Showing 1553 tools
802.1X Authentication Flow Walkthrough
Follow one laptop from a dead switch port to an authorized one, committing to each EAP frame and RADIUS message before it is revealed.
Abstraction Layer Builder
Assemble the computer abstraction stack in order — hardware, firmware/BIOS, device drivers, operating system, user interface, applications — and see why each layer only ever talks to the one below it.
Access Control Model Matcher
Match six access control models to the rule each one uses to decide access.
ACL Rule Builder and Tester
Build an extended ACL that lets the Sales LAN reach one server on one port and nothing else in that subnet, plus a standard ACL guarding R1's VTY lines — then trace six packets through the finished configuration and give each one a verdict.
Agreement Type Matcher
Match seven vendor scenarios to the agreement type that governs each, and separate the umbrella contracts from the per-project ones, the external commitments from the internal, and the binding from the merely intended.
App Category Matcher
Match popular apps and tools to their application category — and spot the ones that cross boundaries.
App Category Sorter
Sort real applications into the five jobs software does for a user: documents, communication, security, remote access, and file utilities.
ARP Process Walkthrough
Commit to a prediction at each step of an ARP resolution, then see what the request, the switch, and the reply actually do.
ASCII Character Encoder
Type a character and watch its decimal, hex and 8-bit binary code appear together — then reverse it and predict a character from its code before revealing it.
Authenticity vs Non-Repudiation Streak Sort
Drill the one distinction most learners get wrong on their first pass through the five pillars: Authenticity vs Non-Repudiation.
Backup Strategy Builder
Build a backup plan by matching each drafted plan line to the recovery requirement that forced it.
Backup Type Comparison Activity
Pick the backup type an RPO and RTO actually call for, and count what it costs — restore steps, job size, and how often it has to run.
Backup Type Selector
Classify backup strategy descriptions as Full, Differential, Incremental, or Snapshot.
Number Base Odometer
Watch a single value change across number systems at once, building an intuitive feel for how decimal, binary, hex, and octal relate to each other.
BIA Scenario Activity
Run one e-commerce checkout through the arithmetic of a Business Impact Analysis — the cost of an hour down, the MTD the business will absorb, the RTO and WRT that must fit inside it, the RPO the backup schedule has to honour, and where more protection stops being worth buying.
Binary Addition — Learn
Learn binary addition step by step — from the first bit to the final carry.
Binary Addition — Practice
Practice adding pairs of binary numbers in nibble or byte range, with immediate feedback on each answer.
Binary Place Values
Watch how binary numbers are built one bit at a time, with each place-value column rendered as a block that grows the higher its bit position.
Binary to Decimal — Learn
Learn binary-to-decimal the way it works — collect the place value of each 1, add them up.
Binary to Decimal — Practice
See exactly how a byte becomes a number, one place value at a time, by converting binary values to decimal.
Binary to Hex — Learn
Learn binary-to-hex the way it works — group the bits into fours and read each group as a single hex digit.
Binary to Hex — Practice
Practice converting binary values to hexadecimal, the shorthand IT professionals use to represent binary data compactly.
Change Management Step Sequencer
Order one change through its lifecycle — Request, Review, Approval, Testing, Implementation, Verification, Documentation, Closure — and say what each step produces.
CIA Triad Breach Labeler
Label a breach diagram's three outcomes with the CIA Triad property each one violates: Confidentiality, Integrity, or Availability.
CIA Triad Scenario Sorter
Classify breach scenarios by which CIA Triad property was violated: Confidentiality, Integrity, or Availability.
Computer Component Label Drop
Click the six core components of a desktop computer on a cutaway diagram, cued by what each one does rather than by its name.
Config Command Builder
Type the missing keyword in a Cisco IOS configuration command — hostname, enable secret, SSH, VTY lines and banners. Seventeen commands in the pool, eight drawn each run.
Cryptographic Attack Scenario Matcher
Match seven cryptographic weaknesses and attacks to the scenarios that describe them, and separate the ones an administrator introduces from the ones an attacker carries out.
CVSS Score Estimator
Run the real CVSS v3.1 base formula by hand — impact sub-score, exploitability sub-score, the Scope Changed branch and CVSS’s own Roundup — on the vectors a scanner actually reports, then read the severity rating off the score.
Cybersecurity Cube Sorter
Sort all nine elements of the Cybersecurity Cube into the three dimensions they belong to: the CIA Triad, the States of Data, and Countermeasures.
Data Classification Sorter
Sort data items into the four-tier classification model: Public, Internal, Confidential, or Restricted.
Data Lifecycle Stage Sorter
Order the seven stages of the data lifecycle — Creation, Classification, Storage, Use, Sharing, Archival, Destruction — by reasoning from the controls that protect the data at each one.
Data Size Comparison Scaler
Convert data sizes across the whole ladder — bits, nibbles, bytes, KB, MB, GB, TB — in both the SI and binary conventions.
Decimal to Binary — Learn
Learn decimal-to-binary the way it works — check each place value from the left, does it fit, and subtract.
Decimal to Binary — Practice
Flip the conversion around and build a binary value place value by place value, starting from a decimal number.
Decimal to Hex — Learn
Learn decimal-to-hex the way it works — test each place value from the left, how many times does it fit, and subtract.
Decimal to Hex — Practice
Convert decimal values to hexadecimal, building the intuition for how IT systems represent large numbers compactly.
Defense-in-Depth Layer Builder
Place twelve security controls onto the six layers of a defense-in-depth architecture — perimeter, network, endpoint, application, data and human — and read the empty layers as the finding.
Deployment Model Scenario Selector
Classify infrastructure deployment scenarios as Public Cloud, Private Cloud, Hybrid Cloud, On-Premises, or Colocation.
Device Function Sorter
Sort computing devices and components into Input, Output, Processing, and Storage categories.
DHCP Process Walkthrough
Order the four messages of a DHCP address assignment — Discover, Offer, Request, Acknowledge — reasoning from who can address whom and from the UDP 67/68 port roles rather than from the DORA acronym.
DNS Resolution Walkthrough
Follow one name — www.techknowsurge.com — from a browser bar to an IP address, committing to what each server sends back before you are shown the real answer.
DoS Attack Type Classifier
Classify DoS attack scenarios as Volumetric (flood bandwidth), Protocol (exhaust state tables), or Application-Layer (overwhelm app logic).
Double Trouble
Guess how big a doubling value will get, then watch the reveal show you exactly where your intuition for exponential growth went wrong — building a feel for why each new bit doubles what came before it.
Ethernet Frame Builder
Fill in Ethernet frame fields — MAC addresses, EtherType, payload limits, and FCS — one blank at a time.
File Extension Matcher
Match common file extensions to their file type — documents, video, audio, executables, images, archives, and data files.
Firewall Rule Builder
Build a five-rule zone-based firewall policy across Trust, DMZ and Untrust for Halvorsen Marine Supply, then trace six packets through it — including the one packet whose verdict flips depending on whether the firewall tracks connection state.
5 Pillars Scenario Sorter
Classify breach scenarios across all five pillars of cybersecurity: Confidentiality, Integrity, Availability, Authenticity, and Non-Repudiation.
Fragmentation Visualizer
Watch seven files land on an empty 80-block disk as clean unbroken runs, watch three of them get deleted, and watch the next big write be forced to scatter into four separate gaps — then press Defragment.
Gap Analysis Activity
Assign five AcmeCorp security gaps to the correct NIST CSF function to build a remediation roadmap.
Hardware vs Software Sorter
Sort computing items into Hardware or Software columns, including edge cases like firmware.
Hash Function Explorer
Type anything and watch MD5, SHA-1, SHA-256 and SHA-3 compute at once — then change one character and measure how much of the output moves.
Hex Color Explorer
Mix a color and watch its hex code build itself — then run it backwards: read a hex code, predict the R, G and B numbers, and only then reveal.
Hex Place Values
Watch how hex numbers are built one column at a time, with each place-value column showing 0–15 blocks that fill and carry.
What Is Hexadecimal? — RGB Explorer
Drag the RGB sliders and watch the hex color code and its full binary stream update in real time — the same 24 bits, two ways.
Hex to Binary — Learn
Learn hex-to-binary the way it works — replace each hex digit with its 4-bit equivalent.
Hex to Binary — Practice
Reverse the process and convert hexadecimal values back into their binary form, one digit at a time.
Hex to Decimal — Learn
Learn hex-to-decimal the way it works — each digit is worth its value times its place, add them up.
Hex to Decimal — Practice
Convert hexadecimal values back to decimal, reinforcing how each hex digit maps to a place value.
Incident Response Phase Sequencer
Order one incident through the response lifecycle — Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons Learned — and say what each phase changes.
IoC Triage Game
Thirty-two indicators of compromise, twelve drawn at random each play. One question every time: High, Medium, Low, or false positive — and the context, not the artifact, decides.
IOS Navigation Mode Map
A clickable map of the six Cisco IOS command modes with a terminal wired to it — type a command and find out whether the mode you are standing in would take it, and if not, which mode wants it.
IP Class Identifier
Classify 15 IPv4 addresses by class (A-E) and identify private, loopback, and APIPA ranges.
IPv6 Address Compression Practice
Type the compressed form of a full IPv6 address, and the full form of a compressed one. Fifteen addresses in the pool, eight drawn each run.
IPv6 Address Type Identifier
Classify IPv6 address strings by type — Global Unicast, Link-Local, Loopback, Multicast, Anycast, or Unique Local — using prefix patterns.
Key Concepts Anatomy Labeler
Label a single breach scene with the eight core cybersecurity terms it depicts: Threat Actor, Vulnerability, Asset, Mitigation, Exploit, Threat, Risk, and Defense-in-Depth.
Keyboard Shortcut Speed Drill
A fast recognition round over thirty-seven real keyboard shortcuts from Windows, macOS, Microsoft Office and the browser — twelve drawn at random each play, every one labelled with the platform it belongs to.
Kill Chain Stage Identifier
Sort attacker action cards into the 7 Cyber Kill Chain stages: Recon, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.
Layer 2 Attack-to-Defense Matcher
Match nine Layer 2 attacks to the switch feature that stops each one.
Logic Gate Truth Table Explorer
Pick a logic gate, flip the input switches, and watch the output lamp and the truth table agree with each other in real time.
MAC Address Table Simulator
Watch frames arrive at a switch one at a time, commit to what the MAC address table now holds and what the switch does with each frame, then see the real answer.
Malware Behavior Classifier
Sort malware behavior descriptions into the correct type: Virus, Worm, Trojan, Ransomware, Rootkit, Spyware, Fileless, or Logic Bomb.
Malware Type Identifier
Match eight malware types to the behavior that defines each one.
MFA Factor Sorter
Sort authentication factors into Something You Know, Something You Have, Something You Are, or Somewhere You Are categories.
MITRE ATT&CK Technique Sorter
Sort attacker behavior cards into MITRE ATT&CK tactic categories: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Collection, and Exfiltration.
NAT Type Selector
Classify NAT scenarios as Static NAT, Dynamic NAT, PAT, or Static PAT based on the described translation behavior.
NDP Process Sequencer
Order a host's Neighbor Discovery activity — multicast group join, duplicate address detection, Router Solicitation and Advertisement, then neighbor resolution — reasoning from what source address each message needs rather than from the ICMPv6 type numbers.
Network Topology Builder
Build a star topology position by position, then label what each possible failure costs and what a bus or mesh would trade for it.
Networking Equipment Role Identifier
Match networking devices to their primary roles — and to their OSI layer where a standard assigns one — in this drag-and-drop activity.
Octal Unix Permissions Calculator
Convert Unix file permissions in both directions — rwx flags to octal digits, and octal values back to symbolic notation.
OS Comparison Matrix Activity
Fill the ten empty cells of a five-by-five operating system matrix from each row’s option menu, then check every answer against a one-line reason.
OS Function Matcher
Match each OS function to the real-world scenario it describes.
OS Type Identifier
Match environment scenario cards to the correct OS type: Desktop, Server, Mobile, Embedded, or Real-Time.
OSI Layer Drag-and-Drop
Drag seven scrambled OSI layer cards into the correct bottom-to-top stack — Physical, Data Link, Network, Transport, Session, Presentation, Application — using what each layer does rather than the number it carries.
OSINT Source Categorizer
Sort reconnaissance activities into Passive (no target contact) or Active (direct interaction with target systems).
OSPF Process Step Sequencer
Order one OSPF adjacency end to end — Hello and Init, 2-Way, ExStart, Exchange, Loading, Full, then the SPF calculation and the route installed — reasoning from what each step needs before it can happen.
OWASP Top 10 Scenario Matcher
Match application attack scenarios to the correct OWASP Top 10 category across 8 key risk types.
Packet Journey Animator
Step one packet from your laptop to a web server through a switch, a router, NAT and the ISP, and watch its addresses change — the MAC pair on every link, the destination IP never.
Password Strength Analyzer
Type a sample password and watch its entropy, character sets and crack time compute live — in two columns, because the brute-force number and the number a real cracker cares about are not the same number.
Personnel Security Principle Scenarios
Identify which personnel security principle — Least Privilege, Need to Know, Separation of Duties, Job Rotation, or Mandatory Vacation — each workplace scenario illustrates or violates.
Phishing Email Red Flag Spotter
Read a fake payroll email line by line and flag the five red flags hiding among the innocent lines.
Physical Security Layer Designer
Match physical security controls to their function and detection or prevention classification.
PKI Certificate Chain Builder
Drag certificate cards into the correct chain order and match each to its signing relationship.
Policy Hierarchy Sorter
Sort governance document descriptions into the five-tier hierarchy: Policy, Standard, Procedure, Guideline, or Control.
Port Number Matcher
Match common network services to their well-known port numbers.
Process vs Service Sorter
Sort running system items into Process (user-launched) or Service (background, system-managed) categories.
Protocol-to-Layer Sorter
Sort protocols and technologies into their correct OSI layer, from Physical (L1) to Application (L7).
RAID Level Architect
Size a RAID array by hand — usable capacity, minimum drives, guaranteed fault tolerance, and which level a stated requirement actually calls for.
RAID Level Selector
Match business storage scenarios to the correct RAID level: 0, 1, 5, 6, or 10.
Raster vs Vector Zoom Test
Zoom into the same icon stored two ways — as a grid of pixels and as vector maths — and watch only one of them fall apart, with the file-size numbers measured live.
Regulation Matcher
Match seven compliance scenarios to the regime that governs each, and separate the ones imposed by law from the one imposed by a contract and the one a customer simply asks for.
Risk Calculation Activity
Run the quantitative risk chain on real scenario numbers — SLE from asset value and exposure factor, ALE from SLE and rate of occurrence, and any missing term solved back out.
Risk Management Strategy Selector
Classify business risk decisions as Avoid, Mitigate, Transfer, or Accept.
Risk Register Builder
Build a risk register entry-by-entry and visualize all risks on a likelihood-impact heat map.
Routing Table Decision Game
Thirty routing tables and thirty destination IP addresses — twelve drawn at random each play. One question every time: which entry wins under longest prefix match?
Security Awareness Training Scenario Selector
Match employee behavior vignettes to the training module they most urgently need: Phishing Awareness, Password Hygiene, Physical Security, Insider Threat, or Social Media Policy.
Security Control Type Sorter
Sort security controls into Technical, Administrative, or Physical categories, each labeled with its function (Preventive, Detective, Corrective).
Security Framework Matcher
Match seven security frameworks and regulations to the audience each one is written for and whether following it is voluntary or compelled.
Security Zone Designer
Lay out a segmented network segment by segment — internet, DMZ, internal LAN, server farm, management — then defend the two rules that make the layout a design rather than a drawing.
SIEM Alert Triage Game
Thirty SIEM alerts, twelve drawn at random each play. One decision every time: true positive, false positive, or needs investigation — and the context cards, not the rule name, decide it.
Social Engineering Technique Identifier
Sort social engineering scenarios into the correct technique: Phishing, Vishing, Smishing, Pretexting, Baiting, Tailgating, Quid Pro Quo, or Spear Phishing.
Social Engineering Technique Identifier (Advanced)
Sort advanced social engineering scenarios into 8 technique bins: Pretexting, Vishing, Smishing, Baiting, Tailgating, Quid Pro Quo, Shoulder Surfing, and Whaling.
Software License Sorter
Match software scenarios to the correct license type: Perpetual, Subscription, Open-Source, Freeware, Shareware, or Enterprise/Site.
SPF/DKIM/DMARC Email Path Tracer
Follow ten messages through a receiving mail server's SPF, DKIM and DMARC checks, committing to pass or fail at every checkpoint before it is revealed.
Static Route Configuration Builder
Type the missing piece of a Cisco IOS static route command — destination, mask, next hop, default route, host route, floating static — and read the routing table entry it produces. Twenty-three items in the pool, eight drawn each run.
Storage Hierarchy Comparison
Hover the eight tiers of the storage pyramid for speed, capacity and cost per gigabyte, then walk a byte up from disk to register and watch the latency add up.
Storage Media Timeline
Drag eight storage media into the order they arrived — punch card, magnetic tape, hard disk, floppy disk, optical disc, USB flash drive, SSD and NVMe — and see the encoding story run from punched holes through magnetism and light to trapped charge.
Storage Type Speed Pyramid
Rank tape, HDD, SSD, RAM and CPU cache from the slowest and largest tier down to the fastest and smallest.
STP Root Bridge Election Simulator
Work the spanning-tree algorithm one decision at a time - root bridge election, root path cost, root port and designated port tiebreakers, and which ports block.
Subnet Mask Binary Converter
Work out subnet masks, subnet counts, host counts, and subnet boundaries from a CIDR prefix.
Subnetting Challenge
Work a subnetting requirement end to end — prefix length, custom mask, subnet count, and the network, broadcast and usable range of a given subnet.
Symmetric vs Asymmetric Key Scenario Sorter
Classify cryptographic scenarios as Symmetric, Asymmetric, or Both (hybrid).
TCP Three-Way Handshake Sequencer
Order the eight events of a TCP connection's life cycle — SYN, SYN-ACK, ACK, data transfer, then the four-step FIN/ACK/FIN/ACK teardown — reasoning from the flag bits and the direction each message travels.
TCP vs UDP Scenario Sorter
Sort networking scenarios into TCP (reliable delivery) or UDP (fast, best-effort) categories.
Threat Actor Profile Builder
Read four characteristics out of an incident write-up — motivation, target, capability, position — and name the threat actor archetype they describe.
TLS Handshake Step Sequencer
Order one TLS 1.3 handshake end to end — ClientHello, ServerHello, EncryptedExtensions, Certificate, CertificateVerify, Finished, Application Data — and say what each step settles.
Transistor Switch Simulator
Sweep the base voltage of an NPN transistor from 0 to 1.5 V and watch the LED stay dark, snap on, and stay on — a smooth input producing a step output.
VLAN Design Challenge
Number the VLANs for a two-floor office — Sales 10, IT 20, Voice 30, Management 99, native VLAN 1 — then decide what each switch port has to be: plain access, access with a voice VLAN, or trunk.
VLSM Planning Tool
Allocate a single 172.20.16.0/24 across five segments of very different sizes — 50, 25, 10, 2 and 2 hosts — then critique the finished plan on allocation order, on what FLSM would have cost, and on what is left over.
VPN Type Comparison
Match five VPN and tunneling types to the deployment each one was built for.
Vulnerability Category Sorter
Sort vulnerability descriptions into Network, Software, Hardware, Human, Cryptographic, or Process/Configuration categories.
Vulnerability Prioritization Activity
Rank five vulnerability scan findings by remediation priority, weighing asset criticality, active exploitation, patch availability and compensating controls against the CVSS base score.
Wireshark Filter Builder
Read the goal, type the Wireshark display filter that meets it — protocol name, ip.addr and its one-direction pair, tcp.port and tcp.dstport, flag bits, and the operators that join and negate them. Twenty-two items in the pool, eight drawn each run.
Binary Addition
Race against the clock to add binary numbers in Bomb Squad, Meltdown, and other arcade engines.
Binary to Decimal
Race the clock turning binary into decimal, one byte at a time.
Binary to Hex
Race the clock converting binary values to hex.
Bit, Nibble & Byte
Classify binary patterns as bits, nibbles, or bytes — Simon Says style.
Decimal to Binary
Race the clock building binary values from decimal, one place value at a time.
Decimal to Hex
Race the clock converting decimal values to hex.
Hex to Binary
Race the clock converting hex values back to binary.
Hex to Decimal
Race the clock converting hex values back to decimal.
Next Binary Number
Count in binary under pressure — one value appears, type the next in Buffer Overflow, Bomb Squad, and other arcade engines.
How Bits Multiply
Watch bits double possibilities in real time — the visual explanation for why 256 shows up everywhere in computers.
How Computers Work
Computers process all data using binary ones and zeros, a system rooted in the physical behavior of transistors inside modern microprocessors. This content covers the history of computing hardware, how digital circuits represent and calculate information, and how binary values translate into text, graphics, and arithmetic operations.
Number Systems
Number systems, including binary, decimal, hexadecimal, and Roman numerals, follow consistent structural rules that make them easier to understand when compared side by side. Binary operates on the same positional logic as the familiar base-10 decimal system, using only two digits — 0 and 1 — to represent any value.
Powers of 2
Binary numbers and powers of two explain why values like 256, 64, and 128 appear so frequently in computing. Each additional bit doubles the number of possible combinations, producing the consistent sequence of numbers seen across networking, processing, and system design.
Bits, Binary, Hex, and Octal
Computers rely on multiple numbering systems—binary, decimal, hexadecimal, and octal—each suited to specific technical tasks. Understanding when and why each system is used is foundational knowledge for working in IT and cybersecurity.
Binary Counting
Binary counting is a foundational skill required for understanding hexadecimal, IP subnetting, and other core networking and IT concepts. This content covers how the binary number system works using a place-value approach drawn from familiar decimal counting methods.
DEMO: Counting in Binary
This hands-on exercise builds fluency in binary counting by walking through the values from 0 to 15 using a structured reference table. Repeated practice is emphasized as the foundation for mastering binary representation.
Binary Odometer
Binary numbers become easier to understand when visualized as an odometer, where each column resets and carries over just like the familiar base-10 system. This topic explores that comparison using interactive online tools to show how binary counting works in practice.
DEMO: Counting in Binary, Part 2
Incrementing a binary number means identifying what value comes next by adding 1 and applying carry operations across the bit positions. This skill builds on basic binary counting and is essential for working with binary arithmetic.
Adding Binary Numbers
Binary addition follows the same carry-over logic as decimal addition, applied to base-2 values. Two worked examples demonstrate how bits combine and carry across place values to produce correct sums.
DEMO: Adding Binary Numbers
Binary addition follows the same carry-over logic as decimal arithmetic, applied strictly to ones and zeros. This topic builds familiarity with binary number systems beyond simple conversion.
DEMO: Binary to Decimal
Binary-to-decimal conversion is a foundational networking skill required for certifications such as the CCNA. This topic covers the positional value method for converting binary numbers to their decimal equivalents.
Decimal to Binary
Decimal-to-binary conversion works by systematically determining which powers of two fit into a given value. This foundational skill underpins how computers represent and process numeric data.
DEMO: Decimal to Binary
Decimal-to-binary conversion works by progressively subtracting the largest possible powers of two from a given value and recording a 1 or 0 for each bit position. Mastering this process alongside binary-to-decimal conversion is essential for networking and IT fundamentals.
DEMO: Checking Your Work
The Windows calculator's programmer mode can verify binary-to-decimal and decimal-to-binary conversions, making it a reliable self-check tool during practice. Calculators are not a substitute for mental math but serve as a useful validation method when drilling number system conversions independently.
Hexadecimal
Hexadecimal is a base-16 numbering system used throughout computing to represent data more concisely and readably than binary or decimal. This topic covers how the system works, why it exists, and where it appears in real-world IT environments.
Hexadecimal Odometer
Hexadecimal numbers use digits 0–9 and letters A–F to represent values in a base-16 counting system, where each column carries over at multiples of 16. Visualizing this with an interactive odometer tool makes the counting patterns behind hex easier to recognize and understand.
DEMO: Counting in Hexadecimal
Hexadecimal counting follows the same positional logic as decimal and binary, using the letters A through F to represent values ten through fifteen before resetting and carrying to the next column.
DEMO: Binary to Hexadecimal
Binary-to-hexadecimal conversion is a foundational skill in computing, and this content covers the process of grouping binary digits into nibbles and mapping them to their hex equivalents. Both chart-based lookup and manual bit-counting methods are demonstrated with practical exercises.
DEMO: Decimal to Hexadecimal
Decimal-to-hexadecimal conversion can be approached through two methods: direct column-based division or an intermediate conversion through binary. Both techniques produce the same result and provide a foundation for working with hex values in IT and cybersecurity contexts.
DEMO: Hexadecimal to Decimal
Hexadecimal-to-decimal conversion is covered using two methods: direct positional calculation and binary as an intermediate step. Both approaches produce the same result and reinforce foundational number system fluency.
Octal
The octal numbering system uses a base-8 structure, counting digits from 0 through 7 across positional columns of ones, eights, 64s, 512s, and beyond. This foundation connects directly to the logic behind binary and hexadecimal, the numbering systems most relevant to IT and cybersecurity work.
Octal and Unix Permissions
The octal numbering system maps directly to Linux and Unix file permissions, providing a concise numeric shorthand for controlling read, write, and execute access across users, groups, and others.
What is IP Addressing
IP addresses are numerical identifiers assigned to networked devices that enable traffic to be routed to and from specific locations across interconnected networks. This content covers address structure, packet headers, address types, hierarchical organization, and the governing bodies that administer address allocation.
IP Address History
IP addressing has evolved through a series of RFCs since 1980, moving from a simple single-octet network scheme through classful addressing, subnetting, VLSM, private addressing, and ultimately IPv6 to meet the demands of a rapidly growing internet. Understanding this progression clarifies why subnetting exists and how modern addressing works.
IP Address Classes
Classful addressing is the original IPv4 framework defined in RFC 791 that divides the IP address space into five classes — A, B, C, D, and E — based on leading bit patterns. Understanding these classes and their network-to-host bit boundaries is foundational to subnetting and modern IP addressing.
DEMO: IP Address Classes
IP address classification is a foundational networking skill covered through hands-on practice identifying which class—A, B, or C—a given address belongs to based on its first octet range. Accurate and fast classification is essential for understanding how networks are structured and addressed.
DEMO: Networks
A hands-on exercise covering how to identify the network portion of IPv4 addresses using classful addressing rules, including Class A, B, C, and multicast address recognition.
DEMO: Hosts
This lesson covers how to identify the host portion of IPv4 addresses using classful addressing rules, building on the foundational skill of isolating network bits.
DEMO: Network Addresses
A network address is the first address in an IP range and identifies the network itself rather than any individual host. Understanding how to derive a network address from any given IP requires knowing the address class and which octets represent the network versus host portions.
DEMO: Broadcast Addresses
A broadcast address is the final address in a network range, used to reach all devices on that network simultaneously. This concept also explains why two addresses are always subtracted when calculating the number of usable hosts on a subnet.
DEMO: Address Types, Part 1
This content covers how to identify network, host, and broadcast addresses from a given IP address, using classful addressing rules as they appear on certification exams.
Address Types
IPv4 addresses are classified in multiple ways, including by class (A through E), by role (network, host, or broadcast), and by special designations such as private ranges, the quad-zero address, and the loopback address. Recognizing each type on sight is a foundational networking skill tested on major certification exams.
DEMO: Address Types, Part 2
A hands-on exercise in identifying IPv4 address types, covering class identification, network and broadcast address boundaries, host ranges, and private address ranges.
DEMO: Usable Hosts
This exercise builds the skill of identifying whether an IPv4 address qualifies as a usable host address, covering Class-based network rules, reserved ranges, and boundary conditions such as network and broadcast addresses.
IP Addressing Application
This content covers how IP addressing, subnetting, and VLSM are applied to a real corporate network environment, including how to assign network addresses, broadcast addresses, and usable host ranges across 31 distinct networks. It also introduces the distinction between Layer 2 and Layer 3 networking as foundational context for practical address planning.
Subnetting
Subnetting is the process of dividing an IP address space into smaller, more manageable networks by borrowing bits from the host portion of an address. The subnet mask communicates to devices exactly where the boundary between the network and host portions has been drawn, and CIDR notation expresses that boundary as a simple bit count.
Subnet Masks
Subnet masks define the boundary between network and host bits in an IP address, using binary values that translate into specific decimal numbers per octet. Understanding the binary math behind those numbers makes reading and calculating subnet masks straightforward.
DEMO: Default Subnet Masks
Default subnet masks define the network and host portions of an IP address for each address class. Understanding how to identify them is a foundational skill for subnetting.
DEMO: Custom Subnet Masks
Custom subnet masks and CIDR notation are calculated by identifying a address's default classful network bits and adding any borrowed bits to determine both the slash notation and the corresponding subnet mask value.
DEMO: Subnetting Class C
Class C subnetting covers how borrowing host bits creates custom subnet masks, increasing the number of available networks while reducing the number of usable hosts per network.
DEMO: Subnetting Class B
This content covers subnetting a Class B address, walking through how borrowing bits from the host portion affects the number of available networks and usable hosts across all valid subnet configurations.
DEMO: Subnetting Class A
Class A subnetting follows the same bit-borrowing process used for Class B and Class C addresses, scaled up to handle a significantly larger number of bits across the full address space.
31 bit prefixes (RFC 3021)
Subnetting requires borrowing the right number of bits to satisfy both network count and host count requirements simultaneously. This content covers how to use subnet reference tables to identify valid bit-borrowing options and make informed design decisions based on anticipated growth.
DEMO: How Many Bits to Borrow
Subnetting requires choosing the right number of bits to borrow based on how many networks and hosts are needed. This topic covers how to use subnet reference tables to find that number for Class B and Class C addresses across a range of real scenarios.
DEMO: Anding
ANDing is the binary process computers use to determine the network address from an IP address and subnet mask. It is a foundational concept in IP subnetting, particularly when custom subnet masks are involved.
DEMO: Subnetting Example C-1
A practical walkthrough of Class C subnetting covers how to determine borrowed bits, custom subnet masks, network addresses, usable host ranges, and broadcast addresses for a four-subnet scenario.
DEMO: Subnetting Example C-2
A guided practice exercise covering Class C IP subnetting, walking through the calculation of subnet masks, network addresses, broadcast addresses, and usable host ranges across five networks using the 192.168.65.0 address space.
DEMO: Subnetting Example B-1
Class B subnetting applies the same foundational concepts as Class C, scaled up to handle significantly larger address spaces with up to 65,534 hosts per network and over 16,000 possible subnets.
DEMO: Subnetting Example A-1
Class A subnetting follows the same process as other address classes, using borrowed bits to meet network size requirements within the 10.0.0.0 range and its default mask of 255.0.0.0.
DEMO: Subnet Visualization, Table
A subnet visualization chart provides a quick reference for identifying network ranges, subnet masks, and usable host addresses without manual calculation. The chart organizes subnetting by bits borrowed, making it a practical field tool for verifying subnet configurations across any octet.
DEMO: Subnet Visualization, Boxes
A visual box-splitting method offers an alternative approach to subnetting, allowing network engineers to calculate subnet ranges, custom masks, and usable hosts by repeatedly halving an address space.
DEMO: Determining a Subnet Range
Calculating a specific subnet's network range doesn't require working through every preceding subnet — a binary conversion shortcut makes it possible to jump directly to any target network. This content covers the method for finding the network address, broadcast address, and usable host range for any numbered subnet in a list.
Subnetting Application
Learn how to assess a corporate network's subnetting requirements by calculating the number of needed hosts and networks, including planning for future growth.
VLSM
Variable Length Subnet Masking (VLSM) allows networks to be divided into subnets of different sizes, making far more efficient use of available IP address space than the fixed-length approach it replaced. This topic also covers CIDR notation and the concept of route summarization.
DEMO: VLSM Example C-1
Variable Length Subnet Masking (VLSM) allows a single IP address block to be divided into subnets of different sizes, allocating addresses efficiently based on each network's actual host requirements. This example walks through subnetting a Class C address across five networks with varying host counts.
DEMO: VLSM Example C-2
A hands-on VLSM practice exercise working through an eight-network 192.168.20.0 scenario with varying host requirements, covering network addresses, usable host ranges, and broadcast addresses. Reinforces variable length subnet masking by applying the full subnetting process from start to finish.
DEMO: VLSM Table Visualization
Variable Length Subnet Masking (VLSM) allows a single IP address block to be divided into multiple subnets of different sizes, allocating only the address space each network actually needs. This content works through a practical VLSM problem using a subnetting table as a visual aid for the allocation process.
DEMO: VLSM Box Visualization
This topic covers Variable Length Subnet Masking (VLSM) using a visual block method to efficiently allocate subnets of different sizes from a single Class C address space. It demonstrates how to assign the correct subnet mask for five networks with varying host requirements.
Summarization
Network summarization reduces routing table size by grouping multiple smaller networks into a single advertised route, while supernetting extends this concept beyond classful address boundaries. Discontiguous networks present a key risk when applying summarization and must be accounted for to avoid misdirected traffic.
DEMO: Summarization
A hands-on practice exercise focused on network summarization, working through the process of identifying common octets, converting values to binary, and determining the correct CIDR notation for a group of networks.
IPv6 Addresses
IPv6 addressing introduces a vastly expanded address space using 128-bit hexadecimal notation, along with improvements to security, quality of service, and network performance. This content covers the structure of IPv6 addresses, prefix notation, and shorthand rules for condensing lengthy addresses.
IPv6 Addresses - Compression
IPv6 addresses can be shortened by removing leading zeros and replacing consecutive all-zero groups with a double colon, which can only be applied once per address. This content covers the rules and hands-on practice for applying both compression techniques correctly.
IPv6 Addresses - Expansion
IPv6 address expansion reverses the compression process by restoring omitted zeros and replacing double-colon notation with the full hextet groups it represents. This skill is essential for correctly interpreting and working with compressed IPv6 addresses.
IPv6 Addresses - Types
IPv6 defines several distinct address types — unicast, multicast, and anycast — each serving a specific communication role, while eliminating the broadcast model used in IPv4. Understanding these types and their assigned address ranges is fundamental to working with modern network infrastructure.
IPv6 Addresses - LLA & EUI 64
IPv6 link-local addresses are automatically generated on any IPv6-enabled interface, allowing devices to communicate on a local network without DHCP or manual configuration. This coverage includes how link-local addresses are structured, the EUI-64 method of deriving them from a device's MAC address, and how Duplicate Address Detection ensures address uniqueness.
IPv6 Subnetting - Prefixes
IPv6 uses a prefix length to identify network bits, functioning similarly to CIDR notation in IPv4. It divides an address into three components — the global routing prefix, subnet identifier, and interface ID — with /64 being the standard boundary for host assignment.
DEMO: IPv6 Subnetting - Basics
IPv6 subnetting is significantly simpler than IPv4, with ISP-assigned /48 prefixes leaving 16 bits for up to 65,536 unique subnet assignments and a full 64-bit host space per network.
DEMO: IPv6 Subnetting - Solving for a Network
Covers the process of identifying a specific IPv6 network address by converting a network number into its hexadecimal equivalent using binary conversion and nibble grouping.
DEMO: IPv6 Subnetting - Advanced
IPv6 hierarchical subnetting uses nibble-based address allocation to create structured, readable network segments across regions, sites, and departments. This approach simplifies access control, traffic identification, and address management at enterprise scale.
IPv6 Subnetting - Application
IPv6's vast address space eliminates the need for variable-length subnet masking, making corporate network design significantly more straightforward. A hierarchical addressing scheme using nibble-based divisions allows organizations to plan for regions and sites with substantial room for growth.
IPv4 Architecting
IPv4 address planning for corporate networks covers private address range selection, overlap avoidance, and logical subnetting strategies using octet-based segmentation to support regional, site, and departmental organization. Understanding these design decisions is essential for building scalable, conflict-free enterprise networks.
IPv6 Architecting
IPv6 corporate network design uses a /48 allocation to give organizations a structured block of public addresses, with the remaining bits divided across regions, sites, departments, and individual hosts.
Scenario
A practical networking scenario centered on building a music streaming setup for a fictional DJ business, used to ground core concepts in real-world application.
What’s a Network Service?
Network services are background programs that run continuously on a machine—independent of any logged-in user—to respond to requests from clients across a network. This content covers what services are, how they behave on Windows and Linux systems, and how common examples like DHCP and web servers put these concepts into practice.
What’s a Network Protocol?
A protocol is a standardized set of rules that governs how devices communicate, defining the order of communication and the format of data exchanged. Understanding protocols is foundational to grasping how different platforms and applications exchange information reliably across a network.
What’s a Network Port?
Network ports are numerical identifiers that direct incoming traffic to the correct service running on a server. Understanding port ranges and common port assignments is fundamental to managing and securing networked systems.
What’s Network Media?
Network media refers to the physical or wireless means by which data travels between devices, with three primary options: copper cable, light-based transmission, and radio signals. Each method encodes binary data differently but serves the same fundamental purpose of enabling device-to-device communication.
What’s a Network Interface Card (NIC)?
A network interface card (NIC) is the component that translates a computer's binary signals into the appropriate format for transmission across copper, wireless, or fiber optic media. Found on nearly all modern devices, the NIC is essential for any network connection regardless of the physical medium used.
DEMO: NIC
A network interface card (NIC) creates the connection between a device and a network, and Windows exposes its properties—including MAC address, IP version, speed, and connectivity status—through the Network Connections interface.
What’s a Hub?
An Ethernet hub is a basic network device that receives incoming signals on one port and broadcasts them out to all other connected ports. Understanding how hubs work provides a foundation for grasping core Ethernet communication principles.
What’s a MAC Address?
A MAC address is a unique 48-bit hardware identifier burned into every network interface card, used to direct network traffic to the correct device. Expressed in hexadecimal and separated by colons or dashes for readability, MAC addresses operate at the hardware level across Ethernet and other network protocols.
What’s Encapsulation?
Encapsulation is the process of adding headers, and sometimes trailers, to data so it can be properly addressed, sequenced, and delivered across a network. It is a foundational concept used across many networking protocols, not just Ethernet.
What’s an Ethernet Frame?
Ethernet frames carry data between network devices using a structured format that includes MAC addresses, a type field, and an error-checking trailer. Understanding this frame structure is foundational to working with wired network communication.
What’s a Collision?
Network collisions occur when two devices transmit data simultaneously, and Ethernet handles this through CSMA/CD, a protocol that detects conflicts and manages retransmission. Understanding this process is foundational to how wired networks operate.
What’s a Broadcast?
A broadcast is a network transmission addressed to all devices simultaneously, using the special destination MAC address of all Fs (FF:FF:FF:FF:FF:FF). Any frame sent to this address is forwarded out every port, and every device on the network processes it.
What’s a LAN?
A local area network (LAN) connects devices within a defined physical boundary, with a router marking the edge where local traffic—broadcasts, collisions, and related security concerns—stops before reaching the wider network. The IEEE 802 standards formally define the protocols governing how LANs communicate, though the conceptual and protocol-based definitions of a LAN don't always perfectly align.
What’s an IP Address?
IP addressing is a hierarchical system that enables data to be routed accurately across global networks by organizing addresses into manageable, delegated ranges. Unlike MAC addresses, which are fixed and only practical on local networks, IP addresses can be dynamically assigned and logically structured to support worldwide communication.
DEMO: ipconfig
IPConfig is a Windows command-line utility used to view a machine's IP address, subnet mask, default gateway, and MAC address. Running it with the /all switch returns full network adapter details including physical addresses.
What’s a Packet?
An IP packet combines a data payload with a header containing source and destination IP addresses, enabling messages to be routed across networks. Understanding packet structure is foundational to how IP-based communication works.
What’s a Router?
Routers direct IP packets across networks by examining each packet's destination IP address and determining the most efficient path forward. Unlike switches and hubs that operate at the frame level, routers function as the gateway between a local network and the broader internet.
DEMO: Ping and TraceRoute
Ping and traceroute are two command-line utilities used to test network connectivity and diagnose routing issues. Ping measures round-trip response time between two devices, while traceroute reveals each hop a packet takes across the network to reach its destination.
What’s a WAN?
A wide area network (WAN) connects multiple LANs across geographically dispersed locations, such as corporate offices, campuses, and facilities in different cities. Unlike a LAN, which handles local communication within a single site, a WAN uses routers and dedicated links to tie those sites together into one unified network infrastructure.
Packets and Frames
Packets and frames work together to move data across networks, with IP addressing handling end-to-end delivery while Ethernet frames manage local segment transmission. As data travels through routers across different network technologies, the packet stays consistent while the frame is stripped and rebuilt at each hop.
What is the Internet?
The internet is a global network of interconnected networks, built and maintained by multiple independent companies using physical infrastructure like undersea fiber optic cables and satellites. No single entity owns or fully maps it — it is a decentralized system that spans the entire planet.
What’s an Internet Service Provider (ISP)?
An Internet Service Provider (ISP) connects end users to the internet's backbone infrastructure, bridging the gap between private homes or businesses and the broader global network. The most significant cost and technical challenge in this process lies in delivering that final connection—known as the last mile—to individual locations using available infrastructure such as DSL, cable, fiber, satellite, or cellular.
Networking Review
A review of core networking concepts including protocols, ports, MAC addresses, IP addresses, and the roles of LANs and WANs in data communication.
What’s Packet Switching
Packet switching is a foundational networking concept that replaced circuit switching by breaking data into discrete packets that can travel independently across a network. This approach enables more efficient use of available bandwidth and supports the scalability modern networks require.
Data Segmentation
Data segmentation is the process of breaking large messages into smaller pieces before transmitting them across a network. This approach allows multiple devices to share network bandwidth efficiently and enables more reliable data transfers by limiting the impact of transmission errors.
DEMO: Packets and Data Segmentation
Data segmentation is the process of breaking large messages into smaller pieces before transmitting them across a network. This approach allows multiple devices to share a network connection efficiently and enables partial retransmission if errors occur during transfer.
Protocol Functions
Networking protocols are the standardized rules that govern how devices communicate and exchange data. This topic covers what protocols are, who creates them, their common functions, and how they work together to meet communication needs.
DEMO: Common Protocol Functions
Network protocols serve specific functions that make communication across systems reliable, structured, and efficient. This content covers the core functions protocols perform — including formatting, addressing, segmentation, error detection, and flow control — with real packet data examined in Wireshark to illustrate each concept.
