Wkrótce
Cybersecurity
Zostań osobą, do której dzwonią, gdy ktoś się włamie.
Pełny kurs
- modułów
- 71
- tematów
- 815
- min na lekcję
- 15
29%
prognozowany wzrost zatrudnienia analityków bezpieczeństwa w USA do 2034.
U.S. Bureau of Labor Statistics, Occupational Outlook 2024–34
Co będziesz potrafić.
Modeluj zagrożenia, zanim system trafi na produkcję
Etap 1 · Foundations & Governance
Zabezpieczaj tożsamość, klucze i dostęp
Etap 2 · Cryptography & Identity
Hartuj Windows, Linuksa i sieci
Etap 3 · Platform & Network Security
Znajduj i łataj luki w webie i chmurze
Etap 4 · Application & Cloud Security
Wykrywaj włamania i prowadź reakcję
Etap 5 · Offense, Detection & Response
Broń planu bezpieczeństwa dowodami
Etap 7 · Practicum & Capstone
Siedem etapów.Jedna równa wspinaczka.
Najpierw ryzyko, potem stos warstwa po warstwie, potem dzień, w którym coś pójdzie źle.
71modułów
w 7 etapach
815tematów
≈ 11 na moduł
≈204godziny
w lekcjach po 15 minut
≈2lata
≈13miesięcy
≈7miesięcy
do końca całego kursu
- 1
Foundations & Governance
Poznaj ryzyko, zanim poznasz narzędzia
9 modułów · 95 tematów · ≈ 24 godz.
- 2
Cryptography & Identity
Kto ma dostęp i co zostaje tajne
10 modułów · 114 tematów · ≈ 29 godz.
- 3
Platform & Network Security
Maszyny i sieci, zahartowane
9 modułów · 107 tematów · ≈ 27 godz.
- 4
Application & Cloud Security
Kod, API i chmura, przetestowane
16 modułów · 189 tematów · ≈ 47 godz.
- 5
Offense, Detection & Response
Atak, wykrycie, śledztwo, powrót do działania
17 modułów · 199 tematów · ≈ 50 godz.
- 6
Resilience & Security Programs
Bezpieczeństwo, które przetrwa zły dzień
5 modułów · 57 tematów · ≈ 14 godz.
- 7
Practicum & Capstone
Cała organizacja, obroniona
5 modułów · 54 tematy · ≈ 14 godz.
Miesiące
0612180369024
MiesiąceMeta · ≈ 2 lata · ≈ 13 miesięcy · ≈ 7 miesięcy
Godziny i miesiące to szacunki: jedna 15-minutowa lekcja na temat, codziennie.
Każdy moduł.Każdy temat.
Tytuły modułów i tematów zostają po angielsku — to język, w którym pracuje ta branża.
Etap 1
Foundations & Governance
Poznaj ryzyko, zanim poznasz narzędzia
9 modułów · 95 tematów
1Foundations of Cybersecurity10 tematów
- Cybersecurity, Information Security, and Digital Resilience
- Confidentiality, Integrity, and Availability
- Authenticity, Accountability, and Nonrepudiation
- Security, Privacy, Safety, and Reliability
- Assets, Threats, Vulnerabilities, and Controls
- Attack Surfaces and Trust Boundaries
- Prevention, Detection, Response, and Recovery
- Security as an Ongoing Engineering Practice
- Technical Controls and Organizational Controls
- Understanding Security Tradeoffs and Residual Risk
2Computing Concepts for Security Analysis10 tematów
- Processes, Threads, and Execution Contexts
- User Space, Kernel Space, and Privilege Boundaries
- Files, Permissions, and Persistent State
- Memory, Address Spaces, and Isolation
- Network Connections, Ports, and Protocol State
- Requests, Sessions, and Application State
- Identities, Credentials, Tokens, and Secrets
- Encodings, Serialization, and Data Interpretation
- Virtual Machines, Containers, and Shared Resources
- Mapping Technical Behavior to Security Consequences
3Threat Actors and Compromise Patterns11 tematów
- Adversary Goals, Capabilities, and Constraints
- Cybercrime, Espionage, Disruption, and Fraud
- Opportunistic and Targeted Intrusions
- Insider Threats and Misuse of Legitimate Access
- Initial Access and Establishment of a Foothold
- Privilege Escalation and Expansion of Access
- Lateral Movement and Trust Exploitation
- Command-and-Control and Data Movement Patterns
- Data Theft, Extortion, and Service Disruption
- Tactics, Techniques, Procedures, and Observable Evidence
- Mapping Compromise Patterns with MITRE ATT&CK
4Professional Practice and Authorized Security Work9 tematów
- Authorization, Ownership, and Defined Assessment Scope
- Rules of Engagement and Testing Constraints
- Production, Staging, and Isolated Lab Environments
- Handling Sensitive Data During Security Work
- Evidence Collection and Minimal Necessary Access
- Coordinated Vulnerability Disclosure
- Research Ethics and Conflicts of Interest
- Escalation, Stop Conditions, and Stakeholder Communication
- Writing Reproducible and Actionable Security Findings
5Security Governance and Policy11 tematów
- Security Objectives and Organizational Mission
- Security Ownership and Decision Rights
- Policies, Standards, Procedures, and Guidelines
- Governance Through the NIST Cybersecurity Framework
- Govern, Identify, Protect, Detect, Respond, and Recover
- Current-State and Target-State Security Profiles
- Selecting and Tailoring Security Controls
- Legal, Regulatory, and Contractual Requirements
- Policy Exceptions and Compensating Controls
- Risk Acceptance and Management Accountability
- Integrating Security into Organizational Decisions
6Cybersecurity Risk Assessment10 tematów
- Risk Scenarios and Business Consequences
- Threat Likelihood and Impact Estimation
- Inherent Risk and Residual Risk
- Qualitative and Quantitative Assessment Approaches
- Exposure, Exploitability, and Asset Criticality
- Dependency Risk and Cascading Consequences
- Uncertainty and Limits of Risk Scoring
- Risk Treatment and Prioritization
- Risk Registers, Owners, and Review Cycles
- Communicating Risk Without False Precision
7Asset Inventory and Attack Surface Management11 tematów
- Hardware, Software, Data, and Identity Inventories
- Business Services and Technical Dependencies
- Internet-Facing Assets and Exposure Discovery
- Shadow IT and Unmanaged Services
- Software Versions and End-of-Life Components
- Data Flow and Trust Relationship Inventories
- External Domains, Certificates, and Public Repositories
- Asset Ownership and Criticality Classification
- Ephemeral Assets and Discovery Gaps
- Continuous Exposure Monitoring
- Reconciling Inventory Data with Observed Reality
8Secure Architecture Principles12 tematów
- Least Privilege and Minimal Functionality
- Defense in Depth and Independent Controls
