MSc in Cyber
Security.

The structure of a C program introduced source and header files, object compilation, linking and the main function. Students practised writing and debugging short programs using output, variables, numeric values and basic types. Arithmetic and assignment operators, precedence and parentheses were examined through pseudocode translation and faulty expressions. Character values and escape sequences extended the examples beyond numbers. Development environments supported the practical work, while the session connected the text of a program with the steps needed to build it.

Logical and bitwise operations were explored through masks, shifts and compound conditions. Exercises included leap-year checks and separating a byte into two four-bit parts. Switch statements introduced default cases, breaks and deliberate fall-through. Arrays then provided sequential collections to initialise, index and traverse, with exercises involving swaps and character manipulation. Bubble sort was applied to floating-point values in descending order, bringing comparisons, loops and changes to stored data together in an explicit algorithm that students could follow.

Pointer movement and dereferencing led into multidimensional character arrays and alternative ways to traverse them. Dynamic allocation introduced checking for failure and releasing memory, including separately allocated rows in a two-dimensional structure. Alphabet and multiplication-table exercises made allocation and cleanup part of the work. Function declarations, parameters, return values and scope then introduced boundaries around calculations and comparisons. The class examined these alongside the distinction between indexing an array and using pointer arithmetic to reach its contents.

Static matrices and dynamically allocated pointer arrays required different function parameter types. The class examined that distinction before introducing command-line arguments and conversion from strings. Worked examples included address validation, matrix comparisons and a command-line calculator. Recursion, conditional expressions and separate source and header files extended the programming model. Pattern-printing and a small randomised game were assigned as exercises, while compilation and linking remained part of understanding how the separate pieces of a program fit together.

C++ introduced streams, namespaces, Boolean values and range-based loops alongside comparisons with C. Parameters passed by value, pointer or reference illustrated different interfaces, including constant references. Default arguments and overloaded functions provided additional ways to express behaviour. Dynamic allocation and array deletion were compared with the earlier C operations. Strings introduced construction, concatenation, indexing and input handling. The session connected these language facilities with the existing questions of types, access and memory rather than treating C++ as an unrelated starting point.

A matrix exercise was reviewed through initialisation, arithmetic, compatibility checks and compiler warnings. Classes then combined data with methods and access restrictions. Constructors and a stack example introduced initialisation and encapsulation before inheritance and overriding. Copy constructors exposed the difference between shallow and deep copying of allocated matrix data. Destructors connected object lifetime with memory release. These examples made class design depend on what an object owns and how it should behave when created, copied or destroyed.

Polymorphism introduced abstract interfaces and the need for appropriate destruction through a base class. Copying restrictions and composed objects were examined alongside const-correctness across variables, parameters and methods. Move operations demonstrated transferring ownership of allocated matrix data, while overloaded operators and output supported its interface. Students began a chess-piece exercise using inheritance and polymorphism to initialise and display a board, with valid movement planned as later work rather than presented as already implemented in that session.

Templates introduced reusable functions and classes parameterised by types, including requirements on the operations those types support. Examples ranged from arithmetic and points to stacks and matrices. Standard library containers were compared through storage, access, insertion and uniqueness. Smart pointers introduced automated lifetime management, particularly shared ownership and deletion when appropriate. Students were asked to adapt a matrix exercise using templates and smart pointers, connecting generic interfaces with the memory-management concerns developed through the preceding sessions.

The session introduced operating systems from a cyber-security perspective, focusing on how user identification, authentication and privileges control access to system resources. It distinguished Linux user and group IDs, including root accounts, service/application accounts and ordinary user accounts, and explained how these support least privilege and traceability during security investigations. Students examined the /etc/passwd and /etc/shadow files, including their fields, the storage of password hashes, home directories and login shells. The class also covered Linux file permissions shown by ls -l, including resource types, owner/group/other permission sets, and read, write and execute rights. Extended permissions were introduced through set-user-ID (SUID), using the passwd command as an example of executing a program with root privileges to update password information.

The session reviewed Linux standard and extended file permissions, including symbolic and octal notation, SUID, set-group-ID (SGID) and sticky bits. It examined the security risks of incorrectly configured SUID files, particularly the possibility of inserting code that could run with root privileges. Students were shown how to use Linux manual pages, their sections, keyword searching with man -k, and command help options. The class introduced pattern matching for selecting files, alongside regular-expression concepts. It also began Bash scripting, covering shebang lines, execution permissions, user and system variables, variable expansion, concatenation, and the PATH environment variable.

The session covered Bash condition testing with the test command and its equivalent square-bracket syntax, including comparisons between strings and checks for empty or non-empty variables. It introduced tests for file types, such as regular files, directories, character and block devices, pipes and links, as well as checks for file existence and size. The class also examined how to test read, write and execute permissions and special permissions including SUID, SGID and the sticky bit. Students were set a scripting exercise to create files, assign permissions, and print messages confirming which standard and special permissions were present. The session linked these techniques to recursively traversing directory trees to inspect files and permissions.

The class reviewed Linux file permissions using chmod in both octal and symbolic notation, distinguishing the owner, group and other users. It explained that octal chmod commands overwrite permissions, while symbolic commands can add or remove specific permissions. Extended permissions were covered, including SUID for executing a file with the owner’s identity, SGID for executing with the group’s identity, and the sticky bit for restricting file deletion to the file owner. Students practised translating permission scenarios into chmod commands while applying the principle of least privilege. The session also introduced the stat command and its manual pages for retrieving file attributes, followed by a planned Bash scripting exercise to list attributes for files in a directory.

The class introduced the separation between user space and kernel space, including privilege levels, protected operating-system resources and the role of system calls as controlled gateways. It explained how processes are scheduled, how interrupts notify the system of events, and how system calls transfer execution into kernel mode before returning results or error codes. Linux-focused examples showed how commands such as ls use system calls for file access, and how system-call tables, numbers, registers and application binary interfaces support these requests. Security coverage examined system calls as an attack surface, including rootkits, suspicious call sequences and the importance of recognising behavioural patterns rather than isolated calls. Practical demonstrations used strace, ltrace and the /proc filesystem to inspect program behaviour, current system calls, memory mappings and file descriptors.

The session reviewed how strace and ltrace distinguish system calls from user-space library calls, and how sequences of system calls can reveal program behaviour such as file access, process creation and network activity. It introduced Linux processes as kernel-managed objects, covering process IDs, parent-child relationships, scheduling, context switching and process states including running, sleeping, stopped and zombie states. The class explained fork, exec, wait and exit in the process lifecycle, including why terminated child processes may remain as zombies until their status is collected. It also covered signals as mechanisms for controlling processes, signal permissions, uncatchable emergency signals, effective user IDs, and the security implications of executing programs with unnecessary privileges. Process-monitoring tools including ps, pstree, top, htop and the /proc filesystem were demonstrated, followed by the start of a C example using fork and process identifiers.

The session introduced virtual memory, distinguishing it from physical memory and explaining how each process has an isolated virtual address space. It covered process memory layout, including code, data, heap, stack and mapped regions, together with dynamic allocation through malloc, brk and mmap, lazy allocation, copy-on-write, and common faults such as page faults, segmentation faults, stack overflows and buffer overflows. Students were shown how to inspect memory usage and mappings using /proc, including maps, smaps and status, alongside tracing tools. The session also covered Unix file permissions, inodes and file descriptors, file access through open, openat, read and write, and program execution through execve. Security considerations included time-of-check-to-time-of-use vulnerabilities, inherited file descriptors, deleted but still-open files, unsafe permissions and monitoring file-related system calls.

The session reviewed virtual-memory allocation, mmap and munmap, copy-on-write after fork, and the persistence of file descriptors, including access to deleted files and inherited descriptors. It also compared open with openat, explaining how directory file descriptors help reduce time-of-check to time-of-use risks. The teaching then introduced networking as a kernel-managed resource accessed through sockets and file descriptors, covering the socket lifecycle from creation and binding to connection, data transfer and closure. Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) were compared in terms of connection state, kernel tracking, reliability, resource use and security implications, alongside concepts of network attack surface and sandboxing. Practical demonstrations used ss and /proc network information to inspect listening sockets, ports, queues, protocol state, process ownership and socket inodes, followed by a client-server example using fork.

Case studies from aerospace, aviation, automotive software and operating systems introduced failures involving arithmetic overflow, exceptions, concurrency and incorrect assumptions. The class distinguished safety from security, examining why security can depend on properties such as the absence of runtime errors. Specifications, execution states and program semantics were explored through C examples involving uninitialised variables and floating-point rounding. The halting problem introduced a fundamental limit on automated reasoning. Testing, assisted proof, model checking, static analysis and bug finding were then compared for automation, soundness, completeness and scalability.