Request for Comment (RFC)
RFCs (Requests for Comments) are the official documents that define networking protocols and standards, serving as the authoritative reference for how technologies like IPv6 are designed and implemented. Understanding RFCs allows IT professionals to verify technical information at the source and gain accurate insight into how protocols actually work.
Protocol Suites
A protocol suite is a group of protocols designed to work together, and understanding how suites like TCP/IP, AppleTalk, and others interact is essential to understanding modern network communication.
The OSI Model
The OSI model is a seven-layer framework that standardizes how network protocols interact, enabling interoperability, structured troubleshooting, and technology upgrades across different protocol suites. It provides a common reference for understanding how data is packaged, addressed, and transmitted between networked devices.
OSI Model Layers
The OSI model is a framework that defines how data travels across a network by dividing communication responsibilities into distinct layers, each with a specific role in preparing, addressing, and delivering data. From application-level protocols like HTTP to physical bit transmission over Ethernet, each layer adds or interprets information to move data reliably from source to destination.
DEMO: Legos and the OSI Model
The OSI model defines how data is packaged, addressed, and transmitted across networks — from application-layer requests down through transport, network, and data link layers to physical signals. Each layer adds or removes specific information as data moves between devices on different network segments.
TCP/IP Model
The TCP/IP model is a streamlined alternative to the OSI model that more accurately reflects how modern networking protocols are structured and used in practice. It consolidates the OSI's seven layers into four, aligning closely with contemporary technologies like HTTP and Ethernet.
DEMO: OSI Layers on Wireshark
Wireshark reveals OSI model layers within a captured network packet, showing how HTTP, TCP, IP, and Ethernet headers each contribute distinct information at their respective layers. Layer 1 data is absent from captures because NICs discard the preamble before processing begins.
What are Nodes?
Network nodes are any devices connected within a network, divided into two categories: end devices that serve as the source or destination of traffic, and intermediary devices that facilitate communication between them.
What are End Devices?
End devices are the source or destination points of network communication, including desktops, laptops, tablets, printers, phones, and video conferencing systems.
What's the Internet of Things? (IoT)
The Internet of Things (IoT) refers to everyday devices and industrial equipment that have gained network connectivity, expanding the internet beyond traditional computers. This coverage spans both home automation and large-scale industrial applications, including SCADA systems used to monitor and control physical infrastructure.
What’s Bring Your Own Device (BYOD)?
BYOD (Bring Your Own Device) is the practice of employees using personal equipment for work purposes, bringing both operational benefits and notable security challenges. Organizations are increasingly adopting BYOD policies as user demand grows and management technologies improve.
What’s a Networking Intermediary Device?
Intermediary devices are the networking components—switches, routers, firewalls, and wireless access points—that connect end devices to each other across a network. Each type of device serves a distinct role in moving data from one point to another.
What's a Network Interface Card (NIC)?
A network interface card (NIC) is the hardware component that connects a device to a network, available in wired, wireless, and server-grade form factors. Understanding NICs also means recognizing how they differ from switch ports, which interconnect devices rather than providing individual network access.
What’s a Network Repeater?
A repeater is a Layer 1 network device that receives a degraded signal and regenerates it to extend the usable distance of a network connection. It operates at the physical layer, making it one of the most fundamental components in network infrastructure.
What’s a Network Hub?
An Ethernet hub is a Layer 1 network device that connects multiple computers by broadcasting all incoming traffic out every port, creating security vulnerabilities and collision risks that led to its replacement by more advanced technology.
What’s a Network Bridge?
A network bridge reduces Ethernet collisions by dividing a network into segments and using a MAC address table to control where frames are forwarded. It operates at Layer 2, making forwarding decisions based on MAC addresses rather than broadcasting all traffic indiscriminately.
What’s a Network Switch?
Network switches are essential layer 2 devices that interconnect end devices by learning MAC addresses and forwarding traffic only to intended recipients. Understanding how switches evolved from hubs and bridges helps explain their role in modern network design.
What’s a Collision Domain?
Collision domains are network segments where data collisions can occur, defined by the devices that connect them. Hubs extend a single collision domain, while bridges, switches, and routers each create separate collision domains per port or segment.
What’s a Wireless Access Point (WAP)?
A wireless access point (WAP) is a Layer 2 network device that enables wireless clients to connect to a wired network infrastructure. Unlike a wireless router, a WAP does not perform routing functions and operates within a single collision domain.
What’s a Network Router?
Routers are Layer 3 devices that forward packets between networks by examining IP addressing information to determine the best path to a destination. Business-grade routers support multiple network interfaces and modular expansion cards, allowing them to interconnect several networks simultaneously.
Unicast, Multicast, Anycast, and Broadcasts
Unicast, multicast, anycast, and broadcast are four distinct methods for directing network traffic, each differing in how many devices receive a given transmission. Understanding these addressing types is foundational to network communication and traffic management.
What’s a Broadcast Domain?
A broadcast domain is a network segment where all devices can receive a broadcast transmission, bounded by routers that prevent broadcasts from propagating further. Understanding how to identify and count broadcast domains is a foundational skill in network design.
What’s a Gateway?
A gateway is a network device that translates between different protocols, enabling communication across dissimilar technologies. Routers, modems, voice gateways, wireless LAN controllers, and firewalls can all function as gateways depending on their role in the network.
What’s a Default Gateway?
A default gateway is the network exit point a device uses when no other specific route matches the destination, providing a path from a local network to external networks. On devices with multiple gateways, the default acts as the fallback when no better route exists.
What’s a Firewall?
A firewall is a network security device that controls inbound and outbound traffic, blocking unauthorized access while allowing legitimate communication to pass through. It serves as the primary barrier between a private network and external threats.
What’s a Layer 3 Switch?
A Layer 3 switch combines the local network connectivity of a traditional switch with the inter-network routing capabilities of a router in a single device. By using virtual routed ports internally, it enables communication between separate LANs without requiring dedicated routing hardware.
What’s a Wireless Router?
A wireless router combines the functions of a switch, router, firewall, and wireless access point into a single device designed for straightforward home network setup. Understanding the difference between a wireless router and a standalone access point is essential for avoiding common network configuration issues.
What’s a Server?
A server is best understood as a concept centered on delivering services to clients, though the term also applies to the dedicated software, operating systems, and hardware built to support that function. Physical servers are engineered for high availability, with features like dual CPUs, expanded RAM capacity, and redundant components that set them apart from standard desktop machines.
What’s a Network Topology
Network topology refers to the arrangement and interconnection of nodes within a network, typically documented through topology maps that serve as visual references for understanding and troubleshooting network infrastructure. These maps can represent physical connections, data flow, and logical routing across OSI layers 1, 2, and 3.
Types of Network Topologies
Network topology defines how devices are physically and logically interconnected, with common designs including point-to-point, bus, star, ring, tree, mesh, and hybrid configurations. Each topology carries distinct trade-offs in complexity, availability, and scalability.
Physical Connections and Dataflows
Network topology covers both the physical arrangement of devices and the logical flow of data across a network, and the two do not always match. Understanding the difference is essential for grasping how technologies like hubs, switches, and token ring actually function.
Physical and Logical Diagrams
Network diagrams come in two types—physical and logical—each representing a different aspect of how a network is structured and how data moves through it. Understanding both is essential for accurate documentation and effective troubleshooting.
Location Sizes
Network topology selection depends on the scale of the environment being served, from personal consumer setups to small offices to large enterprise organizations. Each tier comes with distinct technology requirements, cost considerations, and expectations for bandwidth and availability.
Geographic Scale
Networking protocols and technologies are classified by geographic scale, from near field communication covering inches to wide area networks spanning the globe. Understanding these distinctions—NFC, PAN, LAN, CAN, MAN, and WAN—is foundational to how modern networks are designed and categorized.
Deployment Models
Service deployment models — from bare metal to virtualization, containerization, serverless, and cloud — directly shape how networks are designed and managed. Understanding these models is essential for building infrastructure that is secure, scalable, and reliable.
Service Models
Cloud service models—IaaS, PaaS, and SaaS—define how infrastructure responsibilities are divided between an organization and a cloud provider. Understanding these models is foundational to navigating the shared responsibility model in modern IT environments.
Layer 1 Basics
The OSI model's physical layer defines how raw bits travel between devices through three core components: physical media, encoding, and signaling. This coverage explains each component and surveys the Ethernet and wireless standards that govern Layer 1 implementations.
DEMO: Wireshark, What’s With These Bits
Wireshark is used to capture and inspect live network traffic at the bit level, demonstrating how ARP requests work to resolve IP addresses to MAC addresses on a local network.
Bandwidth & Connection Statistics
This content covers the foundational concepts of bandwidth measurement, clarifying the difference between bits and bytes, and introduces the key metrics used to evaluate network connection quality, including throughput, goodput, latency, jitter, and bursting.
DEMO: Measuring Connection Statistics
Network performance extends beyond bandwidth to include latency, jitter, packet loss, and uptime — all critical metrics for assessing connection quality. Understanding how to measure and interpret each gives network professionals a complete picture of connectivity health.
Copper Cables
Copper cabling transmits data by varying or switching electrical current through a conductor, and remains a foundational medium in network infrastructure due to its low cost and ease of installation. This content covers how copper works, its key advantages and limitations, and the techniques used to mitigate signal degradation and interference.
Copper Coaxial Cables
Coaxial cable is built from a layered structure — center conductor, dielectric insulator, foil shield, braided shield, and outer jacket — designed to carry data while blocking electromagnetic interference. Common coaxial standards include RG6, RG11, and RG59, with F-type and BNC connectors among the most widely used termination options.
Copper Twisted Pair
Twisted pair cabling consists of eight color-coded conductors grouped into four pairs, available in shielded and unshielded variants, and most commonly terminated with an RJ45 connector.
Ethernet Cables
Ethernet cabling fundamentals covering twisted pair cable categories, internal pair structure, RJ45 connector pin-out standards, and the differences between straight-through, crossover, and rollover cable configurations.
Crossover Cables
Ethernet crossover cables are required when connecting like devices—such as PC to PC or router to router—because MDI interfaces share the same transmit and receive pin assignments and need the cable to swap them. Straight-through cables work for MDI-to-MDIX connections, such as a computer or router plugging into a switch.
DEMO: How to assemble RJ45 ends
A hands-on walkthrough of terminating Ethernet cable with RJ45 connectors, covering required tools, wire pair sequencing, and cable testing. Builds the practical skills needed to create reliable straight-through and crossover patch cables.
Fiber
Fiber optic cabling transmits data as pulses of laser light through a thin glass or plastic core, enabling high-speed connections over long distances with minimal signal loss and no susceptibility to electromagnetic interference. This content covers how fiber optics work, their advantages and disadvantages compared to copper, common deployment scenarios, and the differences between multimode and single-mode cable types.
Fiber Connectors
Fiber optic connectors—including the LC, ST, and SC types—require extremely precise alignment to function correctly, making them far less forgiving than standard copper Ethernet connectors.
Wavelength Division Multiplexer (WDM)
Wavelength division multiplexing (WDM) allows multiple data channels to travel simultaneously over a single fiber optic cable by using different light wavelengths. This content covers bidirectional WDM, coarse WDM, and dense WDM, including how they differ in channel capacity, cost, and typical deployment distance.
Small Form-Factor Pluggable (SFP)
Transceivers, commonly known as SFPs or Small Form Factor Pluggables, are modular units that slide into network switches to extend connectivity options across both copper and fiber media. Multiple standards exist, including SFP, SFP+, QSFP, and QSFP+, and these connections typically deliver faster throughput than standard RJ45 copper interfaces.
Waves
A foundational look at wave physics—covering frequency, amplitude, and the electromagnetic spectrum—and how these principles underlie wireless data transmission. Essential groundwork for understanding how Wi-Fi and radio technologies function.
Wireless
Wireless networking relies on amplitude and frequency modulation to transmit data through the air, offering broad coverage and easy deployment alongside real trade-offs in security, interference, and shared-medium performance. This content covers how wireless works, its advantages and disadvantages, key equipment distinctions, and the major standards in use today.
Frequencies and Channels
Wi-Fi channels, frequency bands, and the key differences between 2.4 GHz and 5 GHz wireless networking are explained, covering why only three non-overlapping channels exist in the 2.4 GHz range and how that shapes real-world network design.
Cable Management
This topic covers the physical infrastructure of network installations, including cable management, network room design, and how devices connect through structured cabling systems.
Layer 2 Basics
Layer 2 of the OSI model — the data link layer — governs how data frames are addressed and transmitted within a local area network, covering key protocols such as Ethernet, wireless LAN, and point-to-point protocol. This content explores LAN fundamentals, layer 2 addressing, the relationship between OSI layers 1, 2, and 3, and the IEEE 802 standards framework.
Half Duplex vs Full Duplex
Half duplex and full duplex define whether data can travel in both directions simultaneously across a network connection. Hubs enforce half duplex communication, while switches support full duplex, allowing multiple devices to send and receive at the same time.
Collisions and Access Control
Half-duplex network environments require media access control methods to prevent or manage collisions when multiple devices attempt to communicate simultaneously. Controlled access and contention-based access represent the two primary approaches to this problem.
Carrier Sense Multiple Access (CSMA)
CSMA (Carrier Sense Multiple Access) is a network access protocol that prevents data collisions by requiring devices to listen before transmitting. It operates in two variants—CSMA/CD for wired Ethernet and CSMA/CA for wireless networks—each using different strategies to manage simultaneous transmission attempts.
Ethernet
Ethernet is a Layer 2 protocol operating across the physical and data link layers of the OSI model, and it remains the dominant wired networking technology in homes and enterprise environments. This coverage examines its IEEE standards, sublayer architecture, and the role MAC addresses play in frame-level communication.
MAC Addresses
MAC addresses are six-octet hardware identifiers used to direct Ethernet frames between devices on a local network. They are represented in hexadecimal notation and divided into two parts: the Organizationally Unique Identifier (OUI) assigned to the manufacturer, and the device-specific portion managed by that manufacturer.
DEMO: Mac Address Vendor Lookup
MAC addresses contain an embedded vendor identifier that can be looked up using free online tools to reveal the manufacturer of any network interface card. This demonstration shows how to retrieve MAC addresses from a Windows machine and trace them back to their hardware vendors.
Ethernet Header & Trailer
An Ethernet frame is the Layer 2 data unit responsible for moving information across a network, structured with a header, payload, and trailer that together ensure accurate delivery between devices. Its key fields include destination and source MAC addresses, an optional VLAN tag, a type or length indicator, and a Frame Check Sequence that validates data integrity on arrival.
DEMO: Ethernet Frame (Wireshark)
Wireshark is used to capture and inspect live network traffic, revealing the internal structure of Ethernet frames including Layer 2 headers, source and destination MAC addresses, and upper-layer protocol information.
Ethernet at Layer 1
The Ethernet packet adds a preamble and start frame delimiter to the Ethernet frame before transmission, handling clock synchronization and signaling between devices at the physical layer. The packet also defines an interpacket gap that network cards must observe before sending the next frame.
Maximum Transmission Unit (MTU)
Maximum Transmission Unit (MTU) defines the largest frame size allowed on a network, with standard Ethernet capped at 1,522 bytes total and a usable payload of 1,500 bytes. This limit prevents devices from overwhelming network hardware by sending arbitrarily large frames.
Switches
Ethernet switches improve on hubs by directing frames only to their intended destination based on MAC addresses, increasing both security and network efficiency. This content covers how switches reduce collision domains and how to configure duplex and speed settings for different network environments.
MAC Address Tables
Network switches build and maintain a MAC address table—also called a CAM table—to intelligently forward frames to the correct port based on destination MAC addresses. This table is dynamically updated as frames pass through the switch and ages out stale entries to keep up with changing network conditions.
DEMO: Mac Address Table
A MAC address table on a network switch maps each device's MAC address to the physical port it occupies, which is distinct from ARP, which maps IP addresses to MAC addresses. This demonstration walks through reading a live switch MAC address table and verifying an entry using the ipconfig /all command.
Buffering
Network switches use buffering to temporarily store incoming frames before forwarding them to the correct port, and they support multiple switching methods that balance speed against error checking. Understanding port-based versus shared memory buffering, along with store-and-forward and cut-through switching modes, is essential for grasping how modern switches handle frame traffic efficiently.
Address Resolution Protocol (ARP)
Address Resolution Protocol (ARP) is the mechanism that allows networked devices to discover the MAC address associated with a known IP address, enabling communication at the Ethernet layer. Understanding ARP is foundational to how frames are built and delivered across local area networks.
DEMO: ARP Requests (Wireshark)
ARP requests and replies are captured live in Wireshark to show how devices broadcast MAC address lookups across a network and receive direct unicast responses. Real traffic from two connected machines confirms how the ARP process resolves IP addresses to MAC addresses at the packet level.
ARP Table
The ARP table is a local cache that stores mappings between IP addresses and MAC addresses, eliminating the need to broadcast an ARP request every time a device communicates on a network. Entries in this table expire over time to account for changes in dynamic network environments.
DEMO: ARP Tables
The ARP table maps IP addresses to MAC addresses so devices on a local network can communicate at the hardware level. This content demonstrates how to view, interpret, and clear the ARP table using Windows command prompt tools.
ARP Table vs MAC Address Table
ARP tables and MAC address tables both involve MAC addresses but serve distinct purposes — ARP tables map IP addresses to MAC addresses on end devices, while MAC address tables map port numbers to MAC addresses on switches.
MAC Address Types
Network communication relies on four MAC address types — unicast, broadcast, multicast, and anycast — each determining how frames are delivered across a network. Understanding how switches handle each address type is fundamental to layer 2 networking.
Multicast MAC Addresses
Multicast MAC addresses follow a specific format beginning with 01:00:5E, with a fixed structure that directly maps the last 23 bits to the corresponding multicast IP address.
Layer 2 and Default Gateways
When a device needs to communicate outside its local network, it relies on a default gateway — typically the edge router — to forward traffic beyond the LAN. ARP resolves the gateway's MAC address so the device can properly frame and send packets to it.
Advanced Switching Concepts
Advanced switching features including Power over Ethernet, VLANs, port mirroring, port security, Spanning Tree Protocol, and jumbo frames give network administrators precise control over power delivery, traffic segmentation, monitoring, and performance. These capabilities form the foundation of modern enterprise network design.
Wireless
Wireless LANs operate at Layer 2 using access points that function similarly to hubs, introducing collision management, network identification, and encryption as core considerations. This content covers CSMA/CA, SSIDs, and the critical need to secure wireless traffic against interception.
DEMO: Wireless
Windows laptops allow users to view available wireless networks, configure Wi-Fi security settings, and manually add connections to networks that do not broadcast their SSID. This content covers the key options found in the Windows wireless configuration interface, including security protocol selection and automatic connection behavior.
What is IP Addressing
IP addresses are logical identifiers assigned to network devices that enable traffic to be routed between sources and destinations across interconnected networks. This content covers address structure, packet headers, hierarchical addressing, and the organizations responsible for IP address allocation.
IP Address History
The evolution of IPv4 addressing traces a path from the 256-network limit of RFC 760 through classful addressing, subnetting, VLSM, and private addressing, leading ultimately to the 128-bit address space of IPv6. Understanding this progression explains why subnetting exists and how modern IP addressing schemes are structured.
IPv4 Classful Addresses
Classful addressing is the original IPv4 address classification system defined in RFC 791, dividing the IP address space into five classes—A through E—based on leading bit patterns. Understanding these classes and their network and host ranges is foundational knowledge for subnetting and broader IPv4 networking.
IPv4 Addresses
IPv4 addresses are 32-bit numerical identifiers written in dotted-decimal notation, divided into network and host portions defined by subnet masks. This content covers address structure, address classes, subnet mask values, and the roles of network, host, and broadcast addresses.
IPv4 Unique Networks and Addresses
IPv4 includes several reserved address ranges with specific purposes that affect how networks are designed and managed. Understanding these ranges — including private, loopback, and link-local addresses — is essential for proper network configuration and troubleshooting.
IPv6 Addresses
IPv6 is the next-generation internet addressing protocol, offering a vastly expanded address space of 2^128 compared to IPv4's 2^32, along with improved efficiency and built-in security capabilities.
DEMO: IPv6 Addresses
IPv6 addressing on Windows involves multiple address types—link-local, global unicast, and temporary—each serving a distinct role in local and internet communication. This demonstration uses ipconfig to explore how a Windows machine automatically generates and manages these addresses.
IPv6 Address Format
IPv6 uses 128-bit addresses divided into eight 16-bit segments called hextets, represented in hexadecimal and separated by colons. This content covers IPv6 address structure, prefix length and subnetting, and shorthand notation rules for simplifying these addresses.
IPv6 Address Types
IPv6 eliminates broadcast traffic in favor of three address types—unicast, multicast, and anycast—each serving distinct communication patterns across local and global networks. This content also covers special address categories including link-local, unique local, and global unicast ranges, along with reserved addresses for the default route, unspecified state, and loopback.
Layer 3 Basics
Layer 3 of the OSI model, the Network Layer, governs how data packets are addressed and routed across interconnected networks using protocols such as IPv4, IPv6, and ICMP. It forms the foundation of internet communication, enabling data to travel between geographically distant locations through packet switching and dynamic routing.
IPv4 Packet Header
The IPv4 packet header is a structured 20-byte field containing version, addressing, fragmentation, and error-checking data that network devices use to route and validate traffic. Each field serves a specific function in ensuring packets are correctly identified, prioritized, and delivered across Layer 3 networks.
DEMO: IPv4 Header
This content covers how to capture and analyze live network traffic in Wireshark to examine the fields of an IPv4 packet header in real time. It walks through filtering captured packets by IP address and mapping each header field to its binary and hexadecimal representation.
IPv6 Packet Headers
The IPv6 header uses a fixed 40-byte structure with fewer fields than IPv4, making it more efficient to process at each network hop. Key differences include the removal of checksums and fragmentation support, the addition of a flow label field, and 128-bit source and destination addresses.
Routers
Routers are network devices responsible for forwarding packets toward their destination by determining the best path at each step along the way. Each router in the path examines the destination IP address and decides the next hop until the packet reaches its target.
DEMO: Routing Table
Routers use routing tables to determine the best next hop for each packet based on its destination IP address, forwarding traffic hop by hop until it reaches its target network. This content examines how routing tables work and demonstrates how to view them on both a Windows machine and a Layer 3 switch.
DEMO: Routes
Routing tables store the routes a router uses to forward packets toward their destination, identifying each path by a next-hop IP address or exit interface. This content examines what routing table entries contain and demonstrates how to read them on both a Windows host and a Cisco router.
Types of Destination Networks
Routing tables map destination networks to their next-hop addresses, organizing entries into three categories: directly connected networks, remote networks, and the router's own local interface. Understanding these distinctions is foundational to how routers make forwarding decisions.
Default Route
A default route provides a fallback path for network traffic when a router has no specific routing table entry matching a destination address, forwarding packets to a designated next-hop router instead of dropping them.
Longest Match
Routers use a longest match algorithm to select the best route from a routing table, choosing the entry whose network address shares the most bits with the destination IP address. This process ensures packets are forwarded along the most specific matching path available.
Route Learning
Routers populate their routing tables through three methods: connected interface routes, manually configured static routes, and dynamically learned routes via routing protocols. This content covers how each method works and when to use it.
DEMO: Routing Tables
Routing tables are structured records that tell a router or host device how to forward traffic based on destination networks, next-hop addresses, and exit interfaces. This content covers how to read both a router routing table and a Windows host routing table, including static routes, directly connected networks, and dynamically learned routes.
Routing Process
Routers forward packets by stripping incoming Layer 2 frames, consulting the routing table for the best next hop, decrementing the TTL, recalculating the IP header checksum, and building a new Layer 2 frame before transmitting the packet to the next hop.
Dynamic Routing Protocols
Dynamic routing protocols enable routers to automatically discover and share network routes, eliminating the need for manual static configuration. This overview covers the two primary protocol types — distance vector and link state — including how each calculates paths, shares routing information, and reaches convergence.
Layer 2 and Layer 3 Walk-through
A practical walkthrough of how data travels across networks, tracing the full journey of a packet from a source machine to a remote server across Layer 2 and Layer 3. Covers ARP, MAC addressing, IP routing, and frame construction in sequence.
DEMO: L2 vs L3 Addresses (Wireshark)
Wireshark packet captures reveal how Layer 2 MAC addresses and Layer 3 IP addresses serve distinct roles in network communication, with each operating at a different scope during data transmission. A practical, live capture demonstrates how destination addresses differ at each layer and why that distinction matters for routing traffic across networks.
Layer 4 Basics
Layer 4 of the OSI model, known as the Transport Layer, governs how data is segmented, addressed through ports, and delivered between devices using either TCP or UDP. TCP prioritizes reliability through connection establishment, sequencing, and error recovery, while UDP prioritizes speed with minimal overhead.
Ports
Network ports operate at Layer 4 of the OSI model and serve as the mechanism that directs traffic to specific services running on a host. This content covers port definitions, port group classifications, security considerations, sockets, and ephemeral ports.
DEMO: PC Connections
Learn how to use the netstat command on Windows to view active TCP connections, including local addresses, remote endpoints, ports, and connection states.
DEMO: Wireshark, Ports
Wireshark is used to capture and analyze web traffic on a Windows machine, with a focus on identifying the TCP ports involved in an HTTP connection between two networked devices.
DEMO: Wireshark, Ephemeral Ports
Ephemeral ports are temporary source ports assigned by a client machine to manage individual TCP connections with remote hosts. This topic covers how browsers assign, reuse, and create new ephemeral ports depending on the application and connection context.
Common Port Associations
A working knowledge of common network port assignments is essential for IT and cybersecurity professionals, both for certification exams and day-to-day troubleshooting. This content covers well-known, registered, and ephemeral port ranges alongside the protocols most frequently encountered on the job.
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable data delivery through sequencing, acknowledgements, retransmission, and flow control. This content covers how TCP establishes connections, segments and reassembles data, and manages congestion, along with an introduction to the TCP header.
TCP Header
TCP headers define how segments are structured and managed at the transport layer, encoding critical connection data including port numbers, sequence and acknowledgment numbers, control flags, window size, and error-checking fields. Understanding each field reveals the mechanics behind reliable TCP communication.
DEMO: Wireshark, TCP Header
A practical walkthrough of TCP header fields as seen in Wireshark, using a captured HTTP request to identify and explain each component of a real packet.
TCP Reliability & Sequencing
TCP sequencing and reliability mechanisms ensure data is transmitted in order and retransmitted when lost, using sequence numbers and acknowledgements embedded in the TCP header. Each byte of data is numbered sequentially, allowing the receiving device to reassemble segments correctly and request any missing data.
DEMO: Wireshark, TCP Sequencing
Wireshark is used to examine TCP sequence and acknowledgment numbers in a live packet capture, showing how sequence values increment based on payload size and how acknowledgments confirm successful delivery.
TCP Connections
TCP is a connection-oriented protocol that uses a structured three-way handshake to establish communication and a four-step process to terminate it. This content covers the full lifecycle of a TCP connection, including the role of SYN, ACK, and FIN flags along with sequence and acknowledgment numbers.
DEMO: Wireshark, TCP Connections
TCP connection establishment and termination are examined through a live Wireshark packet capture, tracing the three-way handshake, data transfer, and four-step connection teardown between two networked devices.
Congestion & Flow Control
TCP's congestion and flow control mechanisms regulate how data moves across a network, preventing bottlenecks and packet loss by using acknowledgements and dynamic window sizing. These built-in features allow two devices to communicate at optimized speeds without overwhelming either side of the connection.
UDP
UDP is a connectionless transport protocol that prioritizes speed over reliability, making it well-suited for real-time applications like VoIP, video conferencing, and media streaming. Unlike TCP, UDP does not establish connections, sequence data, or retransmit lost packets.
Application Layer Basics
The application layer operates at the top of both the OSI and TCP/IP models, serving as the interface through which network protocols like DHCP, DNS, HTTP, and email deliver services to end users and applications. This content covers how those protocols function, how client-server and peer-to-peer architectures differ, and how URLs and domain name resolution fit into the process.
DHCP
DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and other essential network configuration—such as subnet masks, default gateways, and DNS servers—to devices when they connect to a network. It eliminates the need to manually configure each device, making it the standard approach for network address management in modern environments.
DHCP Process
DHCP is the protocol that automatically assigns IP addresses to devices when they join a network, using a four-step process known as Discover, Offer, Request, and Acknowledge. Understanding how each step works at the packet level — including MAC addresses, IP addresses, and UDP ports — is essential for network administration and troubleshooting.
DHCP Continued
DHCP scope configuration controls which IP addresses a server can assign to network clients, while lease time settings determine how long those assignments remain valid before being recycled. This content also covers IP address conflict prevention, link-local addressing, and a comparison of IPv4 and IPv6 auto-configuration methods.
DEMO: Setting Up DHCP Server on Pi
A Raspberry Pi is configured as a fully functional DHCP server using the ISC-DHCP-server package, covering installation, lease time settings, subnet configuration, and interface binding. The setup is verified end-to-end by confirming a Windows client successfully receives an IP address from the defined pool.
DEMO: Setting Up DHCPv6 Server on Pi
A Raspberry Pi is configured as a DHCPv6 server by editing the ISC DHCP server configuration files and defining an IPv6 address scope, then verified by successfully leasing an address to a client machine.
DEMO: DHCP, Wireshark
A live Wireshark capture demonstrates the complete DHCPv4 four-step handshake and DHCPv6 exchange, showing exactly how IP address assignment works at the packet level.
DNS
DNS (Domain Name System) is a foundational internet protocol that translates human-readable domain names into IP addresses, making it possible to reach networked resources without memorizing numerical addresses. This content covers how DNS name resolution works, domain name structure, common record types, and how to query DNS using the nslookup command.
DNS Process
DNS name resolution is the process of translating a fully qualified domain name into an IP address through a hierarchical chain of servers. Starting with the local hosts file, a query travels through root servers, top-level domain servers, and authoritative name servers until the correct IP address is returned.
DNS Caching
DNS caching stores resolved domain-to-IP mappings locally so clients can skip the full lookup process on repeat visits. Time-to-live (TTL) values control how long those cached records remain valid before a fresh lookup is required.
DNS Continued
Internal DNS architecture combines split-horizon zone configuration with recursive forwarding, enabling organizations to resolve private resources locally while routing external queries through upstream servers. Key DNS record types — including A, AAAA, NS, SOA, MX, CNAME, and PTR — each serve a distinct role in the overall name resolution process.
DEMO: NSlookup
NSLookup is a command-line tool used to verify DNS resolution by returning the IP addresses associated with a domain name. MX Toolbox extends DNS testing through a web interface, supporting lookups for MX, A, AAAA, SPF records, and blacklist checks.
Internet and the World Wide Web
This content covers the foundational technologies behind the internet and web, including URIs, URLs, HTML, HTTP methods, status codes, and HTTPS with certificates.
HTTPS
HTTPS is the secure version of HTTP that runs on TCP port 443 and uses public key cryptography and digital certificates to encrypt web traffic and verify server identity. It protects users from interception and phishing attacks even on sites that don't handle sensitive data.
DEMO: Web Protocols, Wireshark
Wireshark is used to capture and analyze live HTTP traffic, revealing the full request-response cycle between a client and a web server at the packet level. Key elements examined include the TCP three-way handshake, HTTP GET requests, response codes, and raw payload data.
Email Protocols
Email delivery depends on a coordinated set of protocols and DNS records working together to route messages from sender to recipient. This content covers SMTP, POP3, IMAP, webmail access, and SPF records, along with the DNS infrastructure that makes email routing possible.
File Sharing Protocols
This content covers the key protocols used for sharing and transmitting files across networks, including HTTP/HTTPS, FTP and its variants, NFS, and SMB/CIFS. Each protocol is examined in terms of its practical use cases, port assignments, and relative security.
DEMO: Setting up FTP Server on Pi
A practical walkthrough of installing and configuring a vsftpd FTP server on a Raspberry Pi, including package installation, configuration file editing, directory setup, and service management.
DEMO: FTP, Wireshark
Wireshark packet capture reveals how FTP transmits credentials and file data entirely in cleartext, exposing usernames, passwords, and file contents to anyone monitoring the network. The demonstration also shows how FTP separates control traffic on port 21 from data transfers, which use port 20 or dynamically assigned ephemeral ports.
Troubleshooting Steps
Network troubleshooting requires a structured, methodical approach to avoid compounding problems and restore connectivity as quickly as possible. This content covers a proven step-by-step process — from defining the problem and gathering information to testing theories, implementing a fix, verifying results, and documenting findings.
Documentation
Network documentation is a foundational IT practice that supports troubleshooting, incident response, device replacement, and knowledge continuity across teams. This content covers the case for documentation, common document types, practical guidelines, and a step-by-step approach to implementation.
Common Layer 1 Issues
This content covers common Layer 1 network problems, their root causes, and key cabling considerations for maintaining reliable network infrastructure. Topics include connectivity failures, intermittent issues, hardware faults, and configuration errors.
Common Issues
Common networking problems across OSI layers 2 through 7 can degrade or completely halt network communication when left undiagnosed. Understanding these failure points is essential for effective network troubleshooting.
Common Troubleshooting Tools
A practical overview of the physical tools used in network installation, testing, and troubleshooting, covering everything from cable crimpers and punchdown tools to toners, multimeters, loopback adapters, and network taps.
DEMO: Windows Command Line Tools
Essential Windows command line tools for network troubleshooting are demonstrated in practice, covering ping, ipconfig, nslookup, tracert, arp, netstat, route print, hostname, and Telnet. Each tool is shown in context with a clear explanation of what it reveals and when to use it.
DEMO: Linux Command Line Tools
Essential Linux and Raspberry Pi command line tools for network troubleshooting are covered, including ping, ifconfig, ip, dig, traceroute, arp, netstat, hostname, and route. Each command is demonstrated with practical examples showing how to test connectivity, query DNS, inspect interfaces, and examine routing tables.
DEMO: Switch Command Line Tools
Common network diagnostic commands like ping, traceroute, telnet, and show are demonstrated on a Cisco Catalyst switch running IOS, highlighting how familiar tools translate to a managed switch environment.
ICMP Basics
ICMP (Internet Control Message Protocol) is a Layer 3 protocol used to communicate status and error information about IP packet delivery across both IPv4 and IPv6 networks. Core tools built on ICMP include ping, traceroute, and Neighbor Discovery Protocol.
DEMO: Ping
Ping is a fundamental command-line tool used to test network connectivity at multiple levels, from the local interface to external servers. This content covers how to use ping systematically to isolate network issues and introduces key options like continuous pinging.
DEMO: Tracert
Traceroute is a network diagnostic tool that maps the path data takes to reach a destination, revealing each hop along the route and the latency at each point. Understanding how to read traceroute output helps identify where delays or bottlenecks exist within a network path.
Monitoring & Troubleshooting Software
Network troubleshooting extends beyond the command line to include dedicated software tools and monitoring services that provide deeper visibility into network performance and health. This content covers protocol analyzers, port scanners, bandwidth testers, and monitoring technologies such as SNMP, NetFlow, and log aggregation.
DEMO: Testing Bandwidth
Network connection speed testing covers how to measure download speed, upload speed, and latency using browser-based tools and dedicated applications. Both Google's built-in speed test and speedtest.net serve as practical options for diagnosing connectivity performance.
What is Security
Security is more than just protecting networks and devices — it encompasses the full scope of keeping an organization free from danger or threat. This content covers the CIA triad, common threat sources, and the real business impact of security failures.
Key Security Concepts
Core security concepts—assets, threats, threat agents, vulnerabilities, exploits, exposure, and risk—form the foundation of any effective cybersecurity strategy. Understanding how these terms relate to one another is essential for assessing and reducing organizational risk.
Vulnerabilities
Vulnerabilities in IT systems fall into three categories—technological, configuration, and security policy weaknesses—each capable of exposing critical assets to threats. Understanding how vulnerabilities emerge and progress through their life cycle, from zero-day discovery to CVE publication and patching, is essential for managing risk effectively.
Threat Agents
Threat agents range from novice script kiddies to state-sponsored operatives, each bringing different intentions, attack methods, and skill levels to the networks they target. Understanding who these actors are, how they gain access, and what they're after is foundational to building an effective cybersecurity defense.
Social Engineering Techniques
Social engineering attacks exploit predictable human behavior to manipulate people into revealing sensitive information or granting unauthorized access. This content covers how attackers use email, text messaging, and in-person tactics to compromise individuals and organizations.
Risk Management
A strong security program requires consistent policies, frameworks, and risk management practices to protect an organization from threats that individual employees often underestimate or overlook. This content covers how to build that program, select a security framework, and apply structured strategies to assess and respond to risk.
Basic Security Principles
Core security principles—network segmentation, AAA, least privilege, role-based access control, separation of duties, monitoring, backups, encryption, patching, and equipment hardening—form the foundation of a defensible IT environment.
Common Networking Vulnerabilities
A broad survey of common network attack types, including denial of service, malware, spoofing, and on-path attacks, with explanations of how each technique works against network infrastructure.
Hardening Techniques
Network device hardening requires a consistent set of practices including patch management, eliminating default credentials, disabling unnecessary services and switch ports, and applying control plane policing. These techniques reduce the attack surface across every layer of a network environment.
Passwords
A comprehensive look at password security covering how attackers crack credentials, what makes a strong password, and how multi-factor authentication protects accounts. Covers both individual password habits and organizational enforcement policies.
Remote access
Remote access fundamentals covering VPNs, site-to-site and client-to-site configurations, tunneling protocols, and remote connection technologies used to securely link distributed users and networks. Covers IPSec, SSL/TLS, split tunneling, RDP, VNC, SSH, and virtual desktops.
Firewalls and ACLs
Firewalls and access control lists (ACLs) are foundational tools for controlling which traffic enters and exits a network. This content covers how firewalls filter traffic by IP address, port, URL, and stateful inspection, and how ACLs are structured and applied to enforce granular network access policies.
Wireless Security
Wireless networks broadcast traffic openly through the air, making them vulnerable to interception and unauthorized access. This content covers the core strategies for securing wireless environments, including signal management, authentication methods, encryption standards, and network isolation techniques.
The 5 Pillars of Information Security
Information security is a critical business priority, driven by rising cybercrime, tightening regulations, and growing customer expectations. This content covers the five pillars of information security — confidentiality, integrity, availability, authenticity, and non-repudiation — and the real-world consequences of failing to protect sensitive data.
Why Encrypt Data
Encryption protects data confidentiality but requires processing overhead, making it essential to understand where and at what level to apply it. This covers encryption at rest, in process, and in transit, including common implementation options and the performance trade-offs involved.
Why PKI and Digital Certificates
Public Key Infrastructure (PKI) uses digital certificates and trusted third parties to establish authenticity and encrypt communications across public networks. RSA asymmetric encryption underpins this system, enabling secure key exchange and identity verification between users and servers.
What is Cryptography
Cryptography is the practice of concealing information through encoding, and it has been a cornerstone of secure communication for thousands of years. This content covers the foundational vocabulary and core techniques that underpin modern cryptographic systems.
Cryptography Keys
Cryptographic key length is a primary factor in encryption strength, with longer keys exponentially increasing the number of possible combinations an attacker must try. Modern standards like AES use 128-, 192-, or 256-bit keys, while the one-time pad remains the only theoretically unbreakable encryption method.
Modern Cryptography
Modern cryptography supports the core principles of cybersecurity — confidentiality, integrity, availability, authenticity, and non-repudiation — through algorithms, protocols, and encryption methods. This coverage introduces how cryptographic systems are structured and why they matter in protecting data.
Hashing
Hashing algorithms are a foundational cryptographic tool used to verify data integrity, authenticate users, and ensure non-repudiation by converting input data into a fixed-length, one-way fingerprint. This content covers how hashes work, what makes a hash algorithm secure, and where hashing is applied in real-world systems.
DEMO: Hashing in Windows
File hashing on Windows can be performed using the built-in CertUtil command-line utility, which generates cryptographic hash values for any file using algorithms such as MD5 or MD2.
Salt, Pepper, Key-Stretching
Salting, peppering, and key stretching are cryptographic techniques used to strengthen password storage and defend against common hash-cracking methods such as rainbow table lookups and brute-force attacks.
Symmetric and Asymmetric Encryption
Symmetric encryption uses the same key to encrypt and decrypt data, while asymmetric encryption uses a mathematically linked public and private key pair. Understanding the differences between these two approaches is essential for selecting the right cryptographic method for any given use case.
Symmetric Encryption
Symmetric encryption relies on a shared key for both encryption and decryption, with block and stream ciphers representing the two primary approaches to processing data. This content covers the mechanics of each cipher type, key historical standards like DES and Triple DES, and the architecture of AES, the current encryption standard.
Public-Key Cryptography
Public key cryptography enables secure communication between parties that have never shared a key, using asymmetric key pairs to protect data in transit. Diffie-Hellman and RSA are the two dominant ciphers in this space, each solving the problem through a fundamentally different approach.
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) is the framework of standards, processes, servers, and applications used to manage digital certificates that verify the authenticity and security of encrypted communications. It underpins trusted connections across websites, applications, email, VPNs, and more.
Trust Models
Trust models define how devices and systems verify and extend confidence to one another across a network, covering direct trust, third-party trust, hierarchy trust, web of trust, and how these frameworks underpin zero trust architecture.
Certificate Hierarchy
Public Key Infrastructure uses certificate hierarchies to establish chain-of-trust verification, connecting root certificates through intermediate certificates down to end-entity certificates used by websites and services. This process allows clients to cryptographically verify that they are communicating with a legitimate, trusted source.
DEMO: Digital Certificates
Digital certificates and certificate hierarchies come to life through a browser-based walkthrough of a real-world SSL certificate chain, from end-entity certificate to intermediate CA to root certificate. The demonstration also covers how root certificates are pre-installed on operating systems and managed through tools like Certificate Manager.
Digital Certificates
Digital certificates go beyond basic public key infrastructure, supporting wildcard and self-signed configurations while requiring careful lifecycle management including expiration tracking and revocation mechanisms.
Revoking Certificates
Certificate revocation is the process of invalidating a digital certificate when its associated private key has been compromised. The two primary mechanisms for checking revocation status are the Certificate Revocation List (CRL) and the Online Certificate Status Protocol (OCSP).
Transport Layer Security (TLS)
Transport Layer Security (TLS) is the protocol behind secure web browsing, email, file transfers, and streaming, providing authentication, confidentiality, and integrity for data in transit. It evolved from SSL and exists in multiple versions, with TLS 1.2 and 1.3 being the current standards in widespread use.
