection, and Investigation Coverage
- Developing Incident Response and Recovery Playbooks
- Assessing Supplier, Privacy, and Governance Requirements
- Validating Controls Through a Coordinated Exercise
- Measuring Residual Risk and Documenting Limitations
- Presenting an Evidence-Based Security Improvement Roadmap
Quindici minuti.Ogni giorno.
- 1
Una lezione entra nella pausa pranzo
Un'idea alla volta, in slide brevi. Una lezione intera dura circa quindici minuti.
- 2
Esercizi con correzione immediata
Le domande sono dentro la lezione. Rispondi e vedi subito se hai capito.
- 3
Una serie che ti fa tornare
Una lezione al giorno tiene viva la serie. Sessioni brevi e costanti ti portano fino in fondo.
- 1
Una lezione entra nella pausa pranzo
Un'idea alla volta, in slide brevi. Una lezione intera dura circa quindici minuti.
- 2
Esercizi con correzione immediata
Le domande sono dentro la lezione. Rispondi e vedi subito se hai capito.
- 3
Una serie che ti fa tornare
Una lezione al giorno tiene viva la serie. Sessioni brevi e costanti ti portano fino in fondo.
Per chi viene chiamato in causa.
Amministratori IT che passano alla sicurezza
Sviluppatori a cui arrivano i ticket di sicurezza
Chi cambia carriera puntando al SOC
Dove crescerai di più
Rileva le intrusioni e guida la risposta
Tappa 5 · Offense, Detection & Response
Dove porta questo corso.
Il lavoro attorno a cui è costruito questo corso, e come ci si entra.
Security Operations Analyst
Sorveglia i sistemi di un'azienda contro gli attacchi e interviene quando qualcosa non torna.
Tutte le carriere del futuroSul lavoro
- Smistare gli alert e separare il rumore da un incidente reale
- Indagare su un accesso sospetto dalla prima riga di log alla causa
- Scrivere il report che impedisce allo stesso attacco di ripetersi
Come ci si entra
Un primo lavoro comune nella sicurezza. Le aziende chiedono spesso certificazioni di settore insieme o al posto di una laurea.
Sii il primo della lista.
Accesso anticipato per i singoli, pilota per i team. Dicci chi sta imparando.
enterprise@astratrainer.com