Confidentiality, integrity and availability framed the discussion of security problems. Sources and sinks described how untrusted inputs can reach dangerous operations, or confidential values can reach public outputs. Students examined non-interference: reasoning about what an attacker could infer about secrets from observable results. A small programming language made these questions precise through operational semantics, security labels and typing rules. Interactive exercises tested whether rules prevented explicit and implicit information flows, and considered controlled declassification—allowing particular high-security information to be released under defined conditions.

Abstract interpretation introduced a framework for computing sound approximations of program behaviour. Interval, octagon and convex polyhedral domains illustrated different balances between precision and computational cost. Geometric and sign-analysis examples showed abstract transformations, the joining of states at branches and widening to make loop analysis terminate. The session then applied abstraction to information-flow security through taint analysis. Assignments and conditional statements demonstrated how taints propagate, including implicit flows, and why a conservative approximation must account for behaviours that may occur.

Pysa, a Python static analyser, provided a practical setting for taint analysis. Untrusted Hypertext Transfer Protocol (HTTP) input acted as a source, while operations such as eval, exec and shell-command execution acted as dangerous sinks. Students examined configuration files defining sources, sinks and vulnerability rules, and read reports identifying affected files, locations and functions. Exercises extended configurations to detect remote code execution vulnerabilities. They also introduced sanitisers, allowing safe, validated input to be distinguished from tainted data within the analysis model.

Security type systems were examined through rules that could admit unintended information flows. Procedures with input and output parameters showed how an incorrect call rule could permit explicit or implicit leaks from high-security data into low-security variables. Exercises extended the problem to references and arrays, separating the security of locations, contents and indices. Students developed example attacks and discussed constraints that could repair the rules, including program-counter labels. The session ended with a small language intended to support further explanations of operational semantics, type systems and type-safety proofs.

Practical Pysa work examined sources, sinks and false positives in Python code using eval and exec. The session considered assertions that constrain untrusted input, including allow-listing arithmetic operators and numeric values. Students configured custom sanitisers and discussed how an incorrect declaration could hide a genuine vulnerability. Features attached to flows, inspected through Pysa’s configuration and its SAPP debugging tool, offered another way to examine reported paths. Exercises considered excluding flows carrying Boolean or numeric validation, making the justification for an exclusion part of the analysis.

Further exercises used Boolean and numeric features to filter false positives when tainted data reached a sink. Configuration of sources, sinks, features and rules included an analysis-depth setting that traded speed against precision. Students then explored automatic generation of Pysa models for a Django application, connecting untrusted request data to dangerous operations such as eval. Decorators introduced a further complication by concealing a path from request data to exec. Extending the model generator allowed this additional remote code execution risk to be detected.

The final session reviewed Pysa configuration, analysis runs and installation or configuration problems, emphasising the need to assess findings rather than trust them automatically. A reflected cross-site scripting exercise showed what happens when untrusted request data is returned in a response without sanitisation. Alongside this practical work, students completed information-flow type derivations. Sequencing, conditionals, loops, assignments, variables and constants were checked against typing rules and security-level constraints, connecting the tool-based analysis to the formal reasoning used to establish that a program was typeable.

The session introduced how programs are executed by operating systems before considering how to secure them. It distinguished programs, processes, services and threads, and explained process identifiers, permissions, user space, kernel space, memory layout, dynamic libraries, system calls and dynamic memory allocation in C. Students examined Linux process information through process IDs, memory maps in /proc, and system-call tracing with strace. They then used Windows tools including Process Explorer and Process Monitor to inspect processes, signatures, libraries, environment variables and network connections. The class also discussed how sockets connect programs across systems and how these observations can support investigation of suspicious software.

The session reviewed the use of Windows and Linux monitoring tools to observe file and process activity, including Process Monitor, Process Explorer, VMMap, strace, lsof and fuser. Students practised tracing a program’s file operations and identifying which processes were accessing a particular file, while considering the difference between a file on disk and its contents or temporary representation in memory. The class introduced file descriptors and editor-created temporary files, explaining why some open-file searches may not show the original file directly. It also covered Windows prefetch files as a source of evidence about programs that have already finished running, including execution paths, loaded libraries, running time and launch counts. Finally, system calls and Windows input/output request operations such as creating, reading, writing, querying and changing file information were introduced as indicators of program behaviour for later security analysis.

The session reviewed how to observe operating-system activity generated by scripts, using tools such as Process Monitor on Windows and Sysdig on Linux. It introduced the Windows Registry as a hierarchical key-and-value store, including registry providers, roots, keys, values and common value types. Students created, read and deleted registry values in PowerShell scripts, added delays for monitoring, and identified registry operations such as setting, querying and deleting values. The class then covered creating, querying, modifying and removing local Windows users and passwords with PowerShell, with emphasis on avoiding plaintext passwords and observing the resulting system activity. The forthcoming work on sockets, network activity and the use of isolated Windows and Linux virtual machines for safely examining executable behaviour was outlined.

The session revisited how resource use during program execution can support hypotheses in an investigation, with files and the Windows registry used as examples. System-call tracing on Linux and process monitoring on Windows were used to identify resources accessed by programs, while recognising that such evidence supports inferences rather than certainty. The class then introduced inter-process communication, distinguishing local communication through anonymous and named pipes from remote communication through sockets. Students were asked to create simple programs in which parent and child processes exchange messages through an anonymous pipe, then to explore named pipes between separate programs and observe the resulting system activity.

The session introduced virtual machines and sandboxes for observing potentially harmful code in isolated environments. It compared these with containers and discussed the limits of a shared host kernel as an isolation boundary. Students were shown an executable running in a sandbox and inspected file-system and registry effects, reporting observations rather than assuming knowledge of its source. A Linux exercise used a file-encrypting program as a behavioural-analysis case, with system monitoring intended to reveal the resources it accessed and changed.

The class continued a Linux file-encryption exercise, examining consistent key use and changes across files and subdirectories. Students observed file access and modification through system-call tracing and other monitoring tools. They were asked to document affected resources, directory structures and evidence in an analysis report, using those observations to form hypotheses about suspicious behaviour. A group-based Windows virtual-machine exercise was then introduced: inspect a supplied program safely, gather logs and screenshots, and produce an evidence-based assessment without reverse-engineering it.

The session introduced a forthcoming exercise on investigating program execution and comparing behaviour across sandboxed and virtual-machine environments. Students were asked to identify information available from a standard Windows user session that could be valuable for later attack preparation or defensive investigation, such as network details, shared directories and local system information. The class clarified that this task required an individual, simple written submission rather than code or a formal report. Guidance was also given on analysing suspicious programs without running them with elevated privileges, and on presenting analysis evidence with screenshots or other verifiable artefacts rather than unsupported written claims.

The session examined how malicious code can exploit Windows user permissions, including the distinction between standard-user activity, administrator-group membership and User Account Control. It demonstrated how an executable can be disguised with a folder-like icon and considered why antivirus software may block suspicious behaviour. Students reviewed malware categories including backdoors, ransomware, information stealers, miners, Trojans and rootkits, and considered command-and-control servers and data exfiltration. The class also explored Windows reconnaissance through network settings, environment variables, local users and groups, group policies, registry locations and firewall rules. Students continued a monitoring and reporting exercise and were assigned work on creating and analysing a stealer-like program in a controlled environment.

The class reviewed how malware behaviour can be investigated safely by using isolated virtual machines and monitoring tools. Students presented analyses of a sample executable, identifying browser-data collection, registry access, file creation and a startup registry entry that could provide persistence. The session explained how to distinguish relevant file reads, writes and registry modifications from normal operating-system activity, and how browser paths and files can reveal the types of data being targeted. Guidance was also given on documenting evidence with hashes, describing the contents and significance of accessed resources, and recognising the limits of behavioural analysis before reverse engineering.

The session introduced Windows-focused secure code execution, explaining why Windows client systems and Active Directory are common organisational targets. Students configured a second Windows virtual machine by creating a local administrator account, removing administrative membership from a standard account, and testing User Account Control password prompts. Safe execution of untrusted code was discussed through isolated virtual machines, disabled network and host-file sharing, disposable environments, and sandboxing, while warning that containers share the host kernel. The class examined Windows security principals, access tokens, security identifiers (SIDs), group membership, privileges, discretionary access control lists (DACLs) and access control entries (ACEs), and used PowerShell commands and Process Explorer to inspect process security contexts and permissions.

