Security essentials
The principles, threats, cryptography, and Linux skills everything builds on.
Access control
Understand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.
Adversary in the middle
An intermediary may observe or alter a communication path.
AES
A symmetric block cipher whose safe use depends on its mode and implementation.
Asymmetric cryptography
Explore public and private keys, encryption, signatures, and key agreement without confusing their different purposes.
Authentication
Understand how authentication verifies an account, how login sessions work, and why recovery and multifactor methods matter.
Authorization
Learn how applications check permission for individual resources and actions, with an invoice example and practical access tests.
Availability
Make the required service accessible to authorized users when it is needed.
Bell–LaPadula model
A formal model focused on confidentiality across classification levels.
Biba integrity model
Protect trusted information from less trustworthy inputs.
Botnets
A coordinated set of compromised systems can perform distributed activity.
Brute-force attacks
Try candidates until a valid secret or answer is found.
Caesar ciphers
A historical substitution demonstrates why simple secrecy schemes fail.
Careers in cybersecurity
Security includes technical, investigative, and business-focused work.
Chinese Wall model
Restrict access dynamically to manage conflicts of interest.
Clark–Wilson model
Protect business integrity through controlled transactions and separate duties.
Confidentiality
Limit information disclosure to the people and systems that should receive it.
Credential stuffing
Reused credentials can turn a breach elsewhere into access here.
Credentials from Password Stores
Password-store access targets credentials retained by operating systems or applications.
Cryptanalysis
Study weaknesses in cryptographic schemes and their use.
Cryptographic hashing
Explore cryptographic digests, file comparisons, collisions, and trusted reference values through an evidence-copy example.
Cryptographic randomness
Keys and unpredictable challenges depend on suitable random generation.
Cryptography
Understand encryption, hashing, and digital signatures through a software-update example, with clear guidance on keys and trust.
CrypTool
Explore cryptographic ideas through educational demonstrations.
CyberChef
Transform data with a clear understanding of the operation and sensitivity.
Defense in depth
Use complementary protections so one failure does not decide the outcome.
Denial of service
Exhaust or disrupt a service so legitimate users cannot use it.
Digital certificates and PKI
Bind a public key to an identity within a trust system.
Digital signatures
Learn what digital signatures verify, why trusted public keys matter, and what a valid signature cannot prove about software safety.
Drive-by downloads
Visiting or interacting with content can initiate unwanted download or execution paths.
ECB and block-cipher modes
A cipher needs a construction suited to the data and protection goal.
Elliptic-curve cryptography
Public-key operations using elliptic-curve mathematics.
Email validation and verification
Email validation checks whether an address meets the application's supported format, while verification checks control of the mailbox through an appropriate flow.
End-to-end encryption
Protect message content between the intended endpoints, while recognizing other exposure.
Exploitation for Credential Access
Exploitation for credential access uses a vulnerability to obtain authentication material.
Forced Authentication
Forced authentication induces a system to send authentication material to an unintended party.
Forge Web Credentials
Forged web credentials exploit a trust relationship used to create accepted authentication material.
Frequency analysis
Repeated patterns can reveal structure in classical ciphers.
Input Capture
Input capture observes user-entered information through software or deceptive interfaces.
Insider threats
Legitimate access can still be misused or cause harm.
Integrity
Keep information and actions consistent with authorized, trustworthy states.
IPsec
Protect IP traffic through negotiated security associations.
JSON Web Token (JWT) security
JWTs carry claims in a standardized token format.
JWT expiration and revocation
JWT revocation addresses how a service stops accepting a token before its nominal expiration.
Key agreement
Establish a shared secret without sending that secret as plain data.
Key management
Follow cryptographic keys from creation to retirement, including access, rotation, recovery, and the risks of deleting old keys.
Least privilege
Design access around necessary actions, resources, and duration, with examples of service permissions and temporary administration.
Legacy cryptography
Understand historical algorithms without treating them as current defaults.
Linux file permissions
Read, write, and execute rights apply differently to files and directories.
Linux filesystem and paths
Locate files consistently and distinguish logical paths from their targets.
Linux fundamentals
Understand the operating system before relying on security tools.
