Section 02 · Module 08 Available 🕑 ~2–3 hrs + labs

> cat module-08-cybersecurity-fundamentals.md

Cybersecurity Fundamentals

Everything from Modules 1–7 — networking, Active Directory, Microsoft 365, Linux, cloud — is what cybersecurity actually protects. This module covers the CIA Triad, threat actors, malware, ransomware, phishing, insider threats and social engineering, then 7 labs built to make you think like an analyst instead of memorising definitions.

Introduction

Cybersecurity is the practice of protecting systems, networks, applications, identities and data from unauthorized access, disruption, manipulation, destruction or theft. It is not simply about installing antivirus software or configuring a firewall — in modern organisations, security exists across almost every technology layer: end-user computers, mobile devices, servers, networks, cloud platforms, SaaS applications, APIs, databases, identity systems, email, applications, Operational Technology (OT), Internet of Things (IoT), and third-party suppliers.

A multinational company may simultaneously operate Windows 11 laptops, Windows Server 2025 servers, Windows Server 2012 legacy servers, Linux servers, Active Directory, Microsoft Entra ID, Microsoft 365, AWS, Azure, Google Cloud, Salesforce, SAP, Oracle databases, Kubernetes, VMware, mainframe systems, and industrial control systems. Security therefore has to protect both modern cloud-native infrastructure and technology that may have existed for decades.

This module introduces the core concepts students need before moving deeper into security operations, authentication, Identity and Access Management, incident response and logging.

Learning Objectives

By the end of this module, you should understand what cybersecurity is, why organisations need it, the CIA Triad, the difference between threats/vulnerabilities/risks, common threat actors, malware, ransomware, phishing, insider threats, password attacks, social engineering, how attackers typically enter organisations, how modern enterprises defend themselves, why identity security has become extremely important, how legacy systems increase security risk, how layered security works, and basic incident identification and reporting.

1 Understanding Cybersecurity

Before looking at specific attacks, students need to understand what cybersecurity is trying to protect. Organisations normally have several important categories of assets.

Data
Customer records, employee information, financial/payment information, IP, source code, contracts, credentials, encryption keys, API keys, medical records, government information. Attackers may steal, modify, encrypt, delete, sell, publish, or use it for fraud.
Systems
Active Directory, Microsoft 365, SAP, Salesforce, banking/payment systems, manufacturing systems, websites, VPN infrastructure, HR/CRM/ERP systems. An attack doesn't need to steal information to cause damage — simply making a system unavailable can stop business operations.
Identities
Employees, administrators, customers, contractors, applications, service accounts, APIs, servers, automated workloads. Attackers often prefer stealing legitimate credentials over technically "hacking" through controls — with a valid username, password and session token, their activity may initially look like normal user activity.

This is why MFA, Conditional Access, Privileged Access Management, Identity Threat Detection, passwordless authentication, passkeys, and hardware security keys have become increasingly important. Recent industry research continues to show credential abuse, phishing, ransomware, vulnerability exploitation and third-party compromise remain major enterprise problems — Verizon's 2025 DBIR found compromised credentials used as an initial access vector in 22% of analysed breaches, while ransomware appeared in 44% of breaches.

Threat vs Vulnerability vs Risk

These three terms are frequently confused.

Asset
Something valuable that needs protecting, e.g. a customer database.
Threat
Something capable of causing harm, e.g. a ransomware group.
Vulnerability
A weakness that could be exploited, e.g. an Internet-facing server that hasn't been patched.
Exploit
A technique or piece of software used to take advantage of a vulnerability.
Risk
The potential impact and likelihood of a threat exploiting a vulnerability.
Risk = likelihood × impact

An old internal test server containing no sensitive information may be vulnerable, but its business risk could be relatively low. An Internet-facing banking application containing millions of customer records could represent extremely high risk. Cybersecurity teams therefore don't simply ask "is this vulnerable?" — they ask "how much risk does this vulnerability create for the organisation?"

2 The CIA Triad

One of the oldest and most important concepts in information security is the CIA Triad: Confidentiality, Integrity, Availability. NIST describes these as fundamental security objectives relating to protecting information from unauthorised disclosure, unauthorised modification or destruction, and ensuring reliable access when required. Understanding these three helps security professionals understand what an attack is actually affecting.