The session covered how to prepare and harden virtual machines for safer malware analysis, including network isolation, host-only networking, disabling shared clipboard, drag-and-drop, USB devices and unnecessary virtual-machine features. It compared virtual and dedicated physical analysis environments, explaining malware sandbox detection, the need for realistic conditions, command-and-control communication, and the difficulty of restoring physical machines to a trusted state. Students were shown how to transfer suspected malware safely by packaging it in a password-protected archive, checking file hashes, and restoring isolation before execution. An individual exercise required students to configure a hardened virtual environment, run their previous sample safely, and document findings in a structured malware-analysis report using the MITRE ATT&CK framework and evidence from analysis tools.

The session reviewed information-stealer analyses from isolated Windows virtual machines, including access to environment variables, command history, startup entries, recent documents and privilege information. Students discussed distinguishing visible child processes from activity through Windows interfaces, and reporting observed behaviour, network traffic and limitations. The class considered why access rights and security context can matter more than a simple file listing. A group exercise introduced a simulated phishing-delivered Trojan and controlled collection endpoint, with attention to documenting the execution chain and presenting the evidence clearly.

The session examined sandboxing as a method of isolating untrusted code from the host system, including the distinction between virtual machines, containers and lightweight browser sandboxes. It covered sandbox workflows, monitoring of files, registry changes and network activity, and the benefits and limitations of tools such as CAPE, including malware evasion, delayed execution and incomplete behaviour in isolated environments. Students were shown how VirusTotal can provide initial indicators, sandbox reports, behavioural information and threat classifications, while being reminded to validate findings through their own dynamic analysis using process-monitoring tools. Student activities included presenting analyses of disguised executable files delivered as apparent PDF documents and discussing incident indicators, containment and remediation. The next exercise introduced analysing a Word document containing macros that trigger or download a payload, with monitoring used to evidence the execution chain.

The session continued a group exercise on phishing-style Word documents carrying a Trojan stealer, including troubleshooting why downloaded PowerShell scripts and executables would not run in a virtual machine. Students discussed Windows execution policies, code-signing restrictions and the security controls that detect download-and-execute behaviour. Guidance was given on writing malware-analysis reports using evidence from dynamic analysis and VirusTotal sandbox results, then relating findings to the MITRE ATT&CK framework. Students were advised to state confidence levels for conclusions and to distinguish direct evidence from lower-confidence hypotheses. Rootless Docker was briefly introduced as a topic for later analysis-environment work.

The session introduced data engineering on AWS, focusing on the five Vs of data: value, veracity, volume, velocity and variety. It explained data pipelines, including extract, transform and load (ETL) and extract, load and transform (ELT) approaches, structured and unstructured data, and the choice between batch and streaming processing. AWS ingestion services were covered, including AppFlow for software-as-a-service data, DataSync for file transfers, and Data Exchange for third-party data. The class examined AWS Glue for data catalogues, crawlers, ETL jobs, schema management, data quality and handling sensitive information. Streaming tools including Kinesis Data Firehose, Kinesis Data Streams, managed Apache Flink and Kafka services were compared, alongside data lakes, data warehouses, Lake Formation, Athena, Redshift and OpenSearch.

Disaster recovery planning connected acceptable data loss and recovery delay with storage, computing, databases and networks. Backups, snapshots and cross-region replication were compared, including why replication alone does not protect against corruption. The class reviewed storage migration, lifecycle management and shared file services, then considered machine recovery, automatic scaling, load balancing and regional failover. Managed database recovery and repeatable infrastructure deployment added further recovery options. A guided hybrid-storage lab covered configuring storage, moving files to Amazon Simple Storage Service (S3) and replicating data into another region, connecting architectural choices with the mechanics of protecting and moving data.

The session completed the disaster recovery module by reviewing recovery point objectives (RPOs), recovery time objectives (RTOs), and the relationship between disaster recovery and business continuity planning. It covered AWS services and approaches for resilience, including S3 replication, Storage Gateway, Amazon Machine Images, snapshots, CloudFormation infrastructure as code, Route 53 health checks and failover. Four disaster recovery patterns were compared: backup and restore, pilot light, warm standby, and multi-site active-active, with emphasis on their cost, recovery speed and suitable use cases. Students worked through knowledge-check and exam-style questions on selecting the appropriate recovery pattern and AWS service for different scenarios. The session also introduced the certification exam structure, exam guide and practice-question resources.

Certification preparation used a modular study guide and short quizzes to identify topics needing further revision. The material revisited computing, storage, networking, databases and security, alongside name resolution, logging, resilience, performance and cost. Students were shown how quiz results could guide their study rather than treating every topic as equally familiar. Additional resources included hands-on AWS practice environments, an architecture project and configurable practice tests. The session concerned ways to prepare and assess understanding; the source does not establish completion of the project or an eventual certification result.

The session reviewed commonly misunderstood AWS concepts in preparation for an assessment. It covered service-level agreements, Elastic Compute Cloud (EC2) Auto Scaling, S3 durability, encryption and access logs, virtual private cloud (VPC) networking, network address translation (NAT) gateways, VPC peering, security groups and availability zones. It also compared relational databases with DynamoDB, explained Identity and Access Management (IAM) permissions and roles, and distinguished CloudWatch, CloudTrail and AWS Config for monitoring and auditing. Further topics included messaging with SNS and SQS, CloudFormation, caching, VPC flow logs, cost-allocation tags, SSL offloading, and gateway versus interface VPC endpoints. Practice-question answers were used to reinforce how to select appropriate AWS services for performance, security, scalability and cost management.

Networks were introduced as shared infrastructure connecting users, devices and applications. The class examined campus and wide-area design, including access, distribution and core layers, redundant links, switching and routing. Internet Protocol (IP) addresses, subnet masks and default gateways connected addressing decisions with the path a packet takes. Protocol layering explained how data is packaged and unpackaged during transmission, while reliable transport was compared with approaches suited to real-time traffic. Students built small computer, switch and router topologies in Packet Tracer, assigned addresses, tested connectivity with ping and inspected interfaces and learned hardware-address tables.

Students revised subnet calculations: usable host counts, block sizes, subnet masks and binary operations for finding network addresses. Configuration checks and ping tests helped establish whether hosts shared a subnet or needed a gateway. Internet Protocol version 6 (IPv6) introduced compressed addresses, address types, automatic configuration and coexistence with IPv4. Virtual local area networks (VLANs) then connected logical separation with access ports, tagged trunk links and routing between networks. Spanning Tree Protocol explained how redundant switches can avoid loops. A practical task asked students to build a virtual local area network (VLAN) and trunking topology with redundant switches and consider its protective settings.

The session covered multilayer (Layer 3) switches and their use for inter-VLAN routing, replacing a router-on-a-stick design with switch virtual interfaces (SVIs). Students built a Packet Tracer topology using VLANs, access ports, trunk links, EtherChannel, spanning tree configuration and VTP VLAN propagation. The class practised IPv4 subnetting, including usable host ranges, broadcast addresses, default gateways and /26 and /30 networks. Routing concepts were introduced through routing tables, directly connected and static routes, return routes, loopback interfaces, administrative distance, metrics, longest-prefix matching, floating static routes and default routes. The session also distinguished campus networks from WANs and introduced routing protocols, autonomous systems and the differing roles of internal and external routing.

The session covered configuring OSPF on routers, including network statements, wildcard masks, areas, router IDs, passive interfaces and default-route propagation. Students examined OSPF neighbour adjacencies, routing tables, link-state databases, equal-cost load balancing and troubleshooting commands for common configuration faults. A practical lab required building an OSPF topology, injecting a static default route, testing connectivity and observing rerouting after a link failure. The session then introduced network services including Dynamic Host Configuration Protocol (DHCP) and relay agents, Domain Name System (DNS), network address translation (NAT) and PAT, NTP, Syslog, SNMP and quality of service. Students also reviewed relevant verification commands and began configuring DHCP, NAT overload and NTP in a further lab setup.

A support session explained the assessed network lab, covering VLANs, trunk links, addressing and routing between networks. The brief included connectivity to an internet service provider, loop prevention and verification of blocked links. Address allocation, address translation, encrypted remote administration, port security and access control lists added service and security requirements. Students were advised to verify each configuration stage through diagnostic commands, routing tables, ping tests and captured evidence. A question-and-answer activity revisited subnetting, switching, IPv6 neighbour discovery, routing and automation. These were lab requirements and revision activities, rather than a record of every configuration having been completed.

The session introduced core cybersecurity concepts, distinguishing information security from cybersecurity and explaining prevention, detection and response. It covered the CIA triad of confidentiality, integrity and availability, along with risk management through assets, threats, vulnerabilities, controls and residual risk. Students discussed penetration testing, including scoping, reconnaissance, proof of concept, common vulnerabilities, exploits, payloads, zero-day vulnerabilities, Common Vulnerabilities and Exposures records and vulnerability-severity scoring. A digital-bank case study was used to identify important assets, associated threats and vulnerabilities, and to relate security priorities to business impact. The class also covered access control, multi-factor authentication, authentication, authorisation and accounting, and types of preventive, detective, corrective, deterrent, compensating and recovery controls.

