WEEK 1 – Foundations of Cybersecurity

Lecture Topics (2 hrs)

  1. What is Cybersecurity? Types of Cybersecurity (Network, App, Cloud, Endpoint)
  2. Threat Landscape: Nation-state actors, insiders, cybercrime, hacktivism.

  3. Security Terminologies: Risk, Threat, Vulnerability, Exploit, Impact, Asset.

  4. Attack Vectors: Phishing, Malware, Social Engineering, Ransomware.
  5. Security Frameworks & Regulations: NIST, ISO 27001, OWASP, GDPR, HIPAA

Lab Exercises (2 hrs)

  1. Explore cyber breach case studies (Target, Equifax, Colonial Pipeline); CIA Triad mapping
  2. Analyze real attack reports (APT28, Lazarus); build attacker profiles
  3. Map terms to scenarios; build a security dictionary
  4. Simulate phishing email creation and detection; decode base64-encoded payload
  5. Create a comparison matrix of frameworks; identify non-compliance in scenarios

WEEK 2 –Operating Systems, Networking & Protocols for Cybersecurity

Lecture Topics (2 hrs)

  1. Windows Internals: Registry, Processes, Services, Event Logs
  2. Linux Internals: File System, Permissions, Services, Cron
  3. TCP/IP Fundamentals, Network Topologies, OSI Model
  4. Key Protocols (HTTP/S, DNS, ARP, ICMP, FTP, SSH)
  5. Firewalls, NAT, Routing, VPN Concepts

Lab Exercises (2 hrs)

  1. Use Sysinternals tools: Process Explorer, Autoruns, and analyze logs.
  2. Practice chmod/chown; setup cronjobs; read /etc/passwd, /var/log
  3. Wireshark traffic capture and protocol dissection
  4. Simulate MITM attack using ARP poisoning; view DNS traffic
  5. Set up iptables rules; use OpenVPN; test NAT & static/dynamic routing

WEEK 3 – Ethical Hacking Fundamentals – Part 1

Lecture Topics (2 hrs)

  1. Introduction to Hacking: Legal, Ethical, Methodologies (PTES, OWASP)
  2. Reconnaissance (Passive & Active), Google Dorking, WHOIS, DNS Enum
  3. Scanning Techniques: Port Scanning, OS Fingerprinting
  4. Banner Grabbing, Enumeration of Services (SMB, FTP, SSH, SNMP)
  5. Vulnerability Scanning: CVE, CVSS, NVD, OpenVAS, Nessus

Lab Exercises (2 hrs)

  1. Explore Kali Linux & Parrot OS, set up attack lab (DVWA, Metasploitable)
  2. Use theHarvester, Recon-ng, dnsenum, crt.sh for recon
  3. Perform Nmap scans (SYN, UDP, OS detection), masscan basics
  4. Enumerate Samba shares, FTP dir listing, use enum4linux, snmpwalk
  5. Run OpenVAS/Nessus scan; analyze CVSS score; map CVE to real exploit

WEEK 4 –Ethical Hacking Fundamentals – Part 2

Lecture Topics (2 hrs)

  1. Web Application Overview (Frontend/Backend/DB), OWASP Top 10 (Overview)
  2. XSS (Reflected, Stored, DOM) + Prevention Techniques
  3. SQL Injection, Broken Authentication, IDOR.
  4. Command Injection, File Inclusion, SSRF.

Lab Exercises (2 hrs)

  1. Deploy OWASP Juice Shop; walkthrough its architecture
  2. Exploit XSS in DVWA; implement Content-Security-Policy in code
  3. Perform SQLi using SQLMap; brute-force login using Burp Intruder
  4. Exploit LFI/RFI in DVWA; simulate SSRF with custom script.

