Security Administration Course

Lesson 1 • Threat Landscape Overview

Catalogues current threat categories including insider threats, external attackers, and environmental hazards. Builds threat awareness needed for later risk assessment chapters.

Lesson 2 • Core Security Concepts and Principles

Introduces confidentiality, integrity, and availability as the foundational triad. Connects these principles to every subsequent administrative decision in the course.

Lesson 3 • Legal and Regulatory Foundations

Covers privacy obligations, data protection duties, and industry compliance requirements without referencing specific codes. Prepares administrators to align controls with regulatory expectations.

Lesson 4 • The Security Administrator Role

Defines daily duties, authority boundaries, and accountability of a security administrator. Positions the role within broader IT and business governance structures.

Lesson 1 • Risk Assessment Methodologies

Compares qualitative and quantitative risk assessment approaches and their appropriate contexts. Provides the analytical foundation for all governance and control decisions.

Lesson 2 • Security Policy Development

Guides creation of security policies, standards, and procedures aligned to business objectives. Establishes the policy hierarchy that governs all administrative controls.

Lesson 3 • Risk Treatment and Acceptance

Covers risk mitigation, transfer, avoidance, and acceptance options with decision criteria. Connects risk scores to actionable treatment plans and residual risk tracking.

Lesson 4 • Audit and Continuous Compliance

Establishes internal audit processes, continuous control monitoring, and audit evidence management. Ensures ongoing compliance posture is measurable and defensible.

Lesson 1 • Identity Lifecycle Management

Covers provisioning, modification, and deprovisioning of user accounts. Establishes the full identity lifecycle as the backbone of access control.

Lesson 2 • Access Reviews and Auditing

Establishes periodic access certification and continuous audit log review. Ensures access rights remain appropriate and detectable anomalies are flagged.

Lesson 3 • Privileged Access Management

Addresses elevated account risks, just-in-time access, and privileged session monitoring. Reduces attack surface from administrative credential compromise.

Lesson 4 • Access Control Models

Compares discretionary, mandatory, role-based, and attribute-based access control models. Guides selection of the appropriate model for different environments.

Lesson 1 • Firewall Configuration and Management

Covers rule-set design, change management, and firewall log review. Connects proper firewall hygiene to reduced unauthorised access risk.

Lesson 2 • Secure Remote Access

Addresses VPN technologies, remote desktop security, and zero-trust access for remote workers. Ensures remote connectivity does not expand the attack surface.

Lesson 3 • Network Architecture Security Principles

Introduces defence-in-depth, segmentation, and DMZ design for secure networks. Provides the architectural thinking required before configuring individual controls.

Lesson 4 • Wireless Network Security

Covers wireless encryption standards, rogue access point detection, and guest network isolation. Addresses the unique risks of wireless environments.

Lesson 1 • Hardening Principles and Baselines

Introduces secure configuration baselines, benchmarks, and the concept of minimal footprint. Establishes the methodology applied to all endpoint types in this chapter.

Lesson 2 • Application Whitelisting and Control

Explains allow-listing, software restriction policies, and execution control mechanisms. Prevents unauthorised software from running on managed endpoints.

Lesson 3 • Patch and Vulnerability Management

Establishes patch prioritisation, testing, and deployment workflows tied to vulnerability severity. Connects timely patching to measurable risk reduction.

Lesson 4 • Mobile Device Security

Addresses mobile device management, encryption, and remote wipe capabilities for enterprise mobility. Extends hardening principles to devices outside the traditional perimeter.

Lesson 1 • Encryption at Rest and in Transit

Applies encryption to stored data, databases, and network communications. Ensures data remains protected regardless of where it resides or travels.

Lesson 2 • Data Loss Prevention Controls

Covers DLP policy creation, endpoint and network DLP agents, and incident response for data exfiltration alerts. Connects classification tiers to automated enforcement.

Lesson 3 • Public Key Infrastructure

Explains certificate authorities, certificate lifecycle, and trust chain management. Enables administrators to operate or consume PKI services securely.

Lesson 4 • Data Classification and Handling

Defines classification tiers, labelling requirements, and handling procedures for each tier. Provides the data governance foundation for all encryption and DLP decisions.

Lesson 1 • Log Source Identification and Collection

Identifies critical log sources across network, endpoint, and application layers. Establishes comprehensive collection as the prerequisite for effective detection.

Lesson 2 • Correlation Rules and Use Cases

Teaches creation of correlation rules mapped to known attack patterns and business risks. Translates threat knowledge into actionable detection logic.

Lesson 3 • Alert Triage and Escalation

Establishes a structured triage workflow for prioritising and escalating SIEM alerts. Reduces mean time to detect by minimising alert fatigue and false positives.

Lesson 4 • SIEM Architecture and Configuration

Covers SIEM deployment models, data ingestion pipelines, and index management. Provides the platform knowledge needed to build and maintain detection rules.

Lesson 1 • Detection and Initial Analysis

Applies monitoring skills from the previous chapter to confirm and classify incidents. Bridges alert triage into formal incident declaration and scoping.

Lesson 2 • Incident Response Planning

Covers incident response plan components, team roles, and communication trees. Ensures the organisation is prepared before an incident occurs.

Lesson 3 • Containment Strategies

Presents short-term and long-term containment options for different incident types. Balances operational continuity with the need to stop threat progression.

Lesson 4 • Eradication and Recovery

Covers malware removal, system reimaging, and validated restoration to production. Ensures threats are fully eliminated before systems return to service.