- Secure Defaults and Fail-Safe Behavior
- Complete Mediation and Consistent Enforcement
- Separation of Duties and Separation of Trust
- Isolation, Segmentation, and Compartmentalization
- Zero Trust as an Architectural Approach
- Explicit Trust Decisions and Contextual Access
- Attack Path Reduction and Blast-Radius Limits
- Designing for Detection and Recovery
- Security Boundaries in Multitenant Systems
- Reviewing Assumptions Behind Architectural Controls
9Threat Modeling and Abuse Cases11 tematów
- Defining the System and Its Security Objectives
- Data Flow Diagrams and Trust Boundaries
- Identifying Entry Points and Sensitive Operations
- Attacker Goals and Abuse Cases
- STRIDE and Structured Threat Identification
- Attack Trees and Attack Path Analysis
- Threat Modeling Identities and Administrative Access
- Threat Modeling Dependencies and External Services
- Prioritizing Threats by Context and Consequence
- Linking Threats to Controls and Verification
- Updating Threat Models as Systems Change
Etap 2
Cryptography & Identity
Kto ma dostęp i co zostaje tajne
10 modułów · 114 tematów
10Cryptographic Foundations12 tematów
- Security Properties Provided by Cryptography
- Symmetric and Asymmetric Cryptography
- Encryption and Authenticated Encryption
- Cryptographic Hashes and Integrity Checks
- Message Authentication Codes
- Digital Signatures and Their Limits
- Key Exchange and Forward Secrecy
- Cryptographic Randomness and Entropy
- Nonces, Initialization Vectors, and Replay Protection
- Password Hashing and Key Derivation
- Encoding, Hashing, Signing, and Encryption as Different Operations
- Cryptographic Assumptions and Security Strength
11Cryptographic Engineering and Key Management12 tematów
- Selecting Vetted Cryptographic Implementations
- Algorithm and Protocol Misuse
- Key Generation, Distribution, and Storage
- Key Rotation, Revocation, and Destruction
- Envelope Encryption and Separation of Key Roles
- Hardware Security Modules and Managed Key Services
- Backup and Recovery of Cryptographic Material
- Secret Exposure Through Code, Logs, and Configuration
- Timing and Other Implementation Side Channels
- Cryptographic Inventories and Crypto-Agility
- Post-Quantum Migration Planning
- Validating Cryptographic Controls Across Their Lifecycle
12Public Key Infrastructure and Secure Transport11 tematów
- Certificates, Public Keys, and Identity Binding
- Certificate Authorities and Trust Stores
- Certificate Chains and Path Validation
- Certificate Issuance and Lifecycle Automation
- Expiration, Revocation, and Compromised Credentials
- TLS Handshakes and Authenticated Connections
- Server Authentication and Mutual TLS
- Hostname Validation and Endpoint Identity
- Downgrade Risks and Insecure Fallbacks
- Encryption Termination and Internal Trust Boundaries
- Diagnosing Certificate and Secure Transport Failures
13Identity Lifecycle Management10 tematów
- Human, Service, Device, and Workload Identities
- Identity Sources and Authoritative Records
- Account Provisioning and Entitlement Assignment
- Joiner, Mover, and Leaver Processes
- Shared Accounts and Accountability Gaps
- Inactive, Orphaned, and Duplicate Accounts
- Identity Verification and Enrollment Assurance
- Access Reviews and Entitlement Recertification
- Identity Inventory and Ownership
- Deprovisioning Across Connected Systems
14Authentication and Account Security12 tematów
- Authentication Factors and Assurance Levels
- Password Policies and Compromised Credential Screening
- Multifactor Authentication and Its Failure Modes
- Phishing-Resistant Authentication
- Passkeys, Security Keys, and Credential Binding
- Enrollment, Recovery, and Factor Replacement
- Credential Stuffing and Password Spraying Defenses
- Rate Limiting and Account Lockout Tradeoffs
- Risk-Based Authentication and Context Signals
- Session Creation, Renewal, and Invalidation
- Reauthentication for Sensitive Operations
- Preventing Recovery Flows from Undermining Authentication
15Authorization and Access Control11 tematów
- Authentication and Authorization as Separate Decisions
- Discretionary and Mandatory Access Control
- Role-Based and Attribute-Based Access Control
- Relationship-Based and Object-Level Authorization
- Policy Decision and Policy Enforcement Points
- Default-Deny and Explicit-Allow Policies
- Horizontal and Vertical Privilege Boundaries
- Delegation and Constrained Authority
- Tenant Isolation and Cross-Tenant Access Prevention
- Time-Bound and Context-Bound Permissions
- Authorization Testing and Policy Change Review
16Federation and Identity Protocol Security12 tematów
- Federated Identity and Trust Relationships
- Single Sign-On Architecture
- OAuth Authorization and Delegated Access
- OpenID Connect Authentication
- SAML Assertions and Federation Boundaries
- Access Tokens, Identity Tokens, and Refresh Tokens
- Issuer, Audience, Signature, and Lifetime Validation
- Redirect Handling and Authorization Response Binding
- Proof Key for Code Exchange
- Consent, Scopes, and Third-Party Application Access
- Federation Misconfiguration and Trust Expansion
- Token Revocation, Session Revocation, and Logout Limitations
17Privileged Access and Directory Security12 tematów
- Administrative Identities and Privilege Tiers
- Just-in-Time and Just-Enough Administration
- Privileged Access Workstations and Management Paths
- Credential Vaulting and Privileged Session Controls
- Directory Services and Authentication Dependencies
- Active Directory Trusts and Delegated Permissions
- Kerberos and Ticket-Based Trust
- Legacy Authentication and Relay Risk
- Service Accounts and Managed Credentials
- Directory Certificate Services and Enrollment Permissions
- Emergency Access and Break-Glass Accounts
- Identifying Privilege Paths and Reducing Identity Exposure
18Data Protection and Information Handling12 tematów
- Data Classification and Ownership
- Sensitive Data Discovery and Mapping
