Cybersecurity for everyone
Without any technical background, you learn the core ideas of cybersecurity, common threats and organisational roles, and start spotting risk at work.
Level 101 · 22 lessons · 18 practice labs
Lessons
What cybersecurity is
- Why cybersecurity is everyone’s job: You see through real examples how one careless click can bring a hospital, a council or a shop to a halt.
- What an information asset is: data, devices, people, processes: You sort what your organisation must protect into four groups and can list the assets on your own desk.
- Confidentiality, integrity and availability (the CIA triad): You can classify how an incident affects information in terms of confidentiality, integrity and availability.
- Authentication, authorisation and accountability: You can explain the difference between proving who you are, deciding what you may do and recording what was done.
- Quick task: list the information assets at home and at work
Threats, vulnerabilities and risk
- Threat, vulnerability and risk: telling them apart: Using an unlocked-door analogy, you separate threat, vulnerability and risk and name everyday examples correctly.
- Threat actors and their motives: You can tell what criminal groups, state-backed teams, insiders and activists target, and why.
- Common threats: malware, ransomware, phishing, denial of service: You recognise the threats that hit organisations most and can say which security principle each one breaks.
- How an incident unfolds: first contact, spread, impact: You can describe the stages of a cyber incident and where each stage can be stopped.
- The human factor and a first look at social engineering: You understand why fraudsters target people’s trust, haste and curiosity rather than technology.
- Quick task: separate threat, vulnerability and risk in three scenarios
Layers of protection
- Defence in depth: no single control is enough: With a castle analogy, you can explain how physical, technical and administrative controls complement each other.
- Control types: preventive, detective, corrective: You classify an organisation’s controls by purpose and can notice which type is missing.
- Least privilege and need to know: You can show with examples how giving people only the access their job needs limits possible damage.
- Why updates and backups matter: You can explain how updates close known flaws and why a backup only helps if it can be restored.
- Classifying information: public, internal, confidential: You decide which class a document belongs to and who it can be shared with, and how.
- Quick task: classify documents and match controls
Who owns security in an organisation
- Security roles: CISO, SOC, IT and data owner: You know who is responsible for security in your organisation and which role to take a problem to.
- Policies, standards, procedures: where the rules come from: You separate the layers of organisational rules and can find why a rule exists and where it is written.
- Laws and frameworks at a glance: GDPR, NIS2, ISO/IEC 27001: You can explain in one sentence each what the main international regulations and standards for organisations are for.
- Careers in cybersecurity and a learning path: You get to know security jobs from analyst to auditor and can choose a next step that suits you.
- Capstone: assess an office’s security posture: You list a fictional office’s assets, threats and missing controls, then write a short assessment for the manager.
Practice labs
- A small office's information assets: Pull the data, device, people and process assets out of a dental clinic's description and write them with their type to assets.csv.
- Match incidents to the CIA triad: Label eight short incident summaries by whether they breach confidentiality, integrity or availability.
- Which property matters for which asset: Rank confidentiality, integrity and availability, with reasons, for six of Kestrel Logistics' assets and write the result to priorities.csv.
- Who, what may they do, who did it: Classify ten everyday examples as authentication, authorisation or accountability.
- The cost of a shared account: Review the records of a wrong payment made with a shared accounting account and write why nobody can tell who did it and how to fix that.
- Excess entries in an access list: Compare a shared folder's access list with job descriptions and mark the people whose work does not require access.
- Threat, vulnerability or risk: Sort twelve statements about a stationery shop into threat, vulnerability or risk and write them in a table.
- Match the actor and motive: Match six incident summaries to a criminal group, insider, activist or state-backed actor and its likely motive.
- Order the stages of an incident: Place shuffled incident records into first contact, spread and impact stages and write at which stage it could have been stopped.
- Preventive, detective, corrective: Classify fifteen controls as preventive, detective or corrective and write them to controls.csv.
- An office relying on one layer: Find the missing layers of protection in the scenario of an accounting firm that relies only on antivirus and propose a control for each.
- Which control would have stopped it: Read the account of a ransomware incident and write, for each stage, the control that could have stopped it and why it failed.
- Classify the documents: Label ten of Lumen Retail's documents public, internal or confidential and give a one-sentence reason for each.
- Need to know: Fill in an access matrix showing which document classes five project roles need and remove the permissions granted in excess.
- The consequences of a wrong label: Find six wrongly classified documents and write the correct label and the harm the wrong one could cause.
- Who to tell: Match eight everyday situations to the right role among the security team, IT support, data owner or manager.
- Policy, standard, procedure: Work out which type of document ten sentences come from and label each as policy, standard or procedure.
- Which law or framework applies: Read six organisation profiles and mark, with reasons, where GDPR, NIS2 or ISO/IEC 27001 comes into play.
About this course
Without any technical background, you learn the core ideas of cybersecurity, common threats and organisational roles, and start spotting risk at work.
What you will learn
- What cybersecurity is
- Threats, vulnerabilities and risk
- Layers of protection
- Who owns security in an organisation
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.