Скоро
Cybersecurity
Станьте тем, кому звонят, когда кто-то проник внутрь.
Полный курс
- модуль
- 71
- тем
- 815
- минут на урок
- 15
29%
прогнозируемый рост занятости специалистов по информационной безопасности в США с 2024 по 2034 год — намного выше среднего по всем профессиям.
U.S. Bureau of Labor Statistics, Occupational Outlook 2024–34
Что вы сможете делать.
Моделируйте угрозы системы до релиза
Этап 1 · Foundations & Governance
Защищайте идентификацию, ключи и доступ
Этап 2 · Cryptography & Identity
Укрепляйте Windows, Linux и сети
Этап 3 · Platform & Network Security
Находите и устраняйте уязвимости веба и облака
Этап 4 · Application & Cloud Security
Обнаруживайте вторжения и ведите реагирование
Этап 5 · Offense, Detection & Response
Защищайте план безопасности доказательствами
Этап 7 · Practicum & Capstone
Семь этапов.Один ровный подъём.
Сначала риск, потом стек слой за слоем, потом день, когда всё идёт не так.
71модуль
в 7 этапах
815тем
≈ 11 на модуль
≈204часа
в уроках по 15 минут
≈2года
≈13месяцев
≈7месяцев
до конца всего курса
- 1
Foundations & Governance
Знайте риск раньше инструментов
9 модулей · 95 тем · ≈ 24 ч
- 2
Cryptography & Identity
Кто проходит внутрь, а что остаётся тайной
10 модулей · 114 тем · ≈ 29 ч
- 3
Platform & Network Security
Машины и сети под защитой
9 модулей · 107 тем · ≈ 27 ч
- 4
Application & Cloud Security
Код, API и облако — проверены
16 модулей · 189 тем · ≈ 47 ч
- 5
Offense, Detection & Response
Атака, обнаружение, расследование, восстановление
17 модулей · 199 тем · ≈ 50 ч
- 6
Resilience & Security Programs
Безопасность, которая переживёт плохой день
5 модулей · 57 тем · ≈ 14 ч
- 7
Practicum & Capstone
Вся организация под защитой
5 модулей · 54 темы · ≈ 14 ч
Месяцы
0612180369024
МесяцыФиниш · ≈ 2 года · ≈ 13 месяцев · ≈ 7 месяцев
Часы и месяцы — оценка: один 15-минутный урок на тему, каждый день.
Каждый модуль.Каждая тема.
Названия модулей и тем остаются на английском — на этом языке говорит отрасль.
Этап 1
Foundations & Governance
Знайте риск раньше инструментов
9 модулей · 95 тем
1Foundations of Cybersecurity10 тем
- Cybersecurity, Information Security, and Digital Resilience
- Confidentiality, Integrity, and Availability
- Authenticity, Accountability, and Nonrepudiation
- Security, Privacy, Safety, and Reliability
- Assets, Threats, Vulnerabilities, and Controls
- Attack Surfaces and Trust Boundaries
- Prevention, Detection, Response, and Recovery
- Security as an Ongoing Engineering Practice
- Technical Controls and Organizational Controls
- Understanding Security Tradeoffs and Residual Risk
2Computing Concepts for Security Analysis10 тем
- Processes, Threads, and Execution Contexts
- User Space, Kernel Space, and Privilege Boundaries
- Files, Permissions, and Persistent State
- Memory, Address Spaces, and Isolation
- Network Connections, Ports, and Protocol State
- Requests, Sessions, and Application State
- Identities, Credentials, Tokens, and Secrets
- Encodings, Serialization, and Data Interpretation
- Virtual Machines, Containers, and Shared Resources
- Mapping Technical Behavior to Security Consequences
3Threat Actors and Compromise Patterns11 тем
- Adversary Goals, Capabilities, and Constraints
- Cybercrime, Espionage, Disruption, and Fraud
- Opportunistic and Targeted Intrusions
- Insider Threats and Misuse of Legitimate Access
- Initial Access and Establishment of a Foothold
- Privilege Escalation and Expansion of Access
- Lateral Movement and Trust Exploitation
- Command-and-Control and Data Movement Patterns
- Data Theft, Extortion, and Service Disruption
- Tactics, Techniques, Procedures, and Observable Evidence
- Mapping Compromise Patterns with MITRE ATT&CK
4Professional Practice and Authorized Security Work9 тем
- Authorization, Ownership, and Defined Assessment Scope
- Rules of Engagement and Testing Constraints
- Production, Staging, and Isolated Lab Environments
- Handling Sensitive Data During Security Work
- Evidence Collection and Minimal Necessary Access
- Coordinated Vulnerability Disclosure
- Research Ethics and Conflicts of Interest
- Escalation, Stop Conditions, and Stakeholder Communication
- Writing Reproducible and Actionable Security Findings
5Security Governance and Policy11 тем
- Security Objectives and Organizational Mission
- Security Ownership and Decision Rights
- Policies, Standards, Procedures, and Guidelines
- Governance Through the NIST Cybersecurity Framework
- Govern, Identify, Protect, Detect, Respond, and Recover
- Current-State and Target-State Security Profiles
- Selecting and Tailoring Security Controls
- Legal, Regulatory, and Contractual Requirements
- Policy Exceptions and Compensating Controls
- Risk Acceptance and Management Accountability
- Integrating Security into Organizational Decisions
6Cybersecurity Risk Assessment10 тем
- Risk Scenarios and Business Consequences
- Threat Likelihood and Impact Estimation
- Inherent Risk and Residual Risk
- Qualitative and Quantitative Assessment Approaches
- Exposure, Exploitability, and Asset Criticality
- Dependency Risk and Cascading Consequences
- Uncertainty and Limits of Risk Scoring
- Risk Treatment and Prioritization
- Risk Registers, Owners, and Review Cycles
- Communicating Risk Without False Precision
7Asset Inventory and Attack Surface Management11 тем
- Hardware, Software, Data, and Identity Inventories
- Business Services and Technical Dependencies
- Internet-Facing Assets and Exposure Discovery
- Shadow IT and Unmanaged Services
- Software Versions and End-of-Life Components
- Data Flow and Trust Relationship Inventories
- External Domains, Certificates, and Public Repositories
- Asset Ownership and Criticality Classification
- Ephemeral Assets and Discovery Gaps
- Continuous Exposure Monitoring
- Reconciling Inventory Data with Observed Reality
8Secure Architecture Principles12 тем
- Least Privilege and Minimal Functionality
- Defense in Depth and Independent Controls