TLS Record Protocol
The TLS Record Protocol is the core component of TLS responsible for encrypting and integrity-checking data as it moves between devices. It operates within the application layer of a network packet and handles the bulk of secured data transmission.
Cipher Suites
Cipher suites are preconfigured sets of cryptographic parameters that allow two devices to negotiate a common method for securing communications. They define the algorithms used for encryption, key exchange, authentication, and data integrity.
TLS Handshake Protocol
The TLS handshake protocol establishes the cryptographic parameters, key exchange, and authentication required before secure communication can begin. This content covers how TLS 1.2 and TLS 1.3 handle that process, with particular focus on the improvements TLS 1.3 brings in speed and earlier encryption.
Applied Cryptography
Cryptographic tools like hashing, symmetric and asymmetric encryption, and public key infrastructure are applied in combination across real-world protocols and technologies to establish secure communications. This content covers how those building blocks come together in TLS, VPN tunnels, and other widely used security protocols.
Using Digital Signatures
Digital signatures use hashing and public key cryptography to verify both the integrity and authenticity of messages and legal documents. Public key infrastructure (PKI) supports this process by validating the digital certificates that carry the signer's public key.
Code Signing
Code signing uses public key infrastructure and digital certificates to verify the authenticity and integrity of software before it is installed or executed. Timestamping extends that trust by confirming a signature was valid at the time it was applied, even after the underlying certificate has expired.
Blockchain
Blockchain is a cryptographic data structure that links blocks of information using hashes, creating a tamper-evident chain that preserves data integrity across decentralized systems. It underpins technologies like cryptocurrency, smart contracts, and supply chain tracking.
Key Escrow
Key escrow is the practice of entrusting cryptographic keys to a secure third-party holder so they remain accessible and protected under defined conditions. It applies both to legal agreements between organizations and to technical solutions like centralized key storage for encrypted systems.
Cryptographic Attacks
Cryptographic systems carry their own risks, including weak ciphers, misconfigured implementations, compromised keys, and protocol downgrade attacks. This content also addresses long-term threats to encrypted data, including the growing implications of quantum computing.
Cybersecurity - What is Cybersecurity
Cybersecurity covers the protection of networks, devices, and data from unauthorized access, guided by the principles of confidentiality, integrity, and availability. While definitions vary across sources, the field centers on securing technology and the information that depends on it.
Cybersecurity - The CIA Triad
The CIA Triad is a foundational cybersecurity model built on three principles: confidentiality, integrity, and availability. It provides a framework for evaluating and protecting any technology, system, or service an organization operates.
Cybersecurity - The 5 Pillars of Cybersecurity
The five pillars of cybersecurity expands on the CIA triad by adding authenticity and non-repudiation, providing a more complete framework for evaluating an organization's security posture.
Cybersecurity - Cyber Incident Impact
Cybersecurity incidents carry serious organizational consequences, including revenue loss, regulatory fines, reputational damage, and business failure. Understanding these impacts reinforces why protecting the CIA Triad—confidentiality, integrity, and availability—is critical to organizational survival.
Cybersecurity - Key Cybersecurity Concepts
Foundational cybersecurity concepts including assets, threats, vulnerabilities, risk, and defense in depth form the shared vocabulary used across the security industry. This content defines each term and explains how they relate to one another in practice.
Cybersecurity - Cybersecurity Cube
The Cybersecurity Cube expands the CIA Triad into a three-dimensional framework by layering data states (at rest, in process, in transit) and the people, processes, and technology dimensions to produce 27 distinct security considerations. This structured model helps organizations systematically evaluate and address cybersecurity coverage across every relevant combination of factors.
Threats - Threat Agents
Threat agents and threat actors are individuals or entities that intend to cause harm to an organization, and understanding who they are, what drives them, and how they operate is foundational to building an effective cybersecurity defense.
Threats - Common Attack Vectors
Attack surfaces represent the total sum of potential entry points into an organization, while attack vectors are the specific methods threat actors use to exploit them. This content covers physical, digital, and human attack categories, along with supply chain risks and cloud service models.
Threats - Common Vulnerabilities
Vulnerabilities are weaknesses within attack vectors that can be exploited to compromise an organization, spanning technology, misconfigurations, and process failures. This content covers common vulnerability types across software, hardware, virtualization, protocols, cryptography, mobile devices, and supply chains.
Threats - Common Equipment Vulnerabilities
New network equipment introduces security risks through default settings, unused services, outdated software, misconfigurations, and inherent technology weaknesses. Addressing these vulnerabilities before deployment is a fundamental requirement of secure network management.
Threats - Common Software Vulnerabilities
Software vulnerabilities exist across operating systems, applications, and web platforms, with common threats including buffer overflows, race conditions, SQL injection, cross-site scripting, and zero-day exploits. Understanding the vulnerability life cycle and resources like the CVE database are essential for maintaining a strong security posture.
Threats - Social Engineering Techniques
Social engineering is the manipulation of a person, rather than a system, to obtain information or provoke an action that serves the attacker. This coverage defines social engineering and walks through the methods of contact, the tactics, and the forms of false information a threat agent uses.
Threats - How Passwords are Hacked
Credential-based attacks are among the most common ways threat actors gain unauthorized access to systems and networks. This content covers the primary methods used to steal or guess passwords, including social engineering, eavesdropping, brute force techniques, rainbow table lookups, and credential stuffing.
Threats - Malware and Malware Types
Malware is malicious software designed to damage systems, steal data, or gain unauthorized access, and it takes many forms that every IT and security professional must recognize. This content covers the defining characteristics and real-world behavior of the most common malware types, including viruses, worms, ransomware, spyware, rootkits, botnets, and more.
Threats - Common Network Attacks
Common network attacks including denial-of-service, spoofing, injection, and on-path attacks are examined alongside the techniques attackers use to disrupt services, intercept communications, and exploit system trust relationships. Understanding these threats is foundational to building and maintaining a secure network environment.
Protection - Protecting a Cybersecurity Domain
Protecting a cybersecurity domain requires balancing accessibility with security, layering technical and organizational controls, and making informed risk management decisions. This overview introduces the core principles that shape an effective cybersecurity program.
Protection - The Need for A Cybersecurity Program
A cybersecurity program is a structured, ongoing function that assesses risk, enforces policy, and ensures company-wide accountability — and without one, organizations remain exposed no matter how strong their individual technical controls are.
Protection - Risk Management
Risk management is the foundation of any cybersecurity program, focused on identifying, assessing, and responding to threats based on probability, potential impact, and available resources. This content covers the risk equation, the risk management process, risk assessment methods, and the four core risk response strategies.
Protection - Types of Controls
Cybersecurity controls are the countermeasures organizations use to manage risk, and they fall into three categories—technical, physical, and administrative—as well as several functional types, including preventative, detective, corrective, and more. Understanding how these controls are classified helps organizations build layered, effective security strategies.
Protection - Basic Security Principles
Core security principles—network segmentation, least privilege, separation of duties, monitoring, and equipment hardening—form the foundation of a defensible IT environment. This content explains what each principle means and why it matters for reducing organizational risk.
Protection - Cybersecurity Lifecycles
Cybersecurity risk management requires actively managing the full life cycle of people, processes, and technology — from initial deployment or onboarding through decommissioning or offboarding. Understanding these life cycles helps organizations reduce exposure and maintain consistent security controls.
Identity and Access Management (IAM)
Identity and access management (IAM) is a framework of policies, technologies, and controls that governs how organizations verify who users are and what resources they can access. It also covers the full account lifecycle, from provisioning new users to deprovisioning accounts when employees leave.
IAM and Authentication, Authorization, Accounting (AAA)
Authentication, authorization, and accounting (AAA) is a security framework that controls who accesses a network, what they can access, and tracks what actions occur. Core protocols like RADIUS, TACACS+, and Diameter implement these functions across network infrastructure.
IAM - Password Habits
Weak and mismanaged passwords remain one of the most exploitable vulnerabilities in cybersecurity, and understanding what makes a password strong—and how to manage passwords effectively—is essential for both everyday users and security professionals.
IAM - Multi-Factor Authentication
Multi-factor authentication (MFA) requires users to verify their identity through more than one authentication factor, making it one of the most effective controls for preventing unauthorized account access. It represents a far greater security improvement than stronger passwords alone, which is why cybersecurity insurers increasingly mandate it as a coverage requirement.
IAM - Password Enforcement
Strong password enforcement is a critical responsibility for IT professionals, who must implement policies covering MFA, password length, login attempt limits, and tools like single sign-on to protect systems and guide user behavior.
IAM - Federation
Federation is the practice of linking separate systems through trust relationships so that authentication in one grants access to another. This concept underpins modern identity management, including federated IDs, single sign-on distinctions, and third-party identity services.
IAM - Access Control
Access control is a foundational component of identity and access management, encompassing the policies, technologies, and physical measures that restrict resource access to authorized users only. This content covers permissions, access control lists, implicit versus explicit rules, least privilege, just-in-time permissions, and ephemeral credentials.
IAM - Access Control Models
Access control can be implemented through several distinct models, each suited to different organizational needs and security requirements. This content covers discretionary, mandatory, role-based, rule-based, attribute-based, and risk-based access control, explaining how and when each applies.
IAM - Physical Access Control
Physical access control covers the policies, technologies, and physical measures used to restrict unauthorized entry to facilities, equipment, and sensitive data. Key concepts include building security design, access mechanisms, surveillance systems, detection tools, and equipment protection.
Confidentiality
Confidentiality is a foundational cybersecurity principle focused on keeping sensitive data private and protected from unauthorized access. This content covers data classification, data sovereignty, the distinction between personal information and personally identifiable information, and the methods organizations use to enforce confidentiality.
Confidentiality - Privacy
Privacy laws and regulations govern how personal data must be protected, covering everything from browsing habits to health and financial records. IT professionals are responsible for understanding and enforcing compliance with these laws, which vary by jurisdiction and can apply across international borders.
Confidentiality - Data Management
Data management regulations are expanding globally, and organizations must understand data sovereignty, defined roles, ownership rights, and retention obligations to stay compliant. This content covers the frameworks and responsibilities that govern how data is collected, protected, and removed.
Confidentiality - Data Lifecycle
Data has a defined life cycle that spans creation, active management, and eventual retirement or destruction — each stage carrying distinct security and compliance responsibilities. Understanding how data moves through this cycle is essential for protecting sensitive information and limiting organizational risk.
Confidentiality - Encrypting Data
Encryption protects data confidentiality but introduces performance tradeoffs that require careful decisions about where and how it is applied. This content covers encryption at rest, in transit, and in process, along with key algorithms, protocols like TLS, and the distinction between encryption and hashing.
Confidentiality - Steganography
Steganography is the practice of concealing a message or data inside another file, such as an image or audio recording, rather than encrypting it into an unreadable format. Unlike cryptography, steganography hides the very existence of the message, making it far less likely to attract scrutiny.
Confidentiality - Data Obfuscation
Data masking and obfuscation are two closely related techniques used to protect sensitive information by hiding, replacing, or obscuring real data. This content covers de-identification concepts, practical masking methods such as substitution, shuffling, randomization, and null values, and how obfuscation differs by making data or code deliberately difficult to interpret.
Confidentiality - Data Loss Prevention (DLP)
Data loss prevention (DLP) is a combination of tools, technologies, and strategies designed to stop unauthorized transfer, leakage, or exposure of confidential data. Organizations deploy DLP to monitor network activity, restrict external media, and enforce data classification policies that control what information can leave the environment.
Integrity
Data integrity in cybersecurity ensures that information remains complete, unaltered, and trustworthy from sender to recipient. This topic covers the CIA Triad, the distinctions between integrity, authenticity, and non-repudiation, common threats to message integrity, and the technical controls used to enforce it.
Integrity - PKI and Digital Certificates
Public Key Infrastructure (PKI) extends asymmetric cryptography by introducing trusted third-party certificate authorities that validate digital certificates, enabling authenticity and integrity verification across encrypted communications.
Integrity - Digital Signatures
Digital signatures use hashing and public key cryptography to verify both the integrity and authenticity of messages and documents. Public key infrastructure (PKI) provides the certificate validation that makes the entire process trustworthy.
Integrity - Database Integrity
Database integrity ensures that the data stored in tables and relational systems is accurate, consistent, and reliable across every record and field. This content covers the foundational types of database integrity, data field validation techniques, data types, and check digits.
HA - High Availability
Availability—the 'A' in the CIA Triad—focuses on keeping systems and services consistently accessible to users while minimizing the impact of downtime through fault tolerance, redundancy, and proactive planning. This content covers the business consequences of outages, common threats to availability, and the strategies and plans organizations use to maintain reliable operations.
HA - Measuring Availability, Five 9’s, and SLAs
Availability is measured through uptime percentages and formalized in service level agreements that define guaranteed performance standards and the consequences of falling short. Key benchmarks like three nines (99.9%) and five nines (99.999%) translate abstract reliability goals into concrete, contractually enforceable targets.
HA - Redundancy
Redundancy is a core fault-tolerance strategy that ensures systems remain operational when hardware, software, or infrastructure components fail. This content covers where redundancy is needed, how it is implemented across power, services, data, and location, and how to determine the right amount using the n+1 standard.
HA - Replication
Data replication creates and continuously maintains synchronized copies of data across multiple locations, providing the redundancy required for high availability and rapid failover. Key concepts include synchronous versus asynchronous replication, bidirectional replication, and file locking.
HA - Incident Response
Disaster recovery (DR) covers the processes, people, and technologies required to restore IT systems and data after a catastrophic failure. A solid DR plan addresses capacity planning, platform diversity, and regular testing to ensure recovery is actually achievable when it matters most.
HA - Disaster Recovery
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are the two core metrics that define how quickly an organization must restore operations and how much data loss is acceptable following a disaster. Together, they drive all disaster recovery planning decisions, from infrastructure investment to staff training requirements.
HA - RPO and RTO
Backup strategy covers far more than simply copying data — understanding media types, storage locations, encryption, retention periods, and recovery objectives is essential to building a reliable, tested backup plan. This content walks through the full scope of backup concepts used by IT professionals to protect organizational data and reduce recovery risk.
HA - Backups
Backup types, frequency, and planning strategies are core components of any resilient data protection approach, covering full, differential, incremental, and synthetic full backups. Understanding the trade-offs between storage cost, restore complexity, and recovery objectives drives smarter backup design.
HA - Backup Types
Database backup strategies rely on transaction logs to track and manage changes across full, incremental, and differential backup types. Understanding how these logs are committed or retained determines how each backup method captures and restores database records.
HA - Database Backups
Incident response planning covers the processes, training, and analysis needed to detect, contain, and recover from IT incidents quickly and effectively. A structured plan combined with regular testing and root cause analysis reduces downtime and strengthens an organization's ability to handle future events.
Security - Physical Security
Physical security covers the hardware, environmental, and electrical threats that put network equipment and availability at risk, along with the controls used to protect against them. Key protections include access control, asset tracking, environmental monitoring, power redundancy, and proper asset disposal.
Security - Network Security
Network security requires a layered approach that combines perimeter defenses, internal access controls, and strategic segmentation to protect data as it moves across an organization's infrastructure. Key technologies include firewalls, intrusion detection and prevention systems, zero trust architecture, and deceptive tools like honeypots.
Security - Firewalls
Firewalls serve as the primary security boundary between an internal network and the outside world, controlling which traffic is allowed in or out based on defined rules and inspection methods. This content covers firewall fundamentals, security zones, access control lists, and the advanced capabilities of next-generation firewalls.
Security - Remote access
Remote access technologies enable secure connectivity to corporate networks from outside locations, with VPNs serving as the dominant solution alongside alternatives such as SSH, VNC, remote desktop, VDI, and HTTPS-based applications.
Security - Wireless Security
Wireless signals are inherently exposed to interception, making strong encryption and proper authentication protocols essential for any secure network deployment. This content covers wireless security fundamentals, from outdated and broken protocols like WEP to modern WPA3 configurations and enterprise-grade 802.1x authentication.
Security - Equipment Hardening
New network equipment arrives with outdated software, default passwords, and unnecessary features enabled — all of which must be addressed before deployment. Equipment hardening covers the techniques used to reduce those vulnerabilities across every device added to a network.
Security - Host-Based Security
Host-based security covers the tools and practices used to protect laptops, desktops, and other end-user devices at the individual machine level. Key areas include software firewalls, OS hardening, malware protection, disk encryption, patch management, and continuous monitoring.
Administrative Controls - Documentation and Policies
Strong cybersecurity depends on thorough documentation and well-defined policies that create consistency, reduce repeated effort, and align teams toward shared security standards. Together, they form the foundational backbone of any effective security program.
Administrative Controls - Policies, Standards, Procedures, Guidelines, and Controls
A security program depends on a clear hierarchy of governance documents — policies, standards, procedures, guidelines, and controls — each serving a distinct role in defining and enforcing an organization's cybersecurity expectations. Understanding how these elements relate to one another is foundational to building and operating an effective security program.
Administrative Controls - What is a Security Frameworks
A cybersecurity framework is a structured blueprint of standards and controls used to build and organize an effective security program. Frameworks like NIST CSF, ISO 27001, SOC 2, PCI DSS, and CMMC are selected based on industry, organization type, and regulatory requirements.
Administrative Controls - Policies and Agreements
Policies and agreements formalize expectations across every business relationship, from employees and customers to vendors and partners. This content covers the key documents used to define roles, responsibilities, and acceptable behavior in each of those contexts.
Administrative Controls - Security Awareness Training
Security awareness training ensures that organizational policies, standards, and procedures are understood and followed by the people responsible for them. Effective programs go beyond formal training to include simulations, communications, and ongoing testing that build real-world recognition of threats like social engineering and phishing.
Administrative Controls - Laws and Regulations
Privacy laws and regulations like GDPR, HIPAA, and COPPA require organizations to protect customer and employee data, and non-compliance can result in significant fines and reputational damage. A well-structured security program treats regulatory compliance as a core component of risk management and business continuity.
Computer Software
Software is the code and instructions that tell a computer how to operate, and it comes in many forms—from operating systems and drivers to the applications end users rely on daily. Understanding software types and the key considerations for deploying them in a business environment is essential knowledge for IT professionals.
Needs Assessment
Deploying software in a business environment requires more than simply installing whatever users request — it demands a structured needs assessment to ensure the chosen solution actually fits organizational requirements. This content covers how to evaluate application options, gather stakeholder input, and avoid costly mistakes that come from skipping that process.
Software Compatibility and Requirements
Understanding software compatibility and system requirements is essential before installing any application, as both determine whether software will function correctly on a given system. Compatibility focuses on what specific hardware or operating systems a program supports, while requirements define the minimum and recommended specifications needed to run it.
Software Licensing
Software licensing defines the legal terms under which users can access and use applications, covering everything from open-source and freeware to subscription-based and proprietary models. Understanding these agreements is essential for both individual users and organizations to remain compliant and make informed purchasing decisions.
Software Piracy
Software piracy is the unauthorized use, copying, modification, distribution, or sale of software and digital content — and it is a form of theft with real legal and professional consequences. Organizations that routinely engage in software piracy expose themselves, and potentially their employees, to significant legal liability.
Software Considerations for Business
Selecting software for a business environment requires evaluating far more than basic system requirements, including impacts to device performance, network stability, operations, and company-wide policy compliance. Shadow IT — when users or departments install unauthorized software outside of IT oversight — compounds these risks and can undermine organizational consistency and security.
Software Distribution Methods
Software can be obtained and installed through multiple sources, including websites, app stores, package repositories, removable media, file sharing, and centralized management systems such as MDM solutions and Windows Update Services. Understanding the available distribution methods and how to verify software legitimacy is essential for safe and effective software deployment.
Software as a Service (SaaS)
Software as a Service (SaaS) delivers cloud-hosted applications through a web browser, eliminating the need for local installation, maintenance, or updates. Key advantages include reduced management overhead, enhanced accessibility, easier collaboration, and straightforward scalability.
Privacy Considerations
Privacy in the digital age means understanding how personal data is collected, stored, and shared across software, services, and communication platforms. From email and social media to AI tools and file sharing, protecting personal information requires awareness of where data goes and who controls it.
DEMO: Installing Acrobat Reader
Adobe Acrobat Reader is a free PDF viewer used to open and read Portable Document Format files across different systems without requiring specialized software. This content covers how to download and install Acrobat Reader on a Windows machine for both single-device and scalable multi-device deployments.
DEMO: Installing at Scale
Deploying software to dozens of machines requires a systematic approach that saves time and ensures consistency across every endpoint. This content covers the core strategies IT professionals use to scale software installations efficiently across large fleets of computers.
DEMO: Patching Software
Software vulnerabilities follow a lifecycle from discovery to public exposure to patching, and keeping all applications updated is one of the most effective ways to reduce security risk. Understanding how that lifecycle works helps organizations minimize the window of exposure before a fix is available.
DEMO: Removing Software
Every program installed on a computer consumes system resources and introduces potential security vulnerabilities, making it important to remove software that is no longer in use. This content covers how unused and unnecessary applications create risk and demonstrates the process of uninstalling programs on Windows.
Applications and Suites
Applications are the end-user-facing software that give computers their functional purpose, spanning productivity tools, collaboration platforms, web browsers, and more. This content covers key application categories, software suites, and the distinction between tools built for collaboration and those with collaboration features added.
Microsoft Office vs Google Workspace
Microsoft 365 and Google Workspace both offer productivity suites built around word processing, spreadsheets, and presentations, but they differ significantly in features, ease of use, and collaboration capabilities.
DEMO: Document Storage and Sharing
Cloud storage options like Microsoft OneDrive, Google Drive, and Dropbox each offer distinct advantages for storing, syncing, and sharing files across devices. Knowing how they compare helps users choose the right solution for personal, collaborative, or enterprise needs.
DEMO: Word Processors
Word processors are software tools used to create, edit, and format text-based documents such as letters, notes, and resumes. This content covers Microsoft Word and Google Docs as two widely used examples of word processing applications.
DEMO: Text Editors
Text editors provide a lightweight alternative to word processors, allowing users to work with plain, unformatted text. This content covers two widely used options — Notepad and Notepad++ — and the practical scenarios where each fits best.
DEMO: PDF Viewers and Creators
PDF (Portable Document Format) is a widely supported file format created by Adobe in 1992 that allows documents to be shared and viewed across different systems without requiring proprietary software. Since becoming an open standard in 2008, multiple tools—including built-in Windows features—can create PDFs from virtually any application.
DEMO: Spreadsheets
Spreadsheets are essential productivity tools used to store, organize, compute, and analyze data across personal and professional contexts. This content covers core spreadsheet concepts and practical functionality using Microsoft Excel and Google Sheets as reference platforms.
DEMO: Presentation Software
Microsoft PowerPoint and Google Slides are two leading presentation tools used to design and deliver visual slideshows, each with distinct strengths in features and accessibility.
DEMO: Visual Diagramming
Visual diagramming tools turn complex IT concepts—like network topologies and org structures—into clear, easy-to-read graphics. This content covers the purpose of visual diagrams and introduces popular tools including Miro, Microsoft Visio, and Lucidchart.
DEMO: Email Clients
Email clients provide access to messages either through a web browser or via locally installed applications that store messages directly on a device. Understanding the difference between these two approaches is essential for managing email access in both connected and offline environments.
DEMO: Instant Messaging (IM) Software
Instant messaging tools enable real-time text communication across teams and organizations using internet-based apps rather than cellular networks. This content covers four widely used platforms — Google Chat, Slack, Discord, and Microsoft Teams — and how each one handles direct messages and group conversations.
DEMO: Conferencing Apps
Conferencing tools like Zoom, Google Meet, and Microsoft Teams offer a more effective alternative to email or instant messaging when communication requires more depth. These platforms support video, voice, screen sharing, and breakout rooms for both small teams and enterprise-level collaboration.
DEMO: Unified Communications (UC)
Unified Communications integrates instant messaging, VoIP, video conferencing, and mobility tools into a single platform rather than requiring separate applications for each function. Modern tools like Microsoft Teams demonstrate this approach by combining chat, voice calls, and video conferencing in one interface.
DEMO: Remote Support Software
Remote support software eliminates the guesswork of phone-based technical support by giving technicians a live view of a user's screen and, in many cases, direct control over it. This content covers how RDP, VNC, and third-party tools like TeamViewer each approach remote access and where they differ.
DEMO: Password Manager
Password managers solve the challenge of maintaining strong, unique credentials across every account by storing them in a single encrypted vault secured by one master password. This content covers how password managers work, the tradeoffs between cloud-based, browser-based, and locally stored options, and a hands-on walkthrough of KeePass.
DEMO: Screen Capture and Recording
Windows Snipping Tool allows users to capture screenshots and record screen video to visually communicate technical processes to others. It supports multiple capture modes, annotation tools, and direct integration with Clipchamp for video editing.
DEMO: Antimalware
Anti-malware and antivirus software protects computers by detecting and removing malicious programs designed to damage systems, steal data, or hold files for ransom. This content covers common malware types, third-party tools, and the built-in Windows security options available today.
DEMO: Software Firewalls
Firewalls control which network traffic is allowed to reach devices, operating at both the network edge and directly on individual machines. Most modern operating systems include a built-in software firewall that runs automatically without requiring manual setup.
DEMO: Compression Software
File compression software reduces the size of large files and bundles multiple items into a single package, making them easier to transfer and store. This topic covers how to use Windows built-in compression to create ZIP archives without third-party tools.
Artificial Intelligence (AI)
Artificial intelligence, machine learning, and deep learning are related but distinct concepts that form the foundation of modern AI systems. This content covers how each works, how neural networks enable deep learning, and what to realistically expect from AI technology.
DEMO: Artificial Intelligence (AI)
Artificial intelligence is already embedded in everyday tools, from AI chatbots like ChatGPT to voice assistants, predictive analytics, and search suggestions. This content examines real-world AI applications and how they generate text, interpret speech, analyze trends, and personalize user experiences.
File Extensions
File extensions are the characters after the period in a file name that tell the operating system which program to use when opening that file. Understanding how extensions work—and how to view, change, and manage them in Windows—is a foundational skill for working with files and applications.
Web Browser Overview
Web browsers are client-side applications that request and display web pages delivered by server-side services like Apache or IIS. This content covers how the client-server model applies to browsing and compares the major browsers — Chrome, Firefox, Edge, and Safari.
DEMO: Default Browser
Popular web browsers are free to download and use, with companies monetizing through sponsored content and advertisements displayed within the browser interface. Users can designate any installed browser as their default, controlling which application automatically opens web links and HTML files.
DEMO: Default Search Engine
A search engine is a tool used to find resources online, and each browser comes with a default one that can be changed to fit personal preference.
DEMO: Profile and Synchronization
Google Chrome's profile synchronization feature allows users to keep their bookmarks, history, and settings consistent across multiple devices and browsers by signing into a linked account. Multiple profiles can be created and managed within a single Chrome installation, making it easy to switch between separate browsing environments.
DEMO: Private Browsing
Chrome's private browsing and guest mode allow users to browse without syncing history, cookies, or cached credentials to their main profile. These modes are useful for clean testing environments and presentations where personal browsing data should stay hidden.
DEMO: Accessibility
Accessibility settings in Google Chrome and Microsoft Edge allow users to customize visual and display options to improve readability and usability. This content walks through locating and adjusting those settings in both browsers.
DEMO: Appearance
Browser appearance settings allow users to customize themes, color schemes, and interface elements on a per-profile basis. Assigning distinct visual styles to different profiles makes it easy to identify which profile is active at a glance.
DEMO: Bookmarks
Browser bookmarks streamline web navigation by giving quick access to frequently visited sites, and organizing them into folders makes daily workflows faster and more efficient.
DEMO: Cookies and Caches
Cookies and browser cache are temporary data storage mechanisms that improve the web browsing experience but can also cause access issues that require troubleshooting. Understanding what they are and how to manage them is an essential skill for everyday computer use and IT support.
DEMO: Password Management
Modern browsers include built-in password management, autofill, and payment method storage — features that offer convenience but carry meaningful security tradeoffs. Understanding when and how to use these tools is essential for maintaining sound credential hygiene.
DEMO: Pop-Up Blockers
Browser pop-ups and redirects can be used for legitimate purposes, but they are also common vectors for advertising abuse and scam sites. This content covers how pop-up and redirect permissions work in browser settings and how to configure exceptions for trusted or blocked sites.
DEMO: Browser Add-Ons and Extensions
Chrome extensions are third-party add-ons that expand browser functionality beyond its built-in features, allowing users to customize and enhance their browsing experience. This content covers how to view, manage, enable, disable, and install extensions through the Chrome Web Store.
DEMO: Secure Web Browsing
Secure web browsing depends on verifying that connections are authentic, private, and unaltered — goals achieved through Public Key Infrastructure (PKI) and Transport Layer Security (TLS). Digital certificates, issued by trusted Certificate Authorities, are the mechanism that makes this verification possible.
Shortcut Methods
Common keyboard and mouse shortcuts work across a wide range of applications, making them efficient skills to learn once and apply everywhere.
DEMO: Working with Windows
Core window management skills for Windows-based systems, including keyboard shortcuts, snapping, resizing, and switching between open applications. Covers both mouse and keyboard techniques to improve speed and efficiency on the desktop.
DEMO: Navigating and Quick Access
Covers essential Windows navigation techniques for quickly accessing applications, files, and system tools using keyboard shortcuts, the Start menu, taskbar pinning, and the Run dialog.
DEMO: Scrolling
Efficient cursor movement and scrolling are foundational skills for working productively in any document environment. This content covers the full range of navigation techniques available in Windows, from mouse controls to essential keyboard shortcuts.
DEMO: Selecting
Selecting objects efficiently across Windows applications relies on a handful of keyboard shortcuts that work universally in file folders, Word, Excel, Outlook, and PowerPoint. Ctrl+A selects all, Shift extends a contiguous range, and Ctrl adds or removes non-adjacent items from any selection.
DEMO: Editing
Essential keyboard shortcuts and editing techniques for working efficiently in Microsoft Word, including key functions, text formatting commands, navigation shortcuts, and formatting visibility tools.
DEMO: Cut, Copy, Paste
Cut, copy, and paste operations work across Windows and Microsoft Office applications using keyboard shortcuts, right-click menus, drag-and-drop techniques, and the Windows clipboard history tool. Mastering these methods speeds up everyday file and content management tasks.
DEMO: Find and Replace
Find and Replace is a time-saving tool available across applications like Microsoft Word and Google Sheets, allowing users to locate specific text and swap it out individually or all at once.
DEMO: Format Painter
Format Painter is a productivity tool available across Microsoft Word, Excel, PowerPoint, and Google Docs that copies text and paragraph formatting and applies it to other content in seconds. Mastering it eliminates the need to manually reformat text one element at a time.
DEMO: YouTube Shortcuts
A practical reference to YouTube's keyboard shortcuts, covering playback control, speed adjustment, navigation, captions, and search.
What Is a computer?
A computer is any device that accepts input, processes data, produces output, and stores information — a definition that covers everything from calculators and smartphones to smartwatches and televisions. This content establishes that foundational definition and explores how binary numbers drive the processing behind everyday computing devices.
Computer Components, What Makes Up a Computer
A foundational overview of the core hardware components inside a modern computer, covering how the CPU, RAM, storage, motherboard, GPU, NIC, power supply, and BIOS work individually and together.
The Software Side of Hardware
Computer software encompasses the programs and instructions that direct how a system operates, spanning everything from operating systems and drivers to utilities and applications. Understanding the distinction between system software and application software is foundational knowledge for anyone working in IT.
DEMO: Operating Systems
An operating system (OS) is the foundational software that boots a device, manages hardware access, and creates the consistent environment that applications and users interact with. Firmware serves a similar purpose but is purpose-built for specific hardware rather than deployed across multiple device types.
Hardware Drivers
Device drivers are the software layer that allows an operating system to communicate with individual hardware components. Without them, even a fully installed OS would be unable to interact with the physical components that make up a computer.
DEMO: Computer Utilities
System utilities are software tools that help maintain, troubleshoot, and optimize a computer's performance, and are generally considered part of the operating system environment rather than standalone applications. Common examples on Windows include Ping for testing network connectivity, Disk Cleanup for freeing storage space, and Disk Management for organizing drives.
DEMO: Application
Applications are software programs that enable users to perform specific tasks, from creating documents to editing graphics or playing games. WordPad, Paint, and Solitaire serve as practical examples of how different applications serve different purposes on a Windows system.
Storage
Computer storage encompasses a range of technologies, characteristics, and interfaces that collectively determine how data is retained, accessed, and managed across a system. Understanding the distinctions between volatile and nonvolatile storage, magnetic, solid-state, and optical media, and the protocols that connect them is foundational knowledge for any IT professional.
Network Storage
Network storage gives devices on a local area network shared access to files without requiring direct physical connections to individual machines. NAS devices, file servers, and cloud platforms like Amazon S3 are the primary methods used to make this possible.
History of Computers
Computing hardware has evolved over millennia, from the abacus of 2400 BCE through mechanical calculators, vacuum tubes, transistors, and integrated circuits, to the microprocessors powering modern devices. This progression represents one of the most consequential technological journeys in human history.
Creating a Calculator
A foundational look at how processors handle binary addition, using a simple calculator project to illustrate how chips process data at the hardware level.
Transistors
Microprocessors are built from silicon-based transistors that function as electronic switches, controlling the flow of electricity to produce binary outputs of one or zero. Understanding how silicon's semiconductor properties enable this switching behavior is foundational to understanding how modern computing hardware works.
Gates
Logic gates are the fundamental building blocks of digital circuits, using transistors to process binary inputs and produce predictable outputs. This content covers the OR, AND, and NOT gates, including their behavior, truth tables, and circuit symbols.
Powers of 2 in Computing
Binary numbers and powers of two explain why values like 256 appear repeatedly in computing environments. Each additional bit doubles the total number of possible combinations, producing the consistent sequence of values that define hardware and software boundaries.
Bits, Nibbles, Bytes, and Octets
Bits, bytes, nibbles, and octets are the fundamental units of digital data, each serving distinct roles depending on whether data is being stored or transmitted. Understanding how and when each unit is used—along with the difference between bits-per-second and bytes-per-second measurements—is essential for working with networking and storage technologies.
Kilo, Mega, Giga, Tera, Peta
Digital storage and data transfer speeds are measured using standard unit prefixes — kilo, mega, giga, tera, and beyond — but two competing measurement systems, SI and binary, produce values that diverge significantly at higher scales. Understanding both systems is essential for accurately interpreting storage capacities and network speeds in real-world IT environments.
Bits Representing Characters
Character encoding standards like ASCII and Unicode define how keystrokes are translated into binary data that computers can process. ASCII uses 7 bits to represent 128 characters, while Unicode supports over 155,000 characters across 168 scripts using variable-length encodings like UTF-8.
DEMO: Storing Characters
This topic covers how text characters are stored as bytes in computer files, comparing plain-text editors with rich-text editors that include hidden formatting data.
Bits Representing Graphics
Digital images are built from pixels, each storing red, green, and blue color values as binary data. The number of bits assigned per pixel determines how many colors a display can represent.
Compressing Graphics
Uncompressed image and video files consume enormous amounts of storage, making compression algorithms essential for practical use across digital media. This topic covers how pixel data accumulates into massive file sizes and introduces how compression techniques reduce that footprint.
Raster vs Vector Graphics
Raster graphics store color data for every individual pixel, while vector graphics use mathematical coordinates and equations to define shapes. Understanding the difference helps determine the right format for photos, logos, and other digital assets.
Sending Bits
Network data transfer speeds are measured in either megabits per second or megabytes per second depending on the context, and knowing the difference is essential for interpreting real-world performance accurately.
Processing Bits
CPU performance is measured by clock speed, expressed in hertz, and bit width, which determines how many bits the processor handles simultaneously. Most modern computers and gaming consoles use 64-bit processors running at speeds measured in gigahertz.
CPUs, Cores, and Hyper-Threading
CPU processing speed, measured in hertz, has plateaued due to heat limitations, driving the development of technologies like multi-core processing and hyperthreading to increase overall computational throughput. Understanding how these approaches work—and where they fall short—is essential for evaluating modern processor capabilities in both personal and enterprise environments.
Mainframes vs PCs vs MACs
Personal computers, Macs, and mainframes each represent a distinct era and architecture in computing history, with key differences rooted in how processing power is owned and accessed. Understanding these distinctions also explains why terminal emulation programs remain relevant tools in modern IT work.
Workstations and Desktops
A workstation is a computing setup dedicated to professional tasks, while a desktop is any desk-sized personal computer—terms that overlap but carry distinct meanings in IT contexts.
Laptops
Laptops pack desktop-level computing power into a portable form factor, but that convenience comes with trade-offs in cost, upgradability, and security. Understanding these factors is essential for making informed hardware decisions in professional IT environments.
Raspberry Pi
The Raspberry Pi is a compact, low-cost single-board computer developed by the Raspberry Pi Foundation as an accessible platform for learning about hardware, software, and computing fundamentals. It runs a Linux-based operating system and supports a wide range of practical applications despite its small size and modest specifications.
Tablets
Tablets are portable computers built around touchscreen interaction, offering a compact and accessible alternative to laptops and desktops for everyday tasks.
Smart Phones
Smartphones are pocket-sized computers that merge cellular technology with the processing power of a tablet, running mobile operating systems like iOS and Android. This content covers how smartphones work, their key hardware components, major vendors, and the trade-offs between their benefits and potential drawbacks.
E-Readers
An e-reader is a portable electronic device designed primarily for reading digital books and written material, featuring a low-glare screen that reduces eye strain compared to standard tablet or phone displays.
Gaming Consoles
Gaming consoles are specialized computing devices built primarily for playing video games, sharing the same core hardware components found in traditional computers despite their compact, purpose-built form. Common examples include Xbox, PlayStation, and Nintendo Switch, each running proprietary system software or firmware with a limited but focused application ecosystem.
Virtual Reality Systems
Virtual reality (VR) is a computer-generated, three-dimensional simulation that allows users to interact with a fully immersive digital environment through headsets like the Meta Quest 2 and Apple Vision Pro. Beyond gaming and entertainment, VR sees growing application in engineering, remote work, and healthcare.
Augmented Reality Systems
Augmented reality (AR) overlays computer-generated imagery onto the real world, distinguishing it from virtual reality's fully simulated environments. AR runs across devices ranging from dedicated headsets to smartphones and is used across gaming, healthcare, education, and real estate.
Internet of Things
The Internet of Things (IoT) refers to everyday physical devices — from refrigerators and thermostats to industrial equipment and wearables — that connect to the internet to collect data, enable remote control, and support automation. Understanding what qualifies as an IoT device, how these systems are used, and the privacy and security concerns they introduce is foundational knowledge for IT and cybersecurity professionals.
What is a Server Anyways
A server is a combination of software, operating system, and hardware working together to deliver services to clients on a network. This content breaks down how each of those three layers functions and why dedicated server infrastructure exists separately from standard desktop computers.
Network Attached Storage (NAS) Devices
Network-attached storage (NAS) is a dedicated storage device that connects directly to a network, making files accessible to any authorized device on that network. It serves as a centralized solution for file storage, backup, and media streaming.
A Look Inside a Switch
Network switches connect devices across an infrastructure and operate on application-specific integrated circuits (ASICs) that make them function, technically, as computing devices. This content examines switch hardware internals, including power supplies, ASICs, CPUs in managed switches, and hot-swappable components.
What Is an Operating System
An operating system is the software layer that controls a computer's hardware and provides a consistent environment for applications to run. This topic covers what an OS is, how it evolved, and the core role it plays in shaping the user experience.
Abstraction Layer
An operating system functions as an abstraction layer, sitting between users and hardware to translate high-level interactions into the machine-level instructions a computer can execute. This concept explains how modern computing shields users and developers from direct hardware complexity.
Functions of an Operating System
An operating system performs several core functions that keep a computer running, including device management, memory management, process management, and access control. These functions work together to coordinate hardware, applications, and users on a single machine.
OS Functions: Device Management
The operating system acts as the central coordinator for all hardware devices in a computer, using drivers to communicate with each one. Device Manager in Windows provides a practical interface for viewing and managing these connected components.
OS Functions: Disk Management
The operating system plays a central role in managing how data is read from, written to, and presented from physical storage devices. This content covers storage media types, cluster-based data organization, file fragmentation, and OS-level data protection.
OS Functions: Memory Management
RAM serves as the staging area between a computer's input and output, and the operating system is responsible for managing how that memory is allocated and used. This content covers how memory addressing works and how to inspect real-time memory allocation using Device Manager and Sysinternals RAMMap.
OS Functions: Application and Process Management
The operating system acts as the critical intermediary between applications and hardware, managing every running process to ensure system resources are allocated efficiently. Without it, each application would require direct hardware programming, creating inconsistent user experiences and making multitasking virtually impossible.
OS Functions: Task Management
Windows Task Scheduler automates recurring system maintenance jobs, such as software updates and security patches, by running predefined programs at scheduled times or in response to specific triggers.
OS Functions: Access Control
Operating system access control determines who can view, modify, or execute files and other resources on a computer. Permissions can be assigned or denied at the user and group level to protect sensitive data from unauthorized access.
OS Interfaces
Operating systems present two types of user interfaces: the graphical user interface (GUI) and the command-line interface. Understanding both is fundamental to working effectively with any computer system.
OS Types
Operating systems come in several distinct categories, each designed for a specific type of device or use case. This content covers mobile, desktop, server, embedded, and network operating systems, along with real-world examples and market share data for each category.
Firmware
Firmware is device-specific software embedded directly into hardware, enabling it to perform its core functions. This content covers what firmware is, how it differs from an operating system, and why the boundary between the two has become increasingly blurred.
Patching and Life Cycle
Operating systems require regular patches and updates to fix coding errors, address security vulnerabilities, and add new features. Understanding OS update types, categories, and lifecycle timelines is essential for keeping systems secure and supported.
Operating System Variants
Operating systems vary widely in design and purpose because vendors build on shared foundational code—such as Unix or the Linux kernel—then customize the user experience for specific hardware and markets. Windows, macOS, Linux, Android, and iOS each trace their lineage through a common history shaped by licensing costs, commercial strategy, and the drive to control the software stack.
Windows
Microsoft Windows is the world's most widely used desktop operating system, built on the NT kernel and designed for use on desktops, laptops, and workstations. Windows 11 features a familiar interface including the Start menu, taskbar, and a structured file system organized around the C drive.
Windows Server
Windows Server and Windows workstation share the same NT kernel and familiar interface, but Server is purpose-built to deliver network services—such as DHCP and DNS—to multiple clients at scale.