Confidentiality

Confidentiality means ensuring information can only be accessed by authorised people or systems — e.g. only HR personnel should view an employee salary database. If an attacker steals the database, confidentiality has been compromised.

Failures: customer database stolen, employee records leaked, password database exposed, API keys published on GitHub, private emails accessed, source code stolen, medical records accessed, a cloud storage bucket accidentally made public.

Controls: authentication, MFA, encryption, access control, IAM, DLP, network segmentation, file/database permissions, PAM, secrets management.

Example: finance.company.com contains confidential financial reports. An employee authenticates with username, password, MFA, and Conditional Access; the application then checks whether they belong to the correct Finance security group — confidentiality enforced through several layers.

Integrity

Integrity means protecting information from unauthorised modification — it must remain accurate and trustworthy. If a banking database says Account balance = £10,000 and an attacker changes it to £100,000, confidentiality may not have been affected, but integrity has been compromised.

Attacks: modifying financial transactions, changing database records, altering audit logs, modifying source code, tampering with software packages, changing DNS records, manipulating configuration files, modifying payment instructions, changing employee bank account information.

Controls: cryptographic hashes, digital signatures, file integrity monitoring, code signing, database auditing, access controls, change management, version control, logging, checksums.

Example: a company publishes software with a SHA-256 hash. Users can calculate the downloaded file's hash and compare it — if the values differ, the file may have been corrupted, modified, or replaced. Hashing can therefore help verify integrity.

Availability

Availability means ensuring systems and information remain accessible when authorised users need them. A website may be completely secure from data theft but still fail its users if nobody can access it.

Attacks: DDoS, ransomware, server destruction, network outage, database corruption, DNS outage, cloud service outage, storage failure.

Controls: backups, disaster recovery, high availability, load balancing, clustering, redundant networks, multiple data centres, cloud regions, DDoS protection, replication, UPS systems, backup generators.

A multinational company may deploy an application across London, Frankfurt, and Singapore — if one region becomes unavailable, traffic can potentially be redirected. Availability is therefore both a cybersecurity and infrastructure concern.

CIA Triad Example – Ransomware

Ransomware can affect all three: attackers steal files before encryption (confidentiality), files or configurations may be modified (integrity), and files/systems are encrypted and cannot be accessed (availability). This is why ransomware can be extremely damaging.

3 Understanding Cybersecurity Threats

A cyber threat is anything capable of compromising systems, networks, identities or information. Threats come from many sources.

Cybercriminals
Normally operate for financial benefit — ransomware, banking fraud, credential theft, cryptocurrency theft, BEC, payment fraud, data theft. Cybercrime has developed into a commercial ecosystem where separate groups provide malware, stolen credentials, initial access, or ransomware infrastructure to each other — Microsoft describes this as the cybercrime-as-a-service economy.
Nation-State Attackers
Sophisticated groups believed associated with governments — espionage, intelligence gathering, political influence, military intelligence, IP theft, critical infrastructure disruption. Can remain hidden in networks for long periods; the objective may not be immediate financial gain.
Hacktivists
Attack organisations for ideological or political reasons — DDoS, website defacement, data leaks, account compromise, information campaigns.
Script Kiddies
Inexperienced attackers using existing tools/scripts without deeply understanding the technology — poorly secured Internet-facing systems can still be compromised by automated tools.

A common misconception is that attackers always need sophisticated technical exploits. Many successful attacks instead involve stolen passwords, phishing, password reuse, MFA manipulation, exposed API keys, incorrect cloud permissions, unpatched VPN appliances, or social engineering — cybersecurity is therefore as much about people, configuration and identity as it is about software vulnerabilities.

Attack Surface
All the possible points where an attacker could attempt to access an organisation — websites, VPN gateways, email, employees, cloud platforms, RDP, APIs, mobile apps, suppliers, Wi-Fi, AD, SaaS, developer systems. Security teams continuously ask: what do we own? What's exposed? What's vulnerable? What's most important?
Attack Vector
The route an attacker uses to gain access — phishing email, stolen password, vulnerable VPN, malicious attachment, compromised supplier, exposed RDP, stolen session token, misconfigured cloud storage.