- Data at Rest, in Transit, and in Use
- Encryption Boundaries and Access Enforcement
- Tokenization, Masking, and Redaction
- Database Permissions and Administrative Separation
- Secure File Sharing and Collaboration Controls
- Data Loss Prevention and Its Limitations
- Retention, Deletion, and Secure Disposal
- Backup Protection and Access Separation
- Preventing Sensitive Data Exposure in Logs and Exports
- Verifying Controls Across the Data Lifecycle
19Privacy Engineering for Security Practitioners10 tematów
- Privacy Threats and Security Threats
- Data Minimization and Purpose Limitation
- Identifiability, Linkability, and Inference Risk
- Pseudonymization and Anonymization Limits
- Privacy-Aware Logging and Monitoring
- Consent, User Expectations, and Data Access
- Privacy Threat Modeling
- Differential Privacy and Privacy-Preserving Analysis Concepts
- Balancing Investigation Needs with Data Protection
- Reviewing Third-Party Data Flows and Secondary Uses
Etap 3
Platform & Network Security
Maszyny i sieci, zahartowane
9 modułów · 107 tematów
20Platform Trust and Hardware Security12 tematów
- Hardware Roots of Trust
- Secure Boot and Measured Boot
- Trusted Platform Modules and Device Attestation
- Firmware Integrity and Update Authenticity
- Kernel Isolation and Trusted Computing Bases
- Virtualization Boundaries and Hypervisor Trust
- Trusted Execution Environments and Their Limits
- Direct Memory Access and Peripheral Exposure
- Physical Access and Device Tampering
- Hardware and Firmware Supply Chain Risks
- Side Channels and Fault Injection as Threat Classes
- Mapping Platform Guarantees to Real Security Requirements
21Windows Security and Hardening13 tematów
- Windows Security Principals and Access Tokens
- File, Registry, and Service Permissions
- Local and Domain Policy Enforcement
- Administrative Rights and User Account Control
- Credential Protection and Authentication Exposure
- Application Control and Script Execution Policies
- Service Hardening and Scheduled Task Permissions
- Host Firewall and Network Profile Controls
- Security Auditing and Relevant Event Sources
- Patch Management and Configuration Baselines
- Remote Administration and Management Interface Exposure
- Protecting Endpoint Security Configuration
- Validating Hardening Without Breaking Required Workflows
22Linux and Unix Security13 tematów
- Users, Groups, and Permission Models
- Privileged Execution and Sudo Policy
- File Ownership, Capabilities, and Special Permission Bits
- Service Accounts and Daemon Isolation
- Mandatory Access Control with SELinux and AppArmor
- SSH Authentication and Administrative Access
- Service Exposure and Host Firewall Policy
- Package Trust and Security Updates
- Kernel Hardening and Attack Surface Reduction
- Audit Logging and Authentication Records
- Secrets in Files, Environment Variables, and Processes
- Scheduled Jobs and Writable Execution Paths
- Baseline Validation and Configuration Drift
23Endpoint and Remote Workforce Security13 tematów
- Managed and Unmanaged Device Risk
- Endpoint Protection and Endpoint Detection and Response
- Full-Disk Encryption and Recovery Key Handling
- macOS Code Signing, Gatekeeper, and Notarization
- macOS Privacy Permissions and System Integrity Controls
- Browser, Extension, and Productivity Tool Controls
- Device Compliance and Conditional Access
- Mobile Device Management and Bring-Your-Own-Device Boundaries
- Removable Media and Peripheral Policies
- Remote Support Tools and Administrative Exposure
- Device Loss, Theft, and Secure Decommissioning
- Endpoint Isolation and Response Readiness
- Balancing Usability, Visibility, and Enforceable Controls
24Mobile Application Security11 tematów
- Mobile Platform Sandboxes and Application Permissions
- Android Application Components and iOS Entitlements
- Secure Local Storage and Device-Bound Secrets
- Application Authentication and Token Handling
- Interprocess Communication and Exported Components
- Deep Links, App Links, and Untrusted Input
- Network Trust and Certificate Validation
- Sensitive Data in Backups, Screenshots, and Logs
- Application Integrity and Tamper-Resistance Limits
- Third-Party SDKs and Mobile Data Flows
- Testing Mobile Applications with Their Backend Services
25Network Security Architecture12 tematów
- Security Zones and Network Trust Boundaries
- Segmentation and Microsegmentation
- Ingress, Egress, and East-West Traffic Controls
- Firewall Policy Design and Rule Review
- Intrusion Detection and Intrusion Prevention
- Network Access Control and Device Admission
- Management Plane Isolation
- Secure Administrative Paths and Bastion Access
- Encrypted Traffic Visibility and Inspection Tradeoffs
- Denial-of-Service Resilience and Traffic Filtering
- High Availability of Security Enforcement Points
- Validating Network Boundaries with Observed Traffic
26Protocol and Infrastructure Service Security11 tematów
- Protocol State, Trust Assumptions, and Spoofing Risks
- ARP, Neighbor Discovery, and Local Network Trust
- DHCP Security and Unauthorized Configuration Sources
- DNS Resolution, DNSSEC, and Resolver Protection
- Domain Administration and Registrar Account Security
- Routing Security and Route-Origin Validation
- IPv6 Exposure and Security Control Parity
- Time Synchronization and Security Dependencies
- Secure Remote Management Protocols
- Legacy and Unauthenticated Infrastructure Services
- Identifying Protocol Abuse Through Traffic and Configuration Evidence
27Wireless and Remote Access Security11 tematów
- Wireless Trust Boundaries and Shared Medium Risks
- Enterprise Wireless Authentication
- Certificate Validation in Wireless Access
- Rogue Access Points and Evil-Twin Detection
- Guest Networks and Client Isolation
- Bluetooth and Short-Range Wireless Exposure
- VPN Authentication and Device Trust
- Split Tunneling and Traffic Visibility
- Remote Access Gateways and Administrative Separation
- Zero Trust Network Access and Application-Level Access
