IT Security in Action: Detecting, Defending Against, and Preventing Cyberattacks
Understand Current Attack Techniques and Assess AI Risks Through Hands-On Labs
.svg)
Machine Learning Engineer
1. basics of cyber security
- Hacking vs. IT Security, Attackers and Their Motives, Terms and Metrics
- MITRE ATT&CK; Assessing Vulnerabilities, Misconfigurations, and Permissions Together
- Reconnaissance, enumeration, and scanning; distinguishing between observations and assumptions, and prioritizing relevant countermeasures
2. Initial Infections, Initial Access, and Identities
- Social engineering, password procedures and policies, phishing
- MFA/2FA Bypass and Token Misuse, Attacks on Microsoft 365, Cloud and Identity Attack Vectors
- Browser-based attacks and attacks via peripheral devices
- Phishing-resistant authentication, protection of privileged accounts, and restriction of access rights as defensive measures
3. Infrastructure Security
- Attack chain, enumeration, port scanning, offline cracking
- Reverse and bind shells, vulnerability assessment, command injection, webshells, SSRF, Metasploit
4. linux security
- Exploitation and Privilege Escalation
- Lateral Movement and Pivoting Across System Boundaries, Post-Exploitation
5. Windows Security
- Credential System, IPS Evasion, Memory Corruptions, Exploit Mitigations
- Meterpreter, keylogging, client-side exploitation, Sysinternals, library hijacking
6. Active Directory Security
- Coercion, Pass-the-Hash, Pass-the-Ticket, Golden/Silver Tickets, Kerberoasting
- Skeleton Key, Machine Account Quota, AdminSDHolder, Enterprise Access Model, Privileged Access Workstations
- Credential Access and the Protection of Login Credentials as a Key Line of Defense
7. Web Applications and Network Boundaries
- SQL injection, XSS, command injection, and SSRF using selected examples; identifying the cause of the vulnerability and the corresponding countermeasure
- Network segmentation, protocol analysis, and controlled communication paths; understanding the limitations of firewalls and endpoint protection
8. Post-Exploitation, Detection, and Defense in Depth
- Living off the land, fileless malware, lateral movement via RDP, WMI, WinRM, DCOM
- Evaluate suspicious activity in context; combine logging and detection
- Hardening Windows and Active Directory, Network Defense, ISMS Fundamentals, Threat Modeling
- Setting Up a SOC, Incident Response, Threat Intelligence
9. Ransomware and Recovery
- Blocking Ransomware Attack Vectors, Initial Response Measures, and Access Control
- Backup Strategies, Disaster Recovery with RPO/RTO, Data Recovery
- Considerations Regarding Ransom Payments, Decryption, and Tools
10. AI in Offense and Defense
- AI-powered research, phishing preparation, vulnerability analysis, and triage; critically evaluate results and scope
- Protecting Data and Secrets: Shared Data, an Appropriate Operating Environment, and Clearly Defined Access
- Technically limiting AI agents: minimal permissions, isolation, and approvals for effective changes
- Verifying AI Results: Cross-Checking Statements Against Original Events and Independent Logs
- Monitoring Automated Countermeasures: Responsibilities, Abort Procedures, Rollback, and Recovery
11. Case Studies and Practical Exercises
Selected attack vectors are practiced in a hands-on setting in the lab, while others are explained through demonstrations and case studies
- You identify attack vectors and assess their significance for your own environment.
- You derive specific protective and detection measures from practical laboratory observations.
- You view identities, permissions, and segmentation as interconnected security measures.
- You assess AI risks based on data access, tool permissions, and operational limits.
- You prioritize improvements in prevention, detection, and recovery.
Technical explanations, demonstrations, and hands-on exercises are interspersed throughout the course. You’ll work in a browser-based IT security lab with a simulated corporate network (Windows, Linux, BSD, servers, clients, firewalls, proxies, next-generation firewalls, IPS, WAF, endpoint protection). Selected lab scenarios combine initial access, privilege escalation, and movement between systems; web-based scenarios complement this perspective. Appropriate countermeasures are discussed for each selected attack vector.
In the AI module, you’ll evaluate the use of an agent for log analysis using specific examples: permitted data, permissions, evidence, and approvals. The focus is on secure operation and defense, not on training your own AI models.
Prerequisites: Experience with the operation and administration of Windows and Linux systems, as well as basic knowledge of networks and IT security.
- IT Security Officers and IT Security Managers
- ITadministrators s (Client, Server, Network), and Security Engineers
- Programmers and IT-engineers
- Employees in Security Operations Centers
- Technical generalists who want to analyze risks from an attacker's perspective
.svg)