Linux/Unix
Linux is a free, open-source Unix-like operating system that emerged in the early 1990s and has since branched into hundreds of distributions tailored for different environments and use cases. This content covers its historical origins, the major distribution families, and a hands-on look at the Fedora and Ubuntu desktop environments.
Android
Android is the world's most widely used mobile operating system, built on a Linux kernel and optimized for touchscreen devices while remaining installable on traditional hardware. This content covers the Android interface, its Linux foundation, and how its core components behave across different device types.
Chrome OS/Chromium OS
Chrome OS and Chromium OS are Google-developed, Linux-based operating systems designed for lightweight computing on Chromebook hardware. Chrome OS ships on commercial Chromebooks, while Chromium OS is the free, open-source counterpart available for developers and self-installation.
macOS
macOS is a Unix-based desktop operating system built on a FreeBSD-derived kernel called XNU, designed around a clean graphical interface with a Dock, menu bar, and Finder file manager.
iOS
iOS is the operating system that powers iPhone, sharing the same XNU kernel as macOS despite offering a distinct touch-based interface and user experience. This content covers how to navigate iOS, locate system information, and understand what connects mobile and desktop Apple operating systems at a foundational level.
iPadOS
iPadOS runs on the same XNU kernel as iOS and macOS but is tailored specifically for tablet use, offering a larger display and expanded multitasking while lacking native phone call capability.
FireOS
IoT devices like smart TVs run their own operating systems, as demonstrated by Amazon Fire OS running on a TV alongside Windows and Raspberry Pi OS on connected computers.
Cisco IOS
Cisco IOS is the operating system that runs on Cisco networking devices such as switches, routers, and firewalls, and is managed through a command-line interface using tools like PuTTY over SSH.
Microsoft vs Apples vs Linux
A practical comparison of Microsoft, Apple, and Linux that examines each platform's origins, architecture, and real-world strengths to help users make informed decisions about which operating system fits their needs.
The Kernel
The kernel is the core component of an operating system, sitting closest to the hardware and managing all direct hardware communication. Kernels are categorized as either monolithic or microkernel designs, each with distinct trade-offs between performance and stability.
The Shell
The shell is a software layer that sits between users and the operating system kernel, available as either a command-line interface or a graphical user interface (GUI). On Windows, the graphical shell is Windows Explorer, the program responsible for rendering the desktop environment, taskbar, and file navigation.
Drivers
Device drivers are separate software instructions that allow an operating system to communicate with specific hardware components. Without them, operating systems would be bloated and inflexible, unable to support the vast range of hardware across manufacturers and product lines.
DEMO: Utilities
System utilities are software tools that help maintain, troubleshoot, and optimize computer performance, and they are typically bundled with the operating system rather than serving as standalone end-user applications. Common examples include Ping for testing network connectivity, Disk Cleanup for freeing up storage space, and Disk Management for managing drives on a Windows system.
DEMO: Applications
Applications are programs that run on a computer to help users accomplish specific tasks, from creating documents to working with graphics or playing games. This content breaks down the distinction between system software and applications using hands-on examples in Windows.
DEMO: Processes
Operating systems use processes to track and manage every running program and task, assigning each a unique process ID so the CPU scheduler can prioritize and execute work efficiently. Windows Task Manager provides a practical view of these processes, their IDs, and their resource consumption in real time.
DEMO: Services
Windows Services are background programs that run automatically on a computer, often before any user logs in, making them essential for core system and network functions. The Windows Services console provides visibility and control over each service's status, startup behavior, and configuration.
Storage Devices
Storage devices are a fundamental component of computing, responsible for holding the binary data that makes up every file, image, and application on a system. This content covers the core concepts of how data is stored, the types of storage used in modern computers, and the key characteristics that define each storage solution.
Storage Media
Storage media is the physical layer where digital data is recorded, ranging from magnetic tape and hard disk drives to solid-state chips and optical discs. Understanding the major media categories—magnetic, solid-state, and optical—is foundational to working with computer hardware and data storage systems.
Storage Characteristics
Storage media is categorized by three key characteristics: volatility, longevity, and read/write capability, each suited to different computing needs. Understanding volatile memory, non-volatile memory, and read-only memory is essential for working with modern hardware and data storage systems.
Understanding Computer Components
Computer storage components include both volatile memory, like RAM, and nonvolatile storage, like HDDs, SSDs, and ROM, each serving a distinct role in how a system processes and retains data.
Form Factors
Storage device form factors define the standardized sizes and shapes that allow drives and memory modules to physically fit and function within compatible hardware. This covers the major form factors used in modern IT environments, from 3.5-inch and 2.5-inch drives to mSATA, M.2, and RAM module formats.
Protocols and Interfaces
Storage devices require both a physical interface and a communication protocol to exchange data with a computer. Common examples include SATA, PCIe, NVMe, and USB, each with distinct connectors and signaling standards.
Removable Storage
Removable media refers to storage devices designed to be connected, used, and transferred between systems, including flash drives, SD cards, optical discs, floppy disks, and tape backup. Magnetic and solid-state storage can exist in both removable and non-removable forms depending on how they are configured and used.
Hard Disk Drives (HDDs)
Hard disk drives (HDDs) are nonvolatile magnetic storage devices that retain data without power, available in 3.5-inch and 2.5-inch form factors and commonly connected via SATA interfaces. Rotational speed, measured in RPM, determines read performance, while onboard cache helps manage write speed limitations.
Solid State Drives (SSDs)
Solid state drives offer significantly faster performance than traditional hard disk drives by using flash memory chips instead of mechanical moving parts, and they come in a range of form factors and interfaces including 2.5-inch SATA, M.2, and PCIe NVMe configurations.
Punch Cards
Punch cards use a decimal-based encoding system, not binary, and are read by machines through either electrical contact or light sensors that detect holes punched into the card. Understanding how punch cards work provides foundational context for how early computers processed and interpreted data.
Magnetic Storage
Magnetic media stores digital data by encoding binary values as directional magnetic fields on a physical medium such as a hard disk, tape, or floppy disk. A read/write head applies and detects these magnetic orientations to write and retrieve data.
Optical Storage
Optical media like CDs and DVDs store and retrieve data using focused laser beams that reflect off specially structured disc surfaces, with sensors interpreting the reflected light as binary ones and zeros. The physical encoding of data relies on either removing or blocking portions of a reflective layer to create the patterns a laser can detect.
Solid State Storage
Solid state storage uses semiconductor-based components with no moving parts to retain data without power, making it a fundamental technology in modern computing devices. This content covers the distinction between volatile and nonvolatile memory, how solid state electronics work, and the role of transistors and semiconductors in data storage.
Solid-State Memory Cells
A transistor is a semiconductor switch that controls electron flow but cannot store data on its own. By adding a charge trap layer, engineers transformed the transistor into a memory cell capable of permanently holding a single bit of information.
Flash
Flash memory is a solid-state storage technology built on transistor-based charge traps, used in devices ranging from USB drives to NVMe SSDs. This content covers how flash evolved from early programmable read-only memory into the dominant long-term storage medium found in modern hardware.
Flash and Multi-Level Cell
Flash memory storage density has grown dramatically by encoding multiple bits per cell through precise voltage-level differentiation within each charge trap. This content covers how single-level, multi-level, triple-level, quad-level, and penta-level cell architectures work and where the physical limits of this approach begin.
Flash and V-NAND
Flash memory is built from tiny memory cells that, thanks to vertical stacking technology, can be packed into remarkably dense, compact chips. This topic covers how that vertical NAND architecture works and why it was a turning point in storage capacity.
OS and Storage
Operating systems do far more than connect to storage hardware — they handle the logical setup, data navigation, read/write operations, device management, and protection of everything stored on a drive.
Reading and Writing Data
Storage devices organize data into fixed-size units called clusters, and operating systems use a file allocation table to track exactly where each file is stored on the drive. Understanding this relationship between clusters, addressing, and file lookup is fundamental to how data is read and written at the OS level.
Fragmentation and Defragmenting
File fragmentation occurs when data is stored across non-contiguous clusters on a storage device, which can degrade performance and shorten the lifespan of mechanical hard drives. Defragmentation consolidates scattered file clusters and is recommended for HDDs but should not be run on solid-state drives or optical media.
Formatting Storage
Storage devices rely on file systems to organize and locate data, with the operating system formatting the device to establish structures like file allocation tables or master file tables. Common file systems include NTFS for Windows, EXT4 for Linux, and APFS for macOS, each suited to its platform.
Journaling and Journaling File Systems
File system journaling is a method of logging intended changes before and during execution, allowing the system to detect and recover from incomplete operations that could otherwise cause data corruption or loss.
Partitions, Volumes, and Drives
Partitions, volumes, and drives are related but distinct storage concepts that serve different roles in how data is organized and accessed on a system. Understanding the difference between physical drives, logical drives, partitions, and volumes is essential for managing storage in any IT environment.
Directory and Folders
Folders and directories provide an organized, hierarchical structure for managing files on a storage system, enabling easier navigation, duplicate filenames across locations, and granular access control. At the storage level, directories exist only as records in the file allocation table, while folders are their graphical representation in a GUI.
Metadata
Metadata is data about data — extra information stored alongside files, images, or other digital content that describes properties like creation date, location, and file size. This topic covers what metadata is, how it works, and the different ways it can be stored.
File Attributes
File attributes are metadata settings that describe or control the behavior of files on a system. On Windows NTFS, common attributes include read-only, hidden, archive, compressed, and encrypted, each toggled independently per file.
Working with Files and Folders
Essential techniques for creating, selecting, copying, moving, and renaming files and folders in Windows are covered, including keyboard shortcuts and drag-and-drop methods that improve everyday efficiency.
Moving and Copying Files
Moving and copying files between folders and drives produces different results for file metadata and permissions. Understanding these behaviors is essential for managing files accurately in Windows environments.
Types and Extensions
File extensions are the letters after the period in a filename that tell the operating system which program to use when opening a file. This content covers how extensions work, how to show or hide them in Windows, and how to manage default app associations.
Compression
File compression reduces storage requirements by encoding data more efficiently, replacing repetitive or redundant information with compact representations. Windows supports compression both as a native file attribute and through the ZIP archive format.
Keeping Data Safe
The CIA triad—confidentiality, integrity, and availability—forms the foundation of data security, defining the three core properties organizations must protect. This content introduces each principle and common technical controls used to uphold them.
Access Control and Permissions
Access control protects sensitive data by restricting which users and groups can interact with files and folders. This content covers how to configure user and group permissions on both Windows NTFS and Linux file systems.
Encryption
Encryption transforms readable data into an unreadable format that can only be reversed with the correct key, making it one of the most effective tools for protecting data from unauthorized access. This content covers how encryption is applied to data at rest and data in transit, including disk encryption, file-level encryption, HTTPS, and VPNs.
Storage Integrity
Data integrity ensures stored and transmitted information remains accurate, complete, and unchanged. This content covers key integrity-checking methods including data mirroring, parity bits, and cryptographic hashing.
Storage Redundancy
Storage devices fail, and redundancy is the key strategy for maintaining access to critical data when hardware breaks down. This content covers how redundancy works, why it matters, and how technologies like RAID and disk mirroring protect against data loss.
Storage Backups
Data backup is a foundational IT practice that protects against device failure, accidental deletion, and data loss by maintaining copies of critical data on separate storage. Understanding backup types—full, differential, and incremental—and their trade-offs is essential for building an effective recovery strategy.
Storage Replication
Data replication continuously maintains an exact, up-to-date copy of data at a secondary location, making it a critical strategy for data protection and business continuity.
Storage Versioning
Versioning tracks changes to a file over time, allowing users to roll back to a previous state without maintaining full separate copies. It is a distinct concept from backup and works alongside it to protect against data loss.
Storage RAID
RAID (Redundant Array of Independent Disks) is a storage configuration that combines multiple drives to improve performance, redundancy, or both. This content covers the core RAID levels—0, 1, 5, 6, and 10—along with hardware versus software implementation and a hands-on Windows Disk Manager demonstration.
Data Destruction
Deleting a file removes only its reference in the file system's allocation table, leaving the actual data on disk until it is overwritten — making proper data destruction essential before disposing of any storage device. Physical destruction or a multi-pass data wipe are the accepted methods for ensuring sensitive information cannot be recovered.
Sharing Files
Windows file sharing allows users to make folders on one computer accessible to other devices on the same network by configuring share permissions and NTFS permissions. This content covers the end-to-end process of creating a shared folder, setting access controls, and connecting to the share from another machine using a UNC path.
What's a File Server
A dedicated file server provides centralized, always-available file storage for networked devices, unlike shared folders on a desktop or laptop that become inaccessible when the machine is moved or shut down. This content covers how to configure a Windows Server 2022 machine as a file server, including creating department-level shared folders, managing local user groups, and setting NTFS permissions.
Network Attached Storage (NAS)
Network Attached Storage (NAS) is a dedicated device that connects to a network switch and provides shared file access to all devices on the network. This content covers how to configure a NAS, create user accounts, set up shared folders, and access those shares from a Windows client machine.
Cloud Storage
Cloud storage enables access to files and folders from any location with an internet connection, eliminating the limitations of local network storage. This content covers how cloud storage works and compares four widely used platforms: Dropbox, Microsoft OneDrive, Google Drive, and Amazon Web Services S3.
What's a Database
A database server stores and manages structured data that can be accessed, queried, and shared across a network, serving as the backbone for applications and enterprise IT services.
Lab Options
Network simulation tools fall into three categories — physical equipment, emulators, and simulators — each with distinct trade-offs for hands-on learning and real-world application. Cisco Packet Tracer is the recommended starting point for certification study, with physical hardware and GNS3 as viable next steps.
Download and Install Packet Tracer
A walkthrough of downloading, installing, and launching Cisco Packet Tracer through the Cisco Skills for All platform, including account creation and initial login.
Navigating Packet Tracer
Packet Tracer's interface is built around a central map area for designing networks, supported by a menu bar, main toolbar, and a bottom panel for adding devices and connections. The workspace supports both logical and physical views of network topology.
Deploying Devices
Cisco Packet Tracer's device deployment interface organizes network components into six categories—network devices, end devices, components, connections, miscellaneous, and multi-user—each with context-sensitive submenus for precise selection. Devices are added to the workspace by dragging from the panel and can be removed using the delete tool, undone with standard undo/redo controls, or inspected by hovering.
Configuring Devices
A hands-on introduction to configuring routers, switches, and PCs in Cisco Packet Tracer, covering device placement, module installation, and basic CLI commands.
Connecting Devices
Connecting network devices in Cisco Packet Tracer requires selecting the correct cable type and manually specifying which ports to link between routers, switches, and end devices. Understanding connection status indicators and interface states is essential for building accurate network topologies.
Consoling into a Device
Console access is the standard method for configuring network devices like routers and switches, and Cisco Packet Tracer can replicate this physical connection process in a simulated environment. This covers how to connect a PC to a switch using a console cable, open a terminal session, and begin entering configuration commands via the CLI.
Crossover Cables
Crossover cables solve a fundamental Ethernet wiring problem that occurs when two devices of the same interface type are connected directly to each other. This content covers how crossover and straight-through cables differ, when each is required, and how MDI and MDIX interface configurations determine the correct cable choice.
What is Wireshark
Wireshark is a network protocol analyzer used to capture and inspect the binary data flowing across a network interface card. It translates raw bits into readable, structured information for troubleshooting, security analysis, traffic verification, and deeper understanding of how network communication works.
OSI Layers and Wireshark
A foundational look at the OSI model and how its seven layers relate to data communication and packet analysis in Wireshark. Covers data segmentation, addressing, encapsulation, and how each layer maps to protocols visible in captured traffic.
Downloading & Installing Wireshark
Wireshark is a free, open-source packet analyzer used for network troubleshooting and traffic inspection. This content covers downloading and installing Wireshark on a Windows 64-bit system using the default installation settings.
Capturing Data with Wireshark
Wireshark basics are covered through a live demonstration of selecting a network interface and capturing real traffic from an Ethernet connection on a test network.
Navigating Wireshark
Wireshark's interface is organized into a packet list, packet details, and packet bytes pane, each providing a different layer of visibility into captured network traffic. Understanding the layout is the foundation for effective packet analysis.
Sorting Data
Modern networks generate enormous volumes of captured traffic, making it essential to sort packet data by protocol, source, destination, or time to isolate what matters. This content covers how to use Wireshark's column-based sorting to quickly group and analyze specific traffic types.
Filtering Data
Wireshark's display filter system allows analysts to isolate specific network traffic by IP address, port, protocol, or direction, cutting through the noise of large packet captures. Filters can be typed manually or applied directly from captured packets using right-click context menus.
Other Basic Features
Wireshark's toolbar, capture controls, and display settings can be customized to make packet analysis faster and more efficient. Adjusting text size, managing capture files, and toggling interface panels like the packet bytes view helps tailor the workspace to your needs.
Switch/Router Tour
A physical walkthrough of enterprise-grade switches and a router, covering port layouts, status indicators, uplink options, and key hardware features. Includes side-by-side comparisons of Cisco 2960, 3750, and 1800 series equipment.
Getting to Know your Switch
A foundational look at network switches covering hardware differences, internal components, operating systems, and end-of-life planning. Core concepts apply equally to routers and form essential groundwork for Cisco IOS study.
Switch LED Indicators
Network switches use front-panel LEDs and a mode button to communicate port and system status at a glance. Understanding what each light color and behavior indicates is essential for quickly diagnosing connectivity, speed, duplex, and power delivery conditions.
Connecting to Equipment
Connecting to network equipment requires understanding the available access methods, terminal emulation software, physical cabling, and serial communication settings. This content covers console connections, rollover cables, and the signaling parameters needed to establish a successful session with Cisco switches and routers.
DEMO: Connecting to Equipment
Establishing a console connection to a Cisco device requires a rollover cable, a USB-to-serial adapter, and a terminal emulator configured to the correct COM port and baud rate. This process covers hardware identification, driver verification through Device Manager, PuTTY installation, and completing a live serial session to access the device CLI.
Boot Up Process
Cisco switches and routers follow a structured boot sequence that moves from hardware testing through IOS loading to configuration file processing. Understanding each stage — POST, bootstrap, IOS location, and startup config — is essential for managing and troubleshooting network devices.
DEMO: Boot Up Process
Covers the Cisco 2960 switch boot process, including POST, bootstrap loading, IOS initialization, and how to verify system information using the show version command.
IOS Command Structure
The Cisco IOS command structure defines how commands, required values, and optional parameters are entered at the CLI prompt. Understanding prompt modes, syntax notation, and parameter conventions is foundational to working effectively with Cisco devices.
DEMO: Configs
Network devices use distinct memory types and configuration files to manage settings across reboots. Understanding the difference between RAM-based running configuration and the persistent startup configuration is essential for maintaining consistent device behavior.
DEMO: Identifying Interfaces
This content covers how to identify and address physical and virtual network interfaces on Cisco switches, mapping what is visible on the hardware to how those ports appear in IOS. It also introduces interface naming conventions across devices like the Catalyst 2960 and 3750, including stackable switch configurations.
DEMO: Connecting a Computer
Covers the process of connecting a computer to a Cisco 2960 switch via Ethernet and manually configuring a static IPv4 address when no DHCP server is available on the network.
DEMO: Modes
Cisco IOS uses a structured hierarchy of modes — User EXEC, Privileged EXEC, and Global Configuration — each with distinct access levels and commands. Knowing how to navigate between these modes is fundamental to configuring and troubleshooting Cisco switches and routers.
DEMO: Getting Help in Cisco IOS
Cisco IOS includes a built-in help system that uses the question mark to display available commands, parameters, and syntax guidance based on the current CLI mode. Understanding how to use this feature reduces errors and speeds up navigation across the IOS command-line interface.
DEMO: Show Commands
Cisco show commands provide real-time visibility into switch and router behavior, covering interfaces, running configurations, MAC address tables, ARP entries, and more. This content walks through the most commonly used show commands executed from privileged exec mode.
DEMO: Filtering Show Commands
Cisco IOS output filters allow network administrators to narrow down the results of verbose show commands using pipe operators with keywords like begin, include, exclude, and section.
DEMO: Command History
Cisco IOS devices maintain a session-based command history that allows network administrators to quickly recall, review, and reuse previously entered commands. This feature supports faster troubleshooting and more efficient CLI navigation on switches and routers.
DEMO: Shortcuts
Cisco IOS includes a set of keyboard shortcuts and CLI techniques that significantly speed up device configuration and navigation. This content covers partial command entry, mode shortcuts, inline command execution, and console logging control.
DEMO: Setting a Hostname
Device naming conventions are a foundational network management practice that becomes critical at enterprise scale, where inconsistent naming can lead to costly configuration errors. This topic covers the hostname command on Cisco switches, including the syntax rules that govern valid device names.
DEMO: Setting the Clock
Accurate time synchronization across network devices is essential for log correlation, security auditing, and incident investigation. This content covers manual clock configuration and NTP server setup on network equipment.
DEMO: Console Passwords
Cisco network devices require properly configured password security to prevent unauthorized access through both the console port and privileged exec mode. This content covers how to set, encrypt, and manage passwords using enable password, enable secret, and service password-encryption commands.
DEMO: Management Interface and VTY Lines
Configuring a switch management interface involves assigning an IP address to VLAN 1, setting a default gateway, and enabling Telnet access through the virtual terminal lines so the device can be administered remotely over the network.
DEMO: Configure SSH
Telnet exposes network credentials and traffic in plain text, making SSH the required alternative for secure remote switch management. This content covers the full configuration process for enabling SSH on a Cisco switch, from verifying hardware capability to restricting VTY lines and testing the encrypted connection.
DEMO: Privilege Levels
Cisco IOS supports 16 privilege levels that can be assigned to individual user accounts, enabling granular access control on routers and switches. Levels 2 through 14 are fully customizable, allowing specific commands to be mapped to each level to enforce least privilege.
DEMO: Banners
Cisco IOS banners allow network administrators to display messages to users at login, serving both informational and security purposes. This content covers how to configure the Message of the Day, Login, and EXEC banners on a Cisco switch using global configuration mode.
DEMO: Host Records
Static host records on Cisco devices map hostnames to IP addresses locally, eliminating the need for a DNS server to resolve network equipment names. This technique is especially useful in lab and small network environments where a full DNS infrastructure is not available.
DEMO: Saving Settings
Saving a Cisco switch configuration requires copying the running config to the startup config, ensuring all changes persist through a reload. Two commands accomplish this: the explicit copy running-config startup-config and the shorthand write memory.
DEMO: Capturing Configs
Capturing and storing a copy of a router's running configuration provides a backup for recovery, auditing, or replication to another device. This process uses PuTTY's session logging feature to export the configuration output to a local file.
DEMO: Resetting Devices
Resetting a Cisco switch to factory defaults requires erasing the startup configuration and deleting the vlan.dat file from flash memory. Both steps are necessary to ensure no previous settings persist after a reload.
DEMO: Initial Configuration Dialog
A brand-new or reset Cisco switch has no configuration and prompts for initial setup on first boot. This walkthrough covers using the setup dialog to assign a hostname, set enable and VTY passwords, configure a management IP on VLAN 1, and access the switch remotely via Telnet.
DEMO: Recovering from lost password, Switch
Cisco switch password recovery walks through the full process of regaining enable mode access on a switch when the enable secret password has been lost or forgotten.
DEMO: Recovering from lost password, Router
Cisco router password recovery involves bypassing the startup configuration via ROM Monitor mode, resetting the enable secret, and restoring the configuration registry to its normal boot value. The process preserves all existing device settings while granting full administrative access.
DEMO: Changing the Boot Loading File
Keeping Cisco IOS devices up to date is essential for maintaining security and expanding feature support. This content covers the full process of upgrading IOS firmware on a Cisco router using a TFTP server.
DEMO: Using router as TFTP server
DEMO: Routed Interface Configuration
Routed interfaces are the Layer 3 counterparts to switch ports, requiring manual IP address assignment and activation before they can pass traffic. This content covers how to view interface status, assign an IP address, and bring a router interface online using Cisco IOS commands.
DEMO: Routed Ports on a Switch
Layer 3 switches can be configured to operate routed ports alongside standard switch ports, enabling IP-based routing at the interface level. This content covers the commands used to convert a switch port to a routed port and back again on a Cisco 3750.
DEMO: Dual Stack Configuration, Router
Dual stack router configuration enables a single device to handle both IPv4 and IPv6 traffic simultaneously. This covers enabling IPv6 unicast routing, assigning IPv6 addresses to an interface, and understanding how Cisco devices automatically generate EUI-64 link-local addresses.
DEMO: IPv6/Dual Stack Configuration, Switch
Dual-stack switch configuration covers enabling both IPv4 and IPv6 on a Cisco switch management interface using VLAN 1 as the target. The process includes activating IPv6 support via SDM templates, assigning a link-local address, and configuring a static global unicast address.
DEMO: Resetting Ports
The 'default interface' command resets all configurations on a Cisco router or switch interface back to factory defaults in a single step. It's a practical alternative to manually reversing individual commands when a clean starting point is needed.
DEMO: Troubleshooting Interface Issues
Essential CLI commands for diagnosing network interface problems on Cisco switches, including ping, show interfaces, show ip interface brief, and show buffers.
DEMO: CDP
Cisco Discovery Protocol (CDP) is a Cisco-proprietary Layer 2 protocol that automatically detects and shares device information between directly connected Cisco equipment. This coverage includes key CDP commands, interpreting neighbor data, and managing CDP at both the global and interface levels.
DEMO: LLDP
Link Layer Discovery Protocol (LLDP) is an open, vendor-neutral alternative to Cisco's proprietary CDP, enabling network device discovery across multi-vendor environments. This content covers how to enable and disable LLDP globally and at the interface level on Cisco equipment.
PoE
Power over Ethernet (PoE) allows network switches to deliver both data and electrical power over a single Ethernet cable, eliminating the need for separate power supplies on devices like wireless access points and VoIP phones.
DEMO: Loopback Configuration
A loopback interface is a virtual interface configured on a router for troubleshooting and protocol support. This content covers how to create and assign both IPv4 and IPv6 addresses to a loopback interface using global configuration mode on a Cisco router.
IPv6 Overview
IPv6 is the next-generation internet addressing protocol, designed to replace IPv4 with a vastly larger address space and improved networking capabilities. This overview covers the evolution of IP addressing, IPv6 address formatting, address types, assignment methods, and Neighbor Discovery Protocol.
DEMO: IPv6 Addresses On Windows
IPv6 addresses on a Windows machine include a link-local address, a globally unique address, a temporary address for privacy, and corresponding default gateway entries, all visible through the ipconfig command. Each address type serves a distinct role in network communication and device identification.
IPv6 Address Format
IPv6 addresses use 128 bits organized into eight 16-bit hextets expressed in hexadecimal notation, with prefix lengths defining network boundaries and two shorthand rules available to simplify address representation.
IPv6 Address Types
IPv6 eliminates broadcast traffic in favor of three address types—unicast, multicast, and anycast—each serving a distinct communication role across local and global networks.
IPv6 Multicasting
IPv6 multicasting is a core mechanism that delivers traffic to specific groups of devices rather than broadcasting to all nodes on a network. This coverage includes multicast scoping, well-known multicast addresses, and the solicited node multicast address.
DEMO: IPv6 Multicast Addresses on Windows
A Windows machine is queried using the netsh command to display its active IPv6 multicast group memberships, revealing interface-local, link-local, and solicited-node multicast addresses. The demonstration also shows how to research unfamiliar multicast group designations using publicly available IANA reference resources.
LLA & EUI 64
IPv6 link-local addresses allow devices to communicate on a local network segment without any external server or router, and the EUI-64 process derives these addresses directly from a device's MAC address. Duplicate Address Detection (DAD) then verifies that the generated address is unique on the network before it is used.
IPv6 Packet Headers
The IPv6 packet header uses a fixed 40-byte structure that streamlines routing by eliminating fields like checksums and fragmentation found in IPv4. This coverage compares the two header formats side by side and breaks down each field in the IPv6 header, including traffic class, flow label, payload length, next header, hop limit, and source and destination addresses.
DEMO: Wireshark, IPv6 Packet Headers
This content covers how to capture and analyze IPv6 web traffic using Wireshark, with a focus on reading the fields inside an IPv6 packet header.
Transitioning from IPv4 to IPv6
Migrating from IPv4 to IPv6 requires careful planning, and three core transition strategies make that shift manageable: dual stack, translation, and tunneling. Each method allows networks to adopt IPv6 incrementally without requiring an immediate, full cutover.
Neighbor Discovery Protocol (NDP)
Neighbor Discovery Protocol (NDP) is a core component of IPv6 that handles MAC address resolution, router discovery, and traffic redirection using ICMPv6 message types. It replaces ARP-based broadcast mechanisms with multicast-driven solicitation and advertisement exchanges.
NDP - Neighbors
IPv6 Neighbor Discovery Protocol relies on neighbor solicitation and neighbor advertisement messages to resolve MAC addresses and detect duplicate addresses on a network segment, replacing the broadcast-based ARP process used in IPv4.
DEMO: Wireshark, Multicast Membership
A Windows machine running IPv6 automatically joins several multicast groups when connected to a network. This demonstration uses Wireshark and the netsh command to capture and examine those multicast memberships in real time.
DEMO: Wireshark, NDP - Neighbors
Neighbor Discovery Protocol (NDP) is the IPv6 mechanism for resolving MAC addresses, replacing the ARP broadcasts used in IPv4 with targeted multicast communication. This content covers how neighbor solicitation and neighbor advertisement packets work, examined through live Wireshark packet captures.
DEMO: Wireshark, Duplicate Address Discovery (DAD)
Duplicate Address Detection (DAD) is an IPv6 process that uses the Neighbor Discovery Protocol to verify that a newly generated address is unique before a device begins using it. This topic is examined through live Wireshark packet captures showing exactly how DAD operates at both Layer 2 and Layer 3.
NDP - Routers
Neighbor Discovery Protocol (NDP) enables IPv6 devices to obtain network configuration automatically through Router Solicitation and Router Advertisement messages exchanged between hosts and routers.
DEMO: Wireshark, NDP - Routers
Router Solicitation and Router Advertisement are the IPv6 mechanisms by which a device discovers routers on its local network and receives prefix and configuration information. This content uses a live Wireshark capture to show how these ICMPv6 messages work in practice.
Assigning IPv6 Adresses
IPv6 eliminates the need for DHCP servers by using Stateless Address Autoconfiguration (SLAAC), a built-in mechanism that allows devices to generate and assign their own globally unique addresses. SLAAC is the preferred IPv6 address assignment method due to its simplicity, reduced infrastructure dependency, and lower configuration overhead.
DEMO: Static IPv6 Addresses on Windows
Covers how to manually assign a static IPv6 address on a Windows machine using both the modern Network Settings interface and the legacy adapter properties dialog. Includes verification through the command prompt using ipconfig.
DEMO: Static IPv6 Addresses on Linux
Covers how to assign a static IPv6 address to a network interface on a Raspberry Pi by editing the DHCP configuration file and verifying connectivity with a ping test.
DEMO: Wireshark, SLAAC
This content covers how a device acquires an IPv6 address when first connected to a network, including DHCP discovery, router solicitation and advertisement, and duplicate address detection. Wireshark packet captures are used to trace each step of the process in real time.
Design Requirements
Effective IT and security deployments start with clearly defined design requirements drawn from best practices, frameworks, regulations, and business needs. Skipping this planning phase is a leading cause of project failure, cost overruns, and solutions that miss the mark.
Requirements: Expense
Cost and business impact are critical but often overlooked factors in security architecture. Effective security proposals require translating technical requirements into financial terms that executive stakeholders understand and can approve.
CIA Triad and the 5-Pillars of Security
The CIA triad—confidentiality, integrity, and availability—defines the core objectives of cybersecurity, and the five pillars model extends this framework by adding authenticity and non-repudiation. Together, these models provide a structured way to evaluate and measure the security of any system or design.
Requirements: Confidentiality
Confidentiality, a core pillar of the CIA triad, ensures that sensitive information is accessible only to authorized individuals and stays protected from unauthorized exposure. A single breach can trigger legal liability, customer notification requirements, and significant financial and reputational damage.
Requirements: Integrity
Data integrity ensures that information remains accurate and unaltered as it moves through systems and networks. It is a foundational pillar of the CIA triad and a critical consideration in the design of any secure technology.
Requirements: Availability
Availability ensures that systems, services, and data remain accessible when needed — and losing it can mean lost customers, revenue, and trust. This content covers what availability means in IT contexts and why maintaining it is a core infrastructure priority.
Requirements: Performance
Performance is closely tied to availability in cybersecurity — when systems respond too slowly to be usable, the practical impact mirrors a full outage. Degraded performance risks customer frustration, reputational damage, and lost revenue.
Requirements: Authenticity
Authenticity in cybersecurity ensures that data or communications can be verified as coming from their claimed source, with no dispute about their origin. It is a distinct concept from authentication, though the two are closely related.
Requirements: Non-Repudiation
Non-repudiation ensures that the sender of a message cannot later deny having sent it, providing a verifiable link between a message and its origin. Though closely related to authenticity, the two concepts serve different sides of the same communication.
Requirements: Manageability
Manageability refers to how easily a technology deployment can be operated, maintained, updated, and decommissioned over its lifetime. The architecture choices made at rollout directly determine the long-term cost and complexity of ongoing management.
Requirements: Scalability
Scalability is the ability to grow IT infrastructure without a proportional increase in headcount or manual effort. This content covers the principles of scalable design, the difference between scalability and manageability, and the distinctions between vertical and horizontal scaling.
Requirements: Regulation and Compliance
Regulatory compliance is a foundational driver of security design, requiring IT professionals to align their implementations with applicable laws based on industry, geography, and data handling practices. Understanding these obligations is essential for protecting consumer data and meeting organizational security standards.
Security Architecting Principles
Security architecture principles are the foundational guidelines that drive decisions when designing secure networks and infrastructure. Understanding what these principles are, where they come from, and how to apply current ones correctly is essential before putting any design into practice.
Minimize Attack Surface
Attack surface management is the practice of identifying and reducing every possible entry point into a network, from physical ports and wireless signals to software, data files, human targets, and third-party vendors.
Simplicity
Complexity is the enemy of security — it reduces visibility, expands the attack surface, and increases the chance of human error. The KISS principle reminds security professionals to keep designs as simple as possible without sacrificing essential requirements like availability.
Least Functionality
Least functionality is the principle of configuring systems with only the capabilities they truly need, reducing the number of potential vulnerabilities an attacker can exploit.
Least Privilege
The principle of least privilege limits users, applications, and systems to only the access they need to perform their specific function, reducing the attack surface if an account or system is ever compromised.
Segmentation
Segmentation is the security principle of dividing systems, data, and access into separate sections to reduce exposure and limit the impact of a compromise. Applying it correctly ensures users and systems can only reach what they genuinely need.
AAA Model
The AAA model defines three core security principles — authentication, authorization, and accounting — used to control and monitor access to systems and resources. Understanding this framework is foundational to implementing effective access control in both network and broader IT environments.
Defense-in-depth
Defense in depth is a layered security strategy that places multiple safeguards throughout a network rather than relying solely on perimeter protection. If one layer fails, additional barriers continue to protect critical systems and data.
Zero Trust Principle
Zero trust is a security principle built on the idea of never trusting and always verifying, requiring continuous authentication and authorization rather than granting blanket access based on network location. It addresses weaknesses in traditional perimeter-based security by checking every user and device on an ongoing basis.
Data and Control Planes
The data plane and control plane are a security architecture model that segments day-to-day data handling from routing and management decisions, improving security, scalability, and performance across networking equipment, software, and databases.
Redundancy
Network redundancy ensures critical systems remain available when components inevitably fail, covering everything from power and cooling to hardware, software, and data. Building redundancy into a network is a foundational principle for maintaining consistent availability.
Encryption
Encryption is a foundational security control applied to data in three states: at rest, in transit, and in use. Understanding where and at what level to encrypt data helps balance security strength with system performance.
What is the IT Infrastructure?
IT infrastructure encompasses all the hardware, software, networking, data, and services required to deliver IT capabilities to a business. The composition of that infrastructure — whether on-premises, cloud-based, or collocated — directly shapes how security is managed and who controls it.
Deployment Models
An introduction to server deployment models, covering the client-server relationship, the limitations of physical infrastructure, and how virtualization, containerization, and serverless computing address those challenges.
Bare Metal
Bare metal deployment means installing an operating system and services directly onto physical hardware, offering simplicity and high performance at the cost of scalability and deployment flexibility.
Virtualization
Virtualization creates an abstraction layer between software and hardware, allowing multiple operating system instances to run on shared physical resources. This approach delivers cost savings, rapid deployment, scalability, and resilience across servers, storage, networking, and desktop environments.
Hypervisors
Hypervisors are software abstraction layers that sit between physical hardware and virtual machines, allowing multiple operating systems to run independently on a single server. Type 1 hypervisors run directly on bare metal, while Type 2 run on top of an existing operating system, each with distinct performance and scalability trade-offs.
Containerization
Containerization is a lightweight alternative to traditional virtualization that packages only the components needed to run a specific service, enabling fast deployment and easy scaling. Unlike hypervisors, containers share the host operating system's kernel rather than running fully independent environments.
Serverless
Serverless computing allows code to run on demand through cloud-based services without managing dedicated infrastructure, making it a cost-efficient option for infrequent or lightweight workloads.
Microservices
Microservices architecture breaks applications into small, independently deployable services that communicate with each other, offering greater scalability and manageability than traditional monolithic designs. It has become a dominant approach in modern software development, particularly when combined with container technologies.
Centralized vs decentralized
Centralized and decentralized infrastructure models each carry distinct trade-offs in management, bandwidth, flexibility, and compliance that shape how IT services are deployed across an organization.
Cloud Deployment Models
Cloud computing builds on virtualization and containerization to give organizations flexible alternatives to maintaining costly on-premises infrastructure. Modern businesses typically operate across a spectrum of service models, from fully local systems to colocation, IaaS, PaaS, and SaaS.
Shared Responsibility Model
The shared responsibility model defines how security duties are divided between cloud service providers and their customers, clarifying where one party's obligations end and the other's begin. Understanding this model is essential for IT professionals who rely on third-party vendors to host or manage any part of their infrastructure.
On-Premisses
On-premise infrastructure means an organization owns and manages all hardware, software, and facilities in-house, from firewalls and switches to power backup and cooling systems. Understanding its cost, control, and security trade-offs is essential for evaluating whether local hosting or cloud migration is the right fit for a given business.
Colocation
Colocation is a hosting arrangement where organizations rent physical space in a third-party data center while retaining full ownership and control of their own equipment. It offers a practical middle ground between fully on-premises infrastructure and outsourced cloud or managed services.
Infrastructure as a Service (IaaS)
Infrastructure as a Service (IaaS) provides on-demand access to virtualized servers, storage, and networking, allowing organizations to manage only the operating system and above while the cloud provider handles all underlying hardware and infrastructure.
Platform as a Service (PaaS)
Platform as a Service (PaaS) extends beyond Infrastructure as a Service by managing not just the underlying hardware and virtualization, but also the operating system and runtime environment. AWS RDS is a practical example, offering managed database instances where users interact directly with the database without handling the OS or software configuration.
Software as a Service (SaaS)
Software as a Service (SaaS) delivers applications through a browser or app without requiring local installation, with the provider managing all underlying infrastructure. Common examples include Microsoft 365, Salesforce, Dropbox, Slack, Zoom, and Netflix.
Service Providers
Cloud service providers, managed service providers (MSPs), and managed security service providers (MSSPs) are the three primary categories of external IT service providers organizations rely on to support and secure their infrastructure.
Deployment Model Considerations
Choosing an infrastructure deployment model requires weighing cost, security, compliance, scalability, and organizational readiness across on-premises, cloud, and hybrid options. Each factor carries trade-offs that vary depending on business size, staff expertise, and data sensitivity.
Network Security
Network security fundamentals cover how to protect the perimeter of a network, control data flow through segmentation, and manage access to critical infrastructure resources. Segmentation is a central strategy for limiting exposure and maintaining control over traffic moving in and out of a network.
Network Segmentation
Network segmentation divides infrastructure into isolated zones to limit the spread of threats and restrict access based on role, risk level, or device type. Separating networks at Layer 2 reduces broadcast exposure, makes lateral movement harder, and enables tighter access control through firewalls and access policies.
Logical Segmentation
VLANs enable logical network segmentation by dividing a single physical switch into multiple isolated networks, reducing hardware costs while maintaining traffic separation. This approach supports organized, secure network design without requiring dedicated switches for each segment.
Network Isolation
Isolated networks restrict communication between network segments to protect sensitive resources from unauthorized access. This concept covers how and why network isolation is applied across backend servers, guest networks, and individual devices.
Air Gapped
An air-gapped network is completely isolated from external connections, preventing any outside access to sensitive systems. This approach is used to protect critical data or to contain compromised machines before they can spread malware.
Routers
Routers enable controlled communication between segmented networks by operating at Layer 3, and access control lists can be applied to restrict or permit traffic between those segments.
Network Access Control Lists (NACLs)
Network access control lists (ACLs) define what traffic is permitted or denied between network segments, making them a critical component of effective network security. They can be applied at routers, firewalls, and other devices to enforce boundaries between networks such as internal, guest, and server zones.
Rules
Access control lists (ACLs) on routers and firewalls use permit and deny rules to filter traffic based on source and destination IP addresses and port numbers. Understanding the structure of these rules is essential for controlling how packets move between networks.
How Rules are Processed
Network access control lists process rules in a strict top-down order, applying the first matching rule and stopping immediately, with an implicit deny for any traffic that matches nothing.
Implicit Deny Any Rule
Access control lists include a built-in implicit deny rule that automatically blocks any traffic that doesn't match an explicitly defined entry, even though this rule is never manually created.
Applying Rules to an Interfaces Direction
Network access control lists (ACLs) filter traffic on Layer 3 devices by applying rules to specific interfaces and directions, making precise placement essential to effective traffic control.
Established Traffic
Established traffic rules allow ACLs to permit inbound packets only when they are replies to outbound requests originating from inside the network, blocking unsolicited traffic from external threat actors. This mechanism forms the foundation of stateful packet inspection and modern firewall behavior.
Firewalls
Firewalls are a foundational network security control that filter and regulate traffic between trusted and untrusted network segments. This content covers how firewall technology has evolved from simple packet filtering to stateful inspection, application-layer analysis, unified threat management, and next-generation and machine learning-based systems.
How Firewalls Work
Firewalls control network traffic by enforcing access rules on incoming connections while allowing outbound traffic to flow freely. This content covers how a stateful firewall like OPNsense manages multiple network interfaces to protect internal systems from unauthorized access.
