CSEC201BKK
Intro to Cyber Security
Faculty
Sergey Gordeychik
CEO and Co-Founder at CyberOK
Course length
Duration
Total hours
Credits
Language
Course type
Fee for single course
Fee for degree students
Skills you’ll learn
Overview
This course offers a practical introduction to cybersecurity through the lens of modern Security Operations (SecOps) and Purple Team methodology. It preserves the foundations of network, operating system, cryptographic, application, and access-control security while updating the attack model around identity, internet-facing edge systems, software supply chains, cloud control planes, and AI-enabled and agentic applications. Students learn to connect offensive activity, telemetry, detection, incident response, remediation, and retesting as one continuous engineering loop. The course balances foundational theory with authorised, isolated hands-on practice using current open tools and lab platforms.
- Modern attacks increasingly target control planes: identity providers, edge appliances, CI/CD, cloud consoles, hypervisors, and AI agents.
- Every major practical exercise follows the same loop: observe, attack, detect, explain, remediate, and retest.
Learning highlights
- Understand cybersecurity foundations and modern attack paths. Students will work with the CIA triad, assets, threats, vulnerabilities, risks, controls, attacker motivations, and current initial-access patterns across identity, edge systems, applications, supply chains, cloud, and AI.
- Treat identity and trust as first-class security boundaries. Students will connect human, device, workload, and service identities with sessions, tokens, federation, least privilege, phishing-resistant authentication, and Zero Trust design principles.
- Apply offensive and defensive techniques in realistic scenarios. Students will reproduce common attacks and then investigate them through logs, endpoint and network telemetry, detection rules, system hardening, and incident response.
- Integrate security into software, cloud, and AI development. Students will practice threat modeling, DevSecOps, software-supply-chain controls, container and Kubernetes security, and secure design for LLM, RAG, tool-using, and agentic systems.
- Engineer and validate detections rather than only operate tools. Students will learn basic detection-as-code with Sigma, version control, positive and negative tests, ATT&CK-based coverage, and continuous validation using reproducible adversary behaviours.
Course outline
15 classes
Cybersecurity Foundations and Threat Landscape
- • CIA triad; assets, threats, vulnerabilities, risks, and controls.
- • Threat actors, motivations, attack lifecycle, and business impact.
- • Modern initial access: edge exploitation, stolen identity, social engineering, and supply chain.
- • Ransomware, data theft, extortion, and recovery denial.
- • Regulation and disclosure obligations as security design constraints.
Practical focus: Map a current incident to assets, attack path, controls, and ATT&CK techniques.
Identity, Trust and Access Control
- • Authentication, authorisation, accounting, least privilege, and separation of duties.
- • DAC, MAC, RBAC, ABAC, and formal models in historical context.
- • Human, device, workload, and non-human identities.
- • Sessions, cookies, tokens, OAuth/OIDC, SAML, and federation.
- • Phishing-resistant MFA, passkeys, and Zero Trust architecture principles.
Practical focus: Analyse token and session abuse and draw trust boundaries for a hybrid application.
Introduction to Cryptography and Crypto Agility
- • Symmetric and asymmetric encryption, hashes, MACs, and signatures.
- • PKI, TLS 1.3, certificates, revocation, and ACME automation.
- • Password hashing, key and secret management, and common implementation failures.
- • Post-quantum cryptography, harvest-now-decrypt-later, and hybrid migration.
- • Crypto inventory and agility as engineering requirements.
Practical focus: Inspect certificates and TLS handshakes; compare secure and insecure password storage.
Network Security I – Local Networks and Modern Interception
- • TCP/IP, OSI layers, DNS, HTTP(S), and packet-flow fundamentals.
- • ARP/MAC spoofing and packet sniffing as network “physics.”
- • Segmentation, secure Wi-Fi, switching, and local firewall controls.
- • Modern MitM: reverse-proxy phishing and session-cookie theft.
- • TLS, mTLS, and the limits of network-location trust.
Practical focus: Use Wireshark in an isolated LAN lab and identify where encryption changes visibility.
Network Security II – Internet Edge, Exposure and Prioritisation
- • VPNs, gateways, WAFs, routers, and edge appliances as controls and targets.
- • Internet exposure, asset discovery, attack-surface management, and validation.
- • CVE/CVSS, CISA KEV, EPSS, asset criticality, and environmental context.
- • Firewall rule design, denial-of-service, and resilience principles.
- • Short OT/ICS exposure case: why fragile cyber-physical systems change risk.