- Secure Defaults and Fail-Safe Behavior
- Complete Mediation and Consistent Enforcement
- Separation of Duties and Separation of Trust
- Isolation, Segmentation, and Compartmentalization
- Zero Trust as an Architectural Approach
- Explicit Trust Decisions and Contextual Access
- Attack Path Reduction and Blast-Radius Limits
- Designing for Detection and Recovery
- Security Boundaries in Multitenant Systems
- Reviewing Assumptions Behind Architectural Controls
9Threat Modeling and Abuse Cases11 тем
- Defining the System and Its Security Objectives
- Data Flow Diagrams and Trust Boundaries
- Identifying Entry Points and Sensitive Operations
- Attacker Goals and Abuse Cases
- STRIDE and Structured Threat Identification
- Attack Trees and Attack Path Analysis
- Threat Modeling Identities and Administrative Access
- Threat Modeling Dependencies and External Services
- Prioritizing Threats by Context and Consequence
- Linking Threats to Controls and Verification
- Updating Threat Models as Systems Change
Этап 2
Cryptography & Identity
Кто проходит внутрь, а что остаётся тайной
10 модулей · 114 тем
10Cryptographic Foundations12 тем
- Security Properties Provided by Cryptography
- Symmetric and Asymmetric Cryptography
- Encryption and Authenticated Encryption
- Cryptographic Hashes and Integrity Checks
- Message Authentication Codes
- Digital Signatures and Their Limits
- Key Exchange and Forward Secrecy
- Cryptographic Randomness and Entropy
- Nonces, Initialization Vectors, and Replay Protection
- Password Hashing and Key Derivation
- Encoding, Hashing, Signing, and Encryption as Different Operations
- Cryptographic Assumptions and Security Strength
11Cryptographic Engineering and Key Management12 тем
- Selecting Vetted Cryptographic Implementations
- Algorithm and Protocol Misuse
- Key Generation, Distribution, and Storage
- Key Rotation, Revocation, and Destruction
- Envelope Encryption and Separation of Key Roles
- Hardware Security Modules and Managed Key Services
- Backup and Recovery of Cryptographic Material
- Secret Exposure Through Code, Logs, and Configuration
- Timing and Other Implementation Side Channels
- Cryptographic Inventories and Crypto-Agility
- Post-Quantum Migration Planning
- Validating Cryptographic Controls Across Their Lifecycle
12Public Key Infrastructure and Secure Transport11 тем
- Certificates, Public Keys, and Identity Binding
- Certificate Authorities and Trust Stores
- Certificate Chains and Path Validation
- Certificate Issuance and Lifecycle Automation
- Expiration, Revocation, and Compromised Credentials
- TLS Handshakes and Authenticated Connections
- Server Authentication and Mutual TLS
- Hostname Validation and Endpoint Identity
- Downgrade Risks and Insecure Fallbacks
- Encryption Termination and Internal Trust Boundaries
- Diagnosing Certificate and Secure Transport Failures
13Identity Lifecycle Management10 тем
- Human, Service, Device, and Workload Identities
- Identity Sources and Authoritative Records
- Account Provisioning and Entitlement Assignment
- Joiner, Mover, and Leaver Processes
- Shared Accounts and Accountability Gaps
- Inactive, Orphaned, and Duplicate Accounts
- Identity Verification and Enrollment Assurance
- Access Reviews and Entitlement Recertification
- Identity Inventory and Ownership
- Deprovisioning Across Connected Systems
14Authentication and Account Security12 тем
- Authentication Factors and Assurance Levels
- Password Policies and Compromised Credential Screening
- Multifactor Authentication and Its Failure Modes
- Phishing-Resistant Authentication
- Passkeys, Security Keys, and Credential Binding
- Enrollment, Recovery, and Factor Replacement
- Credential Stuffing and Password Spraying Defenses
- Rate Limiting and Account Lockout Tradeoffs
- Risk-Based Authentication and Context Signals
- Session Creation, Renewal, and Invalidation
- Reauthentication for Sensitive Operations
- Preventing Recovery Flows from Undermining Authentication
15Authorization and Access Control11 тем
- Authentication and Authorization as Separate Decisions
- Discretionary and Mandatory Access Control
- Role-Based and Attribute-Based Access Control
- Relationship-Based and Object-Level Authorization
- Policy Decision and Policy Enforcement Points
- Default-Deny and Explicit-Allow Policies
- Horizontal and Vertical Privilege Boundaries
- Delegation and Constrained Authority
- Tenant Isolation and Cross-Tenant Access Prevention
- Time-Bound and Context-Bound Permissions
- Authorization Testing and Policy Change Review
16Federation and Identity Protocol Security12 тем
- Federated Identity and Trust Relationships
- Single Sign-On Architecture
- OAuth Authorization and Delegated Access
- OpenID Connect Authentication
- SAML Assertions and Federation Boundaries
- Access Tokens, Identity Tokens, and Refresh Tokens
- Issuer, Audience, Signature, and Lifetime Validation
- Redirect Handling and Authorization Response Binding
- Proof Key for Code Exchange
- Consent, Scopes, and Third-Party Application Access
- Federation Misconfiguration and Trust Expansion
- Token Revocation, Session Revocation, and Logout Limitations
17Privileged Access and Directory Security12 тем
- Administrative Identities and Privilege Tiers
- Just-in-Time and Just-Enough Administration
- Privileged Access Workstations and Management Paths
- Credential Vaulting and Privileged Session Controls
- Directory Services and Authentication Dependencies
- Active Directory Trusts and Delegated Permissions
- Kerberos and Ticket-Based Trust
- Legacy Authentication and Relay Risk
- Service Accounts and Managed Credentials
- Directory Certificate Services and Enrollment Permissions
- Emergency Access and Break-Glass Accounts
- Identifying Privilege Paths and Reducing Identity Exposure
18Data Protection and Information Handling12 тем
- Data Classification and Ownership
- Sensitive Data Discovery and Mapping