- Reviewing Remote Access Under Compromised-Device Assumptions
28Email, Browser, and Collaboration Security11 tematów
- Email Trust Boundaries and Message Authentication
- SPF, DKIM, and DMARC
- Phishing, Impersonation, and Business Email Compromise
- Attachment Handling and Content Inspection
- Malicious Links and Browser-Based Delivery Paths
- Mailbox Delegation, Forwarding, and Access Rules
- Domain Lookalikes and Brand Impersonation Monitoring
- Browser Isolation and Download Controls
- Collaboration Invitations and External Sharing
- Suspicious Message Reporting and Investigation
- Validating Controls Against Real Communication Workflows
Etap 4
Application & Cloud Security
Kod, API i chmura, przetestowane
16 modułów · 189 tematów
29Secure Software Design12 tematów
- Security Requirements and Misuse-Resistant Interfaces
- Security Acceptance Criteria in Product Development
- Trust Boundaries in Application Architecture
- Server-Side Enforcement of Sensitive Decisions
- Secure Defaults and Minimal Exposed Functionality
- Input Validation and Output Handling Responsibilities
- Error Handling and Information Disclosure
- Security of State Transitions and Concurrent Operations
- Abuse Resistance and Resource Consumption Limits
- Security Design Reviews and Architectural Findings
- Translating OWASP ASVS Requirements into Verification Goals
- Maintaining Security Assumptions Through Product Changes
30Browser and Web Client Security13 tematów
- Browser Origins and the Same-Origin Policy
- Cross-Origin Resource Sharing and Trust Configuration
- Reflected, Stored, and DOM-Based Cross-Site Scripting
- Contextual Output Encoding and Safe DOM Operations
- Content Security Policy and Its Limits
- Cross-Site Request Forgery and Request Authenticity
- Cookie Security Attributes and SameSite Behavior
- HTTPS Enforcement and Mixed-Content Risks
- Clickjacking and Framing Controls
- Third-Party Scripts and Browser Supply Chain Exposure
- Cross-Window Messaging and Origin Validation
- Browser Storage, Caching, and Sensitive Data
- WebSocket and Persistent Client Connection Security
31Injection, Parsing, and File Processing Vulnerabilities12 tematów
- Data-Code Separation and Injection Root Causes
- SQL and NoSQL Injection
- Operating System Command Injection
- Server-Side Template Injection
- Path Traversal and File Access Boundaries
- File Upload Validation and Content Handling
- Server-Side Request Forgery and Outbound Access Controls
- Unsafe Deserialization and Object Reconstruction
- XML External Entities and Parser Configuration
- HTTP Request Smuggling and Inconsistent Parsing
- Canonicalization, Encoding, and Validation Mismatches
- Parser Isolation and Safe Processing of Untrusted Content
32Application Identity and Business Logic Vulnerabilities12 tematów
- Authentication Bypass and Inconsistent Identity Checks
- Session Fixation and Session Lifecycle Errors
- Insecure Password Reset and Account Recovery
- Object-Level Access Control Failures
- Function-Level and Administrative Authorization Failures
- Cross-Tenant Data and Action Exposure
- Mass Assignment and Unauthorized Property Changes
- Workflow Bypass and Invalid State Transitions
- Race Conditions in Security-Sensitive Operations
- Replay, Duplicate Requests, and Idempotency Failures
- Abuse of Credits, Entitlements, and Approval Workflows
- Validating Security Invariants Across Complete User Journeys
33API and Service-to-Service Security12 tematów
- API Inventories and Undocumented Endpoints
- API Authentication and Credential Scope
- Request-Level and Object-Level Authorization
- Schema Validation and Unexpected Fields
- REST, GraphQL, and RPC Security Boundaries
- GraphQL Complexity and Field-Level Access
- Service Identities and Mutual Authentication
- Rate Limits, Quotas, and Expensive Operations
- Webhooks, Callbacks, and Message Authenticity
- Third-Party API Trust and Response Validation
- API Versioning, Deprecation, and Forgotten Exposure
- Protecting Asynchronous Messages and Event Consumers
34Memory Safety and Low-Level Vulnerabilities12 tematów
- Memory Corruption and Trust Boundary Failures
- Stack and Heap Buffer Overflows
- Use-After-Free and Double-Free Errors
- Integer Overflow and Incorrect Size Calculations
- Out-of-Bounds Reads and Information Disclosure
- Type Confusion and Unsafe Object Interpretation
- Format String Vulnerabilities
- Race Conditions and Time-of-Check-Time-of-Use Errors
- Address Randomization, Nonexecutable Memory, and Control-Flow Protection
- Memory-Safe Languages and Unsafe Interoperability Boundaries
- Sanitizers and Runtime Error Detection
- Distinguishing Vulnerability, Exploitability, and Practical Impact
35Security Code Review and Application Testing12 tematów
- Reviewing Code from Sources to Sensitive Sinks
- Security-Relevant Data Flow and Trust Assumptions
- Static Application Security Testing
- Dynamic Application Security Testing
- Interactive Testing and Runtime Instrumentation
- Fuzz Testing and Input Space Exploration
- Property-Based Security Tests and Invariants
- Reviewing Authentication and Authorization Implementations
- False Positives, False Negatives, and Manual Validation
- Reproducing Findings in Controlled Test Environments
- Remediation Verification and Security Regression Tests
- Selecting Tests by Threat Model and Application Context
36Software Supply Chain Security12 tematów
- Dependency Inventories and Software Bills of Materials
- Direct, Transitive, and Optional Dependencies
- Package Provenance and Maintainer Trust
- Dependency Confusion and Package Impersonation Risks
- Malicious Packages and Installation-Time Behavior
- Dependency Pinning, Lockfiles, and Update Policies
- Open-Source Component Evaluation
- Third-Party Libraries, Plugins, and Extensions
- Artifact Signatures and Integrity Verification
- Build Provenance and Verifiable Release Evidence
- Vulnerability Applicability and Reachability
- Coordinating Dependency Remediation Across Products