Security Zones
Firewall security zones divide a network into distinct segments—such as internal, external, and DMZ—each with its own rules and interface assignments. Zone-based firewalls extend this model by binding permissions to the zone itself rather than to individual interfaces.
Screened Subnets
A screened subnet is an isolated network segment that allows external users to access specific services while keeping the internal network protected behind a firewall. This architecture limits the blast radius of a compromised public-facing server by ensuring it never has a direct path to internal systems.
Stateful Firewalls
Stateful packet inspection improves on stateless firewall filtering by tracking the full state of network conversations rather than evaluating each packet in isolation. This approach allows firewalls to make more informed, context-aware decisions about which traffic to permit or deny.
Network Address Translation (NAT) Gateway
NAT gateways translate private internal IP addresses to public routable addresses, conserving IPv4 address space while creating an inherent layer of stateful security that blocks unsolicited inbound traffic.
Application Layer Filtering
Application layer filtering allows firewalls to inspect actual traffic content rather than relying solely on port numbers, closing a significant gap that adversaries can exploit. This advancement helps ensure that the application communicating across the network matches what the firewall expects to see.
Intrusion Detection and Pervention Systems (IDS/IPS)
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are security tools that monitor network traffic for signs of unauthorized access, with IDS alerting administrators to threats and IPS automatically taking action to stop them.
Device Attributes
Covers the key configuration decisions for network security devices, including passive versus active operation and inline versus monitor deployment modes.
Unified Threat Management (UTM)
Unified Threat Management (UTM) is a network security device that consolidates multiple protection capabilities—including firewall, antivirus, intrusion prevention, and content filtering—into a single, centrally managed appliance. It evolved from traditional firewalls as organizations needed a more comprehensive and manageable approach to edge network security.
Deep Packet Inspection
Deep packet inspection (DPI) goes beyond traditional firewall filtering by examining the actual data payload inside network packets, enabling detection of malware, data exfiltration, and other threats that IP header analysis alone would miss.
Next-Generation Firewall (NGFW)
Next-generation firewalls (NGFWs) represent the latest evolution in firewall technology, distinguished primarily by deep packet inspection and an expanded feature set that typically includes IPS, VPN, antivirus, and content filtering capabilities. The term was coined by Gartner to describe firewalls that had accumulated enough advanced functionality to merit a new classification.
Software Defined Networking (SDN)
Software-defined networking (SDN) virtualizes network management by introducing a centralized control layer that abstracts configuration away from individual devices. This allows administrators to define high-level network behavior once, with the underlying infrastructure handling implementation automatically.
SDN Data and Control Planes
Software-defined networking separates the data plane, which handles the physical forwarding of traffic between devices, from the control plane, which governs how that traffic flows and is managed by a centralized SDN controller.
Network Access
Network access control covers the methods and policies used to determine who and what can connect to a network, whether through physical connections, wireless, or remote access channels like VPNs and RDP. Understanding these concepts is foundational to implementing a defense-in-depth security strategy.
Port Security
Port security controls network access by restricting which devices can connect to a switch port based on MAC addresses, offering a simple but limited layer of physical network protection.
802.1x
802.1X is a network access control standard that authenticates devices and users before granting network access, offering stronger security and greater flexibility than MAC address-based port security.
Authentication Protocols
Authentication protocols define how users, devices, and services verify their identity before gaining access to a network, device, or resource. This topic covers the core protocols used in point-to-point connections and AAA (Authentication, Authorization, and Accounting) frameworks.
Extensible Authentication Protocol (EAP)
Extensible Authentication Protocol (EAP) is a widely used authentication framework that defines how authentication protocols should be structured, enabling a flexible range of methods such as EAP-TLS, EAP-MD5, and EAP-FAST. It supports diverse credential types including certificates, pre-shared keys, and username-password combinations.
Encapsulating EAP
EAP methods handle the authentication layer in network communications, but require encapsulation protocols like RADIUS or Diameter to carry that authentication traffic between devices. This content covers how EAP encapsulation works within frameworks like 802.1x.
EAPOL Protocol
EAPOL (Extensible Authentication Protocol over LAN) is the protocol that enables 802.1X port-based authentication by carrying EAP credentials between a device and a network switch before an IP address is assigned. It serves as the communication bridge that allows a supplicant to authenticate against a network before gaining full access.
AAA Services
AAA (Authentication, Authorization, and Accounting) is a security framework used to manage network access at scale through centralized authentication servers rather than local device databases. Common protocols implementing this model include TACACS+, RADIUS, and Diameter.
RADIUS
RADIUS is a widely used AAA (authentication, authorization, and accounting) protocol that enables centralized user authentication across a range of network access scenarios. Originally developed for dial-up modem environments, it remains a standard component in VPN authentication, network device access, and 802.1X port-based access control.
802.1X Summary
802.1X is a network access control standard that uses a three-component model — supplicant, authenticator, and authentication server — to verify identities before granting network access. It supports both wired and wireless environments and replaces weaker methods like pre-shared keys with certificate- or credential-based authentication.
Wireless Security
Wireless network security covers the principles and tools used to protect Wi-Fi infrastructure, from site planning and signal management to encryption standards and authentication protocols.
Network Access Control (NAC)
Network Access Control (NAC) goes beyond 802.1X authentication by evaluating whether a device meets defined security requirements—such as patch status, antivirus currency, and endpoint protection—before and after granting network access.
Zero Trust Networking
Zero trust is a security methodology built on the principle of never trusting and always verifying, using continuous policy-driven checks to ensure devices and users remain compliant throughout their session. It replaces traditional perimeter-based security with adaptive identity assessment and ongoing access control.
Zero Trust’s Data and Control Plane
Zero trust networks separate traffic handling and access decision-making into two distinct planes: the data plane and the control plane. The data plane enforces access at the policy enforcement point, while the control plane evaluates requests through a policy engine and policy administrator before returning an allow or deny decision.
Deperimeterization
Deperimeterization is a modern network security mindset that shifts focus away from perimeter defenses like firewalls toward protecting the entire network from within. Policy-driven approaches such as zero trust and network access control are central to this strategy.
Remote Connection
Virtual private networks and related technologies allow organizations to extend secure network access to remote workers and branch offices over public internet connections, replacing costly legacy dial-up and leased-line solutions.
VPN
A VPN (virtual private network) uses encryption to secure traffic traveling across public networks, making data unreadable to anyone who intercepts it. This content covers how site-to-site and client-to-site VPNs work, along with the protocols that support them.
Software-Defined WAN (SD-WAN)
Software-Defined WAN (SD-WAN) separates the control plane from the data plane in wide area networks, enabling centralized management of routing, VPN connections, access control lists, and traffic policies across all sites from a single location. This architecture improves scalability, flexibility, performance, and security while reducing the manual configuration overhead associated with traditional WAN deployments.
Customer-to-Cloud Connectivity
Cloud connectivity varies by service model, with SaaS platforms typically accessed via HTTPS through a browser or client app, while IaaS, PaaS, and colocation environments often require direct connections or VPNs for backend infrastructure access.
Cloud Access Security Broker (CASB)
A cloud access security broker (CASB) is a third-party security service that sits between an organization and its cloud applications to enforce visibility, threat protection, data security, and compliance. It addresses critical risks like shadow IT and unauthorized data uploads by monitoring and controlling how cloud resources are accessed and used.
Secure Access Secure Edge (SASE)
SASE (Secure Access Service Edge) is a network security framework that combines SD-WAN with cloud-delivered security services to protect network edges and remote connections. Originally coined by Gartner, it bundles technologies like secure web gateways, cloud access security brokers, zero trust network access, and firewall-as-a-service into a unified architecture.
Jump Server
A jump server is a controlled access point that allows remote users to connect to internal network resources without exposing the broader network to outside traffic. It supports connections via SSH for command-line access or RDP and VNC protocols for full desktop sessions.
Virtual Desktop Infrastructure (VDI)
Virtual Desktop Infrastructure (VDI) enables organizations to host and deliver large numbers of virtual desktops to remote users through a centralized hypervisor-based environment. It scales beyond single-user remote access solutions to support entire user populations accessing dedicated virtual machines over a network.
Deception and Disruption Technologies
Deception and disruption technologies redirect adversaries away from real network assets and into controlled environments designed to monitor and analyze their tactics. Tools like honeypots, honeynets, and honey files are core examples of this defensive strategy.
Honeytoken
A honey token is a fake data entry placed inside a real dataset to detect theft — if the decoy ever gets used, it confirms the data has been compromised.
What are Endpoints?
Endpoint security starts with understanding which devices on a network require protection and how to harden them against attack. This covers the full scope of endpoints — from workstations and servers to mobile devices, IoT systems, and managed network infrastructure.
Endpoint Security
Endpoint security architecture covers the built-in technologies, configuration practices, protective software, and maintenance procedures that keep networked devices secure. Central to this process is hardening — a structured set of steps applied to each device to reduce vulnerabilities before and after deployment.
Built-In Security Technologies
Modern devices ship with built-in hardware and software security features that require little to no configuration, including technologies like the Trusted Platform Module, Hardware Security Module, Secure Enclave, self-encrypting drives, and Address Space Layout Randomization. This content provides a high-level introduction to each of these technologies and the roles they play in device security.
Full Disk Encryption (FDE)
Full disk encryption (FDE) secures an entire drive—including the operating system—against unauthorized access, offering stronger protection than file- or folder-level encryption alone.
Key Management Systems (KMS)
A key management system (KMS) handles the creation, storage, distribution, and management of keys — whether physical, credential-based, or cryptographic. Understanding KMS concepts is foundational to endpoint security and broader IT infrastructure protection.
Trusted Platform Module (TPM)
The Trusted Platform Module (TPM) is a dedicated cryptographic chip that enables full disk encryption and platform integrity verification by securely generating, storing, and managing encryption keys tied to a specific machine's hardware fingerprint.
Secure Enclave
Secure Enclave is a term with four distinct definitions, ranging from a general concept of an isolated high-security zone to Apple's dedicated chip section for cryptographic processing, which functions similarly to a TPM.
Hardware Security Module (HSM)
A hardware security module (HSM) is a dedicated device that handles enterprise-level cryptographic operations and secure key management at high performance. It differs from a TPM in scope and scale, operating across infrastructure rather than serving a single local machine.
Address Space Layout Randomization (ASLR)
Address Space Layout Randomization (ASLR) is a memory protection mechanism that defends against buffer overflow attacks by randomizing where data is stored in RAM each time it is written. This prevents attackers from reliably targeting specific memory locations to execute malicious code.
Hardening Techniques
System hardening reduces device vulnerabilities by replacing default settings, credentials, and configurations with secure, purpose-built ones before equipment is deployed to a network. A structured approach using vendor best practices, secure baselines, and deployment templates helps ensure consistent hardening across an infrastructure.
Hardening - Updates
New hardware often ships with outdated firmware due to the time elapsed between manufacturing and deployment, making it essential to apply patches and updates before putting any device into production.
Hardening - Boot Order
Controlling the boot order on a computer is a foundational security measure that prevents unauthorized users from bypassing the operating system by booting from external media such as USB drives or network sources. Disabling unused boot options like PXE and USB boot reduces the attack surface and keeps the system locked to its intended startup path.
Hardening - BIOS Password
The BIOS is the foundational firmware that initializes hardware and loads the operating system, and securing it with a password prevents unauthorized changes to critical settings like boot order that could be used to bypass system security.
Hardening - Change Default Passwords
Default credentials on network hardware pose a serious security risk, as they are publicly documented and can be exploited by anyone with network access. Changing credentials immediately upon device setup is a fundamental step in securing any environment.
Hardening - Disabling Unused Accounts
Hardening - Remove Unnecessary Software
Every piece of installed software introduces a potential attack vector, making it essential to minimize unnecessary applications on any system. Reducing software exposure is a foundational step in hardening a machine against vulnerabilities.
Hardening - Remove Unused Services
Unused system services expand the attack surface by introducing unnecessary software vulnerabilities that threat actors can exploit. Disabling any services not actively required is a straightforward way to reduce exposure and harden a system.
Hardening - Close Unused Ports and Protocols
Network ports act as virtual connection points on a machine, and leaving unused ports open creates unnecessary vulnerabilities that attackers can exploit. Reducing the attack surface means identifying and closing any port or protocol that is not actively in use.
Secure Baselines
Secure baselines provide standardized checklists for hardening IT equipment, drawing from sources such as product developers, vendors, government bodies like NIST, and security organizations. Organizations typically adopt, adapt, or combine these baselines to fit their specific environments.
Group Policy
Group Policy is a Windows feature that allows administrators to enforce consistent security configurations across all machines in a network through an Active Directory domain controller. It covers settings like screen lock timeouts, password complexity requirements, and password history restrictions.
SELinux
SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) framework that adds a centrally managed security layer on top of Linux's default discretionary access control (DAC) permissions. It can be configured in disabled, enforcing, or permissive modes to control or monitor resource access.
Host-based Firewall
Host-based firewalls are software firewalls installed directly on individual devices, providing a layer of protection that network-based firewalls alone cannot deliver.
Antivirus and Antimalware
Malware represents one of the most common methods adversaries use to compromise networks, making anti-malware protection an essential control across all enterprise devices. This content covers what malware and viruses are, how anti-malware solutions work, and how organizations manage endpoint protection at scale.
HIDS and HIPS
Host-based intrusion detection and prevention systems (HIDS/HIPS) are software solutions installed directly on individual machines to monitor and respond to threats that network-level systems cannot see. Understanding the distinction between detection and prevention, and between host-based and network-based implementations, is essential for building a complete defense strategy.
Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) protects systems by monitoring behavioral patterns rather than scanning for known malicious code, making it effective against novel and emerging threats. Extended and managed variants—XDR and MDR—broaden that coverage across entire networks and through third-party security providers.
Application Control
Application control restricts which software can run on a system, offering a targeted way to reduce vulnerabilities and prevent unauthorized installations. Two core approaches—allow lists and deny lists—provide different levels of restriction depending on the security requirements of the environment.
Device Security
Device security management covers the unique challenges of securing endpoints like IoT devices and mobile devices, including deployment models, shadow IT risks, patching, and wireless communication vulnerabilities.
Device Deployment Models
Mobile device deployment models define how organizations provision, own, and control the devices employees use for work, each carrying distinct trade-offs between security, cost, and usability. The four primary models are corporate-owned, choose your own device (CYOD), corporate-owned personally enabled (COPE), and bring your own device (BYOD).
Choose Your Own Devices (CYOD)
A real-world walkthrough of one IT director's transition from company-assigned equipment to a choose-your-own-device model at a fully remote SaaS company, covering the business logic, logistics, and trade-offs behind both approaches.
Bring Your Own Device (BYOD)
BYOD (Bring Your Own Device) covers the security risks, support challenges, and organizational benefits of employees using personal devices for work. It also examines the technologies and trends making BYOD more viable for modern businesses.
Mobile Device Management (MDM)
Mobile device management (MDM) is both a strategy and a software solution for securing and remotely managing smartphones, laptops, tablets, and other mobile devices across an organization. MDM gives IT teams centralized control over patching, configuration, application access, encryption, and remote wipe capabilities.
Internet of Things (IoT)
The Internet of Things (IoT) refers to everyday physical devices—appliances, locks, thermostats, cameras, and more—that have been connected to the internet to add functionality and remote control capabilities. Unlike traditional computers, these are objects that historically operated without network connectivity.
Embedded Systems
Embedded systems are specialized computer systems built into specific devices, controlling their functions in a compact form factor. As IoT adoption grows, so does the presence of embedded systems across connected devices.
Real-Time Operating System (RTOS)
Real-time operating systems (RTOS) are designed for applications where processing delays are unacceptable, providing precise, near-instantaneous responses between input and output. They are classified by tolerance level — hard, firm, or soft — depending on how critical timing is to the system's function.
Application Specific Integrated Circuit (ASIC)
An application-specific integrated circuit (ASIC) is a chip purpose-built to perform a defined set of functions faster and more cost-effectively than a general-purpose CPU. Understanding ASICs is essential for anyone working with specialized networking hardware like switches and routers.
System-On-Chip (SoC)
A system on a chip (SoC) integrates all core computing components—CPU, RAM, storage, and firmware—onto a single integrated circuit, replacing the separate parts found in traditional computer architectures. This approach enables the compact, efficient designs required by modern embedded and specialized devices.
Operational Technology (OT)
Operational technology (OT) refers to the systems and software used to manage industrial operations, including PLCs, SCADA, DCS, and building management systems. These environments carry distinct cybersecurity risks that differ significantly from traditional IT infrastructure.
Industrial Control Systems (ICS)
Industrial control systems (ICS) are the hardware, software, and networking components used to monitor, automate, and manage industrial processes such as HVAC, access control, and factory operations. They share many of the same vulnerabilities as broader operational technology environments.
Supervisory Control and Data Acquisition (SCADA)
SCADA, or Supervisory Control and Data Acquisition, is a type of industrial control system that centrally manages physical equipment by sending commands and collecting real-time data from sensors and controllers on the floor. Understanding its core components and communication protocols is foundational to securing operational technology environments.
Programmable Logic Controller (PLC)
Programmable logic controllers (PLCs) are the core hardware components in industrial control systems, responsible for sending control data and instructions to individual devices on the factory floor. PLCs are programmed through systems such as SCADA, which communicate with the controllers to define and manage their operational tasks.
Remote Terminal Unit (RTU)
Remote terminal units (RTUs) are field-deployed industrial controllers used in SCADA environments to manage equipment in remote or infrastructure-sparse locations. Though similar to PLCs, RTUs are optimized for distributed deployments where centralized server access is unavailable.
Client Application Security
Client-side application security covers the risks introduced when software on an end-user machine communicates with external servers, and the controls needed to address those risks.
Application Control
Application control restricts which software can run on a system, offering a more targeted layer of security than anti-malware alone by addressing risks like shadow IT and unauthorized installations.
Code Signing
Code signing uses digital certificates and public key infrastructure to verify the authenticity and source of software before installation. A timestamp authority extends this trust beyond certificate expiration, ensuring signed code remains valid over time.
Sandboxing
Sandboxing is a security and development technique that isolates programs or code in a controlled environment, preventing untrusted or potentially malicious software from affecting live systems or the broader network. It is widely used in both cybersecurity analysis and software development workflows to safely test, examine, and validate programs before they reach production.
Configuration Enforcement
Secure software installation isn't enough on its own — configuration enforcement ensures applications and devices are consistently locked down to meet security and operational requirements.
Secure Web Browsing
Web browsers introduce significant security risks by executing remote code on local systems, but multiple protective mechanisms exist to keep end users safe. Technologies like PKI, URL scanning, web filtering, proxy servers, browser isolation, and DNS security all play a role in securing the browsing environment.
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) establishes a chain of trust between web clients and servers by using certificate authorities to verify domain ownership and authenticate encrypted communications. It provides integrity, confidentiality, and message authenticity, though it does not guarantee that a verified server is free from malicious intent or compromise.
Universal Resource Locator (URL) Scanning
URLs can be manipulated to disguise malicious destinations, making URL scanning an essential tool for identifying and blocking deceptive web addresses before they cause harm. Understanding how URLs are structured helps explain why this type of filtering is a critical layer of network security.
Web Filtering
Web filtering protects users and organizations from malicious websites by controlling which online destinations are accessible on a network. Solutions range from agent-based software installed on individual machines to proxy servers, inline filters, and firewall-integrated tools.
Proxy Server
A proxy server acts as an intermediary between clients and servers, enabling organizations to filter web traffic, enforce security policies, improve performance, and preserve anonymity. Understanding how proxies work and the various types available is essential knowledge for network administration and cybersecurity roles.
Browser Isolation
Browser isolation protects client machines by rendering web content on a remote server and streaming only visual images to the end user, preventing malicious code from ever executing locally. It functions as an intermediary layer between the user and any website they visit.
DNS Filtering
DNS filtering controls web access by intercepting domain name resolution requests and returning a blocked-site address instead of the real destination. It provides an alternative to traditional proxy-based web filtering by acting at the DNS layer before a connection is ever established.
Email Security
Email is a primary attack vector for network intrusion, and the standard protocols that power it—SMTP, IMAP, and POP3—transmit messages without encryption, integrity checks, or sender verification by default. Securing email infrastructure requires layering encrypted protocol variants, authentication frameworks like SPF, DKIM, and DMARC, and email gateway filtering to address confidentiality, authenticity, and spam.
Sender Policy Framework (SPF)
Sender Policy Framework (SPF) is a DNS-based email authentication mechanism that allows receiving mail servers to verify whether an incoming message originates from an IP address authorized to send on behalf of a given domain.
DomainKeys Identified Mail (DKIM)
DKIM is an email authentication standard that uses digital signatures and DNS records to verify that incoming messages originate from the domain they claim to represent. It addresses the longstanding lack of authenticity and integrity in traditional email delivery.
Domain-based Message Authentication Reporting and Conformance (DMARC)
DMARC (Domain-based Message Authentication Reporting and Conformance) is a DNS record that builds on SPF and DKIM to define how mail servers should handle messages that fail authentication checks. It also provides reporting capabilities that help domain owners identify legitimate and malicious sources of email sent in their name.
Email Gateway
Mail gateways sit at the front of an email infrastructure to screen incoming messages through a series of security checks before they reach internal mail servers. These checks include deny and allow lists, SPF, DKIM, DMARC, anti-malware, and spam filtering, with a cumulative scoring system that determines whether a message is delivered, quarantined, or dropped.
Server Application Security
Servers introduce unique security risks by exposing services to users inside and outside a network, requiring dedicated hardening measures beyond standard endpoint protection. This content covers the client-server model, secure software development lifecycle practices, network segmentation, and infrastructure-level defenses like firewalls, bastion hosts, and proxy servers.
Input Validation
Input validation is a critical defense against injection attacks, ensuring that data entered into web application forms meets strict rules before reaching back-end systems. SQL injection and similar attacks exploit unvalidated inputs to manipulate databases, but properly enforced validation controls block malicious code from ever executing.
Secure Cookies
Secure cookies are a server-side setting that instructs browsers to encrypt and restrict cookie data, protecting user sessions from hijacking and unauthorized cross-site access.
Services Security
Securing client-server communication requires choosing the right transport method, enforcing modern encryption standards, and making deliberate decisions about protocol and port selection. This content covers VPNs, TLS-secured protocols, and the practical role of non-standard ports in reducing attack surface.
Web Application Firewall (WAF)
A web application firewall (WAF) provides specialized protection for web servers by detecting and blocking threats that standard firewalls are not designed to handle. It sits between external traffic and web applications, filtering attacks such as denial of service attempts before they reach the server.
Bastion Host
A bastion host is a hardened, minimally configured server positioned at the network perimeter to absorb and deflect attacks before they can reach internal systems. It acts as the first point of contact for incoming traffic, protecting the servers behind it.
Content Delivery Network (CDN)
A content delivery network (CDN) is a globally distributed system of servers that caches and delivers web content from locations close to end users, reducing latency and improving performance. CDNs provide both speed and high availability by serving cached content from regional nodes rather than routing every request back to a central origin server.
Reverse Proxy Server
A reverse proxy server sits in front of backend infrastructure to protect servers, balance loads, and offload processing tasks such as encryption, compression, and caching. Unlike a forward proxy, which shields clients from external servers, a reverse proxy shields backend servers from direct client exposure.
Application Programming Interface (API) Gateway
APIs define how applications communicate and exchange data with each other, enabling structured requests and responses between systems. An API gateway acts as a secure, centralized entry point that manages, authenticates, and controls that traffic.
Architecting Availability
Availability is a critical but often overlooked component of security, and downtime carries significant financial and reputational consequences for any organization. This content covers what high availability means, what threatens it, and how redundancy and fault tolerance are used to keep services running.
Measuring Availability
Availability measurement covers the key metrics used to quantify and communicate system uptime, including downtime, uptime percentage, the nines, mean time to recovery, and mean time between failures.
Location
Choosing the right physical location for a data center is a critical step in building highly available services, requiring evaluation of natural disaster risk, power availability, climate, connectivity, and workforce access.
Redundancy
Redundancy is the key to achieving high availability in IT infrastructure, ensuring systems stay online even when individual components fail. This content covers how to build resilience across every layer of an environment, from hardware and networking to power, cooling, and data.
How Much Redundancy? (N+1)
High availability depends on having the right level of redundancy, measured using N+1, N+2, or N+N models that define how many spare systems sit alongside active infrastructure. The appropriate redundancy tier balances the cost of additional hardware against the potential revenue impact of unplanned downtime.
Location Redundancy
Location redundancy distributes backup services and infrastructure across geographically separated sites to protect against regional disasters, outages, or physical failures. Cloud providers like AWS make this practical and cost-effective through globally distributed regions and availability zones.
Hot, Warm, and Cold Sites
Hot, warm, and cold sites represent three tiers of disaster recovery readiness, each balancing recovery speed and cost differently. Understanding the tradeoffs helps organizations choose the right failover strategy for their risk tolerance and budget.
Provider Redundancy
Multi-cloud redundancy distributes services across multiple cloud providers and on-premises infrastructure to reduce dependency on any single vendor's backbone. This approach protects against provider-wide outages that internal regional failover alone cannot prevent.
Power Redundancy
Power redundancy in IT infrastructure relies on layered protection across dual power supplies, redundant power distribution units, UPS battery backups, and backup generators to eliminate downtime during outages. Each layer compensates for failures at any other point in the chain.
Cooling Redundancy
Data center cooling systems require redundancy to prevent equipment overheating in the event of a single unit failure. Maintaining multiple air conditioning units is a critical component of overall infrastructure resilience.
Networking Redundancy
Enterprise network redundancy ensures continuous connectivity between sites by providing multiple paths and failover options when individual links or devices fail.
ISP Redundancy
ISP redundancy protects network connectivity by maintaining multiple internet connections from different providers, ensuring access to the outside world if a primary connection or provider fails.
Hardware Redundancy
Hardware redundancy is a core strategy for keeping enterprise systems online, achieved through duplicate components like drives, power supplies, fans, and network cards within a single device, as well as redundant configurations across multiple devices. Enterprise servers, switches, and firewalls each offer distinct approaches to eliminating single points of failure.
Hot Swappable
Hot swappable components can be removed and replaced while a system is still powered on and running, eliminating downtime during hardware failures. Understanding which parts support hot swap and which do not is essential for maintaining high-availability environments.
RAID
RAID (Redundant Array of Independent Discs) is a storage technology that uses multiple drives working together to improve data redundancy, performance, or both. Common configurations include RAID 0, 1, 5, 6, and 10, each achieving these goals through techniques like striping, mirroring, and parity.
RAID 0
RAID 0 uses data striping to distribute writes across multiple drives simultaneously, delivering faster performance and greater storage capacity but with no fault tolerance and increased data loss risk.
RAID 1
RAID 1 uses disk mirroring to write identical data across two drives simultaneously, providing redundancy and fault tolerance at the cost of double the storage resources.
RAID 5
RAID 5 combines the performance and capacity benefits of striping with fault tolerance through distributed parity, allowing a storage array to survive the loss of one drive without losing data. It requires a minimum of three disks and uses an XOR-based parity system to enable full drive reconstruction.
RAID 6
RAID 6 builds on RAID 5 by writing two sets of parity data across a minimum of four drives, allowing the array to survive the simultaneous failure of two disks.
RAID 10
RAID 10 combines mirroring and striping across multiple drives to deliver both redundancy and performance, and belongs to a broader family of nested RAID configurations. Understanding how these hybrid levels balance fault tolerance and storage efficiency is essential for designing resilient storage systems.
Architecting RAID
Selecting the right RAID configuration depends on balancing performance, redundancy, and workload requirements. This content covers practical RAID selection criteria and a common real-world server storage architecture.
Spare Drive
RAID spare disks are standby drives that automatically replace a failed disk in a redundant array, restoring full redundancy without manual intervention. They work with RAID 1, 5, and 6, but cannot recover lost data in non-redundant configurations like RAID 0.
Service Redundancy
Service redundancy ensures that when a server fails, clients can seamlessly connect to another without losing session data or experiencing disruption. Load balancing and clustering are two primary approaches used to achieve this continuity.
Clustering
Clustering groups servers and services together so they function as a single unit, enabling load distribution and automatic failover when individual nodes go offline. Both active-active and active-passive configurations are covered, along with real-world implementations in VMware, Redis, and SQL Server.
Load Balancing
Load balancing distributes incoming client traffic across multiple servers to prevent any single server from becoming overwhelmed, while also enabling high availability by rerouting connections when a server goes offline. Balancing methods range from static assignment and round-robin to dynamic approaches that factor in real-time resource utilization.
Load Balancing vs Clustering
Load balancing and clustering both improve performance, availability, and scalability, but each serves a distinct purpose in network and application architecture. Clustering coordinates services and shared resources across machines, while load balancing distributes client traffic across servers.
Scaling
Clustering and load balancing support scalability by distributing demand across multiple servers, allowing infrastructure to grow alongside client needs. Horizontal scaling adds more servers to meet demand, while vertical scaling increases the resources of existing servers.
Data Redundancy
Data redundancy covers the methods used to protect critical information from loss, corruption, or hardware failure, including RAID, replication, backups, snapshots, and versioning. Each approach serves a distinct role in ensuring data can be recovered or restored when systems fail.
Replication
Replication creates continuously synchronized copies of data, files, servers, or directories to support high availability and failover across sites. Unlike backups, replicas reflect live data in real time, which introduces distinct advantages and trade-offs depending on how replication is configured.
Backup
Even with RAID configurations, replication, and cloud redundancy, backups remain essential because corruption, viruses, and data errors can propagate across all live copies simultaneously. A dedicated backup strategy ensures earlier, clean versions of data are always recoverable.
Versioning
Journaling is a data protection technique that records transactions made to files, databases, or file systems, allowing changes to be tracked and reversed if corruption or failure occurs. It improves recoverability by enabling faster restoration to a known-good state without requiring a full duplicate copy of the data.
Journaling
Versioning tracks changes to documents, code, or files over time, allowing recovery of earlier states without storing full duplicate copies. It is a useful rollback tool but does not replace traditional backup.
Data Redundancy Method Comparisons
RAID, replication, backup, journaling, and versioning are distinct data redundancy strategies, each designed to address different failure scenarios and recovery needs. Understanding how they differ is essential for designing resilient storage architectures.
Backups
Backup creates a separate, point-in-time copy of data that can be restored later, making it a foundational and irreplaceable component of any data protection strategy. Unlike RAID, replication, or versioning, backup offers both immutability from the moment it is taken and the portability to be stored on-site, off-site, or in the cloud.
Backup Objectives
Effective backup planning starts with defining clear objectives — understanding which systems are critical, how quickly they must be restored, and how much data loss is acceptable. These decisions shape the entire backup strategy and determine the level of investment required.
Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
Recovery Point Objective (RPO) and Recovery Time Objective (RTO) define how much data loss and downtime an organization can tolerate when a disaster occurs. These two metrics drive the design and cost of any effective backup and recovery strategy.
Backup Design Considerations
Designing an effective backup strategy requires evaluating multiple factors, including data criticality, recoverability, cost, recovery objectives, backup windows, security, and how frequently data changes.
What to Backup
Effective backup strategy requires deciding what data to protect and at what level of granularity, balancing recovery speed against storage costs and operational complexity. The right approach depends on defined recovery objectives and the relative criticality of databases, servers, files, and directory information.
Frequency
Backup frequency is a strategic decision driven by how much data loss an organization can tolerate, with different systems often requiring different schedules to balance thoroughness and practicality.
Storage Location
Backup storage location is a critical decision that balances recovery speed against resilience, with most organizations maintaining both on-site and off-site copies to cover different failure scenarios.
Backup Media
Backup storage media options include cloud storage, local hard drives, removable disks, tape drives, and hard copies, each with tradeoffs in speed, portability, and scale. Effective backup strategies combine onsite and offsite storage with a disciplined media rotation schedule.
Encrypting Backup
Encrypting backup data protects sensitive information if a copy is ever lost or compromised, but the encryption keys must be stored offsite and managed carefully to ensure successful restoration.
Databases and Backups
Backup types — full, differential, incremental, and synthetic — each handle database transaction logs differently, and understanding that distinction is key to designing and managing effective backup strategies.
Backup Types
Backup types — full, differential, and incremental — differ in how much data they capture and how they handle restores. The archive bit flags changed files so backup software knows exactly what needs to be copied.
Backup Type: Full
A full backup copies all selected files and data every time it runs, regardless of what has changed since the last backup. This approach simplifies restoration by capturing a complete snapshot at each backup interval.
Backup Type: Differential
Differential backups capture all files changed since the last full backup, offering a faster and less resource-intensive alternative to running full backups repeatedly. Understanding how archive bits track changes and how restore operations work is essential knowledge for any backup and recovery strategy.
Backup Type: Incremental
Incremental backups capture only the changes made since the last backup, using the archive bit to identify modified files and minimizing the time and storage required between full backups. Restoring from incremental backups requires applying the full backup first, followed by each incremental backup in sequence up to the desired recovery point.
Backup Type: Synthetic
A synthetic full backup combines an initial full backup with subsequent incremental backups, continuously merging them into an up-to-date full backup available for restoration at any time.
Architecting Backup
Backup scheduling requires careful planning around data criticality, recovery objectives, and system availability. This content walks through a real-world scenario combining full, differential, and incremental backups to meet a 15-minute recovery point objective on a high-traffic database.
Snapshots
Snapshots are a point-in-time copy mechanism used across platforms like AWS, VMware, and Windows to capture system or file states without duplicating entire datasets. They support backup workflows but are best suited for short-term use rather than long-term data protection.
Testing Backups
Untested backups cannot be trusted — media degrades, corruption happens, and the only way to verify a backup is valid is to actually restore from it. This covers how to test backup integrity across different storage types, including tape and cloud.
Recovery
Restoring data from a backup requires planning around file conflicts, destination paths, and media preparation — especially when working with legacy formats like tape. Understanding these factors helps ensure a smooth and accurate recovery.
Backup Retention and Disposal
Backup data must be managed throughout its entire lifecycle, from defining how long it is retained to ensuring it is securely disposed of when no longer needed. Retention periods and disposal methods must align with compliance requirements and customer contractual obligations.
Archiving
Backup media rotation and archiving are two distinct data retention strategies that serve different purposes in an organization's overall data lifecycle plan. Archiving preserves records that are no longer in active use but must be retained for compliance or future reference.
Physical Security
Physical security is a critical but often overlooked layer of cybersecurity, encompassing protection of hardware and infrastructure from physical threats, unauthorized access, and environmental hazards. This content covers how to control physical access to facilities, network rooms, and equipment to preserve confidentiality, integrity, and availability.
Physical Access Control
Physical security controls are a critical layer of network defense, preventing adversaries from bypassing logical protections through direct hardware access. This content covers access control types, detection methods, and the equipment security measures used to protect IT infrastructure.
Datacenter camouflage
Data centers are often deliberately designed to blend into their surroundings, with no exterior markings or signage that would identify them as high-value targets. This physical obscurity is an intentional security strategy known as maintaining a low profile.
Reflective Glass
A one-way mirror allows security personnel to observe an area without being seen, making it a practical physical security control for data centers and other protected facilities.
Fencing
Fencing is a foundational physical security control used to restrict unauthorized access to protected areas, with options like barbed wire providing a stronger deterrent when higher security is required.
Barricades
Barricades are physical security controls used to restrict access to designated areas, available in a range of sizes and configurations for both pedestrian and vehicle traffic management.
Bollards
Bollards are retractable physical security barriers designed to block vehicle access while allowing pedestrian traffic to pass freely.
Security Guards
Security guards serve as both a preventative control and a deterrent, stopping unauthorized access while discouraging most individuals from attempting entry in the first place.
Security Escorts
A security escort is a physical access control measure used when someone requires temporary entry to a restricted area but lacks the credentials or clearance for unsupervised access. An authorized escort accompanies the individual throughout their time in the secured space to monitor activity and prevent unauthorized interaction with sensitive systems or equipment.
Guard Dogs
Guard dogs serve a dual purpose in physical security, acting as both a visible deterrent and an active monitoring presence that alerts to unauthorized entry.
Alarm Systems
Alarm systems provide automated alerts for unauthorized entry, fire, environmental conditions, and other physical security events in modern facilities. Most organizations deploy multiple alarm systems to cover the full range of physical threats across their environment.
Access Control Vestibule (Mantrap)
An access control vestibule is a secured entryway with two sequential doors that traps unauthorized individuals between them, preventing access to restricted areas. Formerly called a man trap, it functions as both a physical access control measure and a strong deterrent against unauthorized entry.
Magnetometers (Metal Detector)
Magnetometers, commonly known as metal detectors, are a widely used physical security control deployed in airports, corporate buildings, and other secured facilities to detect metal objects on individuals entering a space.
Keys
Physical keys offer a basic form of access control but carry significant security risks, including loss, theft, duplication, and vulnerability to picking or bypass techniques.
Locking Racks
Smart Lockers
Smart lockers are network-connected storage units that grant access through mobile apps, text codes, or keypad entry, commonly used by package distributors like Amazon to secure deliveries until the recipient retrieves them.
Safes
Safes and lock boxes provide physical security for sensitive documents, data backups, and access credentials by protecting them from unauthorized access, theft, and fire damage.
Key Fobs
Key fobs are small, portable access credentials that grant or deny entry to secured areas when tapped against an access reader.
Badge Readers
Badge readers provide electronically controlled access to secured areas, offering advantages over traditional keys such as access logging and the ability to revoke credentials remotely.
Biometrics
Biometrics uses unique physical characteristics—such as fingerprints or eye scans—to verify identity in a way that cannot be lost, duplicated, or stolen. This makes it a more secure authentication factor compared to tokens or cards.
RFID
RFID, or radio frequency identification, uses radio waves to wirelessly identify people and objects, powering everyday technologies like badge readers, key fobs, and race timing chips.
Signal Blocking
Signal blocking is a physical security control used to prevent unauthorized wireless data exfiltration and protect equipment from damaging electromagnetic events. Faraday cages and boxes are common implementations that block radio frequencies across a range of threat scenarios.
Surveillance
Electronic surveillance covers the monitoring of devices and communications across networks to observe activity and detect potential threats. This topic shifts focus from access control toward the observation and analysis of electronic behavior.
Wireless Surveillance
Wireless electronic surveillance involves monitoring network activity and radio frequency interference across a wireless environment to identify devices and signal disruptions. Systems like Cisco Clean Air use access point triangulation to detect, locate, and classify interference sources on the wireless spectrum.
Video Surveillance
Video surveillance is a key physical security control used to monitor facilities and deter unauthorized access. Systems vary widely in connectivity, storage method, and cabling requirements, and selecting the right configuration depends on the specific environment being protected.
Lighting
Proper lighting is a critical component of physical security, enhancing video surveillance effectiveness and deterring criminal activity in vulnerable areas.
Motion Detectors
Motion detectors are a core component of many security systems, used to sense movement in a space and trigger responses like floodlights to deter and identify intruders.
Infrared
Infrared cameras detect light frequencies beyond the visible spectrum, capturing heat signatures and objects that standard cameras and the human eye cannot see. This technology is widely used in surveillance systems to identify people and objects even when they attempt to conceal themselves.
Pressure
Pressure sensors detect physical force and are used in both physical security systems and industrial control environments to monitor contact, equipment handling, and containment levels.
Microwave
Microwave radar systems use the Doppler effect to detect both the direction and speed of moving objects by measuring shifts in the frequency of reflected waves. Understanding how wave compression and expansion relate to motion is fundamental to how these systems work in real-world applications.
Ultrasound
Ultrasound uses high-frequency sound waves above the 20,000 Hz range of human hearing to detect motion and measure speed through the Doppler effect. By analyzing how reflected wave frequencies shift, ultrasonic sensors can determine whether an object is approaching or moving away and calculate its velocity.
Equipment Locks
A Kensington lock is a physical security mechanism used to anchor laptops and other equipment to a fixed location, providing a basic deterrent against theft.
Asset Tags
Asset tracking involves tagging equipment with unique identifiers to maintain accurate inventory records and reduce the risk of theft. Organizations typically apply asset tags to high-value or easily stolen items, often in coordination with accounting requirements.
Tamper Detection
Tamper detection refers to physical and technological mechanisms used to indicate whether a product or device has been accessed or altered without authorization. These controls serve both safety and accountability purposes across consumer, industrial, and technology environments.
Threat and Risk Terms
Core threat and risk terminology in cybersecurity—including assets, the CIA triad, vulnerabilities, exploits, and defense in depth—explained with clear definitions and practical context.
Knowing the Adversary
Understanding who threatens an organization—and how they think, operate, and choose their targets—is foundational to building effective defenses. This content introduces threat actors, their motivations and capabilities, and the role of threat modeling in identifying and assessing organizational risk.
Hacker Ethics (White, Gray, and Black Hat)
Hackers are categorized into three types based on their intent and legal boundaries: white hat, gray hat, and black hat. Understanding these distinctions is foundational to cybersecurity practice and ethics.
An Adversary's Characteristics
Adversary characteristics—including hacker type, motivation, organizational relationship, resources, and sophistication—determine the nature and scale of threats facing an organization. Understanding these factors allows security teams to make informed decisions about where and how to invest in defenses.
An Adversary’s Motivations
Understanding attacker motivation reveals their likely targets, methods, and level of effort — making it a foundational concept in threat analysis and defense strategy. From curiosity and revenge to financial gain and hacktivism, different motivations produce fundamentally different attack profiles.
An Adversary’s Targets
Adversary targeting in cybersecurity is shaped by attacker motivation, available assets, and the relative ease of compromise. Understanding who is likely to attack and why is essential for determining how much security investment an organization actually needs.
An Adversary's Objectives
Action on objectives describes the goals adversaries pursue and the steps they take to achieve them, spanning data exfiltration and operational impact. The MITRE ATT&CK framework organizes these activities into tactics, techniques, and procedures that define how attacks unfold.
An Adversary's Resources and Sponsorships
Modern cyber threats are increasingly backed by corporations, nation-states, terrorist groups, and organized crime syndicates rather than lone individuals. Understanding threat actor sponsorship is essential for accurately assessing the scale and sophistication of today's attacks.
An Adversary's Capabilities
Adversary capabilities refer to the combination of skills, knowledge, tools, and resources a threat actor uses to carry out an attack. Understanding these capabilities—from unskilled script kiddies to advanced persistent threats—is essential for building effective defenses.