WEEK 5 – Wireless & Cloud Hacking Basics

Lecture Topics (2 hrs)

  1. Wireless Network Vulnerability
  2. Wi-Fi Encryption Attacks.
  3. Cloud Security Overview.
  4. Cloud Misconfigurations
  5. Cloud Attack Simulations

Lab Exercises (2 hrs)

  1. Aircrack-ng simulated WPA crack
  2. De-auth and handshake capture demo
  3. Setup AWS/GCP trial and explore IAM
  4. S3 bucket access configuration demo
  5. ScoutSuite and open-source S3 scan tools

WEEK 6 – Defensive Security Essentials.

Lecture Topics (2 hrs)

  1. Defense-in-Depth & Security Layers
  2. Firewalls & IDS/IPS
  3. Endpoint Security & EDR
  4. Secure Configuration & Hardening
  5. Secure Development Basics

Lab Exercises (2 hrs)

  1. Map defensive controls to OWASP Top 10
  2. Suricata/Wazuh demo setup
  3. Setup ClamAV and test signature
  4. CIS Benchmarking using Lynis
  5. Review insecure code and suggest fixes

WEEK 7– Security Monitoring & SIEM

Lecture Topics (2 hrs)

  1. Logging & Event Management
  2. SIEM Overview.
  3. Alerting & Correlation.
  4. Threat Hunting Basics
  5. SOC Workflows & Blue Teaming

Lab Exercises (2 hrs)

  1. Log parsing from Linux & Apache log
  2. Introduction to Wazuh/ELK Stack
  3. Write detection rules and alerts
  4. IOC-based hunting exercises
  5. Simulate SOC alert triage scenario

WEEK 8 –Secure Software Development

Lecture Topics (2 hrs)

  1. OWASP Top 10 (Part 1)
  2. OWASP Top 10 (Part 2).
  3. DevSecOps Concepts
  4. Code Review Practices
  5. Threat Modeling

Lab Exercises (2 hrs)

  1. Code analysis for A1–A5 risks
  2. Code analysis for A6–A10 risks
  3. SAST and DAST setup using GitHub Actions
  4. Review insecure Python and PHP snippets
  5. Create threat model for an ecommerce app

WEEK 9 – ISO 27001 Training (Day 1–5)

Lecture Topics (2 hrs)

  1. ISO 27001 Overview & ISMS Basics
  2. Clauses & Structure
  3. Annex A Controls Deep Dive (Part 1)
  4. Annex A Controls Deep Dive (Part 2)
  5. Risk Assessment & Treatment

Lab Exercises (2 hrs)

  1. Create an org chart and ISMS policy.
  2. Map controls to organizational needs.
  3. Apply A.5–A.10 to case studies.
  4. Apply A.11–A.18 to case studies.
  5. Conduct sample RA and build risk register.

WEEK 10 –ISO 27001 Audits & Certification

Lecture Topics (2 hrs)

  1. Internal Audit Planning
  2. Documentation & Evidence Gathering
  3. Non-conformance Handling
  4. Certification Process & Auditors
  5. ISO 27001 Mock Audit

Lab Exercises (2 hrs)

  1. Simulate audit interviews
  2. Fill audit forms, prepare checklist
  3. Write sample NCR reports
  4. Flowchart certification process
  5. Conduct mock audit for fictional company

WEEK 11 –Capstone Ethical Hacking Lab.

Lecture Topics (2 hrs)

  1. Red Team Engagement Planning
  2. Reconnaissance
  3. Exploitation
  4. Post Exploitation
  5. Reporting

Lab Exercises (2 hrs)

  1. Plan & scope pentest
  2. Perform recon on target
  3. Exploit known services/webapps
  4. Maintain access, extract data
  5. Draft professional pentest report

WEEK 12 –Capstone Defensive Security Lab

Lecture Topics (2 hrs)

  1. Incident Response Intro
  2. Log Review & Alert Handling.
  3. Threat Hunting & IOC Discover
  4. Forensics & Recovery
  5. Final Presentation

Lab Exercises (2 hrs)

  1. IR stages and planning
  2. Detect simulated attack logs
  3. Hunt for attack indicators
  4. Analyze memory/disk images
  5. Present red & blue team findings