Practical focus: Review an authorised exposure dataset and prioritize a patch queue with KEV and EPSS.
Windows and Enterprise Identity Security
- • Accounts, permissions, services, event logging, and audit policy.
- • NTLM and Kerberos fundamentals; pass-the-hash and Kerberoasting.
- • Hybrid identity: SSO, PRT/session/token theft, and OAuth application abuse.
- • EDR, Sysmon, BYOVD, and security-control tampering.
- • Hardening, privileged access, and recovery of trusted identity.
Practical focus: Investigate Windows and Sysmon events and identify a suspicious authentication chain.
Linux and Runtime Security
- • Permissions, ownership, sudo, SSH hardening, and authentication logs.
- • Service management, secure defaults, and common misconfigurations.
- • Capabilities, namespaces, and cgroups as a bridge to containers.
- • SELinux/AppArmor and least-privilege enforcement.
- • Runtime visibility with auditd and eBPF-based tools such as Falco or Tetragon.
Practical focus: Harden a Linux host and trace suspicious process and network activity.
Application Security – Web and API Attacks
- • Web architecture, HTTP, browser/server trust boundaries, and attack surface.
- • OWASP Top 10:2025 with emphasis on access control, misconfiguration, and insecure design.
- • Authentication/session flaws and API authorisation failures such as BOLA/BFLA.
- • Injection, command execution, SSRF to cloud metadata, and file/path issues.
- • Client-side vs. server-side flaws and secure handling of exceptional conditions.
Practical focus: Exploit and remediate selected PortSwigger web/API labs.
Secure Development and Software Supply Chain
- • Secure coding, threat modeling, SDLC, and DevSecOps principles.
- • SAST, DAST, SCA, secret, container, and IaC scanning: strengths and limits.
- • Dependencies, maintainers, package registries, and CI/CD as attack surfaces.
- • SBOMs, SLSA provenance, Sigstore/Cosign, pinning, and OIDC-based publishing.
- • AI-generated code, package hallucination/slopsquatting, review, and provenance.
Practical focus: Inspect a CI workflow, generate an SBOM, and sign or verify a build artifact.
Cloud, Containers and Control-Plane Security
- • Shared responsibility, IAM roles, workload identity, and least privilege.
- • Metadata services, storage exposure, secrets, private endpoints, and network controls.
- • Container images, capabilities, rootless execution, scanning, and hardening.
- • Kubernetes RBAC, admission control, secrets, and network policy.
- • CSPM/CNAPP, runtime defense, and blind spots in hypervisors and management planes.
Practical focus: Find and fix misconfigurations in a cloud/container lab and explain the control-plane risk.
Security Operations and Detection Engineering
- • SOC/MDR functions, telemetry pipelines, log quality, retention, and cost.
- • MITRE ATT&CK v19.1: detection strategies, analytics, and data components.
- • Sigma and detection-as-code in Git: review, versioning, deployment, and rollback.
- • Behavioural and living-off-the-land detection across endpoint, identity, and cloud.
- • Validation with Atomic Red Team or Caldera; TP/FP tests and coverage metrics.
Practical focus: Execute a reproducible behaviour, write a Sigma rule, and test positive and negative events.
Incident Response and Digital Forensics
- • Incident-response lifecycle, evidence collection, chain of custody, and timelines.
- • Disk, memory, network, and endpoint forensics fundamentals.
- • Identity-centric IR: revoke sessions and tokens, remove persistence, restore trust.
- • SaaS, cloud, and Kubernetes evidence where provider logs may be decisive.
- • Extortion-only incidents, recovery, communications, and regulatory reporting clocks.
Practical focus: Build a timeline from mixed logs and run a short containment and notification tabletop.
Red Team Tactics and Adversary Simulation
- • Rules of engagement, ethics, methodology, evidence, and reporting.
- • Reconnaissance, exploitation, privilege escalation, and post-exploitation.
- • Help-desk attacks, vishing, ClickFix, social engineering, and physical context.
- • Modern command-and-control and living-off-the-land tradecraft.
- • AI-assisted recon and exploit development with human validation and safety gates.
Practical focus: Run a scoped adversary-emulation chain and produce an evidence-based remediation report.
AI, LLM and Agentic Application Security
- • Architecture: models, prompts, RAG, vector stores, tools, agents, and MCP.
- • OWASP LLM Top 10 2026 and OWASP Agentic Top 10 2026.