The session examined network access-control mechanisms, including switch port security, 802.1X authentication, network access control lists (ACLs) and Cisco TrustSec. It explained MAC-address-based controls, DHCP snooping and Dynamic ARP Inspection as ways to limit unauthorised access and prevent rogue DHCP and ARP-poisoning attacks. The class compared VLAN segmentation, VLAN access maps, private VLANs and micro-segmentation, then discussed security group tags and downloadable ACLs for applying identity-based policy independently of network location. Students worked through a bank case study on moving from discretionary access control to role-based and attribute-based access control, incident isolation and recovery following ransomware, and interpreting true and false security alerts. The session also introduced symmetric and asymmetric encryption, hashing, and public key infrastructure (PKI) certificates for confidentiality, integrity and endpoint authentication.

The session reviewed how cryptography, PKI, certificates and revocation checks support confidentiality, integrity and authentication. It introduced IPsec virtual private networks (VPNs), including Authentication Header and ESP, transport and tunnel modes, and the performance implications of encryption. The class examined IKE phases, Diffie–Hellman key exchange, NAT traversal, and the distinction between site-to-site and remote-access VPNs using IPsec or SSL/TLS. Advanced VPN designs were compared, including DMVPN for scalable on-demand spoke connections and GET VPN for encrypting traffic over MPLS networks. Students began a Packet Tracer lab to configure an IPsec VPN, first using pre-shared keys and then public key infrastructure (PKI) certificates, IKE, IPsec profiles and virtual tunnel interfaces.

The session reviewed virtual private networks, IPsec and network address translation, distinguishing packet encapsulation from address replacement. It compared stateless access lists, stateful inspection and next-generation firewalls, including application identification, threat intelligence and encrypted-traffic inspection. Segmentation, demilitarised zones, jump servers, proxies and cloud-delivered security were considered alongside the limits of firewalls against command-and-control traffic and denial of service. Incident response and forensics introduced isolation, evidence preservation, disk imaging, write blockers, log correlation and reverse engineering. Students were asked to complete and document an IPsec lab and took part in a quiz on firewalling, address translation and access control.

The session reviewed access-control models, including discretionary, mandatory, role-based and attribute-based access control, along with 802.1X authentication and the roles of endpoints, authenticators and authentication servers. It revisited cryptography, public key infrastructure, certificates, digital signatures, certificate revocation, VPN types and the use of next-generation firewalls for inspection and segmentation. Security operations topics included incident response, threat hunting, digital forensics, evidence handling, write blockers, data recovery and the use of baselines to detect abnormal network behaviour. Students completed and discussed a quiz covering authentication, cryptography, firewalls, intrusion detection, malware, telemetry and forensic concepts. The class then introduced telemetry pipelines, model-driven telemetry, SNMP, NetFlow, data normalisation, SIEM-style analytics platforms, and network profiling through baselines, sampling and anomaly triggers.

The session covered the Diffie–Hellman key exchange, including public and private values, modular arithmetic, primitive roots, key derivation, man-in-the-middle risks, certificates and elliptic-curve variants. It then examined network telemetry and packet analysis, using Cisco FMC for correlation, NetFlow for connection data, TCPdump for packet capture and Wireshark for detailed inspection. Students learned to create network baselines for throughput, sessions and open ports, and to investigate anomalies through traffic mirroring, SPAN, packet capture and analysis. The class also explored TCP and UDP scanning, firewall behaviour, port exposure, and detection of suspicious long-lived connections, scans and abnormal inbound or outbound traffic. Finally, it introduced the cyber kill chain, MITRE ATT&CK and Diamond Model as complementary methods for understanding adversary behaviour, preventing attacks, investigating incidents and correlating campaigns.

The session reviewed the cyber kill chain, Diamond Model and MITRE ATT&CK as complementary frameworks for investigating incidents, linking evidence to adversaries, infrastructure, capabilities and victims. Learners completed and discussed exam-style questions on security concepts, including digital signatures, vulnerability scoring, firewall inspection and Cisco security tools. The extended Diamond Model was used to show how analysts can pivot from evidence such as command-and-control traffic to relevant infrastructure, tactics, techniques and procedures, and correlate related events. Adversary emulation was introduced as a way to test defences against the known behaviour of a particular threat group, using tools such as Caldera and Atomic Red Team. The class also began cloud-security identity topics, covering passwords, hashing and salting, multi-factor authentication, single sign-on and federated identity.

The session began with practice questions modelled on the Cisco CyberOps Associate examination, including exam format, timing and question types. It then introduced cloud computing, its benefits for scalability, pay-as-you-use costing and global access, and the main deployment models: public, private, community and hybrid cloud. The class examined shared responsibility in infrastructure, platform and software as a service, stressing that organisations remain accountable for their data, identities and security even when infrastructure is provider-managed. Cloud security risks discussed included multi-tenancy, hypervisor and container breakouts, metadata-service attacks, and the risks of relying on externally hosted critical services. The session also covered cloud-native development, DevSecOps and CI/CD, containerisation, microservices, container registries, Kubernetes orchestration, and serverless computing.

The session introduced Microsoft Purview as a data protection and compliance service for the SC-401 certification, distinguishing it from tools for endpoint, malware and network security. It covered shared responsibility in on-premises, infrastructure, platform and software as a service environments, emphasising that organisations remain responsible for their data, identities and devices. The class examined defence in depth, the confidentiality, integrity and availability triad, and Zero Trust principles, including explicit verification, least privilege and continuous monitoring. It explained the Purview sequence of sensitivity labels for classification, data loss prevention for enforcement, insider risk management for behavioural monitoring, and audit for investigation. It also compared how Purview applies to Exchange Online email, SharePoint document storage, Teams collaboration and OneDrive business storage.

The session used certification-style scenarios to practise distinguishing governance, risk and compliance functions and selecting suitable Microsoft Purview controls for privacy, healthcare and payment-card requirements. It covered sensitivity labels, data loss prevention, access control, audit logs, retention policies, encryption, endpoint controls and the importance of interpreting exam questions carefully, especially where they ask for a minimum requirement or primary action. The class introduced a data-centred protection approach: identify and classify data first, then apply labels, protection, loss-prevention controls and governance. It also explained Zero Trust principles, including explicit verification, least privilege and continuous monitoring, and considered risks from external sharing, insider mistakes, unmanaged locations and artificial intelligence use.

The session examined how Microsoft Purview detects sensitive data using built-in and custom sensitive information types, keyword dictionaries, exact data match (EDM) and document fingerprinting. It explained how custom detection patterns use regular expressions, supporting evidence, proximity and confidence levels to reduce false positives. Practical activities demonstrated creating and testing a custom sensitive information type, configuring an EDM schema, securely hashing and uploading sample data, and testing detection results. The session then covered sensitivity labels as content-based protection controls, including encryption, access permissions, visual markings, label groups, publishing policies, client-side and service-side auto-labelling, and the retirement of obsolete labels. It emphasised distinguishing detection by sensitive information types from protection through labels and policies.

The session reviewed how sensitivity labels should apply protection proportionately to business impact, balancing confidentiality with normal collaboration. It introduced Microsoft Purview Data Loss Prevention (DLP) as the control used to prevent sensitive data being shared, uploaded, copied or otherwise leaving approved environments, distinct from retention and backup. The class covered planning DLP with appropriate data classification, stakeholder input, simulation mode, phased pilots, policy tips, overrides and ongoing tuning through alerts and analytics. It also examined template versus custom policies, adaptive protection based on risk, cloud-app controls, network DLP, endpoint DLP for actions such as USB copying and printing, and browser-based enforcement for web and AI tools.

The session covered Microsoft Purview Insider Risk Management, which detects unusual patterns of behaviour by users who have legitimate access rather than automatically treating them as malicious. It explained the lifecycle of planning, connecting data sources, creating policies, investigating alerts and improving policies over time, with privacy safeguards such as pseudonymisation, role separation and least-privilege access. The class examined connectors for human-resources events, endpoint activity, browser activity, physical access records, healthcare audit logs and unmanaged cloud applications, including the roles of Microsoft Defender for Endpoint and Defender for Cloud Apps. It compared quick and custom policies, including scopes, indicators, triggers and thresholds, and explained the investigation workflow from indicators to risk scores, alerts, cases and human-led actions. Learners also completed knowledge-check questions on policy configuration, connectors, browser monitoring and the purpose of user dashboards.