37Build Pipeline and Delivery Security12 tematów
- CI/CD Systems as Privileged Infrastructure
- Protecting Repositories and Branch Policies
- Untrusted Contributions and Workflow Execution Boundaries
- Runner Isolation and Ephemeral Build Environments
- Build Secrets and Short-Lived Workload Credentials
- Separation of Build, Approval, and Deployment Authority
- Artifact Registries and Release Access Controls
- Signing, Attestation, and Verification at Deployment
- Infrastructure-as-Code Security Review
- Policy-as-Code and Security Gates
- Preventing Sensitive Data Leakage Through Build Outputs
- Recovering Trust After a Pipeline Compromise
38Cloud Security Architecture12 tematów
- Shared Responsibility Across Cloud Service Models
- Cloud Accounts, Organizations, and Administrative Boundaries
- Identity Policies and Effective Permissions
- Control Plane and Data Plane Security
- Resource Policies and Public Exposure
- Network Boundaries and Private Connectivity
- Cloud Encryption and Key Ownership Choices
- Organization-Wide Guardrails and Policy Enforcement
- Audit Logging and Security Visibility
- Configuration Drift and Continuous Posture Assessment
- Cross-Account Access and Trust Relationships
- Designing Cloud Controls Around Business-Critical Paths
39Cloud Workload and Data Protection11 tematów
- Securing Virtual Machine Images and Runtime Configuration
- Workload Identity and Credential Delivery
- Instance Metadata and Credential Exposure
- Object Storage Access and Data Sharing Controls
- Managed Database Security and Administrative Access
- Serverless Permissions and Event Source Trust
- Secret Stores and Runtime Secret Access
- Managed Service Integrations and Permission Expansion
- Cloud Backups, Snapshots, and Recovery Copies
- Tenant Isolation and Shared Service Dependencies
- Responding to Exposed Cloud Resources and Credentials
40Container and Orchestration Security12 tematów
- Image Trust, Minimal Images, and Package Exposure
- Container Isolation and Shared Kernel Risk
- Rootless Execution and Privilege Reduction
- Capabilities, Seccomp, and Mandatory Access Controls
- Host Mounts and Container Runtime Interfaces
- Kubernetes Authentication and Role-Based Access Control
- Service Accounts and Workload Identity
- Admission Policy and Workload Configuration
- Network Policies and Namespace Boundaries
- Secrets and Sensitive Configuration in Clusters
- Control Plane, Node, and Registry Protection
- Runtime Detection and Container Incident Evidence
41Enterprise SaaS Security10 tematów
- SaaS Shared Responsibility and Administrative Control
- Tenant Configuration and Security Baselines
- Identity Federation and Lifecycle Integration
- Connected Applications and OAuth Grants
- External Sharing and Guest Access
- Data Export, Synchronization, and Retention
- SaaS Audit Logs and Detection Coverage
- Administrator Roles and High-Risk Configuration Changes
- Backup, Recovery, and Service Exit Constraints
- Detecting and Remediating SaaS Misconfiguration
42IoT and Edge Device Security11 tematów
- Device Identity and Secure Enrollment
- Default Credentials and Provisioning Risks
- Secure Boot and Firmware Update Chains
- Device Interfaces and Exposed Management Services
- Embedded Secrets and Credential Reuse
- Network Segmentation for Constrained Devices
- Secure Device-to-Service Communication
- Physical Access and Hardware Debug Interfaces
- Telemetry, Inventory, and Fleet Visibility
- Device Support Lifetimes and Update Constraints
- Product Vulnerability Handling and Coordinated Remediation
43Operational Technology and Cyber-Physical Security11 tematów
- Operational Technology Assets and System Dependencies
- Safety, Availability, and Process Integrity Priorities
- IT-OT Boundaries and Industrial Network Segmentation
- Industrial Protocol Trust and Legacy Constraints
- Engineering Workstations and Controller Access
- Remote Vendor Access and Maintenance Paths
- Passive Discovery and Monitoring Constraints
- Change Management and Testing in Operational Environments
- Incident Response with Physical Process Consequences
- Recovery Planning with Engineering and Operations Teams
- Assessing Cyber Risk in the Context of Physical Operations
44AI, Model, and Agent Security13 tematów
- Security Boundaries in AI-Enabled Applications
- Model and Training Data Supply Chain Integrity
- Data Poisoning, Evasion, and Model Extraction as Threat Classes
- Direct and Indirect Prompt Injection
- Retrieved Content and Untrusted Instruction Sources
- Sensitive Data Exposure Through Model Inputs and Outputs
- Unsafe Output Handling in Downstream Systems
- Agent Identities, Tool Permissions, and Delegated Authority
- Connector and Model Context Protocol Trust Boundaries
- Human Approval and Independent Policy Enforcement
- Agent Memory, Retrieval Stores, and Cross-Session Contamination
- Security Evaluation, Monitoring, and Incident Investigation
- Separating Model Behavior Controls from System Security Guarantees
Etap 5
Offense, Detection & Response
Atak, wykrycie, śledztwo, powrót do działania
17 modułów · 199 tematów
45Vulnerability and Exposure Management13 tematów
- Vulnerability Discovery and Asset Context
- CVE Identifiers and CWE Weakness Categories
- Authenticated and Unauthenticated Assessment
- Scanner Coverage and Blind Spots
- Validating Findings and Removing False Positives
- Severity Scores and Their Interpretation Limits
- Exploit Likelihood and Evidence of Active Exploitation
- Asset Criticality and Reachable Attack Paths
- Patch Prioritization and Remediation Deadlines
- Mitigation, Isolation, and Compensating Controls
- Exceptions, Ownership, and Escalation
- Retesting and Verification of Remediation
- Product Security Response and Vulnerability Disclosure Intake
46Authorized Penetration Testing12 tematów
- Assessment Objectives and Scope Design
- Black-Box, Gray-Box, and White-Box Approaches
- Reconnaissance Within Approved Boundaries