- • Direct/indirect prompt injection; RAG, data, and memory poisoning.
- • Insecure output handling, secrets, model files, and AI supply-chain risk.
- • Excessive agency, tool misuse, delegated authority, isolation, approvals, and monitoring.
- • MITRE ATLAS, NIST AI RMF, AI governance, and responsibility.
Practical focus: Complete a Web LLM Attacks lab and manipulate a tool-using agent through indirect injection.
Final Practical Assessment – Purple Team Challenge
- • Red Team: identify and exploit a realistic chain within the provided scope.
- • Blue Team: detect, analyse, contain, recover, and preserve evidence.
- • Create a working Sigma rule with positive and negative tests.
- • Prioritise remediation, implement at least one control, and retest the attack path.
- • Submit a technical report, executive summary, AI-use appendix, and team review.
- • The challenge may include identity, cloud, supply-chain, or AI-agent control-plane elements.
Practical focus: Demonstrate the complete attack-detect-respond-remediate-retest loop.
Prerequisites
- Understanding of basic computing concepts and computer architecture.
- Familiarity with TCP/IP, IP addressing, ports, DNS, routing, and HTTP(S).
- Basic administrative experience with Linux command-line tools and Windows user and system management.
- Ability to read and modify simple Python and Unix shell scripts.
- Basic familiarity with Git and GitHub or an equivalent version-control platform.
- Familiarity with programming logic, the software development lifecycle, and common data structures.
- Willingness to work only in authorised lab environments and follow the course rules of engagement.
Methodology
The course combines interactive lectures, guided hands-on labs, short incident briefings, and team-based cybersecurity exercises. A typical day includes approximately one hour of lecture followed by two hours of practical work and discussion. Students work individually and in small teams using isolated course systems and online lab platforms such as PortSwigger Web Security Academy, TryHackMe, Hack The Box, LetsDefend, and CyberDefenders. Equivalent tools and platforms may be substituted when needed.
The stable syllabus is supplemented by a current-year case pack. Each week, selected students deliver a five-minute incident briefing based on a vendor advisory, government notice, technical postmortem, or another primary source. The three-week progression moves from foundations to identity, exposure, applications, software supply chains, cloud, detection engineering, incident response, red teaming, and AI security, culminating in a practical Purple Team assessment on Day 15.
All offensive activity is limited to systems explicitly provided or authorised for the course.
Students must follow scope, rate limits, data-handling rules, and stop conditions defined by the instructor.
Grading
Sergey Gordeychik is CEO and Co-Founder of CyberOK, a cybersecurity company delivering advanced services and research. He is also a Visiting Professor at Harbour.Space University (Barcelona, Spain), contributor of different social and educational initiatives. Previously, he was CIO at the Inception Institute of Artificial Intelligence (UAE), where he led AI-driven product development and secure infrastructure design. As Deputy CTO at Kaspersky Lab, he launched Security Intelligence Services and Managed Detection and Response solutions. Earlier, as CTO of Positive Technologies, he led development of award-winning enterprise security products and co-created Positive Hack Days (PHDays), the largest cybersecurity event in Eastern Europe.
Sergey is the author of two books and multiple scientific publications, with three patents in cybersecurity. He has created several training programs including "Critical Infrastructure Protection" and "Web Application Security Assessment." A regular speaker at top-tier conferences such as S4, CCC, CodeBlue, POC, and ZeroNights, Sergey holds CISSP, MCSE, MCT, CWNA, and was recognized as a Microsoft MVP in Enterprise Security R&D.
See full profileApply for this course
Intro to Cyber Security
by Sergey Gordeychik
Total hours
45 Hours
Dates
Aug 17 - Sep 04, 2026
Fee for single course
€1500
Fee for degree students
€750
How to secure your spot
Complete the form below to kickstart your application
Schedule your Harbour.Space interview
If successful, get ready to join us on campus
FAQ
Will I receive a certificate after completion?
Yes. Upon completion of the course, you will receive a certificate signed by the director of the program your course belonged to.
Do I need a visa?
This depends on your case. Please check with the Spanish or Thai consulate in your country of residence about visa requirements. We will do our part to provide you with the necessary documents, such as the Certificate of Enrollment.
Can I get a discount?
Yes. The easiest way to enroll in a course at a discounted price is to register for multiple courses. Registering for multiple courses will reduce the cost per individual course. Please ask the Admissions Office for more information about the other kinds of discounts we offer and what you can do to receive one.