The session covered how to investigate Microsoft 365 security and compliance incidents by distinguishing between audit logs for actions and timelines, and content search for finding emails, files and messages. It explained targeted investigation methods, including defining a time frame, filtering by user, workload, operation and object, and interpreting patterns in the context of behaviour and risk. Audit Standard and Audit Premium were compared, with emphasis on retention periods, permissions, exports and the need to preserve evidence securely. Content search, eDiscovery roles, query scoping, result validation and limited exports were discussed, including when a formal eDiscovery case is needed for legal or regulatory matters. The class also considered communication compliance for reviewing potentially harmful or inappropriate messages with sufficient surrounding context.

The session examined how Microsoft Purview compliance controls can be integrated to manage sensitive data, insider risk, retention requirements and data loss prevention across different industries and jurisdictions. It covered presenting security proposals to senior leaders through business impact, architecture, trade-offs and measurable outcomes, using scenario-based examples. The class then introduced artificial-intelligence security as a data-governance lifecycle: discovering artificial intelligence use and exposure, protecting prompts and outputs, governing generated content, and responding to risky behaviour. Learners reviewed Data Security Posture Management for AI, Activity Explorer, audit logs, sensitivity labels, DLP, browser and endpoint controls, retention, collection policies, eDiscovery, insider risk management, communication compliance and adaptive protection.

The session reviewed Microsoft Purview concepts for the SC-401 exam, focusing on recognising the action required in a scenario and selecting the appropriate tool. It covered sensitive information types, sensitivity labels and policies, auto-labelling, classification methods, encryption, the Information Protection Scanner, and the relationship between labels, DLP, retention and audit. Learners compared cloud and endpoint DLP, practised DLP policy design and rule precedence, and studied retention policies, labels, event-based retention and legal holds. The session also covered Insider Risk Management, adaptive protection, audit, content search, eDiscovery, Data Security Posture Management for AI, Shadow IT discovery and multi-tool investigation workflows. Students completed exam-style multiple-choice questions and case studies, with guidance on time management and interpreting common exam traps.

The session used a timed practice examination to develop exam technique, including identifying requirements, selecting appropriate security controls and managing time. It explained the format of Microsoft certification questions, including multiple-choice, drag-and-drop, hotspot, case-study and non-returnable series questions, as well as the use of practice assessments and exam sandboxes. A healthcare case study covered sensitivity labels, data loss prevention, endpoint and browser controls for preventing AI-related data exfiltration, insider-risk alert escalation, legal retention and deletion requirements, and extended audit retention. Further answer reviews covered custom sensitive information types using regular expressions, exact data match, auto-labelling, label policies, DLP testing and priority, retention-label precedence, HR connectors for departing-user risks, administrative units, adaptive protection and mailbox auditing.

The session compared the compliance architectures of Microsoft Purview, AWS, Google Cloud, Cisco and open-source tools, using the lifecycle of classifying, protecting, enforcing, monitoring, investigating and proving compliance. It explored data classification, DLP, audit logging, eDiscovery, insider-risk monitoring, AI governance and the strengths and limitations of each platform. Students worked through practical scenarios involving multi-cloud DLP, hospital compliance, insider-risk monitoring and the costs and trade-offs of open-source solutions. The class also covered a 90-day plan for a first compliance deployment, including discovery, stakeholder engagement, policy simulation, phased enforcement, metrics, exception handling and communication. Finally, it discussed European digital sovereignty, GDPR, NIS2, DORA and the EU AI Act, alongside approaches for presenting compliance recommendations to senior leaders.

The session introduced security operations analysis, contrasting the configuration of security controls with the operational work of detecting, investigating and responding to incidents. It covered the roles of Microsoft Defender extended detection and response (XDR) and Sentinel, including incident correlation, incident investigation, automated attack disruption, automation rules, playbooks, advanced hunting and Kusto Query Language (KQL). The class examined attack models including the Cyber Kill Chain, MITRE ATT&CK and the PREPARE–ENTER–TRAVERSE–EXECUTE model, alongside protection for email, identities, cloud applications and endpoints. Students were introduced to a team-based adversarial exercise in which they were asked to design attacks and corresponding detection, response and telemetry controls.

The session completed Microsoft Purview coverage by explaining eDiscovery for scoped, auditable content searches, legal holds and evidence exports, alongside Audit Standard and Premium, log retention, and investigations of user activity. It then covered Microsoft Defender for Endpoint, including deployment and device onboarding, endpoint telemetry, attack surface reduction rules, device timelines, behavioural detection, device containment, live response, entity investigation, automation, alert tuning, indicators of compromise and vulnerability management. Students considered how endpoint security supports prevention, detection, investigation, response and risk-based remediation, including integrations with Intune and Conditional Access. The session also introduced Microsoft Defender for Cloud, distinguishing cloud security posture management from cloud workload protection, and covered connecting Azure, on-premises, AWS and GCP resources, secure scoring and security recommendations.

The session introduced Kusto Query Language (KQL) for threat hunting and detection engineering in Microsoft Sentinel. It covered selecting appropriate log tables, filtering and aggregating events, setting detection thresholds, and identifying behavioural anomalies such as brute-force attempts, lateral movement and insider data exfiltration. Students learned KQL pipeline operators including where, extend, summarise, project, render, union and join, as well as parsing text and JSON data and creating reusable functions. They completed exercises arranging KQL query fragments to build detections for failed logons, unmatched logoffs and unusual privileged activity. The session also covered Microsoft Sentinel deployment, workspace architecture, access roles, data retention tiers, watchlists, threat intelligence, and its integration with Microsoft Defender extended detection and response (XDR).

The session examined how Microsoft Sentinel turns collected log data into alerts through analytics rules, including scheduled, near-real-time, anomaly, fusion and threat-intelligence rules. It covered automation rules and Azure Logic Apps playbooks, distinguishing simple incident-property changes from multi-step responses involving external systems. Students explored incident management, entity investigation, user and entity behaviour analytics (UEBA) baselines, Advanced Security Information Model (ASIM) data normalisation, workbooks, alert severity, and the trade-off between false positives and false negatives. Activities used security scenarios to practise selecting severity, containment actions, escalation routes, and the appropriate automation approach. The session also reinforced KQL filtering and pipeline logic for designing precise, efficient detection queries.

The session used a red-team versus blue-team capstone exercise to apply security operations concepts across an insider-threat attack chain. It examined detection gaps involving valid accounts, internal SharePoint data staging, mailbox forwarding rules, anonymous sharing links, sensitivity labels, data loss prevention (DLP), KQL query scope, telemetry, automation rules and playbook-triggered containment. The class compared attacker techniques with defensive detection rules, highlighting the importance of monitoring normal-user behaviour, avoiding overly narrow role-based filters, and understanding business and administrative processes. The afternoon introduced assessment deliverables for an individual scenario, including telemetry architecture, KQL-based detection rules, severity and escalation models, automated response logic and an attack timeline, alongside SC-200 exam preparation.

The session introduced cybersecurity through physical security, secure system design and the importance of planning security controls early. It examined software-update lifecycles, vulnerabilities, exploit value, mass surveillance risks and the security implications of physical access to devices. Students used a virtual machine to create a memory dump after a failed web login, extract readable strings, locate credentials in memory, and use regular expressions and CyberChef to transform data. The class also covered symmetric and asymmetric encryption, public and private keys, certificate authorities, and the role of trust in encrypted web connections. Further examples illustrated how memory modification, malicious USB devices and keystroke injection can compromise systems.

The session examined social engineering and phishing, including how attackers impersonate brands through misleading URLs, fake applications, adverts and artificial-intelligence-generated content. Students learned to identify the genuine domain within a URL, recognise typosquatting and subdomain deception, and understand how phishing pages can evade automated detection through obfuscation. The class compared authentication methods, covering strong unique passwords, password managers, multi-factor authentication, passkeys and hardware security keys, with emphasis on phishing-resistant FIDO2 (Fast Identity Online) authentication. It also covered wireless threats such as evil-twin access points, physical attacks on devices and firmware, data-at-rest encryption, and the use of BitLocker or FileVault to protect stored data. Practical activities included analysing password recovery from video, considering cloned-audio scams, and resetting a local Windows password in a virtual machine to demonstrate the importance of disk encryption.

The session introduced FTP as a file-transfer protocol and compared command-line FTP with the FileZilla graphical client. Students used Wireshark to capture network traffic, inspect packets, and observe that unencrypted FTP credentials can appear in clear text, whereas Transport Layer Security (TLS) protects data in transit. The class examined denial-of-service concepts, including bandwidth saturation, packet flooding and socket exhaustion, through controlled demonstrations using ping, hping3 and Slowloris. It also covered the MITRE ATT&CK and D3FEND frameworks, Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) identifiers, and Common Vulnerability Scoring System (CVSS) scores for assessing vulnerabilities and their impact.