- Service Discovery and Configuration Assessment
- Manual Vulnerability Validation
- Controlled Demonstration of Exploitability
- Testing Privilege Boundaries in Isolated Environments
- Combining Findings into Supported Attack Paths
- Assessing Impact Without Unnecessary Data Access
- Recording Evidence and Reproduction Conditions
- Remediation-Focused Reporting and Debriefing
- Cleanup, Retesting, and Engagement Closure
47Red Teaming and Purple Team Validation11 tematów
- Red Team, Blue Team, and Purple Team Objectives
- Threat-Informed Adversary Emulation
- Scenario Selection and Business Impact Objectives
- Emulation Plans and Exercise Control
- Mapping Techniques to Expected Telemetry
- Testing Preventive and Detective Controls Together
- Coordinating Identity, Endpoint, and Network Observations
- Simulated Social Engineering Within Agreed Scope
- Measuring Detection Gaps and Response Delays
- Distinguishing Exercise Success from Organizational Risk Reduction
- Converting Exercise Findings into Control Improvements
48Security Logging and Telemetry Design12 tematów
- Logging Requirements Derived from Threat Models
- Authentication, Authorization, and Administrative Events
- Endpoint, Network, Application, and Cloud Telemetry
- Event Schemas and Consistent Field Definitions
- Time Synchronization and Event Ordering
- Collection Agents, Forwarders, and Pipeline Reliability
- Log Integrity and Tamper Resistance
- Sensitive Data Minimization in Security Logs
- Retention, Searchability, and Storage Tradeoffs
- Telemetry Gaps and Collection Health Monitoring
- Access Controls for Security Data
- Verifying That Critical Actions Produce Usable Evidence
49Network Traffic Analysis11 tematów
- Packet Captures, Flow Records, and Network Metadata
- Reconstructing Connections and Protocol Conversations
- DNS Activity and Suspicious Resolution Patterns
- HTTP, TLS, and Encrypted Connection Metadata
- Unusual Outbound Connections and Beacon-Like Behavior
- Scanning, Service Discovery, and Lateral Movement Indicators
- Data Transfer Patterns and Possible Exfiltration
- Network Baselines and Environmental Context
- Packet Loss, Sampling, and Visibility Limitations
- Distinguishing Suspicious Patterns from Benign Automation
- Combining Traffic Evidence with Identity and Endpoint Context
50Endpoint and Identity Threat Detection12 tematów
- Process Creation and Parent-Child Relationships
- Command-Line, Script, and Module Execution Evidence
- Persistence-Related Configuration Changes
- Suspicious Credential Access Indicators
- Privilege Changes and Administrative Group Membership
- Unusual Authentication and Session Activity
- Remote Execution and Lateral Access Evidence
- Service, Scheduled Task, and Startup Changes
- Endpoint Security Tool Health and Tampering Signals
- Correlating User, Device, and Workload Identities
- Detecting Misuse of Legitimate Administrative Tools
- Evaluating Indicators in Their Operational Context
51SIEM and Security Analytics11 tematów
- SIEM Architecture and Data Ingestion
- Parsing, Normalization, and Enrichment
- Search, Aggregation, and Event Correlation
- Time Windows and Sequence-Based Analysis
- Entity Resolution Across Data Sources
- Rules, Thresholds, and Baseline-Based Analytics
- Alert Context and Evidence Presentation
- Query Performance and Data Availability
- Analytics Access Controls and Sensitive Evidence
- Validating Results Against Original Events
- Managing Retention and Investigation Cost
52Detection Engineering12 tematów
- Detection Objectives and Required Observables
- Behavior-Based and Indicator-Based Detection
- Mapping Detection Coverage to Threat Scenarios
- Detection Logic and Explicit Assumptions
- Test Data, Replay, and Controlled Validation
- Precision, Recall, and Base-Rate Effects
- False Positive Analysis and Tuning
- Detection Latency and Telemetry Dependencies
- Detection-as-Code and Version Control
- Peer Review and Controlled Deployment
- Regression Testing and Coverage Drift
- Documenting Known Blind Spots and Response Guidance
53Cyber Threat Intelligence10 tematów
- Intelligence Requirements and Stakeholder Needs
- Strategic, Operational, and Technical Intelligence
- Source Reliability and Information Credibility
- Indicators of Compromise and Behavioral Context
- Campaigns, Infrastructure, and Intrusion Patterns
- Vulnerability Intelligence and Exploitation Evidence
- Confidence Levels and Attribution Limits
- Intelligence Enrichment and Expiration
- Sharing Information with Appropriate Handling Restrictions
- Converting Intelligence into Defensive Decisions
54Threat Hunting11 tematów
- Hypothesis-Driven Hunting
- Intelligence-Led and Anomaly-Led Hunts
- Defining Scope and Available Evidence
- Establishing Baselines and Peer Comparisons
- Querying Across Endpoint, Network, Identity, and Cloud Data
- Following Leads and Testing Alternative Explanations
- Identifying Telemetry Gaps During a Hunt
- Recording Negative Findings and Uncertainty
- Escalating Hunt Findings into Incident Response
- Turning Repeatable Findings into Detections
- Measuring Hunt Value Beyond the Number of Alerts
55Security Operations and Alert Triage11 tematów
- SOC Roles and Operational Responsibilities
- Alert Queues and Triage Priorities
- Severity, Confidence, and Business Impact
- Case Enrichment and Initial Scoping
- Escalation Criteria and Ownership
- Investigation Notes and Evidence Continuity
- Shift Handoffs and Operational Communication
- Playbooks and Analyst Decision Support
- Automation, Approval Boundaries, and Rollback
- Alert Fatigue and Sustainable Analyst Workflows
- Reviewing Cases for Detection and Process Improvements
56Incident Response Preparation12 tematów
- Events, Alerts, Incidents, and Crises
- Incident Response Policy and Decision Authority
- Integrating Response with Cybersecurity Risk Management
- Incident Categories and Severity Definitions
- Roles Across Security, IT, Engineering, Legal, and Leadership