Cyberattacks frequently happen in stages — the attack chain:

Reconnaissance↓ Phishing↓ Credential Theft↓ Initial Access↓ Privilege Escalation↓ Lateral Movement↓ Data Collection↓ Data Exfiltration↓ Ransomware

Understanding the entire chain matters — stopping ransomware at the final encryption stage is much harder than detecting the attacker when they first steal credentials.

4 Malware

Malware means malicious software — an umbrella term covering many different types.

Virus
Attaches to legitimate files, spreads when executed. Common in earlier computing eras; "virus" is still often incorrectly used as a general term for all malware. Modern attacks more commonly involve Trojans, ransomware, infostealers, downloaders, and remote access malware.
Worm
Spreads between computers without requiring a user to manually copy the file (Morris Worm, Conficker, WannaCry). Especially dangerous in corporate networks where thousands of computers are connected.
Trojan
Pretends to be legitimate software while containing malicious functionality, e.g. PDFConverterSetup.exe that appears to install a PDF converter but secretly installs malware.
Remote Access Trojan
Lets an attacker remotely control a compromised computer — execute commands, download/upload files, capture screenshots, access browsers, steal credentials.
Spyware
Monitors users or collects information — browser history, login credentials, cookies, documents, screenshots.
Keylogger
Records keyboard input, historically used to capture passwords. Modern identity attacks increasingly target browser sessions, cookies, and authentication tokens instead — stealing a session can sometimes bypass the need to know the original password.
Infostealers
An important modern threat — steal browser passwords, cookies, authentication tokens, cryptocurrency wallets, session information, and files, then sell it to other criminals. Microsoft's 2025 Digital Defense Report highlights their growing use and the criminal markets built around stolen credentials.
Rootkits
Maintain privileged access while hiding from normal OS processes. Historically important, though modern OS security has made many traditional techniques more difficult.
Botnets
Large numbers of compromised systems (PCs, servers, routers, cameras, IoT devices) remotely controlled by attackers for DDoS, spam, credential attacks, malware distribution, or fraud.
Fileless Malware
Abuses legitimate tools already installed on computers (PowerShell, WMI, Command Prompt, Office apps, scripting engines) — "living off the land." The challenge: administrators legitimately use many of these tools, so security platforms must determine whether behaviour is legitimate or malicious.

Historically organisations relied heavily on antivirus using signature-based detection — effective for known threats, less so against newly modified malware. Modern organisations deploy an Endpoint Protection Platform (EPP) for prevention, and Endpoint Detection and Response (EDR) to continuously monitor endpoint behaviour (processes, network connections, file activity, logins, PowerShell activity) — popular products come from Microsoft, CrowdStrike, SentinelOne, Palo Alto Networks, Sophos, Trend Micro, and Broadcom/Symantec.

XDR (Extended Detection and Response) expands detection across endpoints, identity, email, cloud, network and applications, connecting alerts rather than viewing each independently: phishing email received → user opens link → suspicious login → malicious PowerShell starts → server connection occurs — together these provide much more useful context than any single alert alone.

5 Ransomware

Ransomware is one of the most serious threats facing organisations. Traditional ransomware encrypted files and demanded payment for the decryption key; modern operations can be significantly more sophisticated.

1. Initial Access — phishing, stolen creds, vulnerable VPN, exposed RDP, compromised third party↓ 2. Establish Persistence↓ 3. Privilege Escalation↓ 4. Credential Theft↓ 5. Lateral Movement↓ 6. Discover Important Systems — AD, file servers, backup servers, VMware, databases↓ 7. Data Exfiltration↓ 8. Disable Security Controls — backups, AV, EDR, monitoring↓ 9. Encryption↓ 10. Extortion

Double extortion combines encryption with data theft — "pay us or we publish your data" — so even if the organisation restores everything from backup, attackers may still possess confidential information. Triple extortion adds further pressure: contacting customers, threatening partners, DDoS attacks, or regulatory exposure.

Ransomware can stop hospitals, manufacturing, logistics, banks, government agencies, retail organisations, and universities. Financial damage may include lost revenue, incident response, legal costs, regulatory penalties, recovery costs, reputation damage, and customer compensation.