The session reviewed network reconnaissance: identifying an Internet Protocol (IP) address range, finding active hosts with ping sweeps, scanning exposed services with Nmap, and selecting appropriate tools to interact with those services. It demonstrated how anonymous FTP access, weak passwords and excessive permissions can expose files and enable unauthorised access, alongside the principle of least privilege and password-strength considerations. The class explored credential attacks and defences, including word lists, online and offline password cracking, stronger authentication, virtual private networks (VPNs), port knocking and canary accounts. It also covered local-network interception techniques, including name-resolution poisoning, Address Resolution Protocol (ARP) cache poisoning and man-in-the-middle attacks, plus the use of Wireshark and defensive monitoring. Finally, it introduced open-source intelligence, advanced search modifiers, subdomain discovery, cloud-hosted services and Shodan for identifying internet-exposed assets.

The session examined why some software vulnerabilities are difficult to eliminate at scale, including memory-corruption flaws, Rowhammer and the move towards memory-safe languages such as Rust. It discussed ransomware as a criminal business model, including encryption, data theft, double extortion, negotiation and money laundering. Students used CyberChef to practise data extraction with regular expressions and to explore Base64 encoding, Advanced Encryption Standard (AES) encryption, entropy and frequency analysis. The class also considered how phishing sites imitate legitimate services and how users can identify them by checking context, urgency and domain names.

The class introduced cryptography and its main goals: confidentiality, integrity, authenticity and non-repudiation. It distinguished encryption and decryption from hashing, explaining the role of keys, salts, certificates, digital signatures and encrypted-transport protocols. The session also clarified that encoding, including Base64 and URL encoding, is intended for data representation rather than security. Students practised manually converting text into Base64, including binary grouping and padding, then began writing Python command-line scripts to encode and decode Base64 and to correct URL encoding behaviour.

The session introduced block-based symmetric encryption, contrasting it with encrypting data character by character. It compared electronic codebook (ECB), cipher block chaining (CBC), cipher feedback (CFB) and output feedback (OFB) modes, focusing on the use of blocks, shared keys, XOR operations, initialisation vectors and chaining between ciphertext blocks. The class considered the security and performance implications of these modes, including visible patterns in ECB and the sequential processing required by CBC. It also covered the Data Encryption Standard (DES) and Triple DES, explaining key sizes, the weakness of DES’s 56-bit key, and the encrypt–decrypt–encrypt process used in Triple DES. Students were set a Python exercise to encrypt and decrypt a text file using the four block cipher modes and to save the key and resulting files.

The class reviewed a Python exercise using Triple DES in electronic codebook (ECB), cipher block chaining (CBC), cipher feedback (CFB) and output feedback (OFB) modes, confirming that decryption restored the original plaintext and comparing the sizes of encrypted files. It contrasted symmetric encryption, where the same secret key must be shared for encryption and decryption, with asymmetric encryption, which uses a public key for encryption and a private key for decryption. The session explained how public-key encryption supports secure message exchange, the risks of public-key interception, and the role of digital signatures in verifying authenticity and integrity. Students were introduced to common asymmetric algorithms including RSA, DSA and ECC, then assigned a practical RSA exercise simulating a sender, receiver and shared directory for exchanging a public key and encrypted message.

The session reviewed hash functions, focusing on the fixed output length produced by each algorithm and the fact that even small changes to an input produce a completely different hash. Students ran scripts to compare hash outputs for different messages and considered how this supports data-integrity checking. The class then introduced hybrid encryption, combining symmetric encryption for efficient message encryption with asymmetric encryption for securely sharing the symmetric key. Students corrected the sequence of actions in a hybrid-encryption exchange, identifying that the sender encrypts the symmetric key with the receiver’s public key and the receiver decrypts it with their private key. A Python exercise was set to implement this hybrid-encryption process using public keys, an encrypted message and an encrypted symmetric key.

The session introduced database security as the protection of data and systems against malicious activity, including denial-of-service attacks and threats to confidentiality, integrity, availability and traceability. It distinguished database types, explained protection of data at rest and in transit, and outlined authentication, authorisation, least privilege, backups, governance and risk management. The class examined Linux file systems as a form of data storage, covering users, groups, read/write/execute permissions, ownership, access control lists and special permissions such as setuid, setgid and the sticky bit. Students completed a practical lab using a virtual machine to manage Linux users, groups and custom access policies. The later section introduced system hardening, including mandatory access control, strong authentication, software patching, firewalls and reducing the attack surface.

The session introduced authentication as the process of verifying identity before access is granted, and distinguished it from authorisation within access control. It covered operating-system, database and web authentication, including passwords, single sign-on and tokens. Different authentication approaches were compared, including single-factor and multi-factor authentication, biometrics, Secure Shell (SSH) public-key authentication, session-based authentication and JSON Web Tokens. Security practices included password policies, account lockouts, session expiry, secure cookies, monitoring authentication logs and mitigating brute-force, phishing, man-in-the-middle and credential-stuffing attacks. Students began a practical lab using Docker, GitHub and a web application to implement authentication.

The session introduced the security of data in transit, explaining how encryption protects confidentiality and integrity and helps prevent interception and man-in-the-middle attacks. It compared symmetric encryption, which uses one shared key and is efficient for large volumes of data, with asymmetric encryption, which uses public and private keys and supports secure key exchange and identity verification. The class examined how Transport Layer Security (TLS) combines both approaches during the HTTPS handshake, including certificate validation and the establishment of a symmetric session key. It also considered when encryption is essential, such as for sensitive data and authentication information, and when its performance and key-management costs may make it unnecessary. Students were directed to complete a Docker-based practical lab on the material.

The session introduced SQL injection as the manipulation of database queries through unsafe handling of user input. It compared vulnerable string-built queries with parameterised queries and prepared statements, alongside input validation, sanitisation and least-privilege access. Other database-security controls discussed included limits on query resources, monitoring, patching, backups, secure configuration, network protections and incident-response planning. Students examined common SQL injection patterns, including authentication bypass, union-based extraction and time-based blind injection, before beginning a practical lab.

The session introduced big data as data that cannot be stored or processed effectively by a single machine, focusing on volume, velocity and variety. It explained distributed systems, horizontal and vertical scaling, clusters and nodes, along with the benefits and challenges of distributing computation across networked machines. The consistency, availability and partition tolerance (CAP) theorem was used to compare consistency, availability and partition tolerance in distributed data storage. The Hadoop ecosystem was outlined, including Hadoop Distributed File System (HDFS) for storage, Yet Another Resource Negotiator (YARN) for resource management, and processing tools such as MapReduce and Spark. Students began a practical activity by connecting securely to a Hadoop edge node through Secure Shell (SSH) and practising basic Linux command-line use.

The session reviewed distributed systems, Hadoop HDFS and YARN, including master, worker and edge nodes, replication, fault tolerance and high availability. It distinguished online transaction processing (OLTP) from online analytical processing (OLAP) systems and compared databases, data lakes, data lakehouses and data warehouses, including atomicity, consistency, isolation and durability (ACID) properties. The class introduced Apache Hive as a data-warehouse tool built on HDFS, using HiveQL and execution engines to query stored data. It covered external versus managed Hive tables, row-based and columnar file formats, Hive partitioning, and the bronze, silver and gold stages of the medallion architecture. Students then began practical Hive exercises creating and querying external and managed tables, including use of ORC files.

The session reviewed core big-data concepts, including the three Vs, data types, horizontal versus vertical scaling, networking risks and the CAP theorem. It covered Hadoop’s main components: HDFS for distributed block storage, YARN for cluster resource management, and MapReduce for distributed processing. The class examined how HDFS splits and replicates files, why small files create metadata overhead, and why processing should be located with the relevant data blocks where possible. MapReduce was introduced through a word-count example, explaining map, shuffle and sort, reduce, network communication, and disk-based fault tolerance. Students then worked on Hadoop-based Python MapReduce word-count exercises and began designing a MapReduce job from scratch.

The session reviewed distributed-system reliability, including single points of failure, standby NameNodes, split-brain scenarios, leader election and ZooKeeper heartbeats. It compared MapReduce and Spark, covering disk-based versus memory-based fault tolerance, resilient distributed datasets, transformations and actions, lazy evaluation, and narrow versus wide transformations and shuffles. The teaching then introduced Spark DataFrames and Spark Structured Query Language (SQL) as higher-level, more readable alternatives to low-level resilient distributed dataset (RDD) programming, explaining schemas, the Catalyst Optimiser and the benefits of explicitly defining schemas for large production data sets. Students began a practical Docker-based Jupyter lab using New York City taxi data to explore DataFrame operations, SQL queries and joins, with exercises requiring work in both PySpark and Spark SQL.