- Data at Rest, in Transit, and in Use
- Encryption Boundaries and Access Enforcement
- Tokenization, Masking, and Redaction
- Database Permissions and Administrative Separation
- Secure File Sharing and Collaboration Controls
- Data Loss Prevention and Its Limitations
- Retention, Deletion, and Secure Disposal
- Backup Protection and Access Separation
- Preventing Sensitive Data Exposure in Logs and Exports
- Verifying Controls Across the Data Lifecycle
19Privacy Engineering for Security Practitioners10 тем
- Privacy Threats and Security Threats
- Data Minimization and Purpose Limitation
- Identifiability, Linkability, and Inference Risk
- Pseudonymization and Anonymization Limits
- Privacy-Aware Logging and Monitoring
- Consent, User Expectations, and Data Access
- Privacy Threat Modeling
- Differential Privacy and Privacy-Preserving Analysis Concepts
- Balancing Investigation Needs with Data Protection
- Reviewing Third-Party Data Flows and Secondary Uses
Этап 3
Platform & Network Security
Машины и сети под защитой
9 модулей · 107 тем
20Platform Trust and Hardware Security12 тем
- Hardware Roots of Trust
- Secure Boot and Measured Boot
- Trusted Platform Modules and Device Attestation
- Firmware Integrity and Update Authenticity
- Kernel Isolation and Trusted Computing Bases
- Virtualization Boundaries and Hypervisor Trust
- Trusted Execution Environments and Their Limits
- Direct Memory Access and Peripheral Exposure
- Physical Access and Device Tampering
- Hardware and Firmware Supply Chain Risks
- Side Channels and Fault Injection as Threat Classes
- Mapping Platform Guarantees to Real Security Requirements
21Windows Security and Hardening13 тем
- Windows Security Principals and Access Tokens
- File, Registry, and Service Permissions
- Local and Domain Policy Enforcement
- Administrative Rights and User Account Control
- Credential Protection and Authentication Exposure
- Application Control and Script Execution Policies
- Service Hardening and Scheduled Task Permissions
- Host Firewall and Network Profile Controls
- Security Auditing and Relevant Event Sources
- Patch Management and Configuration Baselines
- Remote Administration and Management Interface Exposure
- Protecting Endpoint Security Configuration
- Validating Hardening Without Breaking Required Workflows
22Linux and Unix Security13 тем
- Users, Groups, and Permission Models
- Privileged Execution and Sudo Policy
- File Ownership, Capabilities, and Special Permission Bits
- Service Accounts and Daemon Isolation
- Mandatory Access Control with SELinux and AppArmor
- SSH Authentication and Administrative Access
- Service Exposure and Host Firewall Policy
- Package Trust and Security Updates
- Kernel Hardening and Attack Surface Reduction
- Audit Logging and Authentication Records
- Secrets in Files, Environment Variables, and Processes
- Scheduled Jobs and Writable Execution Paths
- Baseline Validation and Configuration Drift
23Endpoint and Remote Workforce Security13 тем
- Managed and Unmanaged Device Risk
- Endpoint Protection and Endpoint Detection and Response
- Full-Disk Encryption and Recovery Key Handling
- macOS Code Signing, Gatekeeper, and Notarization
- macOS Privacy Permissions and System Integrity Controls
- Browser, Extension, and Productivity Tool Controls
- Device Compliance and Conditional Access
- Mobile Device Management and Bring-Your-Own-Device Boundaries
- Removable Media and Peripheral Policies
- Remote Support Tools and Administrative Exposure
- Device Loss, Theft, and Secure Decommissioning
- Endpoint Isolation and Response Readiness
- Balancing Usability, Visibility, and Enforceable Controls
24Mobile Application Security11 тем
- Mobile Platform Sandboxes and Application Permissions
- Android Application Components and iOS Entitlements
- Secure Local Storage and Device-Bound Secrets
- Application Authentication and Token Handling
- Interprocess Communication and Exported Components
- Deep Links, App Links, and Untrusted Input
- Network Trust and Certificate Validation
- Sensitive Data in Backups, Screenshots, and Logs
- Application Integrity and Tamper-Resistance Limits
- Third-Party SDKs and Mobile Data Flows
- Testing Mobile Applications with Their Backend Services
25Network Security Architecture12 тем
- Security Zones and Network Trust Boundaries
- Segmentation and Microsegmentation
- Ingress, Egress, and East-West Traffic Controls
- Firewall Policy Design and Rule Review
- Intrusion Detection and Intrusion Prevention
- Network Access Control and Device Admission
- Management Plane Isolation
- Secure Administrative Paths and Bastion Access
- Encrypted Traffic Visibility and Inspection Tradeoffs
- Denial-of-Service Resilience and Traffic Filtering
- High Availability of Security Enforcement Points
- Validating Network Boundaries with Observed Traffic
26Protocol and Infrastructure Service Security11 тем
- Protocol State, Trust Assumptions, and Spoofing Risks
- ARP, Neighbor Discovery, and Local Network Trust
- DHCP Security and Unauthorized Configuration Sources
- DNS Resolution, DNSSEC, and Resolver Protection
- Domain Administration and Registrar Account Security
- Routing Security and Route-Origin Validation
- IPv6 Exposure and Security Control Parity
- Time Synchronization and Security Dependencies
- Secure Remote Management Protocols
- Legacy and Unauthenticated Infrastructure Services
- Identifying Protocol Abuse Through Traffic and Configuration Evidence
27Wireless and Remote Access Security11 тем
- Wireless Trust Boundaries and Shared Medium Risks
- Enterprise Wireless Authentication
- Certificate Validation in Wireless Access
- Rogue Access Points and Evil-Twin Detection
- Guest Networks and Client Isolation
- Bluetooth and Short-Range Wireless Exposure
- VPN Authentication and Device Trust
- Split Tunneling and Traffic Visibility
- Remote Access Gateways and Administrative Separation
- Zero Trust Network Access and Application-Level Access