No single product prevents ransomware — organisations implement multiple controls across identity (MFA, privileged account protection, strong authentication, least privilege), endpoint (EDR, application control, patching), network (segmentation, firewalling, secure remote access), email (anti-phishing, attachment scanning, URL protection), backup (offline/immutable backups, tested recovery), and monitoring (SIEM, SOC, XDR, identity monitoring). CISA specifically recommends asset management, vulnerability management, least privilege, protecting remote services, and resilient backup/recovery design.

Simply having backups is not enough — attackers increasingly attempt to compromise backups too. Modern backup strategies include immutable storage, offline backups, separate credentials, separate security boundaries, and restricted administrative access. Organisations must also test restoration — a backup that cannot be restored is effectively useless.

6 Phishing

Phishing attempts to trick people into revealing information or performing an action. It remains one of the most important threats because humans have legitimate access that attackers want. Microsoft notes attackers increasingly use automation and generative AI to make phishing more convincing and scalable.

Basic / Credential Phishing
"Your Microsoft 365 password expires today, click here" — a fake login page captures username and password. Frequent targets: Microsoft 365, Google Workspace, VPN, banking portals, corporate SSO.
Spear Phishing
Highly targeted — researches one person (via LinkedIn, social media, the company website, or previously compromised emails) instead of mass-emailing.
Whaling
Targets senior executives (CEO, CFO, CIO, Directors) who often have authority, sensitive information, and financial approval powers.
Smishing
SMS phishing, e.g. "Your parcel could not be delivered. Pay £1.99 here."
Vishing
Voice phishing — "I'm calling from your company's IT department, we detected suspicious activity and need to verify your login."
QR Phishing
QR codes in emails or documents scanned with a phone — can bypass traditional email URL inspection controls.
Business Email Compromise (BEC)
Targets financial processes — e.g. an attacker compromises a supplier's email, monitors conversations, then sends "our bank details have changed, please send the £250,000 payment to this new account" from a legitimate mailbox.
MFA Phishing
Attackers attempt to steal the password, the MFA response, and the session token together, sometimes proxying the authentication session — one reason phishing-resistant authentication (FIDO2, passkeys, certificate authentication) is increasingly important.

When examining suspicious emails, check the sender (microsoft.com vs micros0ft-security.com), urgency ("password expires in 30 minutes"), attachments (unexpected ZIP/ISO/EXE/Office documents/scripts), links (visible text may not match the actual destination), requests for credentials (legitimate IT teams shouldn't ask users to email passwords), and financial changes (verify bank-detail changes through an independent channel).

7 Insider Threats

Not every threat comes from outside the company. An insider threat originates from someone who already has legitimate organisational access — employees, contractors, administrators, suppliers. Verizon's 2025 EMEA analysis found internal actors associated with a considerably higher share of EMEA breaches than in some other analysed regions.

Malicious Insider
Intentionally causes harm, e.g. an employee planning to leave downloads the customer database, sales pipeline, source code, and IP before taking it to another company.
Negligent Insider
No malicious intent, just a mistake — sending confidential information to the wrong person, uploading files to personal cloud storage, clicking phishing links, losing an unencrypted laptop, weak passwords, accidentally making cloud storage public.
Compromised Insider
The employee is legitimate but their account has been compromised — activity initially appears to come from them. Security systems need to distinguish "John using John's account" from "an attacker using John's account."

Warning signs: unusual download volume, access to files unrelated to the user's job, logins from unusual countries, large USB transfers, mass file copying, unexpected administrator activity, and access outside normal working patterns. Insider-threat monitoring must also consider employee privacy, employment law, data protection, and local regulations, which vary across countries — multinational organisations work closely with HR, Legal, Privacy and Security teams on this.