- Contact Lists and Out-of-Band Communication
- Response Access, Tools, and Evidence Readiness
- Playbooks for Identity, Endpoint, Cloud, and Data Incidents
- External Service Providers and Escalation Agreements
- Tabletop Exercises and Readiness Validation
- Reporting Obligations and Decision Tracking
- Measuring Preparedness Before an Incident Occurs
57Incident Investigation, Containment, and Recovery12 tematów
- Initial Assessment and Incident Declaration
- Establishing Scope and Affected Assets
- Building and Updating Incident Hypotheses
- Preserving Evidence While Reducing Harm
- Host, Identity, Network, and Cloud Containment Options
- Credential and Session Invalidation
- Identifying Persistence and Remaining Access Paths
- Eradication and Remediation of Root Causes
- Coordinating Operational and Business Decisions
- Recovery Validation and Heightened Monitoring
- Incident Timelines and Stakeholder Updates
- Post-Incident Review and Tracked Improvement Actions
58Digital Forensics and Evidence Handling12 tematów
- Forensic Objectives and Investigation Questions
- Evidence Relevance, Integrity, and Provenance
- Order of Volatility and Acquisition Priorities
- Live Response and Offline Examination Tradeoffs
- Forensic Imaging and Integrity Verification
- Chain of Custody and Evidence Access
- Timezones, Clock Drift, and Timestamp Interpretation
- Collection Scope and Data Minimization
- Preservation of Cloud and Third-Party Evidence
- Reproducible Analysis and Tool Limitations
- Separating Observations, Inferences, and Conclusions
- Preparing Technical Findings for Different Audiences
59Host and Cloud Forensic Artifacts13 tematów
- File System Metadata and File Activity
- Deleted Data and Recovery Limitations
- Windows Execution and User Activity Artifacts
- Linux Authentication, Service, and Command History Evidence
- Browser, Download, and Application Artifacts
- Memory Evidence of Processes, Connections, and Loaded Code
- Registry, Configuration, and Persistence Artifacts
- Cloud Audit Trails and Administrative Actions
- Identity Provider Events and Token-Related Evidence
- SaaS Activity and Mailbox Audit Records
- Container and Ephemeral Workload Evidence
- Timeline Reconstruction Across Multiple Sources
- Identifying Gaps That Prevent a Definitive Conclusion
60Malware Analysis and Reverse Engineering13 tematów
- Malware Categories and Behavioral Objectives
- Safe Sample Handling and Isolated Analysis Environments
- File Identification, Hashing, and Initial Triage
- Static Analysis of Strings, Imports, and Structure
- Dynamic Analysis and Behavioral Observation
- Disassembly and Decompilation Concepts
- Control Flow and Relevant Execution Paths
- Persistence, Communication, and Data Access Behavior
- Packed, Obfuscated, and Script-Based Samples
- Recognizing Anti-Analysis Behavior
- Extracting Defensive Indicators and Detection Opportunities
- Relating Sample Behavior to Incident Evidence
- Reporting Capabilities, Confidence, and Analysis Limits
61Ransomware and Data Extortion Response11 tematów
- Encryption, Data Theft, and Extortion as Distinct Impacts
- Initial Access and Pre-Impact Warning Signs
- Rapid Scoping of Affected Systems and Identities
- Protecting Backups and Recovery Infrastructure
- Containing Spread Across Trust Relationships
- Assessing Data Access and Possible Exfiltration
- Decision Authority and Communication During Extortion
- Coordinating Executive, Legal, Insurance, and Response Teams
- Recovery Sequencing for Critical Business Services
- Validation of Restored Systems and Credentials
- Addressing the Conditions That Enabled the Incident
Etap 6
Resilience & Security Programs
Bezpieczeństwo, które przetrwa zły dzień
5 modułów · 57 tematów
62Business Continuity and Cyber Recovery12 tematów
- Business Impact Analysis and Critical Service Dependencies
- Recovery Time and Recovery Point Objectives
- Backup Architecture and Administrative Separation
- Offline and Immutable Recovery Copies
- Restoration Testing and Evidence of Recoverability
- Clean Recovery Environments and Trusted Baselines
- Identity and Key Management Dependencies in Recovery
- Service Degradation and Manual Workarounds
- Disaster Recovery and Cyber Recovery Differences
- Supplier and Infrastructure Failure Scenarios
- Recovery Exercises and Dependency Validation
- Measuring Resilience Through Demonstrated Recovery
63Third-Party and Supplier Security11 tematów
- Supplier Inventories and Risk Classification
- Due Diligence Based on Access and Business Criticality
- Security Requirements in Procurement
- Questionnaires, Audit Reports, and Technical Evidence
- Supplier Identity and Remote Access Controls
- Shared Data and Subprocessor Dependencies
- Incident Notification and Response Coordination
- Concentration Risk and Critical Provider Dependencies
- Ongoing Monitoring and Material Supplier Changes
- Offboarding, Access Removal, and Data Return
- Managing Exceptions When Replacement Is Impractical
64Security Assurance and Control Assessment11 tematów
- Control Design and Operating Effectiveness
- Security Frameworks and Control Mapping
- Audit Scope, Criteria, and Evidence Requirements
- Sampling and Limits of Point-in-Time Assessments
- Technical Validation and Documentary Evidence
- Independent Assurance and Conflicts of Interest
- Continuous Control Monitoring
- Findings, Root Causes, and Corrective Actions
- Tracking Remediation to Verified Closure
- Distinguishing Compliance Evidence from Security Outcomes
- Maintaining Assurance as Systems and Threats Change
65Human Factors and Security Culture12 tematów
- Human Behavior Within Security Systems
- Social Engineering and Manipulated Trust
- Physical Access, Visitor Verification, and Tailgating Risks
- Verification of Payment and Account-Change Requests
- Usable Authentication and Recovery Processes
- Role-Specific Security Education
- Reporting Culture and Psychological Safety
- Phishing Exercises and Meaningful Learning Outcomes