- Reviewing Remote Access Under Compromised-Device Assumptions
28Email, Browser, and Collaboration Security11 тем
- Email Trust Boundaries and Message Authentication
- SPF, DKIM, and DMARC
- Phishing, Impersonation, and Business Email Compromise
- Attachment Handling and Content Inspection
- Malicious Links and Browser-Based Delivery Paths
- Mailbox Delegation, Forwarding, and Access Rules
- Domain Lookalikes and Brand Impersonation Monitoring
- Browser Isolation and Download Controls
- Collaboration Invitations and External Sharing
- Suspicious Message Reporting and Investigation
- Validating Controls Against Real Communication Workflows
Этап 4
Application & Cloud Security
Код, API и облако — проверены
16 модулей · 189 тем
29Secure Software Design12 тем
- Security Requirements and Misuse-Resistant Interfaces
- Security Acceptance Criteria in Product Development
- Trust Boundaries in Application Architecture
- Server-Side Enforcement of Sensitive Decisions
- Secure Defaults and Minimal Exposed Functionality
- Input Validation and Output Handling Responsibilities
- Error Handling and Information Disclosure
- Security of State Transitions and Concurrent Operations
- Abuse Resistance and Resource Consumption Limits
- Security Design Reviews and Architectural Findings
- Translating OWASP ASVS Requirements into Verification Goals
- Maintaining Security Assumptions Through Product Changes
30Browser and Web Client Security13 тем
- Browser Origins and the Same-Origin Policy
- Cross-Origin Resource Sharing and Trust Configuration
- Reflected, Stored, and DOM-Based Cross-Site Scripting
- Contextual Output Encoding and Safe DOM Operations
- Content Security Policy and Its Limits
- Cross-Site Request Forgery and Request Authenticity
- Cookie Security Attributes and SameSite Behavior
- HTTPS Enforcement and Mixed-Content Risks
- Clickjacking and Framing Controls
- Third-Party Scripts and Browser Supply Chain Exposure
- Cross-Window Messaging and Origin Validation
- Browser Storage, Caching, and Sensitive Data
- WebSocket and Persistent Client Connection Security
31Injection, Parsing, and File Processing Vulnerabilities12 тем
- Data-Code Separation and Injection Root Causes
- SQL and NoSQL Injection
- Operating System Command Injection
- Server-Side Template Injection
- Path Traversal and File Access Boundaries
- File Upload Validation and Content Handling
- Server-Side Request Forgery and Outbound Access Controls
- Unsafe Deserialization and Object Reconstruction
- XML External Entities and Parser Configuration
- HTTP Request Smuggling and Inconsistent Parsing
- Canonicalization, Encoding, and Validation Mismatches
- Parser Isolation and Safe Processing of Untrusted Content
32Application Identity and Business Logic Vulnerabilities12 тем
- Authentication Bypass and Inconsistent Identity Checks
- Session Fixation and Session Lifecycle Errors
- Insecure Password Reset and Account Recovery
- Object-Level Access Control Failures
- Function-Level and Administrative Authorization Failures
- Cross-Tenant Data and Action Exposure
- Mass Assignment and Unauthorized Property Changes
- Workflow Bypass and Invalid State Transitions
- Race Conditions in Security-Sensitive Operations
- Replay, Duplicate Requests, and Idempotency Failures
- Abuse of Credits, Entitlements, and Approval Workflows
- Validating Security Invariants Across Complete User Journeys
33API and Service-to-Service Security12 тем
- API Inventories and Undocumented Endpoints
- API Authentication and Credential Scope
- Request-Level and Object-Level Authorization
- Schema Validation and Unexpected Fields
- REST, GraphQL, and RPC Security Boundaries
- GraphQL Complexity and Field-Level Access
- Service Identities and Mutual Authentication
- Rate Limits, Quotas, and Expensive Operations
- Webhooks, Callbacks, and Message Authenticity
- Third-Party API Trust and Response Validation
- API Versioning, Deprecation, and Forgotten Exposure
- Protecting Asynchronous Messages and Event Consumers
34Memory Safety and Low-Level Vulnerabilities12 тем
- Memory Corruption and Trust Boundary Failures
- Stack and Heap Buffer Overflows
- Use-After-Free and Double-Free Errors
- Integer Overflow and Incorrect Size Calculations
- Out-of-Bounds Reads and Information Disclosure
- Type Confusion and Unsafe Object Interpretation
- Format String Vulnerabilities
- Race Conditions and Time-of-Check-Time-of-Use Errors
- Address Randomization, Nonexecutable Memory, and Control-Flow Protection
- Memory-Safe Languages and Unsafe Interoperability Boundaries
- Sanitizers and Runtime Error Detection
- Distinguishing Vulnerability, Exploitability, and Practical Impact
35Security Code Review and Application Testing12 тем
- Reviewing Code from Sources to Sensitive Sinks
- Security-Relevant Data Flow and Trust Assumptions
- Static Application Security Testing
- Dynamic Application Security Testing
- Interactive Testing and Runtime Instrumentation
- Fuzz Testing and Input Space Exploration
- Property-Based Security Tests and Invariants
- Reviewing Authentication and Authorization Implementations
- False Positives, False Negatives, and Manual Validation
- Reproducing Findings in Controlled Test Environments
- Remediation Verification and Security Regression Tests
- Selecting Tests by Threat Model and Application Context
36Software Supply Chain Security12 тем
- Dependency Inventories and Software Bills of Materials
- Direct, Transitive, and Optional Dependencies
- Package Provenance and Maintainer Trust
- Dependency Confusion and Package Impersonation Risks
- Malicious Packages and Installation-Time Behavior
- Dependency Pinning, Lockfiles, and Update Policies
- Open-Source Component Evaluation
- Third-Party Libraries, Plugins, and Extensions
- Artifact Signatures and Integrity Verification
- Build Provenance and Verifiable Release Evidence
- Vulnerability Applicability and Reachability