8 Password Attacks

Brute Force
Many passwords tried against one account. Defences: MFA, rate limiting, account lockout, smart lockout, monitoring.
Dictionary Attack
Testing commonly used passwords/words (Password123, Summer2026) instead of every combination — works because humans choose predictable passwords.
Password Spraying
One common password tried against hundreds or thousands of accounts, helping attackers avoid per-account lockout thresholds. Microsoft reported password spraying as the overwhelming majority of password-based identity attacks in its 2025 threat observations.
Credential Stuffing
Passwords stolen from one breached service (e.g. a streaming site) tested against others (Microsoft 365, VPN, Amazon, Google, banking) — why password reuse is dangerous.
Password Hash Cracking & Rainbow Tables
Systems store password hashes, not plain text; if attackers obtain the hash database they may attempt to crack it offline. Hashing, salting, and computationally expensive hashing algorithms matter here. Rainbow tables are precomputed hash lookup databases — unique salts significantly reduce their effectiveness.
Pass-the-Hash
In some Windows environments, attackers authenticate using password hash material rather than recovering the actual password — relevant to Active Directory, NTLM, credential theft, and lateral movement.
Kerberoasting
Targets AD service accounts associated with Kerberos SPNs — one reason to protect service accounts carefully and increasingly use Managed/Group Managed Service Accounts with strong automatically generated credentials.

Older organisations may still have passwords that never expire, shared administrator accounts, service-account passwords stored in scripts, password spreadsheets, old NTLM authentication, hard-coded application passwords, and Basic Authentication — all substantial risk. Modern environments increasingly use MFA, SSO, risk-based authentication, Conditional Access, passwordless authentication, passkeys, FIDO2, hardware security keys, and certificate authentication, aiming to reduce dependency on passwords altogether.

9 Social Engineering

Social engineering attacks people rather than purely attacking technology — manipulating someone into giving information, revealing credentials, approving MFA, sending money, installing software, or providing physical access. It works because employees naturally want to be helpful, efficient, trusting, and responsive.

Impersonation
"I'm from the IT department," "I'm calling from Microsoft," "I'm the new CFO."
Pretexting
A believable story: "I'm an engineer performing emergency maintenance on your VPN. I need you to confirm the six-digit code you just received."
Baiting
Offering something attractive, e.g. Executive_Bonuses.xlsx, that an employee opens out of curiosity.
Tailgating
Physical social engineering — following an employee through a secure door: "can you hold the door? I forgot my badge."
Shoulder Surfing
Observing sensitive information (PIN, password, access code, confidential document) over someone's shoulder.
Dumpster Diving
Recovering sensitive information from discarded materials — printed passwords, network diagrams, employee lists, invoices, customer records. Why organisations use secure document destruction.
MFA Fatigue
An attacker with a stolen password repeatedly triggers MFA requests, hoping the user eventually approves one just to stop the notifications. Countered by number matching, risk detection, context, and phishing-resistant authentication.

Help desk social engineering is a particular risk: an attacker who knows Sarah Jones works in Finance, reports to David Williams, from public LinkedIn information, calls claiming to be Sarah and asks for an MFA reset. If the support engineer doesn't correctly verify identity, the attacker gains access without technically compromising anything — help desk processes are therefore part of cybersecurity.

Modern generative AI adds further challenges — attackers can generate convincing emails, voice impersonation, artificial images, translated phishing messages, and personalised messages. Security awareness can't rely purely on recognising spelling mistakes; an email can be grammatically perfect and still be malicious.

10 Legacy Technology vs Modern Security

Enterprise infrastructure is rarely completely modern — a large organisation may run technology introduced this year alongside technology from five, ten, or twenty years ago, simultaneously. A large enterprise might still contain Windows Server 2012, old UNIX servers, mainframes, legacy AD applications, NTLM authentication, SMBv1, old TLS versions, static service accounts, and applications that cannot support MFA — because they run factories, hospitals, banks, payment systems, industrial machinery, or government infrastructure. Replacing them may cost millions.

Where a vulnerable legacy system can't immediately be replaced, organisations implement compensating controls: network isolation, firewall restrictions, application allowlisting, strict access controls, monitoring, jump servers, and Privileged Access Workstations.

Modern organisations increasingly use cloud infrastructure, SaaS, containers, Kubernetes, serverless computing, APIs, Zero Trust, passwordless authentication, EDR/XDR, SIEM, and SOAR — security has to evolve alongside infrastructure.