- Insider Risk with Appropriate Oversight and Privacy
- Security Champions and Team-Level Ownership
- Reducing Friction That Encourages Unsafe Workarounds
- Measuring Behavior Change and Control Usability
66Security Program Management and Measurement11 tematów
- Program Goals and Risk-Based Roadmaps
- Security Operating Models and Team Interfaces
- Staffing, Skills, and Service Ownership
- Build, Buy, and Managed Service Decisions
- Budget Allocation and Control Coverage
- Outcome Metrics, Activity Metrics, and Leading Indicators
- Exposure Reduction and Remediation Performance
- Detection and Response Metrics in Context
- Executive Reporting and Decision-Oriented Communication
- Tracking Security Debt and Accepted Risk
- Reviewing Program Effectiveness as the Organization Changes
Etap 7
Practicum & Capstone
Cała organizacja, obroniona
5 modułów · 54 tematy
67Threat Modeling and Architecture Practicum10 tematów
- Mapping a System's Assets, Identities, and Data Flows
- Identifying Trust Boundaries and Sensitive Operations
- Building Abuse Cases and Attack Trees
- Reviewing an Authentication and Recovery Design
- Designing Object-Level and Tenant-Level Authorization
- Evaluating Network and Administrative Segmentation
- Selecting Controls for a Cloud-Based Service
- Assessing Agent Tool Permissions and Data Boundaries
- Defining Verification Criteria for Architectural Controls
- Presenting a Prioritized Security Design Review
68Platform and Identity Hardening Practicum10 tematów
- Assessing Windows and Linux Configuration Baselines
- Reviewing Local and Directory-Based Privileges
- Finding Unmanaged Accounts and Excessive Entitlements
- Evaluating Multifactor Authentication and Recovery Paths
- Reviewing Firewall Rules and Management Exposure
- Assessing Cloud Policies and Public Resource Access
- Reviewing Container Workload Permissions
- Validating Secret Storage and Credential Rotation
- Confirming Security Log Coverage
- Documenting Exceptions and Testing Remediation
69Application Security Assessment Practicum11 tematów
- Planning an Assessment for an Intentionally Vulnerable Application
- Mapping Endpoints, Roles, Objects, and Trust Boundaries
- Reviewing Code for Injection and Unsafe Data Handling
- Testing Authentication, Sessions, and Account Recovery
- Validating Object-Level and Function-Level Authorization
- Examining Business Logic and Concurrent Requests
- Evaluating API Input Validation and Resource Limits
- Reviewing Dependency and Build Pipeline Findings
- Demonstrating Impact Within the Approved Lab Scope
- Writing Findings with Reproducible Evidence
- Retesting Fixes and Adding Security Regression Checks
70Detection, Forensics, and Incident Response Practicum11 tematów
- Reconstructing an Incident from a Curated Evidence Set
- Correlating Endpoint, Network, Identity, and Cloud Events
- Writing and Validating a Detection Hypothesis
- Investigating Suspicious Authentication and Administrative Activity
- Triaging a Malware Sample in an Isolated Environment
- Establishing Scope and Evaluating Alternative Explanations
- Selecting Containment Actions and Recording Tradeoffs
- Building a Forensic Timeline with Explicit Confidence Levels
- Planning Recovery and Verification of Restored Trust
- Preparing Technical and Executive Incident Reports
- Converting Lessons Learned into Tested Improvements
71Integrated Cybersecurity Capstone12 tematów
- Defining an Organization, Service, and Threat Context
- Building an Asset Inventory and Dependency Map
- Assessing Risk and Prioritizing Security Outcomes
- Designing Identity, Data, Platform, and Network Controls
- Threat Modeling Applications and External Integrations
- Establishing a Security Testing and Remediation Program
- Planning Telemetry, Detection, and Investigation Coverage
- Developing Incident Response and Recovery Playbooks
- Assessing Supplier, Privacy, and Governance Requirements
- Validating Controls Through a Coordinated Exercise
- Measuring Residual Risk and Documenting Limitations
- Presenting an Evidence-Based Security Improvement Roadmap
Piętnaście minut.Każdego dnia.
- 1
Lekcja mieści się w przerwie obiadowej
Jedna myśl naraz, na krótkich slajdach. Cała lekcja zajmuje około piętnastu minut.
- 2
Praktyka z natychmiastową informacją zwrotną
Pytania są częścią lekcji. Odpowiadasz i od razu widzisz, czy dobrze.
- 3
Seria, która przyciąga cię z powrotem
Lekcja dziennie podtrzymuje serię. Krótkie, regularne sesje prowadzą cię do końca.
- 1
Lekcja mieści się w przerwie obiadowej
Jedna myśl naraz, na krótkich slajdach. Cała lekcja zajmuje około piętnastu minut.
- 2
Praktyka z natychmiastową informacją zwrotną
Pytania są częścią lekcji. Odpowiadasz i od razu widzisz, czy dobrze.
- 3
Seria, która przyciąga cię z powrotem
Lekcja dziennie podtrzymuje serię. Krótkie, regularne sesje prowadzą cię do końca.
Dla tych, których budzi alert.
Administratorzy IT wchodzący w security
Deweloperzy, którzy dostają zgłoszenia security
Gdzie urośniesz najbardziej
Znajduj i łataj luki w webie i chmurze
Etap 4 · Application & Cloud SecurityOsoby zmieniające branżę, celujące w SOC
Gdzie urośniesz najbardziej
Wykrywaj włamania i prowadź reakcję
Etap 5 · Offense, Detection & Response
Dokąd prowadzi ten kurs.
Zawód, wokół którego zbudowano ten kurs, i to, jak ludzie się do niego dostają.
Security Operations Analyst
Monitoruje systemy firmy pod kątem ataków i reaguje, gdy coś wygląda podejrzanie.
Wszystkie kariery przyszłościW pracy
- Selekcja alertów i oddzielenie szumu od prawdziwego incydentu
- Zbadanie podejrzanego logowania od pierwszej linii logu do przyczyny źródłowej
- Napisanie raportu, dzięki któremu ten sam atak się nie powtórzy
Jak się dostać
Częsta pierwsza praca w bezpieczeństwie. Pracodawcy często oczekują certyfikatów branżowych obok dyplomu albo zamiast niego.
Bądź pierwszy w kolejce.
Wczesny dostęp dla osób indywidualnych, pilotaż dla zespołów. Powiedz nam, kto się uczy.
enterprise@astratrainer.com