The session introduced real-time event streaming, distinguishing unbounded streams from bounded datasets and comparing hard, soft, near-real-time and batch processing requirements. It reviewed stream-processing concepts including event time versus processing time, windows, triggers and watermarks, and strategies for refining aggregated results. The class then examined Kafka as an event-streaming platform, covering events, producers, consumers, brokers, topics, partitions, offsets and consumer groups. It explained partitioning by round-robin allocation or message keys, replication through leaders and followers, producer acknowledgements and delivery guarantees, and leader election using KRaft rather than ZooKeeper. Students were asked to deploy a Kafka cluster in containers, run a consumer, and optionally process streamed events with Python, Spark or an extract, transform and load (ETL) service.

The session reviewed OLAP and OLTP workloads, row-based and columnar file formats, the medallion architecture, Apache Spark, and Kafka’s publish-subscribe model. It introduced Apache NiFi as a tool for managing data flows and compared ETL, extract, load and transform (ELT) and light-transformation loading pipelines. The class covered NiFi’s security, scalability, delivery guarantees, data provenance and lineage, clustering, registry-based version control, and core components including flow files, processors, connections, funnels and process groups. It also considered why NiFi is best suited to moving data and carrying out light transformations rather than heavy processing. Students began a practical Docker-based lab to build, version and document a basic NiFi data flow.

The session reviewed Apache NiFi as a tool for building ETL and ELT data flows, contrasting transformation before loading with transformation after loading into a data lake. It covered NiFi architecture, including flow files, metadata attributes, content, provenance, repositories, processors, controller services and clustering. The class demonstrated the NiFi interface, process groups, ports, funnels, connections, relationships, queues, back-pressure thresholds, load balancing and debugging. It also explained scheduling, retry and penalty behaviour, parameter contexts, expression language, and version-control alternatives following the planned retirement of NiFi Registry. Students were assigned sequenced labs to build increasingly complete pipelines, culminating in consuming Kafka streams with NiFi, transforming the data, and loading cleaned results into PostgreSQL.

The session reviewed distributed cluster roles and introduced four security principles: identification, authentication, authorisation and encryption. It explained how LDAP, Kerberos, Apache Ranger, Knox and Atlas can support identity management, ticket-based access, role-based permissions, gateway access and governance in Hadoop ecosystems, with comparisons to cloud-native tools. The class then compared file, block and object storage, focusing on object storage features such as buckets, metadata, flat namespaces, immutability, S3-compatible application programming interfaces (APIs) and storage tiers. Software-defined storage, MinIO, Ceph and erasure coding were discussed as ways to provide scalable, resilient cloud storage. Students were assigned a lab to deploy MinIO in Docker and create and manipulate object-storage buckets.

Operational technology was compared with information technology through industrial controllers, operator interfaces, sensors and supervisory systems. Architecture models introduced segmentation and controlled exchanges between business and industrial networks. Safety, availability and real-time constraints shaped the discussion, alongside long equipment lifecycles. Incident examples highlighted weak asset inventories, unpatched systems, insecure remote access and poor account management. The session therefore placed security controls within the physical and operational setting in which an industrial system has to continue functioning.

Asset mapping and risk analysis framed physical and logical access controls for industrial equipment. Cabinets, ports, accounts and engineering stations were considered together. Patches needed compatibility testing against production systems, while application allow-listing offered an alternative where conventional protection was unsuitable. The class examined segmentation, filtering, logs and tightly controlled remote access. These measures were discussed in relation to industrial constraints, rather than assuming that a control appropriate for an office computer could be applied unchanged to every device.

Maintenance in operational condition introduced availability, reliability and cost across hardware, software and industrial assets. Lifecycle and logistics approaches provided context for preventive and corrective work. Systematic, condition-based and predictive maintenance were compared through planning, sensors, analysis and documentation. Temporary and permanent repairs raised questions about downtime and continuity. The risks of over-maintenance were also considered, keeping attention on the consequences of intervention as well as the consequences of allowing a fault to remain unresolved.

Reliability and maintainability measures introduced mean time between failures, mean time to repair and availability calculations. Five Whys, Pareto analysis and the Maxer method offered ways to investigate and prioritise causes. Maintenance-management systems were discussed alongside their integration with wider enterprise and security systems. The class also considered technologies such as digital twins, augmented reality and remote maintenance. These examples connected measurement and investigation with the records and tools used to organise maintenance over time.

Middleware was introduced as software connecting applications, with application servers hosting application logic. The class compared their role with web-server delivery before examining misconfiguration and code-related weaknesses. Exposed administration, default credentials, verbose errors and insecure uploads illustrated different points of exposure. Cookie settings, cross-origin controls and encrypted transport were also discussed. Practical work was planned in isolated virtual machines, establishing a controlled setting for examining these issues rather than testing them against services belonging to others.

Cross-site scripting introduced the risk of untrusted input becoming executable content in a user's browser. Reflected and stored forms were distinguished, alongside consequences involving sessions and data. Validation, sanitisation and cookie attributes were discussed as controls with different roles. Students inspected browser developer tools and began an authorised exercise with a deliberately vulnerable application, observing requests and stored input. Cookie inspection connected the browser's behaviour with response attributes, while the discussion also considered secure transport and actions performed within a user's session.

Cross-site request forgery examined how an authenticated browser action can be induced through an unintended route. SQL injection then introduced the different problem of input changing a database query. Parameterised queries and restricted database privileges were discussed among mitigations. The class also distinguished forms of privilege escalation and remote shell connections. Practical setup began for Tomcat in a virtual machine using a non-root account, connecting the vulnerability discussion with the permissions under which an application service runs.

Tomcat error responses were examined for disclosure of server details. Configuration-file permissions introduced another exposure path, particularly when files contain credentials, while lockout settings addressed repeated authentication attempts. Students practised generic error handling at server or application level, including custom pages and redirects. They were then asked to select misconfigurations in their own isolated environments, examine the impact and apply corrections. The sequence connected observing a weakness with understanding and changing its underlying configuration in the lab.

Hardening covered service-account privileges, file permissions and removal of unnecessary examples or management applications. Access to Tomcat administration was considered through roles, credentials and network restrictions. Demonstrations introduced encrypted web connections using certificates and a Java keystore, along with protocol checks and redirection. Credential storage and the shutdown connector were also examined. Students were asked to apply these measures to their configurations in preparation for an audit exercise, rather than the session being presented as a completed audit.

The session introduced monitoring and detection in industrial environments, beginning with security principles including least privilege, need to know, segregation of duties, data lifecycles and service level agreements. It explained event-log management, covering timestamps and clock synchronisation, storage, rotation, centralisation, archiving, protection and the gradual development of a useful logging baseline. Syslog was examined as a common logging protocol, including message structure, priorities, severity, facilities, transmission limits and examples from industrial equipment. The class compared security information management, security event management and security information and event management (SIEM) functions, and considered centralised and multi-site logging architectures. It also explored the constraints of industrial monitoring, including legacy equipment, differing operational technology (OT) architecture levels, passive network detection, physical access, safety versus security culture, and relevant European cybersecurity requirements.

The session reviewed the design of secure centralised logging architectures for IT and industrial control environments, including server sizing, redundancy, log sources and risk-based decisions. It covered monitoring the event-collection chain, preserving native log formats, and choosing between real-time or scheduled transfers, push or pull collection, and reliable protocols such as TCP. Secure log transmission using TLS, certificate management, bandwidth control, server hardening and network segregation were discussed. The class also examined log storage, indexing, rotation, retention periods, access controls, outsourcing considerations and collection from mobile devices. Practical examples demonstrated configuring a central syslog service and enabling secure log forwarding from industrial controllers, network equipment and machine tools.

The session reviewed secure centralised monitoring architectures, including log collection, access control, storage, network security and the role of a security operations centre. It introduced incident response as a process comprising preparation, detection and analysis, containment, eradication, recovery, and post-incident review, drawing on NIST, ISO and European guidance. The class examined industrial network security components such as next-generation firewalls, field firewalls, managed switches, network address translation, segmentation and industrial demilitarised zones. It also covered passive industrial monitoring sensors, their placement in OT networks, anomaly detection through baselining, asset discovery, vulnerability correlation and the distinction between sensors and intrusion detection systems. Recovery planning included backups, testing restorations, replacing compromised equipment, collecting evidence and communicating factual findings to management.

The session examined detection strategies for industrial control systems, including infrastructure equipment and industrial equipment such as PLCs, sensors, actuators, HMIs and SCADA systems. It compared signature-based and anomaly-based detection, using network traffic, extracted files and event logs to identify malicious activity, abnormal values, unauthorised access and suspicious configuration changes. The class considered the limitations of legacy industrial assets and the need to involve operational specialists when assessing whether process values are abnormal. It also introduced security dashboards, distinguishing operational metrics from strategic key performance indicators and explaining how dashboards should be tailored to their audience, purpose and reporting frequency. Key measures included mean time to detect, identify, repair and restore services, alongside guidance on using reliable, documented and reproducible indicators.