- Coordinating Dependency Remediation Across Products
37Build Pipeline and Delivery Security12 тем
- CI/CD Systems as Privileged Infrastructure
- Protecting Repositories and Branch Policies
- Untrusted Contributions and Workflow Execution Boundaries
- Runner Isolation and Ephemeral Build Environments
- Build Secrets and Short-Lived Workload Credentials
- Separation of Build, Approval, and Deployment Authority
- Artifact Registries and Release Access Controls
- Signing, Attestation, and Verification at Deployment
- Infrastructure-as-Code Security Review
- Policy-as-Code and Security Gates
- Preventing Sensitive Data Leakage Through Build Outputs
- Recovering Trust After a Pipeline Compromise
38Cloud Security Architecture12 тем
- Shared Responsibility Across Cloud Service Models
- Cloud Accounts, Organizations, and Administrative Boundaries
- Identity Policies and Effective Permissions
- Control Plane and Data Plane Security
- Resource Policies and Public Exposure
- Network Boundaries and Private Connectivity
- Cloud Encryption and Key Ownership Choices
- Organization-Wide Guardrails and Policy Enforcement
- Audit Logging and Security Visibility
- Configuration Drift and Continuous Posture Assessment
- Cross-Account Access and Trust Relationships
- Designing Cloud Controls Around Business-Critical Paths
39Cloud Workload and Data Protection11 тем
- Securing Virtual Machine Images and Runtime Configuration
- Workload Identity and Credential Delivery
- Instance Metadata and Credential Exposure
- Object Storage Access and Data Sharing Controls
- Managed Database Security and Administrative Access
- Serverless Permissions and Event Source Trust
- Secret Stores and Runtime Secret Access
- Managed Service Integrations and Permission Expansion
- Cloud Backups, Snapshots, and Recovery Copies
- Tenant Isolation and Shared Service Dependencies
- Responding to Exposed Cloud Resources and Credentials
40Container and Orchestration Security12 тем
- Image Trust, Minimal Images, and Package Exposure
- Container Isolation and Shared Kernel Risk
- Rootless Execution and Privilege Reduction
- Capabilities, Seccomp, and Mandatory Access Controls
- Host Mounts and Container Runtime Interfaces
- Kubernetes Authentication and Role-Based Access Control
- Service Accounts and Workload Identity
- Admission Policy and Workload Configuration
- Network Policies and Namespace Boundaries
- Secrets and Sensitive Configuration in Clusters
- Control Plane, Node, and Registry Protection
- Runtime Detection and Container Incident Evidence
41Enterprise SaaS Security10 тем
- SaaS Shared Responsibility and Administrative Control
- Tenant Configuration and Security Baselines
- Identity Federation and Lifecycle Integration
- Connected Applications and OAuth Grants
- External Sharing and Guest Access
- Data Export, Synchronization, and Retention
- SaaS Audit Logs and Detection Coverage
- Administrator Roles and High-Risk Configuration Changes
- Backup, Recovery, and Service Exit Constraints
- Detecting and Remediating SaaS Misconfiguration
42IoT and Edge Device Security11 тем
- Device Identity and Secure Enrollment
- Default Credentials and Provisioning Risks
- Secure Boot and Firmware Update Chains
- Device Interfaces and Exposed Management Services
- Embedded Secrets and Credential Reuse
- Network Segmentation for Constrained Devices
- Secure Device-to-Service Communication
- Physical Access and Hardware Debug Interfaces
- Telemetry, Inventory, and Fleet Visibility
- Device Support Lifetimes and Update Constraints
- Product Vulnerability Handling and Coordinated Remediation
43Operational Technology and Cyber-Physical Security11 тем
- Operational Technology Assets and System Dependencies
- Safety, Availability, and Process Integrity Priorities
- IT-OT Boundaries and Industrial Network Segmentation
- Industrial Protocol Trust and Legacy Constraints
- Engineering Workstations and Controller Access
- Remote Vendor Access and Maintenance Paths
- Passive Discovery and Monitoring Constraints
- Change Management and Testing in Operational Environments
- Incident Response with Physical Process Consequences
- Recovery Planning with Engineering and Operations Teams
- Assessing Cyber Risk in the Context of Physical Operations
44AI, Model, and Agent Security13 тем
- Security Boundaries in AI-Enabled Applications
- Model and Training Data Supply Chain Integrity
- Data Poisoning, Evasion, and Model Extraction as Threat Classes
- Direct and Indirect Prompt Injection
- Retrieved Content and Untrusted Instruction Sources
- Sensitive Data Exposure Through Model Inputs and Outputs
- Unsafe Output Handling in Downstream Systems
- Agent Identities, Tool Permissions, and Delegated Authority
- Connector and Model Context Protocol Trust Boundaries
- Human Approval and Independent Policy Enforcement
- Agent Memory, Retrieval Stores, and Cross-Session Contamination
- Security Evaluation, Monitoring, and Incident Investigation
- Separating Model Behavior Controls from System Security Guarantees
Этап 5
Offense, Detection & Response
Атака, обнаружение, расследование, восстановление
17 модулей · 199 тем
45Vulnerability and Exposure Management13 тем
- Vulnerability Discovery and Asset Context
- CVE Identifiers and CWE Weakness Categories
- Authenticated and Unauthenticated Assessment
- Scanner Coverage and Blind Spots
- Validating Findings and Removing False Positives
- Severity Scores and Their Interpretation Limits
- Exploit Likelihood and Evidence of Active Exploitation
- Asset Criticality and Reachable Attack Paths
- Patch Prioritization and Remediation Deadlines
- Mitigation, Isolation, and Compensating Controls
- Exceptions, Ownership, and Escalation
- Retesting and Verification of Remediation
- Product Security Response and Vulnerability Disclosure Intake
46Authorized Penetration Testing12 тем
- Assessment Objectives and Scope Design
- Black-Box, Gray-Box, and White-Box Approaches
- Reconnaissance Within Approved Boundaries