11 Defence in Depth

One of the most important cybersecurity concepts: never depend on one security control. If a company relies entirely on a firewall and an attacker compromises an employee's laptop, the firewall alone may not protect everything. Instead, organisations create multiple layers:

Internet↓ Email Security↓ Firewall↓ Endpoint Security↓ Identity Security↓ MFA↓ Application Permissions↓ Data Encryption↓ Monitoring↓ Backups

An attacker may need to defeat several independent controls, not just one.

12 Principle of Least Privilege

Users should receive only the permissions required to perform their job. A marketing employee probably doesn't need Domain Administrator access. A help desk employee might need password-reset permissions, but not full Domain Administrator privileges. Limiting permissions reduces the damage a compromised account can cause.

13 Zero Trust

Traditional security assumed "inside corporate network = trusted, outside = untrusted" — reasonable when employees and servers were primarily inside corporate offices. Modern environments are different: employees work from home, airports and hotels on mobile devices; applications run in Azure, AWS, SaaS platforms, and private data centres.

Zero Trust works on the principle that access should be continuously verified rather than automatically trusted because of network location:

Never trust automatically. Verify explicitly. Assume breach.

Checks may include: who is the user? What device? Is MFA complete? Is the device compliant? Where is the login from? Is the behaviour unusual? What application are they accessing?

14 Security Controls

Cybersecurity controls can be grouped into categories.

Preventive
Attempt to stop attacks — MFA, firewall, antivirus, permissions, encryption, secure configuration.
Detective
Attempt to detect attacks — SIEM, IDS, EDR, security monitoring, audit logs.
Corrective
Help fix problems after they occur — patching, malware removal, password reset, system rebuilding.
Recovery
Help restore operations — backups, disaster recovery, failover sites.

15 Common Enterprise Security Technologies

Firewall
Controls network traffic.
IDS / IPS
Intrusion Detection/Prevention System — detects, and can attempt to block, suspicious network activity.
EDR / XDR
Endpoint Detection and Response monitors endpoints; XDR correlates security information across multiple systems.
SIEM
Security Information and Event Management — collects and analyses security logs (Microsoft Sentinel, Splunk, IBM QRadar, Google Security Operations).
SOAR
Security Orchestration, Automation and Response — automates security workflows.
DLP
Data Loss Prevention — attempts to prevent sensitive information leaving the organisation.
PAM / IAM
Privileged Access Management protects powerful administrator accounts; Identity and Access Management controls identities and access generally.

16 Security Operations Centre

Large organisations frequently operate a Security Operations Centre (SOC). SOC analysts monitor security alerts, authentication logs, endpoint alerts, network activity, cloud activity, email security, and threat intelligence — asking what happened, which account/machine was involved, is this malicious, has the attacker accessed anything else, and do we need to contain the incident.

Microsoft Entra ID: "Impossible travel detected" — john.smith@company.com logged in from London at 09:02 and Singapore at 09:08.

The analyst investigates whether VPN caused it, the user is genuinely travelling, or the account is compromised — illustrating why logs and context matter so much.

17 Security Awareness

Technology cannot solve every security problem. Employees must also understand phishing, password security, MFA, data handling, social engineering, and incident reporting. Companies frequently run security awareness training, simulated phishing campaigns, security newsletters, and mandatory annual training. The objective isn't to punish employees who make mistakes — it's to create employees who recognise unusual behaviour and quickly report it.

18 Reporting Security Incidents

Employees should know where to report suspicious activity — a suspicious email, an unexpected MFA prompt, a lost laptop, a malware warning, a stolen phone, an accidentally exposed password, or a confidential file sent incorrectly. Speed matters: if someone enters their password into a phishing website but immediately reports it, the security team may be able to reset credentials, revoke sessions, block malicious infrastructure, search for similar emails, and investigate account activity before serious damage occurs.

19 Cybersecurity in Global Companies

Large multinational organisations face additional challenges: 100,000+ employees, hundreds of offices, multiple cloud providers, multiple AD forests, thousands of applications, acquired companies, contractors, suppliers, legacy infrastructure, and different legal jurisdictions.