Inside Threats and Shadow IT
Insider threats represent one of the most significant risks to organizational security, encompassing both malicious actors and unintentional mistakes made by employees within the network. Shadow IT — the unauthorized use of devices, software, or services outside of established IT processes — is a closely related risk that can quietly undermine an organization's security posture.
Attack Methodologies
Cyber attackers follow structured processes that vary by motivation, resources, and sophistication, and security professionals use established frameworks to analyze and defend against those methods. This content covers TTPs, MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model of Intrusion Analysis.
Tactic, Techniques, and Procedures (TTPs)
Tactics, techniques, and procedures (TTPs) are a core framework cybersecurity professionals use to understand and analyze adversary behavior across every stage of an attack. The MITRE ATT&CK framework catalogs 14 tactics, 203 techniques, and 453 sub-techniques that map out how attackers operate inside real-world networks.
MITRE ATT&CK
MITRE ATT&CK is a publicly available framework that catalogs the tactics, techniques, and sub-techniques used by real-world adversaries, organized across enterprise, mobile, and industrial control system environments. Security professionals use it to understand attacker behavior, identify defensive gaps, and investigate known threat groups.
Cyber Attack Tactics
The MITRE ATT&CK framework defines 14 adversary tactics—from reconnaissance through impact—that map the progression of a network attack, and it can be used alongside the Cyber Kill Chain to build a comprehensive picture of threat behavior.
Cyber Kill Chain
The Cyber Kill Chain is a framework developed by Lockheed Martin that models the sequential stages an adversary follows when planning and executing an attack against an organization. Understanding each phase helps security professionals anticipate attacker behavior and identify opportunities to detect or disrupt an intrusion.
Cyber Kill Chain and Cyber Defense
The Cyber Kill Chain maps adversary attack stages to specific defensive countermeasures, giving security teams a structured framework for identifying where and how to interrupt an attack before it succeeds.
Diamond Model of Intrusion Analysis
The Diamond Model of Intrusion Analysis is a structured framework for investigating network compromises by mapping relationships between adversaries, victims, capabilities, and infrastructure. It enables security teams to trace attacker activity across a network and determine the full scope of a breach.
Attack Patterns and Adversary Signatures
Adversary fingerprinting is the practice of identifying attackers by analyzing the consistent patterns and behaviors they exhibit during a network intrusion. Security teams use tools like MITRE ATT&CK and CAPEC to catalog these signatures and attribute attacks to known threat groups.
Reconnaissance
Reconnaissance is the process of systematically collecting intelligence about a target before and during an attack, and understanding it is foundational to both offensive security operations and effective defense. This coverage establishes what reconnaissance is, how it relates to terms like enumeration and discovery, and how attackers approach it across passive and active methods.
Open-Source Intelligence (OSINT)
Open-source intelligence (OSINT) is the practice of gathering, analyzing, and disseminating publicly available information about a target organization. It serves as a foundational step in reconnaissance, due diligence, and competitive research.
DNS Reconnaissance
DNS reconnaissance is a foundational step in target enumeration, using domain and IP address relationships to map an organization's infrastructure and identify potential attack surfaces. Tools like DNSdumpster, WHOIS, nslookup, and dig make it possible to extract significant intelligence with minimal effort.
Websites Reconnaissance
Website reconnaissance covers the techniques used to gather intelligence from a target organization's public web presence, including web crawling, URL enumeration, and data scraping. Understanding how these methods work is essential for identifying exposed information and potential attack surfaces before an engagement.
Social Media Scraping
Social media scraping is a reconnaissance technique used to gather intelligence on target organizations by harvesting publicly available data from platforms like LinkedIn, Facebook, Reddit, and job boards. Exposed employee details, job postings, and unintentional disclosures can all be leveraged to identify high-value targets and support social engineering attacks.
Dumpster Diving
Dumpster diving is a physical reconnaissance technique where attackers search discarded materials for sensitive information that can be used to target an organization. Unlike purely digital reconnaissance, this method carries legal risk and can expose data that employees fail to properly shred or destroy.
Eavesdropping
Eavesdropping is the deliberate interception of private communications, whether in person or across digital networks, and represents a serious security threat to organizations. Network-based eavesdropping attacks use tools like packet sniffers to capture data in transit without detection.
Attack Surface
Attack surface analysis identifies every possible entry point into a system—physical, digital, social, and through third-party connections—giving security professionals a complete picture of where a network is exposed. Modern networks are more accurately modeled as layered but permeable structures, not hardened perimeters, making comprehensive surface mapping essential.
Attack Vectors and Vulnerabilities
Attack surfaces, attack vectors, and vulnerabilities are foundational concepts in offensive security, defining where a target is exposed, how an attacker gains entry, and what weaknesses make that entry possible. This content covers a wide range of vulnerability categories across physical, technical, human, and procedural domains.
Weaponization
The weaponization phase of the cyber kill chain covers how attackers acquire, create, or compromise the tools and infrastructure needed to execute an attack. Known as resource development in the MITRE ATT&CK framework, this phase is a critical step in an adversary's attack preparation.
Brokers
Access brokers are cybercriminals who buy, sell, and trade stolen credentials, system access, vulnerabilities, and malware on dark web marketplaces, making large-scale cyberattacks faster and easier to carry out. Understanding how these brokers operate is essential for recognizing the infrastructure behind modern cyber threats.
Malware
Malware is software intentionally designed to cause disruption, and it encompasses a wide range of threats with goals ranging from data theft and system control to ransomware and adware. Understanding malware means examining its components — vectors, payloads, droppers, and command-and-control mechanisms — rather than forcing it into rigid categories.
Virus
A computer virus is a specific type of malware that replicates itself by inserting its code into existing files or programs and spreading from host to host. Understanding the distinction between viruses and malware broadly is a foundational concept in cybersecurity.
Boot Sector Virus
A boot sector virus infects the initial startup code of a drive, giving it early control over the system before most security mechanisms load. This early execution makes it particularly difficult to detect and remove.
Worm
A computer worm is a standalone, self-replicating form of malware that spreads across networks without needing to attach to another file or program. Unlike viruses, worms can consume massive amounts of bandwidth and system resources on their own, and may also carry destructive payloads.
Trojan
A Trojan is a type of malware that disguises itself as legitimate software to deceive users into interacting with it, ultimately stealing credentials or compromising the system.
Ransomware
Ransomware is malicious software that encrypts a victim's data and demands payment in exchange for the decryption key needed to restore access. It is one of the most common and damaging categories of malware in use today.
Command and Control (C2)
Command and control (C2) is a technique used by attackers to remotely access and manipulate compromised systems within a target network. It appears as a phase in the Cyber Kill Chain, a tactic in the MITRE ATT&CK framework, and a category of malicious software.
Remote Access Trojan (RAT)
A remote access Trojan (RAT) is a type of malware that disguises itself as legitimate software while silently granting an attacker full remote control over an infected system. RATs function as command-and-control (C2) tools, enabling attackers to pivot from a compromised machine into the broader network.
Botnet
A botnet is a network of compromised machines that an attacker controls to launch coordinated attacks such as distributed denial-of-service floods and large-scale spam campaigns. Understanding how botnets operate is essential for recognizing and defending against some of the most common threats in modern cybersecurity.
Spyware
Spyware is malicious software designed to secretly collect information from a victim's device, including screen activity, camera footage, and keystrokes. It operates covertly, transmitting captured data back to the attacker.
Keylogger
Keyloggers are a form of spyware that capture and record keystrokes, and can be deployed as either software installed on a target system or as a physical hardware device inserted between a keyboard and a computer. Both forms can store captured data locally or transmit it to a remote location.
Fileless Malware
Fileless malware evades traditional antivirus detection by running entirely in RAM rather than writing to disk, making it harder to discover but also easier to eliminate with a system restart.
Logic Bomb
A logic bomb is a malicious payload embedded in malware that remains dormant until a specific condition or trigger is met, at which point it executes its destructive function. This delay allows the malware to propagate widely before the attack is detected.
Rootkit
Cryptojacking is a cyberattack in which malicious software secretly uses a victim's computing resources to mine cryptocurrency without their knowledge or consent. The attacker profits while the victim bears the costs in performance degradation, resource consumption, and electricity.
Cryptojacking
Adware is software that displays unwanted advertisements on a user's machine, and while it may seem relatively harmless, it can disrupt productivity, consume network resources, and serve as a delivery mechanism for more serious malware.
Adware
Scareware is malicious software that uses alarming fake warnings to trick users into downloading and installing malware onto their own systems. It exploits fear and urgency to manipulate victims into taking actions that compromise their own security.
Scareware
Bloatware refers to unnecessary software that consumes storage, processing power, and bandwidth, degrading overall system performance. It commonly arrives pre-installed on new devices or develops when applications are overloaded with unused features.
Bloatware
Legitimate software can still create serious problems on enterprise networks, from resource drain to fragmented communications and unsanctioned IT deployments. Cybersecurity professionals need to account for these risks even when no malware is involved.
Enterprise Level Concerns
A rootkit is a suite of software tools used to gain elevated, root-level access to a device, bypassing the manufacturer's security restrictions. While not always malicious, rootkits pose serious security risks when used by attackers to compromise devices and escalate privileges across a network.
Delivery
The delivery phase of a cyberattack focuses on getting malware into a target network through vectors such as email attachments, social engineering, removable media, and compromised third parties. Human vulnerability consistently represents the most exploitable entry point in an otherwise hardened environment.
Social Engineering
Social engineering exploits predictable patterns in human psychology to manipulate people into compromising security, and it remains one of the most prevalent attack vectors in cybersecurity today. Attacks can be carried out through messaging, voice, in-person interaction, or no-contact physical methods, each with distinct tradeoffs in effort, effectiveness, and scalability.
Social Engineering Methods
Social engineering attacks exploit human psychology through overt tactics like blackmail and covert techniques like phishing, using emotional triggers such as curiosity, fear, greed, and urgency to manipulate targets into compromising security. Recognizing these emotional manipulation patterns and responding with deliberate, logical thinking is the foundation of effective social engineering defense.
Developing Connection and Trust
Social engineering attacks depend not just on emotional manipulation but on establishing trust, and adversaries use specific techniques such as empathy, flattery, social proof, shared similarities, and embedded truths to create that credibility with their targets. Understanding how trust is manufactured is essential to recognizing and resisting these tactics.
Impersonation
Impersonation is a core social engineering technique in which an attacker poses as a trusted person, authority figure, or recognized brand to bypass victim skepticism and extract information or access. Understanding how these tactics work is essential for recognizing and defending against them.
Typosquating
Typosquatting is a cyberattack in which malicious actors register misspelled or lookalike domains to impersonate legitimate websites and deceive unsuspecting users. It is also known as URL hijacking, cousin domain, sting site, or fake URL.
DEMO: URL Obfuscation
URL obfuscation is a social engineering technique that disguises a link's true destination by manipulating the structure of a URL, redirecting users to malicious sites without their knowledge.
Domain Shadowing
Domain shadowing is an attack technique where threat actors compromise a legitimate domain's DNS server and secretly insert malicious records to redirect traffic for phishing, malware distribution, data exfiltration, or command-and-control operations. By piggybacking on a trusted domain, attackers make malicious activity appear credible and avoid detection.
HTTP 302 Cushioning
A 302 cushioning attack exploits HTTP redirect responses to silently send users to a malicious site while they believe they are visiting a legitimate one. Understanding HTTP response codes is essential to recognizing how this redirection-based deception operates.
Business Email Compromise (BEC)
Business email compromise (BEC) is an attack where a threat actor impersonates a trusted colleague or internal contact via email to deceive employees within an organization.
Pretexting
Pretexting is a social engineering technique in which an attacker fabricates a believable story to gain a target's trust and manipulate them into revealing information or taking a harmful action. It is a foundational tactic in cybersecurity threats and is often combined with other deception methods such as impersonation.
Watering Hole
A watering hole attack compromises a third-party website frequently visited by members of a target organization, using it as a vector to deliver malware and gain access to the intended network.
Baiting
Baiting is a social engineering technique that uses enticing offers to lure victims into clicking malicious links, downloading harmful files, or surrendering sensitive information. It is one of the most common methods behind phishing emails and spam campaigns.
SPAM
Spam refers to unsolicited or unwanted email messages that range from bulk commercial mailings to borderline content recipients never requested. Beyond being an annoyance, spam creates measurable productivity loss for individuals and organizations.
Phishing
Phishing is a social engineering technique that tricks victims into revealing sensitive information or taking harmful actions through email or other messaging systems. It remains one of the most common entry points for cyberattacks across all industries.
Spear Phishing
Spear phishing is a targeted form of phishing in which an attacker crafts messages specifically designed to deceive a particular individual rather than a broad audience.
Whaling
Whaling is a targeted phishing attack aimed at high-level executives such as CEOs and C-suite leaders within an organization. It is a form of spear phishing distinguished by the seniority of its intended victims.
Smishing
Smishing is a social engineering attack that uses SMS text messages to trick victims into revealing sensitive information. It has emerged as an alternative to email phishing in response to increasingly crowded and filtered email-based attack channels.
Vishing
Vishing is a social engineering attack that uses phone calls or voice messages to trick victims into revealing sensitive information. It targets cell phones, landlines, and business lines as traditional phishing and smishing tactics become less effective.
Shoulder Surfing
Shoulder surfing is a physical social engineering technique where an attacker observes a victim's screen or keypad to steal credentials or access codes. It occurs in everyday settings like ATMs, point-of-sale terminals, and workplace environments.
Tailgating and Piggybacking
Tailgating and piggybacking are physical social engineering attacks where an unauthorized person gains access to a secured area by following an authorized individual through a controlled entry point. The key distinction is consent: tailgating occurs without the authorized person's awareness, while piggybacking relies on their cooperation.
USB Drop
A USB drop attack involves leaving infected USB drives in public places to trick unsuspecting users into plugging them in and compromising their systems. Recognizing this threat and handling unknown removable media with caution are essential practices for maintaining network security.
False Information
Misinformation, disinformation, and deep fakes represent three distinct but related threats in today's information landscape, each carrying serious potential for harm. Understanding the differences between them is essential for anyone navigating digital media and communications.
Quid Pro Quo
Quid pro quo is a social engineering attack in which an attacker offers something of value in exchange for access, credentials, or other sensitive resources. Unlike many covert manipulation tactics, it often involves the target knowingly participating in the exchange.
Blackmail
Blackmail is a social engineering attack in which an adversary threatens to expose damaging information about a victim unless they receive payment, access credentials, or other valuable concessions. Unlike most social engineering tactics, blackmail is overt — the victim knows they are being coerced.
Tools
Specialized tools and software exist to support social engineering attacks, including the Social Engineering Toolkit and AI-powered technologies used by both adversaries and security professionals.
AI and Social Engineering
Adversaries are increasingly using artificial intelligence to execute social engineering attacks with alarming effectiveness, from AI-generated phishing emails to deepfake audio and video impersonations. Real-world incidents from 2024 demonstrate how these techniques have led to multimillion-dollar losses and unauthorized organizational access.
Vulnerabilities and Exploitation
Vulnerabilities are weaknesses in systems, software, or infrastructure that attackers can exploit to cause harm. This content covers the vulnerability life cycle, exploitation concepts, and the public databases used to track and catalog known vulnerabilities.
Common Network Vulnerabilities
Common network vulnerabilities include insecure wireless and wired connections, open service ports, and misconfigurations that expose systems to unauthorized access. Keeping firewall rules and network settings current is essential to reducing attack surface across an organization's infrastructure.
Common Protocol Vulnerabilities
Many network protocols in use today were designed before security was a priority, leaving them vulnerable to attacks like spoofing, session hijacking, and denial of service. Even protocols with secure alternatives are often still deployed in their original, unencrypted forms.
Common Hardware Vulnerabilities
Hardware vulnerabilities arise from insecure default configurations, outdated firmware, misconfiguration, and end-of-life equipment that no longer receives security patches. Identifying and addressing these risks is a foundational responsibility in any network environment.
Common Software Vulnerabilities
Software vulnerabilities fall into two broad categories: weaknesses in purchased business applications and flaws introduced during in-house software development. Understanding both is essential for maintaining a secure enterprise environment.
Common Virtualization and Cloud Vulnerabilities
Virtualization and cloud environments introduce unique security risks alongside their operational benefits, including VM escape, hypervisor attacks, misconfiguration, and insecure resource sharing. Understanding these vulnerabilities is essential for securing modern infrastructure across on-premises, hybrid, and cloud deployments.
Common Cryptographic Vulnerabilities
Cryptographic vulnerabilities arise not from encryption being fundamentally breakable, but from poor implementation choices such as weak ciphers, improper key management, and insecure configurations. Understanding these failure points is essential for deploying cryptography that holds up under real-world attack conditions.
Common Human Vulnerabilities
Human behavior is one of the most significant vulnerabilities in any organization's cybersecurity posture, making people a primary target for social engineering and other attacks. Factors like inherent trust, emotional responses, lack of training, carelessness, and even malicious intent all contribute to this risk.
Common Password Vulnerabilities
Common password vulnerabilities stem from two core risks: passwords that are stolen through social engineering, eavesdropping, or data breaches, and passwords that are guessed due to weak choices and predictable patterns.
Common Process Vulnerabilities
Security processes are meant to reduce human vulnerability, but poorly defined, undocumented, or outdated procedures introduce their own risks. Understanding where process gaps exist is the first step toward building consistent, reliable security controls.
Physical Vulnerabilities
Physical vulnerabilities affect servers, switches, routers, and firewalls through threats ranging from unauthorized access and theft to environmental failures and human error. These risks directly impact the CIA triad, particularly the availability of critical systems and services.
Exploit Chaining
Exploit chaining occurs when attackers combine multiple vulnerabilities, none of which may be severe enough on its own, to gain unauthorized access to a system. Understanding how these vulnerability chains are constructed is essential for recognizing and defending against complex, multi-stage attacks.
Common Attacks
Common cyberattacks such as denial of service, eavesdropping, spoofing, and adversary-in-the-middle attacks each exploit one or more vulnerabilities, and understanding their relationships is foundational to cybersecurity defense.
Installation and Persistence
The installation phase of the cyber kill chain covers how adversaries establish persistence within a compromised network, ensuring continued access even if initial entry points are discovered. Techniques include staged malware delivery, scheduled tasks, SSH key creation, and backdoor account creation across local and domain systems.
Network Discovery and Enumeration
Discovery and enumeration are the intelligence-gathering phases attackers use after gaining initial access to a network, mapping out devices, services, credentials, and defenses before expanding their foothold.
Network Reconnaissance
Network discovery and enumeration techniques range from passive methods like packet sniffing and ARP monitoring to active approaches such as network scanning, packet crafting, and banner grabbing. Understanding when and how to apply each method is essential for effective reconnaissance while avoiding detection.
Wiretapping
Wiretapping is the unauthorized interception of electronic communications, whether across traditional phone lines or modern digital networks. Physical devices or software-based methods can be used to silently monitor data in transit without the target's knowledge.
DEMO: Sniffing Attack with Wireshark
A sniffing attack passively captures network traffic to gather intelligence about devices, protocols, and infrastructure without sending a single packet. Wireshark is a common tool used to carry out and demonstrate this technique.
DEMO: Network Scanning with Nmap
Network scanning is a technique used by attackers to discover active devices, open ports, and running services across a network. This content covers the fundamentals of IP scanning using Nmap and Zenmap, demonstrated through a live ping scan against a /24 network.
Wireless Reconnaissance
Wireless networks present unique security vulnerabilities because radio signals are inherently broadcast, allowing anyone within range to intercept traffic passively. This coverage explores how adversaries exploit those characteristics to enumerate wireless networks, devices, and communications.
Wardriving
War driving is a wireless reconnaissance technique where an attacker travels through an area using a device to scan for insecure or open Wi-Fi networks. It is commonly used to identify vulnerable targets with minimal access controls.
DEMO: Port Scanning with Nmap
Port scanning, also called service discovery or protocol enumeration, identifies which ports and services are active on a networked device. Tools like Nmap and its graphical front end Zenmap make it possible to quickly surface open ports, running services, version numbers, and operating system details that can inform further security testing.
DEMO: Fingerprinting
Operating system fingerprinting is a reconnaissance technique that identifies a target machine's OS by analyzing how it responds to network probes, rather than through direct disclosure. Tools like Nmap can automate this process, mapping response patterns to known operating system signatures.
Credential Harvesting
Credential harvesting is the large-scale theft of usernames, passwords, and other login data from networks, systems, or web applications. Common methods include malware, phishing campaigns, domain spoofing, and adversary-in-the-middle attacks.
Vulnerability Scanning and Enumeration
Vulnerability enumeration is the process of scanning a network to identify and catalog exploitable weaknesses, using the same tools and databases available to both defenders and attackers. Understanding how these scans work, how to conduct them covertly, and how vulnerabilities are scored is essential knowledge for anyone working in offensive or defensive security.
Target Prioritization
Target selection and prioritization is a critical phase of penetration testing in which identified assets are evaluated based on their value to the organization and the relative ease of exploitation. This process helps testers sequence their attack path strategically to maximize efficiency and meet defined objectives.
Denial of Service (DoS) Attack
A denial-of-service (DoS) attack targets the availability pillar of the CIA triad by making systems, services, or network resources inaccessible to legitimate users. Attack methods range from volumetric flooding and protocol exploitation to application vulnerabilities and physical disruption.
Jamming
Jamming is a wireless denial of service attack that disrupts communication between devices by overwhelming or interfering with the radio signals they rely on to stay connected. It can target any wireless technology, including Wi-Fi, Bluetooth, cellular, and GPS.
DEMO: DoS Attack with Rogue DHCP
A rogue DHCP server is an unauthorized device on a network that hands out incorrect IP configuration, preventing clients from communicating properly and causing a denial-of-service condition. This topic also introduces the related concept of DHCP spoofing and how both can be exploited in network attacks.
DEMO: DHCP Starvation Attack
A DHCP starvation attack exhausts a DHCP server's address pool by flooding it with requests from spoofed MAC addresses, preventing legitimate devices from obtaining IP addresses. This content covers how the attack works and demonstrates its execution using DHCPig on Kali Linux.
DEMO: Buffer Overflow Attack, Part 1
A buffer overflow attack occurs when data written to a memory buffer exceeds its allocated size, spilling into adjacent memory and causing system instability, crashes, or unauthorized code execution. Understanding this vulnerability is foundational to recognizing how denial-of-service attacks and arbitrary code execution exploits are carried out.
DEMO: Ping of Death
Ping of death is a legacy denial-of-service attack that crashes older systems like Windows 95 by sending an oversized ICMP packet that triggers a buffer overflow during fragment reassembly. Understanding it builds foundational knowledge of protocol and application weaknesses and reinforces the risks of retaining legacy equipment.
DEMO: TCP Reset Attack
A TCP reset attack is a network-based denial-of-service technique that forcibly terminates an active connection between two devices by spoofing a TCP RST packet. This content covers how TCP connections are established, why the reset mechanism exists, and how an adversary exploits it using crafted packets.
Wi-Fi Deauthentication Attack
A Wi-Fi deauthentication attack exploits unencrypted management frames to forcibly disconnect a client from an access point, enabling denial-of-service or adversary-in-the-middle attacks. It is a foundational wireless attack technique and a common precursor to the evil twin attack.
Resources Limitations and Flooding
Flooding attacks are a form of denial-of-service attack that exhaust a device's resources—memory, CPU, bandwidth, or storage—by overwhelming it with excessive requests until it can no longer serve legitimate traffic. Tools originally built for application stress testing, such as JMeter and Load Ninja, can be repurposed by attackers to carry out these attacks.
DEMO: Ping Flood (ICMP Flood) Attack
An ICMP flood, also known as a ping flood, is a denial-of-service attack that overwhelms a target device by sending a massive volume of ICMP echo requests, consuming its resources until it becomes unreachable. Understanding how this attack works—and how to execute it in a controlled environment—is foundational knowledge for anyone pursuing ethical hacking or network defense.
DEMO: TCP SYN Flood Attack
A TCP SYN flood attack exploits the TCP three-way handshake by overwhelming a server with connection requests, exhausting its resources and blocking legitimate users. This content covers how the attack works and demonstrates it using Kali Linux in a controlled lab environment.
DEMO: UDP Flood Attacks
A UDP flood attack overwhelms a target server by sending massive volumes of UDP packets, exhausting its resources and preventing it from responding to legitimate traffic. This content covers how the attack works and demonstrates it using hping3 on Kali Linux.
DEMO: DNS Flood Attack
A DNS flood attack overwhelms a target by sending massive volumes of UDP traffic to port 53, preventing the server from responding to legitimate DNS requests. It can use actual DNS queries, ICMP packets, or amplified traffic to achieve denial of service.
Amplification Attack
Amplification attacks exploit protocols where small requests generate disproportionately large responses, allowing attackers with limited bandwidth to overwhelm target systems. Different protocols carry different amplification ratios, with DNS and NTP among the most commonly abused.
Distributed Denial of Service (DDoS) Attack
A distributed denial-of-service (DDoS) attack uses multiple machines to overwhelm a target server, making its services unavailable to legitimate users. Two common methods include command-and-control botnets and reflected attacks using spoofed IP addresses.
DEMO: Reflected DDoS Attack
A DDoS reflected attack uses address spoofing to redirect traffic from intermediate machines toward a victim, amplifying the assault while obscuring the attacker's true origin.
Directed Broadcasts and Broadcast Storm
Broadcasts, directed broadcasts, and broadcast storms are fundamental networking concepts with direct implications for both network stability and security. Understanding how broadcast traffic behaves across network boundaries reveals how it can be exploited or unintentionally cause serious disruptions.
DEMO: Smurf Attacks
A smurf attack is a reflected, amplified DDoS attack that exploits ICMP and directed broadcasts to overwhelm a victim machine with traffic from spoofed requests. Understanding its three core components—ICMP flooding, address spoofing, and directed broadcast—is essential for recognizing and defending against this threat.
Adversary-in-the-Middle (AitM)
An adversary-in-the-middle (AiTM) attack occurs when a threat actor secretly positions themselves between two communicating parties, gaining the ability to intercept, alter, or block transmitted data. This class of attack poses risks to confidentiality, integrity, and availability, often without either party detecting the intrusion.
Replay Attacks
A replay attack occurs when an adversary intercepts network traffic and retransmits it to gain unauthorized access or facilitate a man-in-the-middle attack. Even hashed or encrypted credentials can be vulnerable if the authentication protocol lacks proper replay protection.
Spoofing Attacks
Spoofing is a network attack technique where a device or user impersonates a legitimate system component to intercept traffic, disrupt services, or gain unauthorized access. Common spoofing targets include ARP replies, MAC addresses, IP addresses, DHCP servers, DNS servers, and wireless access points.
DEMO: DHCP Spoofing
DHCP spoofing is an attack in which a malicious host impersonates a legitimate DHCP server to feed false network configuration data to connecting clients, enabling traffic interception, DNS manipulation, and adversary-in-the-middle attacks. This content covers how the attack works and demonstrates its execution using Ettercap on Kali Linux.
DEMO: ARP Cache Poisoning
ARP cache poisoning is a network attack technique in which an adversary corrupts a device's ARP table to redirect traffic through a machine they control. It is commonly used to execute adversary-in-the-middle attacks on local area networks.
DEMO: DNS Cache Poisoning
DNS cache poisoning is an attack technique in which an adversary inserts fraudulent DNS records into a client's cache, redirecting traffic to malicious or spoofed destinations. Understanding how this attack works is essential for recognizing and defending against it in real-world environments.
Evil Twin
An evil twin attack is a wireless threat where an attacker impersonates a legitimate access point to intercept network traffic, positioning themselves as an adversary in the middle between the victim and the network. Once a device connects to the rogue access point, the attacker can monitor, manipulate, or capture all communications passing through it.
Software Vulnerabilities and Attacks
Application attacks stem from common coding vulnerabilities, insecure data handling, and weak protocol choices that leave software exposed to exploitation. Understanding how applications process and transmit data is foundational to recognizing and defending against these threats.
Common Weakness Enumeration (CWE)
Common Weakness Enumeration (CWE) is a structured, numbered database of software and hardware weaknesses maintained at cwe.mitre.org that helps security professionals categorize and track recurring coding flaws before they become real-world vulnerabilities. Understanding CWE alongside CVE provides a clear framework for distinguishing between general weakness categories and the specific incidents they produce.
OWASP Top 10
The OWASP Top 10 is a globally recognized, open-source framework that identifies the most critical web application security risks, helping developers and security professionals prioritize vulnerabilities in their systems.
DEMO: Race Conditions
Race conditions occur when multiple processes access or modify shared resources simultaneously, creating a vulnerability that can be exploited to bypass security controls or corrupt data. Understanding the time-of-check to time-of-use (TOCTOU) gap is essential for identifying and defending against this class of weakness.
Deserialization Attack
Deserialization attacks exploit the process of converting serialized data back into objects, allowing attackers to inject malicious code that executes when a server processes the payload. This attack vector is classified under CWE-502, Deserialization of Untrusted Data.
DEMO: Path Traversal
Path traversal (CWE-22) is a vulnerability that allows attackers to manipulate file path inputs in web applications to access directories and files outside the intended scope. Understanding how this attack works is foundational to identifying and securing vulnerable systems.
DEMO: Injection Attacks
Injection attacks occur when malicious input is inserted into application fields to execute unauthorized commands or access restricted data. This content covers the core concept of injection vulnerabilities and demonstrates command injection using a real web application example.
DEMO: Structured Query Language (SQL) Injection
SQL injection is a widely exploited attack technique in which malicious input is inserted into application fields to manipulate backend database queries, enabling unauthorized access, data theft, or data manipulation. Understanding how these attacks work is foundational to securing any application that relies on a SQL-based database.
DEMO: Cross-Site Scripting (XSS)
Cross-site scripting (XSS) is a web vulnerability that allows attackers to inject malicious scripts into web pages, which then execute in the browsers of unsuspecting visitors. It is cataloged under CWE-79 in the Common Weakness Enumeration database.
DEMO: iFrame Attacks
Iframes are a legitimate HTML feature used to embed content from external sources, but they can be exploited to host malicious code, facilitate adversary-in-the-middle attacks, and create convincing phishing sites that harvest user credentials.
Authentication and Access Attacks
Authentication and access attacks cover the techniques adversaries use to break into systems, escalate privileges, and move laterally across a network. Methods range from credential theft and brute-force guessing to replay attacks, trust exploitation, and authentication bypass.
DEMO: Password and Credential Attacks
Password and credential attacks rely on tools like Hydra and Hashcat to compromise authentication systems through techniques ranging from brute force to hash cracking. This content covers how attackers acquire credentials and how these two tools are used in ethical penetration testing scenarios.
MFA Fatigue
MFA fatigue is a social engineering attack that exploits user frustration by bombarding victims with repeated authentication requests until they approve access just to stop the notifications. Understanding this threat is essential for anyone relying on multi-factor authentication as a security control.
Credential Replay
A credential replay attack allows an adversary to gain unauthorized access to a system by intercepting and reusing authentication data — such as a hashed password — without ever knowing the actual credentials. Understanding this attack and its variants is essential for recognizing authentication vulnerabilities in modern systems.
Pass-the-Hash/Ticket/Token
Pass the hash, pass the ticket, and pass the token are credential replay attacks in which an adversary intercepts and reuses an authentication hash, Kerberos ticket, or session token to gain unauthorized access to systems and resources.
Session Hijacking
Session hijacking occurs when an attacker takes over an active communication session between a client and a server, effectively impersonating the legitimate user. Cookies and tokens are among the primary mechanisms targeted in this type of attack.
Compromised Key Attack
A compromised key attack occurs when an adversary obtains a cryptographic key—such as a session key or private key—allowing them to intercept, decrypt, or manipulate secured communications between systems.
Privilege Escalation
Privilege escalation is the process attackers use to gain higher-level access on a system after an initial compromise. This coverage explains the techniques adversaries employ to move from limited access to full control over a target resource.
Jailbreaking
Jailbreaking removes manufacturer-imposed restrictions on mobile devices, granting access to backend settings and unauthorized software installation. It poses serious security risks in enterprise environments, even when performed without malicious intent.
Sideloading
Sideloading is the practice of installing applications on a device outside of its official app store, bypassing the manufacturer's authorized distribution channel. This introduces security risks by circumventing the vetting processes designed to keep malicious software off devices.
Trust Exploit
Trust exploitation is a cyberattack technique in which an adversary leverages an established trust relationship between systems or entities to gain unauthorized access to resources. It can occur across networks, servers, services, domains, and organizations.
Cross-Site Request Forgery (CSRF)
Cross-site request forgery (CSRF) is a trust exploitation attack in which an adversary tricks a legitimate user's browser into sending unauthorized requests to a web server on their behalf. The server processes the request as if it came from the trusted user, granting the attacker the victim's access rights.
Confused Deputy
The confused deputy attack exploits trust relationships between programs, tricking a privileged process into performing actions on behalf of a less-privileged one that would otherwise be denied. It falls under CWE-441 and represents a common class of software trust exploitation.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) is a vulnerability in which an attacker manipulates a web server into making requests to internal resources that the attacker cannot reach directly. It is classified under the Confused Deputy category in the Common Weakness Enumeration (CWE-918).
Physical Attack
Physical security is a critical layer of IT infrastructure protection, covering threats like unauthorized device access, lock bypass, badge cloning, and equipment sabotage.
DEMO: Password Hashing
Passwords stored in plaintext create serious security risks, so modern systems use hashing algorithms to convert credentials into irreversible fingerprints that protect users even when storage is compromised. This content covers how password hashing works, how it is implemented on Cisco devices and Linux systems, and how hashed values are used to verify credentials without ever exposing the original password.
DEMO: Rainbow Tables
Rainbow tables are precomputed lookup tables that map hash values back to their original plaintext passwords, allowing attackers to reverse hashed credentials stolen from a database. Long passwords and salting are the two primary defenses that render rainbow table attacks impractical.
DEMO: Salting Passwords
Password salting is a cryptographic technique that appends unique random data to each password before hashing, rendering rainbow table attacks ineffective. It is a foundational defense for securing stored credentials in any database system.
DEMO: Brute-Force Password Cracking
Brute force password attacks work by systematically testing every possible character combination until a match is found. Password length is the most effective defense, as each additional character increases cracking time exponentially.
DEMO: Password Cracking with hashcat
Hashcat is a leading password-cracking tool used in ethical hacking and penetration testing to recover passwords from cryptographic hashes. This content covers its core syntax, hash modes, wordlist-based attacks, and how salting affects the cracking process.
DEMO: Dictionary Attack
A dictionary attack uses a predefined list of words to crack password hashes by systematically testing each entry until a match is found. This demonstration covers the full process using Hashcat on Kali Linux to crack an MD5 hash with a custom wordlist.
DEMO: Mask Attacks
A mask attack is a targeted form of password cracking that uses known patterns to reduce the search space, making it far more efficient than a full brute force approach. This technique is applied in Hashcat using character placeholders to isolate and crack unknown portions of a password.
DEMO: Using hydra to Hack an Account
Hydra is a command-line password cracking tool used in ethical hacking to test authentication security through dictionary attacks and password spraying against network services like FTP.
DEMO: Password Spraying
Password spraying is a credential attack that tests a single password against many user accounts, exploiting common and default passwords to avoid account lockouts. This coverage includes a live demonstration using Hydra and practical defensive guidance for IT and security teams.
DEMO: Credential Stuffing
Credential stuffing is an attack technique that uses stolen username and password pairs to gain unauthorized access to systems. This content covers how the attack works and demonstrates it using Hydra on a Kali Linux machine against an FTP target.
Stealth Techniques
Stealth techniques allow attackers to operate on a compromised network without being detected, covering both the actions they take and the traffic they generate. Understanding these methods is essential for recognizing how adversaries evade intrusion detection systems and other security controls.
Stealth Technique: Encryption
Encryption is a core stealth technique that converts data into unreadable code using a key, obscuring activity whether data is stored or actively transmitted across a network.
Stealth Technique: Tunneling
Tunneling is a network stealth technique that encapsulates Layer 3 packets under a new header to reroute traffic covertly, often combined with encryption to form a VPN connection between an attacker and a compromised machine.
Stealth Technique: Obfuscation
Obfuscation is the practice of concealing data by making it difficult to interpret, such as embedding hidden messages within image files or encoding text using Unicode. It is commonly used to disguise data exfiltration by making malicious traffic appear as ordinary, benign content.
Stealth Technique: Traffic Fragmentation
Traffic fragmentation is a stealth technique that breaks data into smaller segments before transmission, making the overall payload harder to detect or identify in transit. Splitting traffic this way conceals the true nature or intent of what is being moved across a network.
Stealth Technique: DNS Tunneling
DNS tunneling is a technique that exploits DNS traffic to covertly exfiltrate data from a network by embedding information within DNS queries and responses. Because DNS is essential infrastructure that cannot simply be blocked, it presents an attractive and often overlooked channel for adversaries.
Stealth Technique: Proxies
Proxy servers mask an attacker's true IP address by routing traffic through an intermediary, preventing defenders from tracing packets directly back to the source.
Stealth Technique: Fast-Flux
Fast flux is a DNS-based evasion technique that rapidly cycles traffic through a pool of rotating proxy servers to conceal an attacker's true location and maintain persistent command-and-control communication.
Stealth Technique: Double-Flux
Double flux is an advanced fast flux technique that continuously rotates both proxy servers and DNS servers, making command-and-control infrastructure nearly impossible to block or trace. It builds on single flux by eliminating the single point of failure that a static authoritative DNS server creates.
Stealth Technique: Domain-Flux
Domain flux extends fast flux techniques by continuously rotating domains, DNS servers, and proxy servers simultaneously, making botnet command-and-control infrastructure nearly impossible to block or trace.
Stealth Technique: Domain Generation Algorithms (DGA)
Domain generation algorithms (DGAs) automatically produce large numbers of pseudo-random domain names, providing the continuous supply of domains required to execute domain flux attacks.
Indicators of Compromise (IoC)
Indicators of compromise (IoCs) and indicators of attack (IoAs) are the signs and signals security professionals use to detect whether a network, host, or application has been targeted or successfully breached. This coverage explains the distinction between the two terms, where to look for these indicators, and how employee reporting factors into an organization's overall detection strategy.
Alerts
Effective security monitoring depends on configuring alerts ahead of time so that potential attacks or system compromises trigger timely investigation. Key sources include antivirus, firewalls, EDR, IDS/IPS, and SIEM systems.
Logs
Log analysis is a core technique for identifying indicators of compromise, with security teams reviewing network, firewall, application, and system logs to detect abnormal activity such as repeated failed login attempts.
Removed Evidence
Gaps in log files and deleted evidence can signal that an attacker has compromised a system and attempted to cover their tracks. Identifying these anomalies is a critical step in incident detection and response.
Disabled Defenses
Attackers routinely disable security tools like firewalls, antivirus, and EDR systems to avoid detection after gaining access to a network. Recognizing disabled defenses is a critical indicator of potential compromise.
Resource Consumption
Unusual resource consumption—including spikes or drops in CPU, memory, bandwidth, or storage—can signal a compromise and warrants investigation. Monitoring these metrics across devices and network infrastructure helps identify patterns that fall outside normal operating parameters.
Screen Freezing or System Crashes
Frequent system crashes and freezes can signal more than software bugs or hardware failures — they may indicate an active malware infection or ongoing attack. Recognizing these symptoms, including the Windows blue screen of death, is a key step in identifying potential system compromise.
Resource Inaccessibility
Resource inaccessibility—including blocked content, service interruptions, and unreachable sites—can signal a cyberattack or malware infection, such as a denial-of-service attack or a virus that redirects traffic through an unauthorized proxy server.
Strange Communication
Anomalous network communication—including unexpected outbound traffic, unknown open ports, and unauthorized emails—can signal data exfiltration, command-and-control activity, or a compromised system.
Data Exfiltration
Data exfiltration occurs when an adversary covertly transfers stolen data out of a network, sometimes using disguised DNS queries to avoid detection. Recognizing the signs of this technique is essential for identifying and stopping unauthorized data theft.
Rogue Devices
Unauthorized devices appearing on a network—whether connected wirelessly, via removable media, or physically plugged into a port—can signal an active attack or intrusion attempt. Recognizing these rogue devices is a critical step in identifying and responding to network-based threats.
Scans and Sweeps
Network scanning and enumeration techniques like IP sweeps and port scans leave detectable traces that can reveal unauthorized reconnaissance activity. Identifying these indicators early enables teams to investigate and assess potential network compromise.
Beaconing
Beaconing is a command-and-control technique in which malware on a compromised system periodically sends outbound check-in requests to an attacker's server, bypassing firewall restrictions that block inbound connections.
Unauthorized Changes
Unauthorized changes to a network or system—whether to files, accounts, processes, scheduled tasks, or permissions—are key indicators of an active attack. Recognizing these changes early is critical to detecting and responding to threats before they cause serious damage.
Account Lockout
Account lockouts can signal a brute force attack, where an adversary repeatedly attempts username and password combinations until access is gained or the account is blocked. Account lockout policies limit login attempts to mitigate this risk.
New Accounts
Unexpected new accounts appearing on network machines can signal a compromise, as attackers often create them to maintain persistent access after gaining entry.
Concurrent Session Usage
Concurrent session usage occurs when an adversary accesses a compromised machine without disconnecting the legitimate user, allowing malicious activity to go undetected. Windows Task Manager's Users tab provides a straightforward way to identify multiple active sessions on a single system.
Impossible Travel
Impossible travel is a security indicator that flags account logins from geographically distant locations within an unrealistically short time window, signaling potential account compromise.
Other Strange Behavior
Indicators of compromise extend beyond obvious intrusions to include subtle anomalies such as sluggish performance, unexpected outputs, and abnormal system behavior. Recognizing these out-of-the-ordinary signals is a critical skill in identifying active threats on a network.
Security Operations
Security operations encompasses the day-to-day actions, policies, and procedures an organization uses to mitigate risk and uphold the CIA Triad of confidentiality, integrity, and availability. This coverage extends to the structure of a formal security program and the collaborative SecOps methodology.
Cybersecurity Programs
A cybersecurity program is a structured, ongoing organizational function that identifies risk, enforces compliance, and establishes the policies and accountability measures needed to protect a company across every role and department. Without one, even a single employee's poor security habits can expose an entire organization to serious harm.
Security Program Documentation
Proper documentation is a cornerstone of any effective security program, enabling consistency, efficiency, and continuous improvement across security operations. Many industries also require it by law, making it both a best practice and a compliance necessity.