- Service Discovery and Configuration Assessment
- Manual Vulnerability Validation
- Controlled Demonstration of Exploitability
- Testing Privilege Boundaries in Isolated Environments
- Combining Findings into Supported Attack Paths
- Assessing Impact Without Unnecessary Data Access
- Recording Evidence and Reproduction Conditions
- Remediation-Focused Reporting and Debriefing
- Cleanup, Retesting, and Engagement Closure
47Red Teaming and Purple Team Validation11 тем
- Red Team, Blue Team, and Purple Team Objectives
- Threat-Informed Adversary Emulation
- Scenario Selection and Business Impact Objectives
- Emulation Plans and Exercise Control
- Mapping Techniques to Expected Telemetry
- Testing Preventive and Detective Controls Together
- Coordinating Identity, Endpoint, and Network Observations
- Simulated Social Engineering Within Agreed Scope
- Measuring Detection Gaps and Response Delays
- Distinguishing Exercise Success from Organizational Risk Reduction
- Converting Exercise Findings into Control Improvements
48Security Logging and Telemetry Design12 тем
- Logging Requirements Derived from Threat Models
- Authentication, Authorization, and Administrative Events
- Endpoint, Network, Application, and Cloud Telemetry
- Event Schemas and Consistent Field Definitions
- Time Synchronization and Event Ordering
- Collection Agents, Forwarders, and Pipeline Reliability
- Log Integrity and Tamper Resistance
- Sensitive Data Minimization in Security Logs
- Retention, Searchability, and Storage Tradeoffs
- Telemetry Gaps and Collection Health Monitoring
- Access Controls for Security Data
- Verifying That Critical Actions Produce Usable Evidence
49Network Traffic Analysis11 тем
- Packet Captures, Flow Records, and Network Metadata
- Reconstructing Connections and Protocol Conversations
- DNS Activity and Suspicious Resolution Patterns
- HTTP, TLS, and Encrypted Connection Metadata
- Unusual Outbound Connections and Beacon-Like Behavior
- Scanning, Service Discovery, and Lateral Movement Indicators
- Data Transfer Patterns and Possible Exfiltration
- Network Baselines and Environmental Context
- Packet Loss, Sampling, and Visibility Limitations
- Distinguishing Suspicious Patterns from Benign Automation
- Combining Traffic Evidence with Identity and Endpoint Context
50Endpoint and Identity Threat Detection12 тем
- Process Creation and Parent-Child Relationships
- Command-Line, Script, and Module Execution Evidence
- Persistence-Related Configuration Changes
- Suspicious Credential Access Indicators
- Privilege Changes and Administrative Group Membership
- Unusual Authentication and Session Activity
- Remote Execution and Lateral Access Evidence
- Service, Scheduled Task, and Startup Changes
- Endpoint Security Tool Health and Tampering Signals
- Correlating User, Device, and Workload Identities
- Detecting Misuse of Legitimate Administrative Tools
- Evaluating Indicators in Their Operational Context
51SIEM and Security Analytics11 тем
- SIEM Architecture and Data Ingestion
- Parsing, Normalization, and Enrichment
- Search, Aggregation, and Event Correlation
- Time Windows and Sequence-Based Analysis
- Entity Resolution Across Data Sources
- Rules, Thresholds, and Baseline-Based Analytics
- Alert Context and Evidence Presentation
- Query Performance and Data Availability
- Analytics Access Controls and Sensitive Evidence
- Validating Results Against Original Events
- Managing Retention and Investigation Cost
52Detection Engineering12 тем
- Detection Objectives and Required Observables
- Behavior-Based and Indicator-Based Detection
- Mapping Detection Coverage to Threat Scenarios
- Detection Logic and Explicit Assumptions
- Test Data, Replay, and Controlled Validation
- Precision, Recall, and Base-Rate Effects
- False Positive Analysis and Tuning
- Detection Latency and Telemetry Dependencies
- Detection-as-Code and Version Control
- Peer Review and Controlled Deployment
- Regression Testing and Coverage Drift
- Documenting Known Blind Spots and Response Guidance
53Cyber Threat Intelligence10 тем
- Intelligence Requirements and Stakeholder Needs
- Strategic, Operational, and Technical Intelligence
- Source Reliability and Information Credibility
- Indicators of Compromise and Behavioral Context
- Campaigns, Infrastructure, and Intrusion Patterns
- Vulnerability Intelligence and Exploitation Evidence
- Confidence Levels and Attribution Limits
- Intelligence Enrichment and Expiration
- Sharing Information with Appropriate Handling Restrictions
- Converting Intelligence into Defensive Decisions
54Threat Hunting11 тем
- Hypothesis-Driven Hunting
- Intelligence-Led and Anomaly-Led Hunts
- Defining Scope and Available Evidence
- Establishing Baselines and Peer Comparisons
- Querying Across Endpoint, Network, Identity, and Cloud Data
- Following Leads and Testing Alternative Explanations
- Identifying Telemetry Gaps During a Hunt
- Recording Negative Findings and Uncertainty
- Escalating Hunt Findings into Incident Response
- Turning Repeatable Findings into Detections
- Measuring Hunt Value Beyond the Number of Alerts
55Security Operations and Alert Triage11 тем
- SOC Roles and Operational Responsibilities
- Alert Queues and Triage Priorities
- Severity, Confidence, and Business Impact
- Case Enrichment and Initial Scoping
- Escalation Criteria and Ownership
- Investigation Notes and Evidence Continuity
- Shift Handoffs and Operational Communication
- Playbooks and Analyst Decision Support
- Automation, Approval Boundaries, and Rollback
- Alert Fatigue and Sustainable Analyst Workflows
- Reviewing Cases for Detection and Process Improvements
56Incident Response Preparation12 тем
- Events, Alerts, Incidents, and Crises
- Incident Response Policy and Decision Authority
- Integrating Response with Cybersecurity Risk Management
- Incident Categories and Severity Definitions
- Roles Across Security, IT, Engineering, Legal, and Leadership