Global organisations may need to consider GDPR, UK GDPR, NIS2, DORA, PCI DSS, HIPAA, local banking regulations, and national cybersecurity requirements. Cybersecurity therefore involves more than purely technical controls — security teams interact with Legal, Compliance, Risk, Audit, Privacy, HR, and Management.

20 Third-Party and Supply Chain Risk

Modern companies depend heavily on suppliers — a bank might depend on its cloud provider, payment processor, authentication provider, telecommunications provider, software vendor, and managed security provider. An attacker may compromise the organisation indirectly by attacking one of its suppliers. Third-party risk has become particularly important; Verizon's 2025 DBIR found third-party involvement in breaches had doubled compared with the previous report. This creates the concept of supply chain security — companies increasingly assess the cybersecurity posture of organisations they work with.

21 Shared Responsibility

Security is everyone's responsibility, but different teams have different duties.

Employees
Follow security policy.
IT
Secure infrastructure.
Security Operations
Detect threats.
Security Engineering
Design security controls.
IAM
Protect identities.
Network Team
Protect network infrastructure.
Cloud Team
Secure cloud resources.
Developers
Build secure applications.
Management
Manage business risk.
Legal & Compliance
Manage regulatory obligations.

Cybersecurity therefore requires collaboration.

22 Example Attack Scenario

A realistic enterprise attack, step by step:

Attacker researches the org on LinkedIn, finds Sarah in Finance↓ Sends "Updated Employee Pension Scheme" — Sarah clicks, enters credentials on a fake login page↓ Attacker tries Microsoft 365 — MFA blocks them↓ Attacker calls Sarah pretending to be IT: "approve the MFA request to complete your security update"↓ Sarah approves it — attacker gains access↓ Reads email, finds financial conversations, hides messages with an inbox rule↓ Sends modified payment instructions — Finance transfers £250,000 to the attacker

What failed? Sarah trusted the attacker (social engineering); credentials were stolen (phishing); MFA existed but was socially engineered; payment details were changed without independent verification (business process); the malicious email reached Sarah (email security); and suspicious authentication wasn't identified quickly enough (detection). This demonstrates why cybersecurity requires multiple defensive layers.

23 Legacy vs Modern Attack Scenario

Consider LEGACY-SERVER01, running Windows Server 2012 with critical manufacturing software the equipment depends on — it can't be upgraded, and the company can't simply remove it. Security architects might instead: place the server in an isolated network, restrict firewall access, block Internet access, allow only required systems to communicate, monitor all connections, restrict administrator access, access it through a hardened jump host, and plan replacement.

This is a realistic enterprise cybersecurity problem — security professionals frequently have to balance business requirements against security requirements.

Lab Lab 1 — CIA Triad

🦡 Hands-on lab

For each scenario, identify whether it primarily affects Confidentiality, Integrity, or Availability.

🔮 Predict first

A. A hacker steals customer records. B. A hacker modifies payroll records. C. Ransomware encrypts the company's file server.

Reveal the answers

A: Confidentiality. B: Integrity. C: Availability — although modern ransomware may also affect confidentiality and integrity.

Lab Lab 2 — Identify Threat, Vulnerability and Risk

🦡 Hands-on lab

Scenario: a company runs an unpatched VPN appliance exposed to the Internet.

🔮 Predict first

Identify the Asset, Threat, Vulnerability, and Risk in this scenario.

Reveal the answer

Asset: corporate network. Threat: cybercriminal. Vulnerability: unpatched VPN. Risk: attacker compromises the VPN and obtains corporate access.

Lab Lab 3 — Phishing Investigation

🦡 Hands-on lab

Find or construct several sample emails (real reported phishing samples work well). For each one, examine the sender, domain, links, attachments, urgency, grammar, financial requests, credential requests, and context, then classify it as Legitimate, Suspicious, or Malicious.

Reveal the examination checklist

Sender domain (is it correct, or a lookalike like micros0ft-security.com?), artificial urgency, unexpected attachment types, whether the visible link text matches the actual destination, any request for credentials by email, and any request to change financial/banking details. These nine checks catch the overwhelming majority of phishing attempts.

Lab Lab 4 — Password Attack Comparison

🦡 Hands-on lab

🔮 Predict first

Explain the difference between Brute Force, Password Spray, and Credential Stuffing in your own words.

