Information Security Fundamentals Course

Lesson 1 • Core Security Concepts and Terminology

Defines confidentiality, integrity, availability, and key vocabulary. Provides the shared language used throughout the entire course.

Lesson 2 • Regulatory and Compliance Foundations

Covers data protection obligations, privacy principles, and audit requirements. Connects compliance drivers to technical and policy controls.

Lesson 3 • Security Principles and Design Goals

Introduces least privilege, defence in depth, and fail-safe defaults. Links design principles to practical control selection decisions.

Lesson 4 • Information Security Roles and Responsibilities

Maps organisational roles from end users to security officers. Clarifies accountability structures that support a security-aware culture.

Lesson 1 • Security Frameworks and Control Catalogues

Surveys widely adopted control frameworks and maps controls to risk scenarios. Enables organisations to benchmark and improve their security posture.

Lesson 2 • Risk Treatment and Acceptance

Explains mitigation, transfer, avoidance, and acceptance strategies. Aligns risk decisions with organisational risk appetite and tolerance.

Lesson 3 • Security Metrics and Reporting

Defines KPIs, KRIs, and dashboard design for executive communication. Translates technical findings into business-relevant security insights.

Lesson 4 • Risk Assessment Methodologies

Covers qualitative and quantitative risk analysis, likelihood, and impact scoring. Produces risk registers that guide resource allocation decisions.

Lesson 1 • Symmetric and Asymmetric Algorithms

Compares block and stream ciphers with public-key algorithms. Enables informed algorithm selection based on performance and security needs.

Lesson 2 • Cryptography Fundamentals

Explains plaintext, ciphertext, keys, and algorithm types. Grounds later protocol discussions in mathematical and conceptual basics.

Lesson 3 • Hashing and Digital Signatures

Covers integrity verification through hashing and non-repudiation via signatures. Connects these mechanisms to authentication and data integrity goals.

Lesson 4 • Cryptographic Protocol Applications

Applies cryptography to TLS, VPNs, and secure email. Bridges theoretical knowledge to real-world protocol configuration.

Lesson 1 • Identity Lifecycle Management

Addresses provisioning, modification, and deprovisioning of user accounts. Reduces risk from orphaned accounts and privilege creep.

Lesson 2 • Authentication Mechanisms

Covers passwords, tokens, biometrics, and multi-factor authentication. Establishes how identity verification strength affects overall security posture.

Lesson 3 • Authorisation and Access Control Models

Compares DAC, MAC, RBAC, and ABAC models. Guides selection of the right model for different organisational contexts.

Lesson 4 • Privileged Access Management

Focuses on securing administrative accounts through vaulting and session monitoring. Mitigates the highest-risk access paths in an organisation.

Lesson 1 • Network Security Fundamentals

Reviews TCP/IP, ports, protocols, and traffic flow from a security perspective. Provides the networking baseline required for all subsequent sections.

Lesson 2 • Network Segmentation and Microsegmentation

Explains VLANs, subnetting, and software-defined segmentation. Limits lateral movement by isolating sensitive network zones.

Lesson 3 • Secure Remote Access

Addresses VPN technologies, zero-trust network access, and remote endpoint controls. Secures distributed workforces without sacrificing usability.

Lesson 4 • Firewalls and Perimeter Controls

Covers stateful inspection, next-generation firewalls, and DMZ design. Teaches rule-set construction and perimeter defence strategies.

Lesson 1 • Input Validation and Output Encoding

Covers allowlist validation, parameterised queries, and context-aware encoding. Prevents the most prevalent injection and XSS vulnerabilities.

Lesson 2 • Authentication and Session Management

Addresses secure session tokens, timeout policies, and credential storage. Protects user sessions from hijacking and replay attacks.

Lesson 3 • Secure Software Development Lifecycle

Integrates security requirements, threat modelling, and code review into SDLC phases. Shifts security left to reduce remediation costs.

Lesson 4 • Common Application Vulnerabilities

Examines injection, broken authentication, and misconfiguration flaws. Grounds remediation decisions in understanding root causes.

Lesson 1 • Vulnerability Management Operations

Covers scanning cadence, CVSS scoring, and remediation prioritisation. Closes the loop between detection and risk reduction in operations.

Lesson 2 • Threat Intelligence Integration

Introduces threat feeds, indicators of compromise, and intelligence-driven detection. Improves detection relevance by incorporating external adversary knowledge.

Lesson 3 • Security Event Triage and Escalation

Defines triage workflows, severity classification, and escalation criteria. Ensures analysts respond to genuine threats without alert fatigue.

Lesson 4 • Log Management and Analysis

Covers log sources, collection pipelines, and retention policies. Provides the data foundation for all detection and investigation activities.

Lesson 1 • Containment and Eradication

Addresses short-term and long-term containment strategies and root cause removal. Prevents attacker persistence while minimising operational disruption.

Lesson 2 • Post-Incident Review and Lessons Learned

Structures blameless post-mortems, root cause documentation, and control improvements. Converts incident experience into measurable security programme enhancements.

Lesson 3 • Incident Response Planning

Defines IR plan components, team roles, and communication protocols. Ensures organisations can respond decisively before an incident occurs.

Lesson 4 • Detection and Initial Analysis

Covers alert validation, initial scoping, and incident declaration criteria. Reduces time-to-contain by establishing clear detection-to-response handoffs.