- Contact Lists and Out-of-Band Communication
- Response Access, Tools, and Evidence Readiness
- Playbooks for Identity, Endpoint, Cloud, and Data Incidents
- External Service Providers and Escalation Agreements
- Tabletop Exercises and Readiness Validation
- Reporting Obligations and Decision Tracking
- Measuring Preparedness Before an Incident Occurs
57Incident Investigation, Containment, and Recovery12 тем
- Initial Assessment and Incident Declaration
- Establishing Scope and Affected Assets
- Building and Updating Incident Hypotheses
- Preserving Evidence While Reducing Harm
- Host, Identity, Network, and Cloud Containment Options
- Credential and Session Invalidation
- Identifying Persistence and Remaining Access Paths
- Eradication and Remediation of Root Causes
- Coordinating Operational and Business Decisions
- Recovery Validation and Heightened Monitoring
- Incident Timelines and Stakeholder Updates
- Post-Incident Review and Tracked Improvement Actions
58Digital Forensics and Evidence Handling12 тем
- Forensic Objectives and Investigation Questions
- Evidence Relevance, Integrity, and Provenance
- Order of Volatility and Acquisition Priorities
- Live Response and Offline Examination Tradeoffs
- Forensic Imaging and Integrity Verification
- Chain of Custody and Evidence Access
- Timezones, Clock Drift, and Timestamp Interpretation
- Collection Scope and Data Minimization
- Preservation of Cloud and Third-Party Evidence
- Reproducible Analysis and Tool Limitations
- Separating Observations, Inferences, and Conclusions
- Preparing Technical Findings for Different Audiences
59Host and Cloud Forensic Artifacts13 тем
- File System Metadata and File Activity
- Deleted Data and Recovery Limitations
- Windows Execution and User Activity Artifacts
- Linux Authentication, Service, and Command History Evidence
- Browser, Download, and Application Artifacts
- Memory Evidence of Processes, Connections, and Loaded Code
- Registry, Configuration, and Persistence Artifacts
- Cloud Audit Trails and Administrative Actions
- Identity Provider Events and Token-Related Evidence
- SaaS Activity and Mailbox Audit Records
- Container and Ephemeral Workload Evidence
- Timeline Reconstruction Across Multiple Sources
- Identifying Gaps That Prevent a Definitive Conclusion
60Malware Analysis and Reverse Engineering13 тем
- Malware Categories and Behavioral Objectives
- Safe Sample Handling and Isolated Analysis Environments
- File Identification, Hashing, and Initial Triage
- Static Analysis of Strings, Imports, and Structure
- Dynamic Analysis and Behavioral Observation
- Disassembly and Decompilation Concepts
- Control Flow and Relevant Execution Paths
- Persistence, Communication, and Data Access Behavior
- Packed, Obfuscated, and Script-Based Samples
- Recognizing Anti-Analysis Behavior
- Extracting Defensive Indicators and Detection Opportunities
- Relating Sample Behavior to Incident Evidence
- Reporting Capabilities, Confidence, and Analysis Limits
61Ransomware and Data Extortion Response11 тем
- Encryption, Data Theft, and Extortion as Distinct Impacts
- Initial Access and Pre-Impact Warning Signs
- Rapid Scoping of Affected Systems and Identities
- Protecting Backups and Recovery Infrastructure
- Containing Spread Across Trust Relationships
- Assessing Data Access and Possible Exfiltration
- Decision Authority and Communication During Extortion
- Coordinating Executive, Legal, Insurance, and Response Teams
- Recovery Sequencing for Critical Business Services
- Validation of Restored Systems and Credentials
- Addressing the Conditions That Enabled the Incident
Этап 6
Resilience & Security Programs
Безопасность, которая переживёт плохой день
5 модулей · 57 тем
62Business Continuity and Cyber Recovery12 тем
- Business Impact Analysis and Critical Service Dependencies
- Recovery Time and Recovery Point Objectives
- Backup Architecture and Administrative Separation
- Offline and Immutable Recovery Copies
- Restoration Testing and Evidence of Recoverability
- Clean Recovery Environments and Trusted Baselines
- Identity and Key Management Dependencies in Recovery
- Service Degradation and Manual Workarounds
- Disaster Recovery and Cyber Recovery Differences
- Supplier and Infrastructure Failure Scenarios
- Recovery Exercises and Dependency Validation
- Measuring Resilience Through Demonstrated Recovery
63Third-Party and Supplier Security11 тем
- Supplier Inventories and Risk Classification
- Due Diligence Based on Access and Business Criticality
- Security Requirements in Procurement
- Questionnaires, Audit Reports, and Technical Evidence
- Supplier Identity and Remote Access Controls
- Shared Data and Subprocessor Dependencies
- Incident Notification and Response Coordination
- Concentration Risk and Critical Provider Dependencies
- Ongoing Monitoring and Material Supplier Changes
- Offboarding, Access Removal, and Data Return
- Managing Exceptions When Replacement Is Impractical
64Security Assurance and Control Assessment11 тем
- Control Design and Operating Effectiveness
- Security Frameworks and Control Mapping
- Audit Scope, Criteria, and Evidence Requirements
- Sampling and Limits of Point-in-Time Assessments
- Technical Validation and Documentary Evidence
- Independent Assurance and Conflicts of Interest
- Continuous Control Monitoring
- Findings, Root Causes, and Corrective Actions
- Tracking Remediation to Verified Closure
- Distinguishing Compliance Evidence from Security Outcomes
- Maintaining Assurance as Systems and Threats Change
65Human Factors and Security Culture12 тем
- Human Behavior Within Security Systems
- Social Engineering and Manipulated Trust
- Physical Access, Visitor Verification, and Tailgating Risks
- Verification of Payment and Account-Change Requests
- Usable Authentication and Recovery Processes
- Role-Specific Security Education
- Reporting Culture and Psychological Safety