Linux processes and services
Inspect running work and its identity before interpreting it.
Malware
Software used to perform unwanted or harmful activity.
Message authentication codes and HMAC
Use a shared secret to verify message integrity and origin under that key.
Multi-Factor Authentication Interception
MFA interception targets the material or process used for an additional authentication factor.
Multifactor authentication
Compare authentication factors, phishing resistance, approval prompts, and recovery choices through practical account-security examples.
Mutual TLS (mTLS)
Mutual TLS uses certificates to authenticate both sides of a TLS connection when configured for client authentication.
OAuth 2.0 security
OAuth 2.0 delegates access through tokens and defined authorization flows.
OAuth scopes and delegated permissions
OAuth scopes describe a requested or granted range of delegated access.
OpenSSL
A cryptographic library and toolset whose options require deliberate use.
OS Credential Dumping
OS credential dumping targets authentication material stored or processed by an operating system.
Passkeys and WebAuthn
Understand passkey registration and sign-in, public-key challenges, phishing resistance, and the recovery choices that still matter.
Password storage
Understand password verifiers, salts, work factors, and why a fast file hash is unsuitable for protecting a password database.
PGP and GnuPG
Understand encryption, signing, and public-key trust as separate operations.
Phishing
Recognize deceptive requests, verify them through trusted channels, and understand what to report after interacting with a message.
Proof Key for Code Exchange (PKCE)
PKCE binds an OAuth authorization-code exchange to a verifier created by the initiating client.
Ransomware
Extortion can involve service disruption, stolen data, or both.
RBAC and ABAC
Compare role-based and attribute-based access control using support-team scenarios, and learn where combined policies need careful testing.
Replay attacks
A valid old message can still be an unauthorized new action.
RSA
A public-key family requiring appropriate parameters and schemes.
S/MIME
Apply public-key signatures and encryption to email content.
SAML assertion security
SAML exchanges identity assertions between an identity provider and a relying service.
Secrets management
Manage credential ownership, distribution, rotation, revocation, and leaked copies across source history, deployment artifacts, logs, and runtime consumers.
Secure account recovery
Examine password-reset links, lost-authenticator recovery, and session handling as alternate routes to controlling an account.
Secure cookie attributes
Cookie attributes control browser handling of values such as session identifiers.
Security awareness
Help people recognize relevant risks and follow usable protective processes.
Security controls
Safeguards can prevent, detect, correct, or compensate for a problem.
Security domains
A breach crosses boundaries; effective defense does too.
Separation of duties
Split sensitive steps so one identity cannot control an entire transaction.
Session fixation
Session fixation occurs when an attacker can cause a victim to authenticate using a session identifier already known to the attacker.
Session hijacking and cookie theft
Session hijacking uses a valid session credential to act as its owner without completing the original login again.
Shells, pipes, and text tools
Compose commands carefully and understand where data flows.
Side-channel attacks
Infer secrets from what an implementation leaks while operating.
Social engineering
Manipulate a person’s decision rather than only exploiting software.
SSH
An encrypted channel for remote administration and related operations.
Steal Application Access Token
Application access token theft exposes delegated authority represented by tokens.
Steal or Forge Kerberos Tickets
Kerberos ticket theft or forgery abuses ticket-based authentication material to access services.
Symmetric encryption
Understand shared-key encryption, authenticated encryption, nonces, and key access through a document-storage example.
The CIA triad
Use confidentiality, integrity, and availability to explain security failures, set practical requirements, and understand tradeoffs.
Threat, vulnerability, and risk
Separate the possible source of harm, the weakness, and the potential consequence.
TLS and secure transport
Learn what TLS protects, how endpoint validation matters, and why encrypted transport cannot establish that a website or its application is safe.
Transaction authorization
Transaction authorization confirms a specific sensitive operation rather than merely proving a general login.
Trust boundaries
A trust boundary separates components or actors operating under different security assumptions.
Unsecured Credentials
Unsecured credential discovery searches locations where secrets have been left readable.
What is cybersecurity?
Explore what cybersecurity protects, how prevention and recovery fit together, and where beginners can start learning.
Zero-day vulnerabilities
A newly unknown or unaddressed weakness challenges patch-only defense.