Reveal the definitions

Brute Force: many passwords against one account. Password Spray: one or a few passwords against many accounts. Credential Stuffing: previously stolen username/password combinations tested elsewhere. This distinction is extremely important for SOC and IAM engineers.

Lab Lab 5 — Security Log Investigation

🦡 Hands-on lab 
09:10 john.smith  Login Success     London
09:14 john.smith  Login Success     London
09:17 john.smith  Login Failure     Romania
09:17 john.smith  Login Failure     Romania
09:18 john.smith  Login Success     Romania
09:19 john.smith  MFA Device Added

🔮 Predict first

What looks suspicious here, and what actions should a SOC analyst take?

Reveal the analysis

Suspicious signals: unexpected geography (Romania right after London), failed authentication attempts, a successful login immediately after those failures, and an MFA device change right afterward — a classic account-takeover pattern.

Actions to consider: contact the user, check authentication logs further, revoke active sessions, investigate device information, reset credentials if compromise is confirmed, investigate the MFA change specifically, and search for related activity on other accounts.

Lab Lab 6 — Ransomware Tabletop Exercise

🦡 Hands-on lab · group discussion

Scenario: at 10:00 AM, employees report that shared files suddenly have strange extensions. Several servers become unavailable. A ransom message appears.

🔮 Work through this before reading on

1. Who should be notified? 2. Should affected machines remain connected? 3. What logs should be collected? 4. Are backups available? 5. Are backups compromised? 6. Which systems are affected? 7. How did the attacker enter? 8. Was data stolen? 9. Should credentials be reset? 10. How would business operations continue?

Reveal the point of the exercise

The purpose is not to expect beginners to solve the entire incident, and there's no single "correct" answer sheet here. The objective is to teach structured thinking under pressure — notice how many of these ten questions you'd genuinely need to answer before you could even start technical remediation.

Lab Lab 7 — Design Defence in Depth

🦡 Hands-on lab
Internet↓ Microsoft 365↓ Employee Laptop↓ VPN↓ Corporate Network↓ Active Directory↓ File Server

🔮 Predict first

Suggest at least one security control for each layer above before revealing.

Reveal example controls per layer
Microsoft 365
MFA, Conditional Access, anti-phishing.
Laptop
EDR, patching, disk encryption.
VPN
MFA, strong encryption, restricted access.
Active Directory
Least privilege, tiered administration, monitoring.
File Server
Permissions, backups, auditing.

Practical Challenge — Global Coffee Ltd

🦡 Capstone exercise

Create a fictional company: Global Coffee Ltd — 2,000 employees, Windows laptops, Active Directory, Microsoft 365, Azure, AWS, VPN, file servers, a customer database, a public website, and remote employees.

🔮 Build this yourself

Identify 10 assets (e.g. customer database, Active Directory, Microsoft 365), 10 threats (e.g. ransomware, phishing, credential theft), 10 vulnerabilities (e.g. missing MFA, unpatched servers, weak passwords), and 10 security controls (e.g. EDR, MFA, backups, SIEM).

Then write one complete attack scenario end to end: initial access → compromise → lateral movement → business impact → detection → containment → recovery.

This exercise forces you to connect networking, Active Directory, Microsoft 365, Linux, cloud and cybersecurity together — everything from Modules 1–8 at once.

Module 8 Final Knowledge Check

Click each question once you're confident you can answer it from memory.

0 / 30 reviewed

Module 8 Outcome

After completing this module, you should understand that cybersecurity is fundamentally about managing risk to identities, systems, networks and information. You should understand how malware, ransomware, phishing, password attacks, insider threats, and social engineering relate to real enterprise infrastructure.

Most importantly, you should begin connecting the technologies learned in previous modules: networking knowledge helps you understand how attackers move between systems; Active Directory knowledge helps you understand privilege escalation and identity attacks; Microsoft 365 knowledge helps you understand phishing and cloud account compromise; Linux knowledge helps you investigate and secure servers; cloud knowledge helps you understand modern infrastructure and shared responsibility. Cybersecurity brings all of these disciplines together.

The next modules move deeper into authentication, Identity and Access Management, Security Operations, incident response, APIs, logging and automation.