- Phishing Exercises and Meaningful Learning Outcomes
- Insider Risk with Appropriate Oversight and Privacy
- Security Champions and Team-Level Ownership
- Reducing Friction That Encourages Unsafe Workarounds
- Measuring Behavior Change and Control Usability
66Security Program Management and Measurement11 тем
- Program Goals and Risk-Based Roadmaps
- Security Operating Models and Team Interfaces
- Staffing, Skills, and Service Ownership
- Build, Buy, and Managed Service Decisions
- Budget Allocation and Control Coverage
- Outcome Metrics, Activity Metrics, and Leading Indicators
- Exposure Reduction and Remediation Performance
- Detection and Response Metrics in Context
- Executive Reporting and Decision-Oriented Communication
- Tracking Security Debt and Accepted Risk
- Reviewing Program Effectiveness as the Organization Changes
Этап 7
Practicum & Capstone
Вся организация под защитой
5 модулей · 54 темы
67Threat Modeling and Architecture Practicum10 тем
- Mapping a System's Assets, Identities, and Data Flows
- Identifying Trust Boundaries and Sensitive Operations
- Building Abuse Cases and Attack Trees
- Reviewing an Authentication and Recovery Design
- Designing Object-Level and Tenant-Level Authorization
- Evaluating Network and Administrative Segmentation
- Selecting Controls for a Cloud-Based Service
- Assessing Agent Tool Permissions and Data Boundaries
- Defining Verification Criteria for Architectural Controls
- Presenting a Prioritized Security Design Review
68Platform and Identity Hardening Practicum10 тем
- Assessing Windows and Linux Configuration Baselines
- Reviewing Local and Directory-Based Privileges
- Finding Unmanaged Accounts and Excessive Entitlements
- Evaluating Multifactor Authentication and Recovery Paths
- Reviewing Firewall Rules and Management Exposure
- Assessing Cloud Policies and Public Resource Access
- Reviewing Container Workload Permissions
- Validating Secret Storage and Credential Rotation
- Confirming Security Log Coverage
- Documenting Exceptions and Testing Remediation
69Application Security Assessment Practicum11 тем
- Planning an Assessment for an Intentionally Vulnerable Application
- Mapping Endpoints, Roles, Objects, and Trust Boundaries
- Reviewing Code for Injection and Unsafe Data Handling
- Testing Authentication, Sessions, and Account Recovery
- Validating Object-Level and Function-Level Authorization
- Examining Business Logic and Concurrent Requests
- Evaluating API Input Validation and Resource Limits
- Reviewing Dependency and Build Pipeline Findings
- Demonstrating Impact Within the Approved Lab Scope
- Writing Findings with Reproducible Evidence
- Retesting Fixes and Adding Security Regression Checks
70Detection, Forensics, and Incident Response Practicum11 тем
- Reconstructing an Incident from a Curated Evidence Set
- Correlating Endpoint, Network, Identity, and Cloud Events
- Writing and Validating a Detection Hypothesis
- Investigating Suspicious Authentication and Administrative Activity
- Triaging a Malware Sample in an Isolated Environment
- Establishing Scope and Evaluating Alternative Explanations
- Selecting Containment Actions and Recording Tradeoffs
- Building a Forensic Timeline with Explicit Confidence Levels
- Planning Recovery and Verification of Restored Trust
- Preparing Technical and Executive Incident Reports
- Converting Lessons Learned into Tested Improvements
71Integrated Cybersecurity Capstone12 тем
- Defining an Organization, Service, and Threat Context
- Building an Asset Inventory and Dependency Map
- Assessing Risk and Prioritizing Security Outcomes
- Designing Identity, Data, Platform, and Network Controls
- Threat Modeling Applications and External Integrations
- Establishing a Security Testing and Remediation Program
- Planning Telemetry, Detection, and Investigation Coverage
- Developing Incident Response and Recovery Playbooks
- Assessing Supplier, Privacy, and Governance Requirements
- Validating Controls Through a Coordinated Exercise
- Measuring Residual Risk and Documenting Limitations
- Presenting an Evidence-Based Security Improvement Roadmap
Пятнадцать минут.Каждый день.
- 1
Урок влезает в обеденный перерыв
По одной мысли за раз, на коротких слайдах. Весь урок — около пятнадцати минут.
- 2
Практика с мгновенной обратной связью
Вопросы — внутри урока. Отвечаете и сразу видите, получилось ли.
- 3
Стрик, который возвращает вас снова
Урок в день держит стрик. Короткие регулярные занятия доводят до конца курса.
- 1
Урок влезает в обеденный перерыв
По одной мысли за раз, на коротких слайдах. Весь урок — около пятнадцати минут.
- 2
Практика с мгновенной обратной связью
Вопросы — внутри урока. Отвечаете и сразу видите, получилось ли.
- 3
Стрик, который возвращает вас снова
Урок в день держит стрик. Короткие регулярные занятия доводят до конца курса.
Для тех, кому звонят первыми.
IT-админы, берущие на себя безопасность
Разработчики, которым достаются тикеты по безопасности
Где вы вырастете сильнее всего
Находите и устраняйте уязвимости веба и облака
Этап 4 · Application & Cloud SecurityМеняющие карьеру, нацеленные на SOC
Где вы вырастете сильнее всего
Обнаруживайте вторжения и ведите реагирование
Этап 5 · Offense, Detection & Response
Куда ведёт этот курс.
Работа, вокруг которой построен курс, и как в неё попадают.
Security Operations Analyst
Следит за системами компании, чтобы заметить атаку, и реагирует, когда что-то выглядит не так.
Все карьеры будущегоВ работе
- Разбирать алерты и отделять шум от настоящего инцидента
- Расследовать подозрительный вход от первой строки лога до первопричины
- Написать отчёт, после которого та же атака не пройдёт второй раз
Как туда попадают
Частая первая работа в безопасности. Работодатели нередко просят отраслевые сертификации вместе с дипломом или вместо него.
Будьте первыми в очереди.
Ранний доступ — для частных лиц, пилот — для команд. Расскажите, кто у вас учится.
enterprise@astratrainer.com