Policies
Security policies form the foundation of any security program, serving as the high-level governing principles that define what an organization is trying to achieve and how it will operate. Understanding the distinction between policies, standards, procedures, and guidelines is essential for building and managing an effective security program.
Information Security Policy (ISP)
An information security policy (ISP), also called a written information security policy or WISP, is the master document that consolidates all of an organization's security policies into a single governing framework. Many states and regulated industries now require businesses to maintain one.
Standards
Security policies define organizational goals, while standards provide the specific, measurable requirements used to achieve them. Together, they form the foundation for consistent, auditable security practices across areas like password management, access control, physical security, and encryption.
Procedures
Procedures translate policies and standards into actionable, step-by-step instructions that guide how organizations implement processes, manage daily operations, and respond to incidents. Collectively, these procedures form a playbook that strengthens consistency, accountability, and security across the organization.
Guidelines
Procedures define the steps required to complete a task, while guidelines provide supporting guidance for judgment calls and decision-making that procedures cannot fully anticipate. Together, they help practitioners navigate variability and make informed choices within a process.
Controls
Security controls are the measures, safeguards, and procedures organizations put in place to reduce cybersecurity risk, and they can be understood through three distinct definitions depending on the context. They are also organized by category and type to address different aspects of an organization's security posture.
Fail-Open vs Fail-Closed
Security controls are designed to fail in one of two ways: fail open, which maintains availability by removing restrictions, or fail closed, which preserves confidentiality and integrity by blocking all access. Choosing the right failure mode depends on weighing the sensitivity of the asset against the criticality of keeping it available.
Types of Security Controls
Network security controls are categorized by their function—preventing, deterring, detecting, correcting, recovering from, compensating for, or directing responses to risk. Understanding each control type and how they can overlap is essential for building a layered security strategy.
Policies, Standards, Procedures, Guidelines
Policies, standards, procedures, guidelines, and controls form a structured hierarchy that governs how organizations build and manage a cybersecurity program. Understanding how these components relate to each other—and how to document them appropriately—is essential for designing a program that is both effective and scalable.
Cybersecurity Frameworks
Cybersecurity frameworks provide a structured blueprint for building an organizational security program, offering predefined standards and controls that teams customize to fit their specific environment. Common frameworks range from the broad NIST Cybersecurity Framework to the highly detailed NIST 800-53, with options in between suited to different organizational sizes and compliance requirements.
Monitoring and Revisions
Cybersecurity policies and procedures require continuous monitoring and revision to remain effective as business needs evolve. A structured revision cycle—from requirements gathering through implementation and assessment—keeps security programs aligned with organizational realities.
Security Program Governance
Building an effective cybersecurity program requires understanding what drives the need for one, who owns it organizationally, and how it gets structured across the business. This content covers the internal and external pressures that prompt security investment, the role of executive support, and the differences between centralized and decentralized program governance.
Compliance Management
Compliance management in security operations requires navigating a complex web of international, federal, state, and industry-specific regulations that govern how organizations protect and handle data. This content covers a structured, cyclical process for identifying applicable regulations, assessing their organizational impact, developing supporting policies, and maintaining ongoing compliance as laws evolve.
Risk Management
Cybersecurity risk management centers on two core activities: establishing a measurement framework and conducting structured risk assessments. Together, these allow organizations to identify, prioritize, and respond to threats in proportion to their risk tolerance and available resources.
Asset Acquisition and Management
Asset management in cybersecurity extends far beyond physical hardware to include data, software, intellectual property, and even workforce—each requiring security controls at every stage of its life cycle. Understanding how assets are acquired, assigned, maintained, transferred, and securely disposed of is essential to reducing organizational risk.
Vulnerability Management
Vulnerability management is the practice of identifying, analyzing, reporting, and remediating weaknesses in an organization's technology infrastructure before threat actors can exploit them. It differs from risk management in that it focuses on technical flaws rather than broader business threats.
Patch Management
Patch management is a critical security practice, but many organizations struggle with inconsistent, incomplete, or inefficient patching processes that leave systems exposed. Understanding the vulnerability lifecycle reveals why minimizing the gap between patch release and patch application is essential to reducing risk.
Vendor and Supply Chain Management
Vendor and supply chain management covers the processes organizations use to evaluate, onboard, and oversee the external providers that supply hardware, software, and services. Understanding the full supply chain—and the risks embedded within it—is essential for maintaining security and operational continuity.
Personnel Management
Effective cybersecurity programs extend beyond technology into personnel management, influencing hiring practices to reduce insider threats and ensure trustworthy staff are placed in the right roles. This coverage examines how security teams contribute to onboarding, offboarding, background checks, and audit processes across an organization.
Identity and Access Management (IAM)
Identity and access management (IAM) is a critical cybersecurity discipline covering account provisioning, maintenance, and de-provisioning — yet most IT departments operate at only about 60% of where they should be. Understanding the full IAM lifecycle and keeping processes well documented is essential to reducing organizational risk.
Security Awareness & Training Management
Employees represent one of the greatest cybersecurity risks to any organization, making security awareness and training a critical component of any effective cybersecurity program. This content covers the policies, training methods, and testing strategies organizations can use to reduce human-based cyber threats.
Configuration and Change Management
Change management is a structured process for controlling and implementing changes within an IT environment to reduce errors, minimize downtime, and improve stakeholder communication. A properly scaled change management framework helps organizations maintain consistency and quality while keeping workflows efficient.
Data Management
Data management covers the full lifecycle of information, from creation and use to storage and retirement, and has never been more critical given today's growing privacy regulations. Understanding each stage of the data lifecycle is essential to building a comprehensive and compliant data management process.
Monitoring and Alerting
System monitoring and alerting are essential practices for maintaining infrastructure reliability and protecting organizational reputation. Effective monitoring requires continuous refinement to minimize false positives and false negatives while ensuring critical issues are caught before they escalate.
Incident Management
A structured incident response plan reduces the duration and impact of system outages by guiding technicians through preparation, response, and follow-up phases. Organizations that invest in this process consistently resolve incidents faster and experience fewer recurring issues over time.
Contingency Planning
Rebuilding systems and recovering lost data after a major incident requires planning long before disaster strikes. This content covers disaster recovery plans, contingency plans, and business continuity plans — what they are, how they differ, and how they work together to keep an organization operational.
Auditing and Assessments
Overconfidence in cybersecurity is a well-documented risk, and regular internal and external audits are essential tools for identifying gaps that technical teams may overlook. Organizations need structured assessments to verify that security practices align with both operational reality and regulatory requirements.
Program Management
Cybersecurity program management provides the overarching structure that coordinates all security functions, budgets, roles, and resources into a unified organizational strategy. Rather than treating each security discipline as an isolated silo, effective program management ensures every component works together toward a common mission.
Compliance Management
Compliance means aligning organizational operations and processes to meet the requirements of laws, regulations, customers, and other defined standards. This content covers the core factors that drive compliance obligations, how compliance is implemented through policies and procedures, and how the compliance life cycle works in practice.
Privacy
Privacy fundamentals cover the core rights and regulations that govern how personal data is collected, used, and protected in today's connected world. Key concepts include data sovereignty, ownership, the right to access, the right to be forgotten, and consent requirements across different jurisdictions.
Data Roles
Understanding data roles and terminology is essential for navigating the laws, regulations, and standards that govern how organizations collect, manage, and protect information. This content covers the standard definitions for roles such as data controller, data subject, data steward, data custodian, data processor, and data protection officer.
Compliance Factors
Organizations must navigate a complex web of laws, regulations, industry standards, and relationship-driven requirements that govern how they collect, store, and process data. Compliance obligations vary based on geographic location, industry, services offered, customer base, and the types of data handled.
Regulation, Accreditations, and Standards
Regulations, standards, accreditation, compliance, and frameworks are distinct but closely related concepts that shape how organizations build and measure their security programs. Key examples include GDPR, PCI DSS, COPPA, CSA STAR, Common Criteria, CMMI, ISO 27000 series, and NIST.
Customer, Vendor, and Partner Agreements
Businesses formalize their relationships with customers, vendors, and partners through legally binding agreements that define expectations and service standards. Common agreement types include privacy policies, service level agreements, non-disclosure agreements, and data retention policies, each carrying real consequences for non-compliance.
Legal Actions
Legal obligations can arise from lawsuits or broken contracts, requiring organizations to locate, preserve, and produce electronic records through a formal process called e-discovery. Understanding due care, due diligence, and legal holds is essential for handling these situations properly.
Compliance Monitoring and Reporting
Regulatory compliance is an ongoing process that requires continuous monitoring and structured reporting, not a one-time implementation. This content covers how organizations track adherence to standards internally and externally, and how attestation and automation support those efforts.
Gap Analysis
Gap analysis and compliance monitoring are essential practices for identifying where an organization falls short of required security standards before undergoing formal third-party audits. SOC 2 attestations, performed by CPA firms, provide external validation of a company's compliance posture but come with significant cost.
Consequences of Non-Compliance
Non-compliance with regulatory and contractual standards exposes organizations to serious consequences, including fines, sanctions, reputational damage, license revocation, and contract termination. Understanding these risks is essential for anyone responsible for managing or securing an organization's infrastructure.
Risk Management
A foundational overview of risk management concepts, covering key terminology, the CIA Triad, threat and vulnerability relationships, and how risk management differs from vulnerability management in scope and function.
Risk Management Approach
Risk management fundamentals cover the frameworks, models, and lifecycle processes organizations use to identify, assess, and mitigate threats to business assets. Core concepts include Enterprise Risk Management, the People-Processes-Technology model, data states, the CIA triad, and widely adopted frameworks such as NIST, COSO, and ISO 31000.
Risk Assessment
Risk assessment is a core component of risk management that involves identifying, analyzing, and prioritizing the risks facing an organization. The process produces a formal report that guides decision-making and risk mitigation efforts.
Risk Appetite, Risk Threshold, and Risk Tolerance
Risk appetite, risk tolerance, and risk threshold are key terms organizations use to define how much risk they are willing to accept, though inconsistent definitions across the industry make practical application challenging.
Risk Identification
Risk identification is the foundational step of the risk management lifecycle, focused on building a comprehensive understanding of every threat an organization faces. This coverage walks through the key methods used to surface, document, and begin tracking organizational risks.
DEMO: Assessments
Asset and data inventory assessments are foundational tools for identifying and prioritizing organizational risk. This content covers how to structure these assessments, assign ownership, and score assets and data based on risk factors and recovery requirements.
Risk Tracking & Risk Register
A risk register is a structured tool used to track organizational risks through their full lifecycle, from identification and assessment to mitigation and review. Each recorded risk is assigned an owner, evaluated by likelihood and impact, and linked to a treatment or response.
Risk Analysis
Risk analysis determines the severity of identified threats by measuring their likelihood and potential impact, helping organizations prioritize which risks demand the most immediate attention. The two primary approaches are quantitative analysis, which assigns numerical values and dollar amounts to risks, and qualitative analysis, which uses descriptive ratings such as low, medium, or high.
Qualitative Risk Analysis
Qualitative risk analysis uses descriptive ratings like low, medium, and high to assess the likelihood and impact of risks, offering a faster alternative to number-based quantitative methods. A risk matrix can then be used to compare and prioritize risks based on where they fall across those rating scales.
DEMO: Risk Register and Analysis
A risk register is a structured tool used to document, assess, and prioritize organizational risks by evaluating each risk's probability and potential impact. This content walks through a practical example of how entries are built, scored, and compared to support informed risk management decisions.
Asset Value (AV) and Total Cost of Ownership (TCO)
Quantitative risk analysis uses mathematical equations to calculate potential losses by multiplying probability by financial impact. Understanding asset value and total cost of ownership are essential foundations for applying these calculations accurately.
Quantitative Risk Analysis
Quantitative risk analysis translates cybersecurity risks into measurable dollar amounts, giving organizations a clear, comparable basis for evaluating and prioritizing threats. This approach moves beyond subjective high-medium-low ratings by factoring in probability, full financial impact, and annualized loss expectations for recurring risks.
Single-Loss Expectancy (SLE) and Exposure Factor (EF)
Single Loss Expectancy (SLE) quantifies the expected monetary loss from a single occurrence of a risk event, calculated by multiplying an asset's value by its exposure factor (EF). Understanding SLE is essential for quantitative risk analysis and feeds directly into calculating Annualized Loss Expectancy (ALE).
Annualized Loss Expectancy (ALE) and Annual Rate of Occurrence (ARO)
Annualized Loss Expectancy (ALE) combines the cost of a single risk event with how frequently that event is expected to occur, giving organizations a consistent annual figure for budgeting and risk planning. Understanding ALE and Annual Rate of Occurrence (ARO) allows security professionals to quantify risk exposure across different threat frequencies.
Risk Reporting
Effective risk management depends on clear, consistent reporting to keep stakeholders informed about identified risks, mitigation plans, and outcomes. This content covers the key phases of risk reporting, common audiences, delivery methods, and the role of KPIs, KRIs, and trend analysis in communicating organizational risk health.
Risk Management Strategies
Risk management strategies help organizations bring unacceptable risks within policy thresholds through avoidance, reduction, transference, or acceptance. Understanding the distinction between risk exceptions and exemptions is essential for proper governance and compliance.
Risk Mitigation and Controls
Security controls are countermeasures organizations put in place to reduce or transfer risk, and they are classified by both category and functional type. The four control categories are managerial, operational, technical, and physical, while control types include preventative, deterrent, detective, corrective, recovery, compensating, and directive.
Inherent and Residual Risk
Risk mitigation reduces but rarely eliminates threats entirely, leaving a remaining exposure known as residual risk. Understanding the difference between inherent risk and residual risk is essential for accurate risk management planning.
Trade-Off Analysis
Tradeoff analysis is a structured approach to evaluating competing priorities when time, budget, or resources allow for only one course of action. Cost-benefit analysis and return on investment calculations provide a common financial baseline for comparing fundamentally different options.
Cost-Benefit Analysis (CBA) Example
Cost-benefit analysis applied to IT infrastructure weighs the revenue lost from service downtime against the investment required to prevent it. Finding the optimal balance between these two cost curves determines the most financially sound level of uptime investment.
Calculating Return On Investment (ROI)
Return on Investment (ROI) is a financial metric used to evaluate and prioritize cybersecurity risk mitigation efforts by comparing the benefit gained from a solution against its implementation cost. It provides an objective, standardized way to rank competing projects and communicate security value in business terms.
DEMO: ROI Worksheet
Risk ROI analysis is a structured method for comparing security solutions by calculating the financial benefit of risk reduction against implementation costs. This approach helps organizations prioritize which controls to implement first based on measurable return on investment.
Planning and Prioritization
After identifying and analyzing risks, organizations must prioritize, plan, mitigate, and monitor those risks to drive real improvement. This content covers practical prioritization methods—including ROI analysis, the quadrant method, and others—along with mitigation workflows and the continuous monitoring cycle.
Asset Management
Asset management is a foundational component of organizational risk management, covering everything from hardware and software to data, reputation, and leased services. Effective asset management requires classifying assets by value and data sensitivity, then applying appropriate lifecycle controls from acquisition through deprovisioning.
Acquisition and Procurement
IT procurement and acquisition processes establish how organizations evaluate, approve, and purchase technology products and services. Without structured oversight, companies risk shadow IT, wasted spending, and serious security vulnerabilities.
Assignment and Accounting
Asset assignment is the practice of formally linking IT equipment or services to a specific individual or department to establish clear ownership and accountability. Directly assigning high-value or high-risk items to named individuals produces the strongest security outcomes.
Monitoring and Asset tracking
Effective asset management requires both tracking physical locations and monitoring device security across a network. This coverage spans inventory methods, tracking technologies, ownership records, and network scanning techniques used to identify unauthorized devices.
Decommissioning and Disposal
Secure asset disposal covers how to safely decommission hardware so that sensitive data cannot be recovered by unauthorized parties. Methods include multi-pass data wiping, degaussing, physical destruction, and third-party disposal services with certification.
Vulnerability Management
Vulnerability management is the continuous process of discovering, assessing, prioritizing, and remediating technical weaknesses in systems, software, and infrastructure. This coverage establishes the core concepts, distinguishes vulnerability management from risk management, and introduces the vulnerability lifecycle along with key detection methods like scanning and penetration testing.
Common Vulnerabilities and Exposures (CVE)
The Common Vulnerabilities and Exposures (CVE) list is a publicly searchable database of over 240,000 known security vulnerabilities, giving security professionals and attackers alike visibility into existing weaknesses across software and systems.
Common Vulnerability Scoring System (CVSS)
The Common Vulnerability Scoring System (CVSS) provides a standardized 0–10 scale for assessing the severity of security vulnerabilities, helping organizations prioritize remediation efforts based on risk. Scores are calculated from factors including attack vector, attack complexity, required privileges, user interaction, and potential impact on confidentiality, integrity, and availability.
Discovering Vulnerabilities
Identifying vulnerabilities across an IT infrastructure requires more than awareness—it demands active, ongoing discovery through scanning, testing, code review, and threat intelligence. This content covers the core methods security professionals use to find and assess weaknesses before attackers do.
Discovering Application Vulnerabilities
Application security analysis covers the methods used to identify and address vulnerabilities in software during and after development. Techniques include static and dynamic analysis, fuzz testing, reverse engineering, software composition analysis, and side-channel analysis.
Vulnerability Scans
Vulnerability scanning is a core technique for identifying security weaknesses across a network, using tools ranging from locally installed software to cloud-based services and managed security providers. Scanners compare discovered assets against curated vulnerability databases and report findings with severity rankings to guide remediation priorities.
Vulnerability Scanner Settings and Considerations
Vulnerability scanning requires careful configuration decisions that directly affect the accuracy, depth, and operational impact of each scan. Key settings include scan scope, active versus passive methods, credential use, agent deployment, and sensitivity levels.
Common Enumeration (CPE, CCE, and CVE)
Vulnerability scanners rely on standardized enumeration systems to identify and assess the hardware, software, operating systems, configurations, and known vulnerabilities present on a network. This content covers Common Platform Enumeration (CPE), Common Configuration Enumeration (CCE), Common Vulnerabilities and Exposures (CVE), and the scoring systems CVSS and CCSS.
Security Content Automation Protocol (SCAP)
SCAP (Security Content Automation Protocol) is a NIST-maintained framework that standardizes how vulnerability scanners collect, structure, and exchange security data across networked systems. It bundles together identification schemes, assessment languages, and scoring systems into a unified, XML-based approach to automated security compliance and vulnerability management.
Penetration Testing (Pentesting)
Penetration testing is a structured security practice in which ethical hackers simulate real-world attacks against a network to uncover vulnerabilities before malicious actors can exploit them. Understanding the pen testing process, its tools, and its key configuration decisions is essential for any cybersecurity professional.
Red Teams and Blue Teams
Red team/blue team operations pit offensive security professionals against defensive teams to test and strengthen an organization's security posture. Purple teams can also serve as a coordination layer between the two.
Reporting
Vulnerability management reporting covers the types of reports generated throughout the vulnerability management lifecycle, what they contain, and who receives them. Reports vary in content and format depending on the stage of the process and the audience, from internal stakeholders to external clients and vendors.
Vulnerability Validation
Vulnerability scan reports are not always accurate, and validating results means distinguishing between true positives, false positives, true negatives, and false negatives. Understanding these four states is essential for ensuring scan findings reflect actual network conditions.
Vulnerability Analysis and (Re-)Classification
Vulnerability analysis goes beyond running scans — it requires assessing each finding against your organization's specific environment, risk tolerance, and asset value to determine true impact. Standard severity scores like CVSS provide a starting point, but organizations must often reclassify vulnerabilities to reflect their actual exposure.
Prioritization and Escalation
Vulnerability prioritization is the process of ranking identified security weaknesses by severity so remediation efforts are applied in the most effective order. Understanding when to escalate urgent patches and how zero-day vulnerabilities fit into this workflow are key components of a sound vulnerability management program.
Action Plan
Vulnerability remediation requires a structured action plan that outlines the steps needed to address identified security weaknesses, from simple patches to complex mitigation strategies. This content covers the planning phase of the vulnerability management cycle and the most common remediation approaches used in practice.
Vulnerability Remediation
Vulnerability remediation is the process of fixing identified security weaknesses after discovery, assessment, and prioritization. This topic covers the distinction between remediation and mitigation, common inhibitors to remediation, and the compensating controls available when full remediation is not possible.
Validation of Remediation
After implementing a control to address a vulnerability, validating that the fix actually worked is a critical step in the remediation process. The same methods used to discover the vulnerability — such as vulnerability scans or penetration tests — can typically be used to confirm it has been resolved.
Patch Management
Patch management is the structured process of planning, testing, deploying, and validating software updates to keep systems secure and minimize vulnerabilities. A well-defined patching workflow reduces downtime, protects critical infrastructure, and ensures no devices are left unpatched.
Data Management
Data is both a valuable business asset and a potential liability, requiring organizations to manage it carefully across its entire life cycle from creation to disposal. Understanding the costs, risks, and protective measures associated with data is foundational to sound information security practice.
Compliance, Privacy, and Data Roles
Data privacy compliance is a growing priority for organizations worldwide, shaped by evolving laws and regulations that define how personal data must be collected, managed, and protected. This content covers core privacy concepts, data subject rights, key regulatory frameworks like GDPR, and the defined roles organizations must fulfill to remain compliant.
Data Types
Data types determine how information must be handled, protected, and whether it falls under legal and regulatory requirements. Key categories include regulated versus non-regulated data, personally identifiable information, protected health information, and business data such as trade secrets and intellectual property.
Personally Identifiable Information (PII)
Personally identifiable information (PII) is defined in multiple ways across industry and regulatory standards, and understanding the distinctions between those definitions is essential for handling data correctly. This content breaks down three NIST definitions of PII and explains which is most practical for real-world data protection work.
Data Classifications
Data classification is the process of categorizing information based on its sensitivity and potential impact if disclosed. Organizations use classification levels to establish appropriate handling procedures and protect data from unauthorized exposure.
Data Inventory and Data Labeling
Data classification only works when it's consistently applied through labeling and inventory practices that identify and track sensitive information across an organization's systems. This content covers how to conduct a data inventory, perform data mapping, and use labels and metadata to enforce a classification scheme.
Data Protection
Data protection strategies are built around the CIA Triad—confidentiality, integrity, and availability—which guides how organizations define handling procedures for classified data. Core techniques include hashing, parity bits, RAID configurations, data replication, and access controls.
Data States
Data exists in three distinct states — at rest, in transit, and in use — each requiring its own security considerations to maintain confidentiality, integrity, and availability. Understanding these states is foundational to building a complete data protection strategy.
Keeping Data Confidential
Data confidentiality depends on three core strategies: avoiding unnecessary data collection, restricting access to what is retained, and concealing sensitive data through technical controls. Understanding how to balance data's business value against its security liability is fundamental to building an effective protection posture.
Encrypting Data
Encryption protects data confidentiality by transforming plaintext into unreadable ciphertext that can only be decoded with the appropriate key. This coverage spans encryption at rest, in transit, and in use, along with the performance trade-offs involved in choosing the right level of encryption granularity.
Steganography
Steganography is the practice of concealing secret messages within ordinary files such as images, text, or audio, hiding information in plain sight rather than encrypting it into unreadable cipher text. Unlike cryptography, which transforms data into a coded format, steganography embeds data invisibly so that the existence of the message itself goes undetected.
Data Masking and Obfuscation
Data masking and data obfuscation are techniques used to modify sensitive information so it remains useful for internal purposes while offering no value to unauthorized parties. Methods include substitution, shuffling, hashing, encryption, nulling, and partial masking, each suited to different data protection scenarios.
Data Loss Detection
Data loss detection covers the strategies and tools used to identify, monitor, and respond to sensitive data that has been leaked, mishandled, or compromised. Key approaches include document watermarking, digital rights management, network traffic analysis, and dedicated data loss prevention systems.
Data Loss Prevention
Data Loss Prevention (DLP) encompasses the tools and controls organizations use to keep sensitive data from leaving or being mishandled within their environment. Key mechanisms include blocking removable media, restricting printing and remote desktop access, securing clipboard activity, deploying virtual desktop infrastructure, and applying classification-based controls to monitor and stop unauthorized data transfers.
Data Retention and Retirement
Data retirement covers the processes and compliance requirements for properly archiving, sanitizing, or destroying data once it reaches the end of its life cycle. Understanding retention obligations, storage locations, and secure deletion methods is essential for managing data as both an asset and a liability.
Vendor Management
Vendor management is a structured lifecycle that covers everything from gathering requirements and assessing vendors to negotiating contracts, onboarding, ongoing monitoring, and eventual contract termination. It applies across hardware, software, and service providers, including managed service providers handling outsourced functions like help desk or security.
Gathering Requirements
A thorough needs assessment and requirements-gathering process is essential before purchasing any IT product, service, or hardware — skipping this step leads to wasted resources and serious security gaps. This content covers how to evaluate vendors across security, compliance, technical, geographic, and financial dimensions before any contract is signed.
Vendor Assessment
Vendor assessment is the structured process of identifying, evaluating, and selecting third-party suppliers based on defined requirements, security criteria, and business fit. Key considerations include scoring methodologies, conflict of interest, vendor lock-in, and independent audits.
Cloud Hosting Considerations
The shared responsibility model defines how security duties are divided between cloud service providers and their customers, varying based on the service model in use. Understanding this division is essential when handling sensitive data in cloud environments.
Supply Chain Management
Supply chain security involves analyzing every vendor and component in the chain of products and services that support an organization's operations. Understanding these dependencies helps identify risks ranging from component shortages to security vulnerabilities introduced by third-party suppliers.
Vendor Selection
Vendor selection and negotiation are overlapping processes that follow supplier assessment, culminating in a formal agreement and contract. A thorough assessment makes choosing the right vendor more straightforward and strengthens negotiating position.
Agreement Types
Business agreements between organizations go far beyond a handshake, requiring formal contracts that define service expectations, confidentiality obligations, partnership terms, and security requirements. This content covers the full range of common agreement types used in IT and business partnerships, along with the individual terms and clauses that give those agreements their legal and operational weight.
Vendor Monitoring and Termination
Vendor agreements require continuous monitoring and careful contract management, including service level agreements that define performance standards, penalties for underperformance, and clearly understood termination and auto-renewal clauses.
Personnel Management
Personnel management covers the full employee life cycle—from pre-hire screening and onboarding through active employment and eventual separation—with security playing a critical role at every stage. Understanding these phases helps security professionals protect organizational assets and reduce risk tied to human behavior.
Onboarding and Termination Procedures
Secure employee onboarding and offboarding are critical IT processes that establish security expectations from day one and eliminate access risks at separation. Proper execution directly impacts retention, performance, and overall company security posture.
Least Privilege
The principle of least privilege is a foundational security guideline that limits user access to only the resources required to perform their role. Restricting unnecessary permissions reduces attack surface, limits malware propagation, and minimizes the impact of security incidents.
Need to Know
The need-to-know principle restricts access to sensitive information only to those who require it to perform their roles, reducing the risk of accidental or intentional disclosure. It operates similarly to least privilege, limiting the attack surface by controlling the flow of sensitive data across an organization.
Separation of Duties
Separation of duties is a security and compliance principle that divides critical business processes across multiple individuals to prevent fraud, embezzlement, and unauthorized access. By ensuring no single person controls an entire workflow from start to finish, organizations create built-in checks and balances that deter and detect misconduct.
Job Rotation
Job rotation is a security control that reduces the risk of fraud and abuse by periodically moving employees through different roles, ensuring no single person maintains unchecked control over sensitive processes.
Mandatory Vacations
Mandatory vacation policies serve as both an employee wellness measure and an internal fraud detection control by temporarily removing individuals from processes they may be manipulating. When employees cannot intervene in reporting or approval workflows during their absence, hidden misconduct is more likely to surface.
Identity and Access Management (IAM)
Identity and Access Management (IAM) is a framework of policies, technologies, and controls that governs how organizations verify who users are and what resources they can access. It spans authentication protocols, authorization systems, and the full account lifecycle from provisioning to deprovisioning.
Authentication, Authorization, and Accounting (AAA)
AAA (Authentication, Authorization, and Accounting) is a core security framework that controls who accesses a network, what they can access, and tracks all activity. This content also covers how AAA relates to IAM and introduces the key protocols used to implement it, including TACACS+, RADIUS, and Diameter.
What Makes a Good Password
Weak and outdated password practices remain one of the most exploited vulnerabilities in cybersecurity. This content covers how passwords are compromised, what current guidelines recommend, and how to build stronger password habits using length, complexity, and multi-factor authentication.
Password Manager
Password managers solve the challenge of maintaining strong, unique credentials across every account by storing them in a single encrypted vault secured by one master password or passphrase. This coverage includes hands-on use of KeePass and a comparison of local, cloud-hosted, and self-hosted deployment options.
Privileged Access Management (PAM)
Privileged Access Management (PAM) covers the tools and strategies used to secure accounts with elevated system access, preventing unauthorized use and reducing insider risk. PAM solutions go beyond standard password managers by controlling, monitoring, and auditing how privileged credentials are granted and used.
Key Storage
Cryptographic key management is essential to maintaining data security, covering the use of hardware and software solutions to store and protect keys across various systems and environments. Key management systems, including Hardware Security Modules (HSMs) and Trusted Platform Modules (TPMs), provide structured approaches to securing cryptographic keys at scale.
Multi Factor Authentication (MFA)
Multi-factor authentication (MFA) significantly reduces credential-based threats by requiring users to verify identity through more than one factor, making it far more effective than password improvements alone. Authentication factors fall into five categories: something you know, something you have, something you are, somewhere you are, and something you do.
One-Time Passwords (OTP)
One-time passwords (OTPs) are a widely used multi-factor authentication method that generate short-lived, single-use codes to verify possession of a trusted device. They are delivered either through SMS or an authenticator app and expire after a set time window, typically between 30 seconds and 15 minutes.
HOTP and TOTP
HOTP and TOTP are two widely used one-time password protocols that allow an authenticator app and a server to independently generate matching codes without direct communication. HOTP uses an incrementing counter while TOTP uses the current time, with both methods relying on a shared secret key and HMAC-based hashing to produce short, truncated authentication codes.
IAM Policies and Enforcement
Effective password and identity management policies balance security requirements with what users can realistically follow, combining measures like MFA, longer passphrases, account lockouts, password managers, and single sign-on. Security professionals must set enforceable standards, train users on the reasoning behind them, and continuously adapt to current industry guidance.
Single Sign-On (SSO)
Single sign-on (SSO) enables users to authenticate once and gain access to multiple systems and resources using a single set of credentials, strengthening security while reducing password management burden.
Federation
Federation is the practice of creating trust relationships between separate systems or organizations so that authentication in one grants access to another. This topic covers trust direction, transitive trust, federated identity, how federation differs from single sign-on, and the protocols that support it.
Identity Proofing
Identity proofing is the process of verifying a user's identity through official documentation before granting access to a service or system. Unlike open account registration, identity proofing requires legal proof of identity such as a government-issued ID or supporting records.
Access Control
Access control is the practice of restricting who can reach an organization's networks, data, and services through physical, logical, and administrative measures. Permissions and access control lists define exactly what users, groups, and systems are allowed to do with any given resource.
Access Control Models
Access control can be implemented through several distinct models, each with different approaches to granting and managing permissions across users and resources. Understanding discretionary, mandatory, role-based, rule-based, attribute-based, and risk-based access control helps security professionals choose the right combination for their environment.
Physical Access Control
Physical access control covers the strategies, technologies, and policies used to protect facilities, equipment, and data from unauthorized physical entry. Topics include building perimeter defenses, door access mechanisms, surveillance systems, equipment security, and employee training.
Awareness
Security awareness is a critical component of organizational risk reduction, encompassing far more than formal training alone. Policies, communications, simulations, and consistent IT practices all play a role in building a security-conscious workforce.
Training
Security awareness training is a foundational component of any organizational security program, covering who needs training, when it should occur, and how to develop, deliver, test, and monitor it effectively. Understanding the full training lifecycle helps organizations reduce risk and maintain compliance across their workforce.
Security Training Content
Security awareness training content should be driven by current threat intelligence and risk levels, covering topics like social engineering, phishing recognition, password management, and insider threats.
Delivery
Cybersecurity training delivery covers the methods and platforms used to roll out security education, policy acknowledgment, and phishing simulations across an organization. Modern training management systems consolidate these functions into a single reportable workflow.
Awareness Testing
Testing employees for security awareness helps organizations identify who understands security protocols and who remains a vulnerability risk. Key methods include phishing simulations, password audits, knowledge assessments, and USB drop tests.
Monitoring and Reporting
Monitoring and reporting are essential components of security awareness programs, supporting internal oversight, regulatory compliance, and client-facing accountability. Reports typically cover training participation, phishing campaign results, policy acknowledgments, and meeting attendance.
Configuration vs Change Management
Configuration management and change management are related but distinct processes for handling modifications within an IT environment. Understanding the difference between the two is essential for managing organizational and system-level changes effectively.
Change Management
Uncontrolled changes are the leading cause of network outages and security vulnerabilities — a formal change management process provides the structured framework organizations need to reduce that risk. This content covers the full change management lifecycle, from initial request and ownership assignment through planning, evaluation, implementation, monitoring, and closure.
Planning Considerations
Change management planning requires evaluating service impacts, dependencies, maintenance windows, and rollback strategies before any implementation begins. Structured pre-change analysis, staged testing environments, version control, and proactive stakeholder communication are essential to reducing risk and ensuring successful system changes.
Evaluation and Implementation
Evaluating and implementing a change management plan requires structured review against policies, procedures, and communication standards before any change goes live. A Change Advisory Board provides independent oversight and grants final approval to ensure nothing is overlooked.
Monitoring, Documentation, and Closure
After a change is implemented, IT teams must monitor the environment for adverse effects and complete all final documentation before officially closing out the change request. Proper closure ensures system configurations, updated procedures, and approval records are all captured and the originating ticket or request is formally resolved.
Automation
Automating change control reduces manual effort, enforces consistency, and accelerates deployment by replacing step-by-step human tasks with software-driven processes. Key concepts include orchestration, APIs, CI/CD pipelines, and infrastructure as code.
Monitoring
IT monitoring is the continuous observation of systems, networks, and data to mitigate risk, support compliance, and inform business decisions. Core monitoring functions include discovery, mapping, aggregation, alerting, reporting, and log management, all anchored to the CIA Triad of confidentiality, integrity, and availability.
Monitoring Example
Effective organizational monitoring spans infrastructure, security, user experience, and business metrics, each requiring specialized tools and approaches. This content walks through a realistic SaaS environment to illustrate the full monitoring stack a modern IT team needs to manage.
Monitoring Methods
Infrastructure monitoring relies on four core methods—capturing, scanning, probing, and logging—each serving a distinct role in maintaining visibility across a network environment. Together, these approaches form the foundation of a comprehensive monitoring strategy.
Capturing
Network traffic analysis relies on tools and techniques like packet capture, network taps, port mirroring, and flow monitoring to inspect data moving across an organization's infrastructure. These methods help security teams detect intrusions, identify malware, prevent data loss, and uncover misconfigured or unauthorized devices.
Scanning and Probing
Network scanning identifies devices and assesses their state across an infrastructure, supporting asset discovery, vulnerability assessment, and uptime monitoring. Tools like Nmap, PRTG, and Pingdom each serve distinct scanning and probing purposes in a professional network environment.
Polling
Network monitoring goes beyond simple up/down scanning by using polling, protocols like SNMP and WMI, and optional agents to collect granular performance data — CPU usage, RAM, storage, temperature, and more — from devices across the infrastructure. A centralized monitoring platform aggregates this data to give administrators a full, real-time picture of network health.
Logging
Logging captures discrete events across network infrastructure—from firewalls and endpoints to SIEM systems—giving security teams a record of what happened, when, and where. Centralizing those logs through aggregation servers, synchronized timestamps via NTP, and syslog protocols turns raw data into a coherent, investigable timeline.
Netflow vs SNMP vs Syslog
NetFlow, SNMP, and Syslog each play a distinct role in network monitoring, and together they provide a comprehensive view of network activity and health. Understanding how these protocols differ and complement each other is essential for effective network visibility and security operations.
Benchmarking
Benchmarking establishes a baseline for normal system performance, enabling IT teams to quickly determine whether observed metrics represent a real problem or standard operating behavior. It is a foundational component of effective network troubleshooting and infrastructure monitoring.
Security Information and Event Management (SIEM)
A Security Information and Event Management (SIEM) system centralizes security logs and event data from across an infrastructure into a single, access-controlled platform. Keeping it isolated from other monitoring tools prevents insider threats from manipulating security records.
Indicators of Compromise (IoC)
Indicators of compromise (IOCs) are the signs detected through network monitoring that suggest a system or account has been attacked or breached. Recognizing common IOCs—such as account lockouts, impossible travel, and missing logs—is a foundational skill in network security monitoring.
File Integrity Monitoring (FIM)
File integrity monitoring (FIM) detects unauthorized changes to critical system files, helping security teams identify compromised servers before damage spreads. It is a core capability in modern SIEM deployments.
Alerting
Network monitoring and alerting are complementary practices that allow IT teams to detect and respond to system issues before they escalate into critical failures. Effective alert systems use tiered notification methods—dashboards, emails, texts, and calls—calibrated to severity to minimize downtime and reduce operational risk.
Log Management and Archiving
Managing log data at scale requires balancing system performance, storage capacity, compliance retention requirements, and the secure disposal of personally identifiable information. Log rotation, archiving, and structured disposal policies are core practices for keeping logging infrastructure reliable and audit-ready.
Threat Hunting
Threat hunting is the practice of having a human analyst actively search network devices, logs, and traffic for indicators of compromise that automated monitoring systems may miss. This topic covers how threat hunting compares to SIEM-based monitoring and how both relate to vulnerability scanning and penetration testing.
Incident Response (IR)
Incident response covers the strategies, processes, and plans organizations use to detect, contain, and recover from IT and security incidents while minimizing impact on users and services. It also includes digital forensics fundamentals for situations requiring evidence collection and criminal investigation.
Measuring Availability and Five 9s
System availability is measured as a percentage of uptime over a defined period, with industry standards ranging from three nines (99.9%) to five nines (99.999%) determining acceptable downtime thresholds. Service level agreements (SLAs) formalize these commitments and define financial penalties when availability targets are not met.
MTTR and MTBF
Mean Time to Recovery (MTTR) and Mean Time Between Failures (MTBF) are key reliability metrics used to evaluate system health beyond simple uptime and downtime tracking. Understanding how to calculate and consistently apply these measurements helps organizations assess and improve the dependability of their systems and services.
IR Process
Effective incident response depends on structured preparation and a clear sequence of actions spanning detection, analysis, containment, eradication, recovery, and post-incident learning. Organizations that establish these processes before an incident occurs are far better positioned to respond quickly and minimize damage.
Preparation
Effective incident response starts long before an incident occurs, requiring clearly defined procedures, assigned roles, and tested plans. This content covers the key elements of incident response preparation, including documentation, tooling, training, and automation with SOAR platforms.
Incident Response Plan
An incident response plan consolidates an organization's procedures, roles, tools, and training into a single reference document used to guide teams through detecting, containing, and resolving security incidents. Playbooks and runbooks are scenario-specific documents within that plan that provide structured, repeatable steps for handling threats like ransomware, data exfiltration, or social engineering.
Training and Testing Plans
Incident response plans require regular training and testing to ensure procedures are accurate and personnel know their roles. Testing methods range from tabletop exercises to parallel environment simulations and live environment validation.
Detecting, Declaring, and Escalating
Incident detection and declaration is one of the most challenging phases of incident response, requiring teams to verify true positives, apply consistent thresholds, and follow a controlled process before mobilizing a full response. This content covers how organizations identify, validate, and formally declare incidents to minimize impact while avoiding unnecessary disruption.
Containment, Eradication, and Recovery
Incident response containment, eradication, and recovery are the three core phases that follow threat detection and analysis, each serving a distinct role in neutralizing and resolving a security incident.
Communication
Effective communication is a critical component of incident response, shaping both the efficiency of technical troubleshooting and the organization's reputation during a security event. A well-defined communication plan identifies who to notify, what to share, and when, across internal teams, stakeholders, and external parties.
Root Cause Analysis
Root cause analysis (RCA) is a structured process used during incident response to trace an incident back to its true origin rather than stopping at surface-level symptoms. Identifying the root cause enables more effective containment, eradication, and recovery.
Incident Follow-Up
Effective incident response doesn't end at recovery — the follow-up phase, including root cause analysis and structured after-action reporting, is what drives lasting improvement and reduces future incidents.
Incident Response Example
A real-world incident response walkthrough traces a high-traffic application outage from initial anomaly detection through containment, root cause analysis, and post-incident review. The scenario illustrates how escalation procedures, cross-team coordination, and lessons learned drive continuous improvement to an organization's response plan.
Security Orchestration, Automation, and Response (SOAR)
SOAR (Security Orchestration, Automation, and Response) is software designed to streamline and manage the incident response process by coordinating communication, automating repetitive tasks, and centralizing data analysis across security tools and teams.
Digital Forensics
Digital forensics is the practice of collecting, preserving, and analyzing electronic evidence to support criminal investigations, internal inquiries, or legal proceedings. This content covers the core forensics process and key legal concepts such as litigation holds and e-discovery.
Forensic Process
Digital forensics is the disciplined process of collecting, preserving, analyzing, and reporting digital evidence in a legally defensible manner. Proper methodology is critical, as improperly handled evidence can be ruled inadmissible in court.
Contingency Planning
Contingency planning prepares organizations to maintain operations when unexpected events—such as natural disasters, cyberattacks, or infrastructure failures—disrupt normal business functions. This content covers the key planning frameworks, including incident response, disaster recovery, and business continuity, and how they work together to protect people, processes, and technology.
Business Impact Analysis (BIA)
A Business Impact Analysis (BIA) is a structured process for identifying an organization's critical functions, assessing the consequences of disruptions, and prioritizing recovery efforts to guide contingency planning. It helps organizations allocate resources where they matter most by defining impact categories, tolerance thresholds, and recovery requirements for essential systems.
RPO and RTO
Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are two critical metrics that define how much data an organization can afford to lose and how quickly systems must be restored after an incident. Understanding both helps organizations design backup strategies and allocate the resources needed to meet their recovery commitments.
Disaster Recovery Plan (DRP)
Disaster recovery planning prepares organizations to restore systems and data following major incidents like ransomware attacks, natural disasters, or utility failures. This content covers DR plan components, roles and responsibilities, and the differences between hot, warm, and cold recovery sites.
Testing Plans
Disaster Recovery plans must be regularly tested to verify their effectiveness, and several testing methodologies exist to balance thoroughness with operational risk. From tabletop exercises to live failovers, each approach offers different tradeoffs between accuracy and potential customer impact.
Auditing
Auditing is the process of inspecting systems, accounts, and procedures to verify that policies are being followed and nothing has fallen out of alignment. This content covers the account management lifecycle, what to prioritize for regular audits, and the differences between internal self-assessments and third-party external audits.
Attestation
Attestation is the practice of providing verifiable evidence that security policies and procedures are being followed. It plays a central role in audits and compliance activities across cybersecurity disciplines.
Compliance Audits Example
SOC 2 Type II is a third-party security audit conducted by certified CPA firms to verify that an organization's policies, procedures, and controls meet established information security standards. The resulting compliance report gives other businesses a reliable benchmark for evaluating a vendor's or partner's security posture.
Gap Analysis
A gap analysis measures an organization's current security or compliance posture against a required standard, identifying exactly what must be addressed to close the difference. It is commonly used to prepare for costly formal audits, such as a SOC 2 Type 2, by resolving weaknesses before the official assessment begins.
Program Management
Cybersecurity program management covers the oversight structures, audit processes, and governance mechanisms that ensure a security program operates as intended at an organizational level. It addresses how policies are maintained, how audits are verified, and how leadership accountability is defined within frameworks like NIST 800-53.
Evaluation and Metrics
Effective security programs must demonstrate measurable business value by reducing risk and contributing to revenue growth or cost reduction. Key performance indicators and key risk indicators provide the framework for tracking and communicating that value to organizational leadership.
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is a European Union privacy law enacted in 2018 that governs how organizations collect, process, and protect personal data — with penalties reaching up to 4% of global revenue or 20 million euros for non-compliance.
California Consumer Privacy Act (CCPA)
The California Consumer Privacy Act (CCPA) is a state-level data privacy law modeled after GDPR that protects the personal information of California residents and imposes compliance requirements on qualifying for-profit businesses.
Payment Card Industry Data Security Standard (PCI DSS)
PCI DSS is a global security standard established in 2004 by major credit card networks to protect payment card data for any organization that stores, processes, or transmits cardholder information. Unlike consumer privacy laws, it prescribes specific technical controls and compliance requirements that scale based on transaction volume and data handling practices.
Sarbanes-Osxley Act (SOX)
The Sarbanes-Oxley Act (SOX) was enacted in 2002 to protect investors from corporate financial fraud following widespread accounting scandals in publicly traded U.S. companies during the late 1990s. It establishes strict financial disclosure requirements, corporate accountability, and legal penalties for executives who misrepresent financial data.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA is a U.S. federal law enacted in 1996 that establishes privacy and security standards for protecting patient health records held by healthcare providers. It defines patient rights, data transmission rules, enforcement mechanisms, and breach notification requirements.
Cybersecurity Maturity Model Certification (CMMC)
The Cybersecurity Maturity Model Certification (CMMC) is a DoD-established framework requiring contractors and vendors to meet defined cybersecurity standards based on the nature of their work with the department. Non-compliance can result in loss of DoD contracts.
Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA), enacted in 1999, requires any organization offering financial products or services to protect consumer financial data through defined privacy rules, risk controls, and regulatory oversight. Non-compliance carries significant penalties for both the organization and its leadership.
Children’s Online Privacy Protection Act (COPPA)
The Children's Online Privacy Protection Act (COPPA) is a U.S. law that governs how websites and online services must handle personal data collected from children under 13. Understanding COPPA compliance requirements is essential for any organization operating digital platforms that may reach younger audiences.
Family Educational Rights and Privacy Act (FERPA)
FERPA is a 1974 federal law that protects the privacy of student educational records, governing who can access that data, how it can be shared, and which institutions must comply. Schools receiving federal funding are required to follow FERPA, and its reach can extend to third-party organizations that handle student data on their behalf.
Service-level agreement (SLA)
A Service Level Agreement (SLA) is a formal contract between a vendor and a customer that defines the expected performance and availability of a service. Understanding when and how to establish SLAs is essential for protecting business operations and managing customer expectations.
Operational Level Agreement (OLA)
A Service Level Agreement (SLA) defines the performance standards a provider must meet, while an Operational Level Agreement (OLA) details the internal processes used to achieve those standards. Understanding the distinction between these two documents is essential for evaluating and managing third-party service relationships.
Privacy Level Agreement
Privacy level agreements, service level agreements, and operational level agreements each serve distinct roles in managing vendor relationships and data handling expectations. Understanding when and why to use each helps organizations meet growing privacy regulatory requirements.
Master Service Agreement (MSA)
A Master Service Agreement (MSA) is a legally binding contract that establishes the terms and expectations between two parties engaged in an ongoing business relationship. Understanding how MSAs work, who drafts them, and how to implement them is essential for any organization working with third-party vendors or service providers.
Work Order (WO)/Statement of Work (SoW)
A master service agreement (MSA) and statement of work (SOW) are two legally binding documents used together to govern ongoing contractor relationships, with the MSA covering overarching terms and the SOW defining the specifics of each individual project or engagement.
Non-disclosure agreement (NDA)
A non-disclosure agreement (NDA) is a legal contract between two parties that restricts the sharing of sensitive information exchanged during a business relationship. NDAs are typically mutual, binding both parties to confidentiality, and are often embedded within broader master service agreements.
Memorandum of Understanding (MOU)
A Memorandum of Understanding (MOU) is a non-legally binding written agreement that outlines the expectations and responsibilities of two parties when a formal contract is not yet in place. It serves as a structured alternative to a handshake, documenting mutual understanding while both sides work toward a finalized legal agreement.
Business Partners Agreement (BPA)
A business partnership agreement is a formal contract between two parties that defines each party's responsibilities and sets clear expectations for how they will work together. It serves as a reference point for resolving disputes and establishing the terms of a shared business relationship.
Memorandum of Agreement (MOA)
A Memorandum of Agreement (MOA) is a legally binding document that sits between a non-binding Memorandum of Understanding and a full Business Partner Agreement, offering a formal but streamlined way for two organizations to commit to working together.
Interconnection Security Agreement (ISA)
An Interconnection Security Agreement (ISA) is a formal contract between organizations that defines the security requirements, terms, and technical parameters governing how their IT systems will be connected. It ensures both parties align on security measures before any cross-organizational network link is established.
Aggrement Type Example: Pentesting
Vendor agreements for penetration testing follow a structured framework that includes a Master Service Agreement, Statements of Work, and supporting documents like NDAs to govern each engagement. Understanding how these agreements work together ensures that scope, access, costs, and rules of engagement are clearly defined before testing begins.
Aggrement Type Example: SaaS
SaaS agreements differ significantly from penetration testing contracts, relying instead on standardized terms of service and service level agreements that define uptime guarantees, security responsibilities, and user obligations. Understanding these documents is essential for ensuring a SaaS provider meets organizational security and operational standards.
Aggrement Type Example: Business Partner
Business partnerships require a structured series of agreements—from NDAs and memorandums of understanding to formal partner agreements and interconnection security agreements—to protect sensitive information and define the terms of the relationship. Each document serves a distinct purpose as the partnership progresses from early discussions to full operational integration.
VLANs Explained
VLANs enable network segmentation on a single switch by grouping ports into isolated logical networks, improving security, performance, and manageability without requiring additional hardware. This content covers the fundamentals of VLANs, including segmentation concepts, VLAN trunks, physical versus logical topologies, VLAN IDs, and the default VLAN.
DEMO: Creating and Assigning VLAN
Covers the process of creating and assigning VLANs on a Cisco switch, including verification commands and VLAN removal procedures.
VLAN Trunking Protocol (VTP)
VLAN Trunking Protocol (VTP) enables VLAN configurations made on one switch to automatically propagate across all switches within the same VTP domain, simplifying administration in large-scale network environments. This content covers VTP modes, advertisements, domains, configuration revision numbers, and versioning at the level required for CCNA exam preparation.
VLAN Trunking
VLAN trunking allows multiple VLANs to travel across a single link between switches, eliminating the need for a dedicated cable per VLAN. The IEEE 802.1q standard governs this process by inserting a 4-byte tag into Ethernet frames to identify which VLAN the traffic belongs to.
DEMO: Configuring VLAN Trunking
Trunk link configuration on Cisco switches controls which VLANs can pass traffic between network segments. This content covers how to enable trunking and manage allowed VLANs on inter-switch connections.
DEMO: Inter-Switch Link (ISL)
Inter-Switch Link (ISL) is a Cisco-proprietary VLAN trunking protocol that serves as an alternative to 802.1q on select Cisco switches, though it is now deprecated and no longer recommended for new deployments.
Native VLANs
Native VLANs allow a single untagged VLAN to traverse an 802.1q trunk link alongside multiple tagged VLANs, enabling backward compatibility with legacy devices that cannot process VLAN tags. Understanding how to configure and match native VLANs on both ends of a trunk is essential for maintaining a stable and secure switched network.
DEMO: Native VLANs
Native VLANs on trunk links carry untagged traffic between switches, and configuring a non-default native VLAN is an important step in reducing security exposure on managed networks.
Dynamic Trunking Protocol (DTP)
DEMO: Dynamic Trunking Protocol (DTP)
Dynamic Trunking Protocol (DTP) controls how Cisco switch ports negotiate trunk links with neighboring devices. This content covers the key switchport mode commands and how to enable or disable DTP on a Catalyst 2960 interface.
Voice and Data VLANs
Voice VLANs isolate and prioritize voice traffic on a dedicated subnet to prevent the latency degradation that occurs beyond 150 milliseconds. This coverage includes the differences between data and voice traffic, QoS versus CoS prioritization, and how IP phones function as built-in switches to support dual VLAN access from a single network port.
DEMO: Voice and Data VLANs
A Cisco switch port is configured to support both a data VLAN and a voice VLAN simultaneously, using the commands required to separate traffic from a VoIP phone and a connected workstation on a single access port.
VLAN routing
Inter-VLAN routing enables traffic to flow between segmented network VLANs, and there are three primary methods to accomplish it: legacy multi-interface routing, router-on-a-stick, and Layer 3 switching.
DEMO: Configuring Layer 3 switch
Layer 3 switching enables inter-VLAN routing directly on a capable switch using Switch Virtual Interfaces (SVIs), eliminating the need for an external router. This topic covers how Layer 3 switching works and how to configure it on a Cisco 3750.
DEMO: Configure Legacy Routing
Legacy inter-VLAN routing connects separate VLANs by running dedicated physical links from a switch to individual router interfaces, with each interface assigned to a different VLAN. This approach enables Layer 3 routing between VLANs using standard router and switch configurations.
Connecting to Router
Covers how to connect a Layer 3 switch to a router to enable internet access beyond inter-VLAN routing, including both routed port and Switch Virtual Interface (SVI) approaches.
DEMO: Configuring Router-on-a-Stick
Router on a stick is a network design that enables inter-VLAN routing through a single physical link between a router and a switch, using 802.1Q-tagged subinterfaces to handle traffic for multiple VLANs. This content covers the concept and a full configuration walkthrough on Cisco hardware, including real-world troubleshooting.
DEMO: L3 Switch to Router via Routed Port
Routed ports on a Layer 3 switch allow the switch to connect directly to a router by converting a switchport into a routable interface with its own IP address. This content covers the configuration steps needed to establish that link and verify connectivity between the two devices.
DEMO: Troubleshooting Router-on-a-Stick Issue 1
A misconfigured 802.1Q encapsulation tag on a router-on-a-stick subinterface blocks inter-VLAN traffic, and a systematic ping-based troubleshooting process leads to identifying and correcting the VLAN ID mismatch.
DEMO: L3 Switch to Router via SVI
A Switched Virtual Interface (SVI) on a Layer 3 switch provides an alternative method for connecting that switch to a router, using a dedicated VLAN and an access port rather than a routed physical port. This approach assigns an IP address to the VLAN interface itself, allowing Layer 3 communication between the two devices.
DEMO: Troubleshooting Router-on-a-Stick Issue 2
A misconfigured subnet mask on a router-on-a-stick subinterface is diagnosed and corrected through systematic CLI troubleshooting, restoring inter-VLAN connectivity. The fault—a /30 mask applied where a /24 was required—caused the router to drop traffic destined for hosts outside the narrowed address range.
DEMO: Troubleshooting Router-on-a-Stick Issue 3
A systematic troubleshooting walkthrough for router-on-a-stick connectivity failures, covering how to isolate the fault using ping tests, routing table inspection, and interface status checks.
Spanning Tree Protocol
Spanning Tree Protocol (STP) is a Layer 2 network protocol that prevents switching loops caused by redundant links while preserving failover capability. It operates on managed switches by selectively blocking ports to eliminate loops and automatically restoring blocked paths when an active link fails.
Spanning-Tree Algorithm (STA)
The Spanning Tree Algorithm is the logic behind Spanning Tree Protocol, guiding switches through a structured election process to eliminate network loops. This overview covers how switches exchange Bridge Protocol Data Units, elect a root bridge, calculate path costs, and assign port roles to maintain a loop-free topology.
STA - Elect Root Bridge
The Spanning Tree Protocol root bridge election process determines how switches establish a network reference point by selecting the device with the lowest bridge ID, a value composed of priority, extended system ID, and MAC address. Understanding how these components interact — and how to manually influence the election — is essential for controlling traffic flow in switched networks.
STA - Elect Root Ports
Spanning Tree Protocol root port election determines the optimal path to the root bridge by calculating path costs based on link speeds and applying tiebreakers. Understanding this process is essential for designing and troubleshooting Layer 2 switched networks.
STA - Elect Designated and Non-Designated Ports
Spanning Tree Protocol determines designated and non-designated ports on each network link after identifying the root bridge and root ports, ensuring a loop-free topology by blocking redundant paths. Ports on the root bridge are always designated, while any remaining ports not selected as root or designated are blocked as alternates.
STA - Example #1
Spanning Tree Protocol (STP) root bridge election, root path cost calculation, and port role assignment are walked through using a multi-switch topology example. The process covers how bridge IDs, link costs, and port IDs determine which ports forward traffic and which are blocked.
BPDU Header
Bridge Protocol Data Units (BPDUs) are the frames Spanning Tree Protocol uses to exchange switching topology information between switches, carrying key fields such as root ID, root path cost, bridge ID, and port ID. This information drives the STP election process that determines which ports remain active and which are blocked to prevent switching loops.
DEMO: Wireshark BPDUs
Wireshark is used to capture and analyze Bridge Protocol Data Units (BPDUs) live on a network, revealing how Spanning Tree Protocol fields map to real switch behavior. Captured frame data — including root priority, path cost, VLAN ID, and MAC addresses — is cross-referenced against actual switch configurations to confirm STP topology assumptions.
Spanning Tree Algorithm Example #2
A hands-on walkthrough of Spanning Tree Protocol election on a four-switch topology, covering root bridge selection, root path cost calculation, root port election, and designated port assignment.
STP Continued
Spanning Tree Protocol port states, STP timers, PortFast, and BPDU Guard are the final concepts needed to understand how switches initialize safely and how network loops are prevented. This content completes a foundational understanding of STP behavior in switched networks.
STP Versions
Spanning Tree Protocol has evolved significantly since its origins in the 1980s, with IEEE standards and Cisco proprietary versions each advancing convergence speed, VLAN support, and network recovery time. This content covers the major STP variants and examines how Rapid Spanning Tree Protocol improves on the original through simplified port states and faster failover mechanisms.
DEMO: STP
Spanning Tree Protocol (STP) configuration commands control root bridge election, port priority, PortFast, and BPDU Guard across VLANs in a switched network. These settings ensure loop prevention while optimizing convergence time and network stability.
DEMO: BPDU Filter
BPDU filter disables Spanning Tree Protocol on a switch port, which increases switching loop risk and should only be used in specific, well-understood network scenarios. This topic also covers how BPDU filter differs from BPDU guard and how to configure both features using Cisco IOS commands.
DEMO: Loopguard
Loop Guard is a Spanning Tree Protocol feature that prevents network loops by keeping non-designated ports in a blocking state when BPDU transmissions stop while the link remains active. It is configured at the interface level using the spanning-tree guard loop command.
DEMO: Root Guard
Spanning Tree Protocol root guard prevents unauthorized switches from becoming the root bridge on a network, protecting against both misconfigurations and deliberate STP-based attacks. It differs from BPDU guard in that it is applied to trunk and inter-switch ports while still allowing STP participation.
Link Aggregation
Link aggregation combines multiple physical network links between switches into a single logical connection, increasing total bandwidth and providing redundancy. Configuration requirements, load sharing behavior, and key differences from Spanning Tree Protocol are also covered.
Link Aggregation Protocols
Link aggregation protocols define how multiple physical network links are combined into a single logical connection, with IEEE 802.3ad serving as the industry standard and Cisco's EtherChannel as a widely deployed proprietary implementation. This content covers the distinctions between LACP, PAgP, and static EtherChannel configurations, including how active, passive, desirable, and auto negotiation modes affect whether an aggregated link is established.
DEMO: Configuring EtherChannels
EtherChannel configuration on Cisco switches covers how to bundle multiple physical interfaces into a single logical port channel using the channel-group command and supported negotiation modes including static, LACP, and PAgP.
DEMO: LACP Port Priority
LACP port priority controls which physical links are activated or suspended within an EtherChannel when the group exceeds a switch's maximum supported links. Lower priority values increase the likelihood a port will be selected as active, while higher values make suspension more likely.
EtherChannels Loops
EtherChannel misconfigurations can create network loops and broadcast storms that Spanning Tree Protocol may be unable to resolve. Understanding how asymmetric EtherChannel settings between switches lead to these failures is essential for safe network design.
DEMO: EtherChannels on Routed Ports
EtherChannel configuration between a Layer 3 switch and a router increases available bandwidth by bundling multiple physical links into a single logical routed port channel.
DHCP Review
DHCP is a network protocol that automatically assigns IP addresses and configuration settings to client devices through a structured discovery and negotiation process between clients and servers. This content covers the client-server relationship, the four-step DORA process, and key server configuration components including scopes, lease times, reservations, and options.
DEMO: Configuring DHCP
Covers the full process of configuring a Cisco IOS DHCP server on a Layer 3 switch, including address exclusions, pool creation, and client verification. Demonstrates how to assign a management VLAN scope with a default gateway, DNS server, lease duration, and domain name.
IPv6 Refresher
IPv6 addressing methods, Neighbor Discovery Protocol, and router advertisement flags are covered in this focused refresher for network professionals. Key topics include globally unique, unique local, and link-local address types, along with stateless and stateful address assignment.
DEMO: Setting RA Flags
Router Advertisement (RA) flags control how IPv6 clients obtain addressing information, directing them to use SLAAC, DHCPv6 for additional options, or DHCPv6 for full address assignment. This content covers how to configure the O flag and M flag on a Cisco switch virtual interface to define client behavior on a VLAN.
SLAAC
SLAAC (Stateless Address Autoconfiguration) allows IPv6 clients to generate their own IP addresses without a DHCP server, using router advertisements and either EUI-64 or random host bit generation to produce a unique address. Duplicate Address Detection ensures no two devices on the network share the same address.
DEMO: SLAAC
Enabling IPv6 unicast routing on a Cisco Layer 3 switch activates SLAAC, allowing connected devices to automatically generate their own IPv6 addresses from router advertisements. This configuration also provides default gateway assignment across all VLANs through the switch's link-local address.
DHCPv6
DHCPv6 enables IPv6 clients to obtain network configuration through a structured exchange between clients, a Layer 3 switch acting as the default gateway, and a DHCPv6 server. The process supports both stateless and stateful address configuration depending on how router advertisement flags are set.
High Availability
Service Level Agreements (SLAs) define the availability, performance, and security commitments between service providers and their customers, while high availability design relies on layered redundancy to meet those commitments. First Hop Redundancy Protocol (FHRP) addresses a critical gap by enabling a backup device to assume the default gateway IP address if the primary Layer 3 device fails.
FHRP
First Hop Redundancy Protocols (FHRPs) provide gateway redundancy by assigning a shared virtual IP address across multiple Layer 3 devices, ensuring uninterrupted network connectivity if one device fails. Key FHRP options include HSRP, HSRP version 2, VRRP, and GLBP, with some protocols being Cisco-proprietary and others based on open standards.
HSRP
Hot Standby Router Protocol (HSRP) is a Cisco-proprietary first-hop redundancy protocol that uses a shared virtual IP and MAC address to maintain gateway availability when a router or Layer 3 switch fails.
DEMO: HSRP
Hot Standby Router Protocol (HSRP) configuration requires assigning virtual IP addresses to switch virtual interfaces and setting standby group priorities across two Layer 3 switches. This content covers the CLI commands used to deploy HSRP, verify active and standby roles, and enable preemption for automatic failover.
DEMO: DHCP Relay
DHCP relay agents enable clients on one VLAN to reach DHCP servers located on a separate network segment. This topic covers how to configure a Cisco Layer 3 switch as a relay agent for both IPv4 and IPv6 DHCP traffic.
DEMO: DHCP Client
Cisco devices can be configured as DHCP clients to receive IPv4 or IPv6 addresses dynamically, rather than always acting as DHCP servers. This coverage includes the interface-level commands for DHCP and SLAAC assignment, along with key show commands for verification.
Basic Device Security
Covers essential techniques for protecting network infrastructure against both internal and external threats, including physical security, management traffic isolation, and device hardening. Practical guidance addresses access controls, secure protocols, and configuration best practices for network equipment.
Port Security
Port security is a switch-level feature that controls which and how many MAC addresses are permitted on a given port, defending against attacks such as MAC address flooding and DHCP starvation. This content covers how each attack works and how port security settings can be configured to mitigate them.
DEMO: Port Security
Port security configuration on managed switches involves setting MAC address limits, learning modes, aging timers, and violation responses to control which devices can connect to each interface. This content covers the available options, their defaults, and practical examples of how different port security profiles are applied across multiple switch interfaces.
VLAN Hopping
VLAN hopping is an attack technique that allows adversaries to bypass network segmentation by exploiting switch spoofing and double tagging vulnerabilities. This content covers how both attack methods work and the configuration practices used to defend against them.
DEMO: Mitigating VLAN Hopping
VLAN hopping is a low-frequency but preventable network attack, and the right switch configurations make mitigation straightforward. This content walks through the specific port and trunk settings that block the attack vectors attackers rely on.
DHCP Snooping
DHCP starvation and DHCP spoofing attacks expose networks to denial-of-service and man-in-the-middle threats that can disrupt client connectivity and intercept traffic. DHCP snooping is a switch-level security feature that filters illegitimate DHCP messages by classifying ports as trusted or untrusted and validating message content against a binding database.
DEMO: DHCP Snooping
DHCP snooping is a switch-level security feature that blocks rogue DHCP servers and protects the network from address assignment attacks. This coverage walks through the full configuration process, including enabling the feature globally, designating trusted ports, setting rate limits, and activating snooping per VLAN.
Dynamic ARP Inspection (DAI)
IPv4's reliance on ARP introduces serious network vulnerabilities, including ARP spoofing, ARP poisoning, and MAC address spoofing, all of which can be mitigated through Dynamic ARP Inspection (DAI).
DEMO: Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) is a network security feature that protects against ARP-based attacks by validating ARP packets against a trusted DHCP snooping binding database. This coverage walks through enabling and configuring DAI on a managed switch, including trust assignments and validation rules.
IP Source Guard
IP Source Guard protects networks against IP and MAC address spoofing by validating traffic against the DHCP snooping binding database at the switch level. It serves as an additional layer of Layer 2 security alongside port security, DHCP snooping, and Dynamic ARP inspection.
DEMO: IP Source Guard (IPSG)
IP Source Guard is configured on Cisco switches using DHCP snooping as the binding database or manually defined static IP-to-MAC bindings, with a single interface-level command enabling traffic verification.
BPDU Guard
Spanning Tree Protocol (STP) prevents switching loops in redundant network environments but introduces security vulnerabilities that attackers can exploit to manipulate traffic flow. This content covers how STP attacks work and how to defend against them using PortFast and BPDU Guard configuration.
DEMO: CDP & LLDP Reconnaissance
CDP and LLDP are network management protocols that expose detailed device information to potential attackers, making it essential to disable them on interfaces or globally when not in use.
802.1X
802.1X is a network access control standard that ensures only authenticated devices can connect to a network, using certificates or credentials verified through a central authentication server.
Wireless Review
A high-level review of wireless networking fundamentals, covering IEEE 802.11 standards, 2.4 GHz and 5 GHz frequency bands, key terminology, and the hardware used to build and manage wireless LANs.
DEMO: WLC Setup
Covers the step-by-step initial configuration of a Cisco CT2504 Wireless LAN Controller, from console setup through first login to the web management interface.
DEMO: WLC Web Interface
The Cisco Wireless LAN Controller web interface provides centralized visibility and configuration management for enterprise wireless networks, including connected access points, clients, rogue device detection, and WLAN security settings.
CAPWAP
CAPWAP is the protocol used to provision and manage lightweight access points in enterprise wireless networks, enabling centralized control through a wireless LAN controller. This content also covers split MAC architecture, DTLS encryption, and FlexConnect for controller failover scenarios.
DEMO: Setting up a WAP
Covers the process of adding a Cisco 2700 series access point to a wireless LAN controller, including DHCP Option 43 discovery, PoE connectivity, and initial configuration through the controller interface.
DEMO: Configure WPA2 PSK
Covers wireless LAN configuration on a Cisco Wireless LAN Controller, including WPA2 security settings and PSK authentication to enable client connectivity on a VLAN-segmented network.
DEMO: Configuring DHCP
A wireless LAN controller can serve as its own DHCP server, eliminating the need to rely on a Layer 3 switch for IP address assignment on wireless networks. This content covers how to configure a DHCP scope directly on the WLC and bind it to a specific wireless interface.
DEMO: Configuring SNMP
Simple Network Management Protocol (SNMP) enables centralized monitoring and control of network devices by collecting logs and event data from across the infrastructure. This content covers how to configure a wireless LAN controller to send SNMP trap messages to a designated SNMP server.
DEMO: Configure RADIUS and WPA2 Enterprise
WPA2 Enterprise with RADIUS authentication provides stronger wireless network security than shared passphrases by requiring individual user credentials or certificates. This content covers how to configure a RADIUS server on a wireless LAN controller and apply 802.1X authentication to a wireless network.
Wireless Troubleshooting
Wireless troubleshooting requires a structured, methodical approach to diagnose connection failures and performance degradation across Wi-Fi environments. This content covers the core troubleshooting process alongside common causes of wireless connectivity loss and poor network throughput.
DEMO: Wireless QoS
Wireless LAN controllers support Quality of Service (QoS) configurations that assign traffic priority levels—Platinum, Gold, Silver, and Bronze—to different wireless networks. This allows sensitive traffic like voice and video to be prioritized over lower-priority data during periods of network congestion.
DEMO: Link Aggregation on WLC
Link aggregation on a wireless LAN controller combines multiple physical ports into a single logical connection to increase bandwidth and provide redundancy. Configuration requires static port channel assignment on both the controller and the connected switch, as dynamic protocols like LACP and PAgP are not supported.
DEMO: WLC Management
Wireless LAN Controller (WLC) management covers three interface types—dynamic, management, and virtual—along with access controls for web, SSH, Telnet, and local versus RADIUS-based administrator authentication.
WAN Refresher
Layer 3 of the OSI model handles end-to-end packet delivery using IP addressing, routing tables, and next-hop decisions to move data across networks. This coverage establishes the foundational concepts needed before diving into wide area networks and static routing.
WAN Connections
Wide area networks (WANs) connect geographically separate sites using dedicated, circuit-switched, packet-switched, or internet-based connections, each with distinct trade-offs in cost, speed, and reliability. Core WAN concepts include serial versus parallel transmission, network topologies, and the role of internet service providers in delivering connectivity.
WAN Technologies
This content covers the major WAN connection technologies used in networking, including fiber, T1/E1 carriers, PSTN, ISDN, DSL, Frame Relay, ATM, and cable. Each technology is examined for its key characteristics, speeds, and practical limitations.
WAN Equipment
WAN connectivity requires specific equipment split between two parties: the subscriber and the service provider. Understanding where that ownership boundary falls — and the devices on each side — is essential for managing and troubleshooting wide area network infrastructure.
HDLC and PPP
This topic covers HDLC and Point-to-Point Protocol (PPP) as Layer 2 WAN protocols, explaining how they differ from Ethernet and how they operate over T1 serial connections between routers.
DEMO: SSH Hopping
SSH hopping is a technique for moving through a network device by device using Secure Shell connections, allowing administrators—and attackers—to reach equipment that isn't directly accessible from a management workstation.
Routes
Routers use routing tables to forward packets toward their destination by matching the destination IP address against a list of known routes. This content covers how routes work, what information they contain, and the key types found in both IPv4 and IPv6 routing tables.
Route Discovery
Routers learn network paths through either manual static route configuration or dynamic routing protocols, each with distinct trade-offs in scalability, security, and manageability. This content covers how routing tables are built and when to apply each approach.
Routing Table
This content covers how routers determine which routes are installed in the routing table and how the best path is selected when multiple options exist for the same destination. Key concepts include administrative distance, routing metrics, longest prefix match, and default route behavior.
Router Processing
Router packet processing covers three core switching methods—process switching, fast switching, and Cisco Express Forwarding (CEF)—that determine how efficiently a router forwards traffic through its data plane and CPU.
L2 and L3 Walkthrough
A detailed walkthrough of how data travels across a multi-device network, tracing the full path of an SSH connection through Layer 2 and Layer 3 processes including routing table lookups, ARP resolution, and frame encapsulation.
Static Routes
Static routing is a foundational network configuration technique that gives administrators precise control over how traffic moves through a network. This content covers the four types of static routes, their advantages and disadvantages, and key configuration options.
DEMO: Static Route
Static routing configuration is demonstrated on a Cisco router, showing how to resolve a connectivity failure caused by a missing return path to a remote network. Both IPv4 and IPv6 static routes are added and verified using common IOS show commands.
DEMO: Default Route
Covers how to configure default routes on a Layer 3 switch for both IPv4 and IPv6, directing all unknown traffic to an upstream router.
DEMO: Static Host Route
Covers how to configure a host-specific static route on a Cisco router, explaining why return traffic fails without one and how a /32 subnet mask targets a single IP address.
DEMO: Floating Static Route
Floating static routes provide automatic failover by assigning a higher administrative distance to a backup route, keeping it dormant until the primary path fails. This topic covers how to configure a floating static route on a Layer 3 switch to redirect traffic through a secondary link when the default route becomes unavailable.
DEMO: 31 Bit Prefixes (RFC 3021)
RFC 3021 defines the use of /31 prefixes for point-to-point IPv4 links, allowing both addresses in a two-host subnet to be assigned rather than reserving one for the network and one for broadcast. This approach doubles the number of available subnets compared to the traditional /30 method while conserving IPv4 address space.
Dynamic Routing Protocols
Dynamic routing protocols enable routers to automatically discover and share network information, eliminating the need for manual route configuration. This content covers how these protocols function, their evolution over time, and the three core components that define them.
Dynamic Routing Protocols Types
Dynamic routing protocols fall into several categories that determine how routers exchange and calculate path information across a network. Understanding the differences between interior and exterior gateway protocols, as well as distance vector and link state approaches, guides the selection of the right protocol for a given environment.
RIP
Routing Information Protocol (RIP) is a distance-vector routing protocol that builds complete network awareness by having routers exchange routing tables with their neighbors over multiple rounds until full convergence is reached. This content covers how RIP version 2 propagates routes across a multi-router network and how hop count determines the path packets take to their destinations.
DEMO: RIP
Covers the CLI commands needed to enable and disable RIP version 2 on a Cisco router, including how to configure network statements so the router begins exchanging routing updates with neighboring devices.
OSPF Introduction
OSPF is a link-state routing protocol that builds a complete network topology using three specialized databases, five packet types, and Dijkstra's algorithm to determine the lowest-cost path to every destination. This content covers how OSPF routers exchange information, synchronize their link-state databases, and construct shortest path first trees to populate their routing tables.
OSPF Process
OSPF routers establish network connectivity through a four-step process: forming neighbor adjacencies, exchanging link state advertisements, building a shared link state database, and running Dijkstra's shortest path first algorithm to populate the routing table.
OSPF Configurations
OSPF configuration requires just two core commands to get a network up and running, covering process IDs, network statements, wildcard masks, and area assignments. This content builds a practical foundation before diving deeper into advanced OSPF concepts.
DEMO: Configuring OSPF
A practical walkthrough of configuring OSPF on a router to establish full network connectivity across a multi-VLAN topology. Covers process ID assignment, wildcard mask usage, and network statement configuration in a single OSPF area.
OSPF Networks
The OSPF network statement serves two distinct purposes: activating OSPF hello packets on matching interfaces and including those networks in link-state advertisements to neighboring routers. Understanding both functions is essential for correctly configuring OSPF on multi-VLAN environments.
Wildcard Masks
Wildcard masks define which bits in an IP address a router must match and which it can ignore, making them essential for routing protocols like OSPF and access control configurations.
DEMO: Configuring OSPF Networks
OSPF network statements and wildcard masks control which router interfaces participate in the routing process, and understanding how to scope them correctly is essential for managing network connectivity.
DEMO: Configuring Passive Interfaces
OSPF passive interfaces prevent hello packets from being transmitted on network segments where routing updates are unnecessary, reducing resource consumption and eliminating a significant attack surface.
OSPF Packets
OSPF relies on five distinct packet types to establish and maintain routing information between neighboring routers. This content covers the structure of the OSPF header, each packet type, and the Link State Advertisements that carry detailed topology data.
OSPF Hello Timers
OSPF hello packets serve a dual purpose: establishing neighborships and acting as keep-alives to detect when adjacent routers go offline. Understanding hello and dead interval timers is essential for controlling how quickly OSPF responds to topology changes.
DEMO: Set Hello and Dead Interval Counters
OSPF hello and dead interval timers control how routers detect and maintain neighbor relationships, and mismatched timer values between connected interfaces will cause adjacencies to fail and disrupt network connectivity.
OSPF Costs
OSPF uses a cost metric to determine the best path through a network, calculated by dividing a reference bandwidth by the interface bandwidth. Because the default reference bandwidth is outdated, modern high-speed links require a corrected value to produce accurate path selection.
Load Balancing
Network redundancy and load balancing allow routers to distribute traffic across multiple equal-cost paths, maximizing bandwidth and providing automatic failover when a route goes down. OSPF supports up to four equal-cost paths by default and up to sixteen when configured manually, while EIGRP extends this further with unequal-cost load balancing across links of different speeds.
DEMO: LSA Overload Protection
OSPF overload protection limits the number of Link State Advertisements a router will process, preventing excessive LSA floods from consuming CPU, memory, and bandwidth. The max-lsa command controls LSA thresholds, warning percentages, temporary shutdown behavior, and reset timers.
OSPF Areas
OSPF areas divide large networks into smaller, manageable segments to reduce topology change overhead and limit the scope of link-state advertisements. Area Border Routers connect these segments and support route summarization to keep routing tables lean across the broader network.
DR and BDR
OSPF on multi-access networks uses a Designated Router (DR) and Backup Designated Router (BDR) to reduce the volume of routing traffic by centralizing link-state updates rather than flooding them between every neighbor pair. This content covers how DR and BDR elections work, the role of interface priority and router ID in that process, and how these concepts apply across different network types.
OSPF States
OSPF neighbor states define the step-by-step process a router uses to discover, synchronize, and maintain routing relationships with adjacent devices. This content covers each state from Down through Full convergence, the role of the Designated Router, and how topology changes are propagated across the network.
DEMO: Setting Router ID and Priority
Covers the configuration of OSPF router IDs and interface priorities on Cisco routers, including the commands required to apply and verify both settings.
DEMO: Configure Ethernet as a Point-to-Point
When only two OSPF-enabled devices share an Ethernet segment, configuring the interface as a point-to-point network type eliminates the unnecessary Designated Router and Backup Designated Router election process, reducing overhead on the link.
DEMO: Loopback as a Network
Loopback interfaces in Cisco IOS are advertised as /32 host routes by default, but applying the OSPF point-to-point network type overrides this behavior and allows the full subnet to be distributed across the routing domain. This technique is useful for simulating entire networks during troubleshooting without requiring additional physical interfaces.
Private Addressing Refresher
RFC 1918 defines three private IP address ranges that are not routable on the public internet, allowing organizations to use Network Address Translation (NAT) to map many internal devices to one or more public IP addresses. This approach emerged from decades of IPv4 exhaustion workarounds, from classful addressing and subnetting to CIDR, before IPv6 ultimately provided a long-term solution.
NAT
Network Address Translation (NAT) is a foundational networking technology that maps private internal IP addresses to public-facing ones, conserving IPv4 address space while adding a layer of network separation. This coverage includes NAT terminology, how the NAT table functions, and the key advantages and disadvantages of deploying NAT in real-world networks.
NAT Types
Network Address Translation (NAT) and Port Address Translation (PAT) are related but distinct techniques routers use to map internal IP addresses to external ones, with key differences in how they handle IP addresses, ports, and network layer involvement. This topic covers static and dynamic variants of each, how PAT extends NAT by incorporating Layer 4 port information, and how these mechanisms function in both enterprise and home network environments.
DEMO: Static NAT
Static NAT translates a single private IP address to a fixed public or routable IP address, enabling consistent, one-to-one address mapping on a Cisco router. This topic covers configuration, verification, and removal of a static NAT entry using Cisco IOS commands.
DEMO: Dynamic NAT and PAT
This content covers how to configure Network Address Translation (NAT) and Port Address Translation (PAT) on a Cisco router, including creating NAT pools, access lists, and interface assignments. Verification commands such as show ip nat translations and clear ip nat translation are also demonstrated.
DEMO: PAT (using interface)
Port Address Translation (PAT) can be configured to translate all internal traffic to a single public IP address assigned to a router's external interface, which reflects how most real-world networks connect to an ISP. This demonstration walks through the full configuration and uses Wireshark to verify the address translation in action.
NAT64
NAT64 enables translation between IPv4 and IPv6, allowing networks to run both protocols simultaneously during the transition away from IPv4. It bridges legacy IPv4 segments with modern IPv6 infrastructure without disrupting network operations.
Firewalls
Firewalls serve as the critical security boundary between internal networks and the outside world, controlling which traffic is allowed in or out based on defined rules and inspection methods. This content covers firewall fundamentals, security zones, returning traffic handling, access control lists, and next-generation firewall capabilities.
ACLs
Access control lists (ACLs) are rule sets applied to routers, firewalls, and switches to permit or deny network traffic based on source addresses, destination addresses, protocols, and ports. This content covers ACL types, processing logic, configuration guidelines, and interface placement.
Standard ACLs
Standard access control lists (ACLs) filter network traffic based on source IP addresses using numbered or named entries, with an implicit deny-all applied to any unmatched traffic. Proper placement close to the destination — rather than the source — is essential to avoid unintentionally blocking legitimate traffic flows.
DEMO: Standard Numbered ACLs
Standard Access Control Lists (ACLs) on Cisco routers filter traffic based on source IP address and must be placed close to the destination to avoid unintentionally blocking traffic to other network segments. This content covers ACL configuration commands, wildcard masks, interface application, verification, and removal.
DEMO: Secure VTY Ports
Named ACLs applied to VTY lines control which IP addresses can establish SSH or Telnet sessions on a Cisco device. This approach differs from interface-based ACLs and uses the access-class command instead of access-group.
Extended ACL
Extended ACLs offer greater traffic filtering precision than standard ACLs by allowing administrators to specify source and destination IP addresses, protocols, and port numbers in a single rule. Understanding their numbering ranges, command syntax, and optimal placement on the network is essential for effective access control.
DEMO: Extended Numbered ACLs
Extended numbered ACLs allow granular traffic filtering by source, destination, and protocol, and should be applied as close to the traffic source as possible. This content covers building and applying an extended ACL on a Layer 3 switch virtual interface to selectively permit and deny traffic across VLANs.
DEMO: Extended Named ACLs
Extended named ACLs offer a flexible way to control network traffic by combining descriptive naming with granular permit and deny rules applied directly to VLAN interfaces.
DEMO: Established Traffic
Access control lists (ACLs) can be configured with the established keyword to allow only return traffic that was initiated from inside the network, blocking unsolicited inbound connections while permitting requested responses. This approach creates a basic stateful-style filtering mechanism on a Layer 3 switch without requiring a dedicated firewall.
DEMO: ACL Example
Tunneling
Network tunneling encapsulates packets within an additional Layer 3 header so traffic can traverse networks that would otherwise block or expose it. Common use cases include routing protocols across ISP infrastructure and securing wireless guest traffic through encrypted tunnels to a wireless LAN controller.
GRE Tunnels
Generic Routing Encapsulation (GRE) is a Cisco-developed tunneling protocol used to carry traffic, including routing protocol updates, across networks where direct transmission is not possible or desirable. This content covers GRE packet structure, its lack of native encryption, and how it combines with IPSec to secure tunneled communications.
MPLS Tunnels
Multiprotocol Label Switching (MPLS) is an ISP-provided networking service that uses labels to switch traffic between sites faster than traditional IP routing. It supports flexible site connectivity, quality of service prioritization, and full-mesh topology without additional physical links.
IPv6 over IPv4
Tunneling enables IPv6 and IPv4 networks to coexist during the transition between protocol versions by encapsulating one protocol's traffic inside the other. This allows organizations to maintain connectivity across infrastructure segments that don't yet support a common IP version.
IPSec
IPsec is a suite of protocols designed to secure IP traffic between networks by encrypting and authenticating communications across tunnels. Key configuration decisions include choosing between Authentication Header and Encapsulating Security Payload, selecting transport or tunnel mode, and defining a cipher suite.
VPNs
Virtual Private Networks (VPNs) use encryption over public internet connections to create secure, private communication between networks or individual users and a network. They offer a cost-effective, scalable alternative to leased physical lines for both site-to-site and remote access connectivity.
Dynamic multipoint VPN (DMVPN)
Cisco's Dynamic Multipoint VPN (DMVPN) solves the scalability and management challenges of traditional site-to-site VPN deployments by enabling hub-and-spoke connectivity with dynamic direct spoke-to-spoke tunnels. A single DMVPN replaces the complex full-mesh configurations that would otherwise require dozens of individually managed VPN connections.
MFA and DUO
VPNs protect network traffic in transit, but weak user credentials remain a major vulnerability — multi-factor authentication (MFA) through tools like Cisco Duo adds a critical second layer of verification to remote access connections.