The session linked industrial cybersecurity detection practices to regulatory and standards requirements. It covered NIS2 expectations for compliance monitoring, incident handling, logging, event classification, incident response, post-incident reviews, malware protection and vulnerability management. The class examined requirements for asset logging, time synchronisation, alarm thresholds, log protection, reporting, documented roles and regular testing of procedures. It also considered the French NIS2 implementation guidance, the Machinery Regulation, the Cyber Resilience Act and IEC 62443 requirements for audit trails, centralised logging, integrity and continuous monitoring. A short knowledge-check activity reviewed security dashboards and artificial-intelligence use cases.

The session introduced information security governance, risk and compliance, distinguishing contextualised information from raw data and explaining the relationship between information security and cybersecurity. It covered the CIA triad of confidentiality, integrity and availability, alongside controls such as access control, encryption, hashing and backups. Key security principles included least privilege, defence in depth, separation of duties, accountability, risk-based decision-making, security by design and zero trust. The class examined governance, risk and compliance (GRC) roles, risk identification and treatment, compliance obligations, policy hierarchies, the three lines of defence, assurance levels, and shared responsibility across on-premises, infrastructure, platform and software as a service services. Students began a scenario-based activity on planning the first 90 days of a newly appointed information security leader at a multinational renewable-energy company.

The session reviewed core GRC and information-security concepts, including levels of assurance, risk as a threat exploiting a vulnerability on an asset, ISO 27001 and ISO 27002, and the four families of security controls. It explained cloud shared responsibility through an infrastructure-as-a-service example and distinguished information security from cybersecurity. Students developed a high-level business, technical and data view of a fictitious energy company, identifying systems, sensitive data, identity management, external integrations and likely high-value assets. The class considered relevant legal, regulatory and contractual obligations, including GDPR, PCI DSS, NIS2, the AI Act and customer security requirements, and linked security objectives to business strategy. It also introduced information security management system (ISMS) scoping, statements of applicability, risk registers and the risk-management process, with students identifying ransomware, data breaches, phishing and denial-of-service attacks as example risks.

The session reviewed PCI DSS, including the payment ecosystem, the value of network segmentation in reducing cardholder-data scope, version 4.0.1, and the distinction between PCI DSS and ISO 27001 certification. It examined GDPR as a privacy regulation, covering consent, data-subject rights, controllers and processors, security measures proportionate to risk, third-party accountability, breach notification, and financial penalties. The class also covered the EU AI Act’s risk-based categories, including prohibited, high-, limited- and minimal-risk systems, alongside requirements for oversight, transparency, security and conformity assessment. NIS2 was introduced as a directive aimed at cybersecurity resilience in critical sectors, with risk-management, supply-chain, governance and rapid incident-reporting requirements, while SOC 2 reports were compared with compliance certificates as more detailed audit evidence. The session concluded by introducing incident response and crisis management, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.

The session introduced social engineering as an attack vector that manipulates people into disclosing information, taking actions or bypassing security controls. It distinguished social engineering from purely technical attacks and examined common forms including phishing, smishing, business email compromise, impersonation, fake technical support and artificial-intelligence-generated deepfakes. The class considered why human decision-making can be exploited, focusing on stress, urgency, authority, scarcity, trust, reciprocity and social compliance biases. Real-world examples and quizzes were used to identify the psychological levers used in scams and to discuss their financial, operational and reputational consequences. The session also stressed legal and ethical limits on testing, the importance of reporting suspected manipulation without blaming victims, and the need to pause, verify and think critically.

The session analysed real-world social-engineering attacks involving phishing, fake GitHub security requests, fraudulent recruitment, QR-code scams, account takeover and ransomware targeting hospitals. Students identified warning signs such as urgency, secrecy, mismatched domains, suspicious links, requests for credentials or tokens, and impersonation of trusted contacts or authority figures. The class examined possible visual clues to deepfakes, including unnatural skin texture, symmetry, lighting, shadows and facial details. A demonstration showed how an adversary-in-the-middle phishing site can capture a session identifier and bypass the practical protection offered by multi-factor authentication. The session also covered technical mitigations, including email filtering, sender authentication, attachment and link analysis, behavioural detection, artificial-intelligence-supported monitoring and appropriate access controls.

The session introduced the course structure and its aim of preparing students to participate in or lead data science projects. It contrasted traditional, waterfall-style project management with agile approaches, explaining time-boxed sprints, sprint reviews, retrospectives, planning and visual task boards. A project was defined as a temporary undertaking with a unique objective, a defined timescale and required resources, distinguishing it from routine operations. The class also examined product and sprint backlogs, prioritisation, team commitment, transparency and measuring progress. Business cases, break-even points, return on investment and the need to reassess a project when business conditions change were introduced.

The session began with sprint planning and reflection, using completed work and team capacity to agree a realistic commitment for the next sprint. It covered project vision statements, the limitations of AI-generated content, and the need to understand project-management concepts well enough to assess artificial intelligence (AI) outputs critically. Key traditional project-management concepts included the triple constraint of scope, time and cost; project life-cycle phases; uncertainty, risk and the rising cost of change; and the Project Management Institute (PMI) waterfall framework, including project charters, planning, resources, communication, procurement and stakeholder management. Students practised preparing elements of a project charter and assigning stakeholder roles through a responsible, accountable, consulted and informed (RACI) matrix, then discussed stakeholder power and influence. The class also covered Gantt charts, task estimation, S-curves, earned value, cost and schedule variance, key performance indicators (KPIs), and the Plan-Do-Check-Act cycle.

The session used a simulated sprint review, retrospective and planning exercise to demonstrate approval of completed work, velocity tracking, forecasting and commitment to a minimum sprint scope. It introduced Agile values from the Agile Manifesto, stressing individuals and interactions, working software, customer collaboration and responding to change whilst recognising the continuing value of plans, documentation and contracts. Agile and waterfall approaches were compared in terms of fixed constraints, planning, suitability for different levels of uncertainty, stakeholder involvement and regulated environments. The class examined timeboxing, incremental delivery, technical debt, minimum viable products, proof of concepts, product backlogs, prioritisation and Agile contract models. It also covered the roles of the product owner, Scrum Master and self-managing cross-functional teams, followed by a scenario activity, quiz and video on Agile product ownership.

The session showed how an agile backlog can be adapted as new information emerges, using prioritised user stories and changing investigation scenarios to illustrate this process. It emphasised the importance of direct, timely communication for agile teams, particularly where teams are distributed. Agile software development practices included automated testing, continuous integration and delivery, code standards, collective code ownership, technical-debt reduction, and responsible use of AI-assisted programming. The class then introduced scaled agile working through Scaled Agile Framework (SAFe), including Agile Release Trains, programme increments, programme increment (PI) planning, cross-team dependencies, and the roles of product manager, Release Train Engineer and system architect. It also considered how agile delivery can be connected with wider business strategy and product value.

The session introduced cybersecurity fundamentals through physical and digital attack surfaces, showing how weak design, unnecessary functionality and delayed security updates can create vulnerabilities. It covered threats affecting devices, networks and users, including exploit chains, rogue wireless access points, phishing, social engineering, hardware tampering, skimming and unauthorised memory access. The class compared authentication methods and explained why phishing-resistant FIDO2 security keys, unique passwords and password managers provide stronger account protection than reusable passwords, SMS codes or manually entered tokens. Students also examined signs of artificial-intelligence-generated identities and discussed reducing digital exposure, checking breach notifications and protecting personal data. A practical exercise asked students to access files from a password-protected Windows virtual machine.

The session covered reconnaissance as the first phase of penetration testing, including identifying an organisation’s external attack surface before vulnerability research, exploitation and privilege escalation. Students used internet-mapping and search tools to find publicly exposed hosts, remote-desktop services, cameras, web assets and shared favicons, while considering the limits and freshness of different data sources. The class practised domain and subdomain enumeration through Domain Name System (DNS) look-ups, search-engine queries, brute forcing, certificate-transparency logs and attempted DNS zone transfers. It also introduced ProjectDiscovery tools for collecting subdomains, identifying web technologies and scanning ports, followed by discussion of using software versions, changelogs and CVE sources to research known vulnerabilities. Finally, the session explained TCP three-way handshakes and compared SYN scanning with full TCP connect scanning in Nmap.

The session compared passive network listening with active scanning, using Wireshark and Nmap to identify hosts, services and operating-system information in a lab network. It explained FTP, including anonymous access, unencrypted credentials, password brute forcing, and the use of Nmap scripts and Hydra to test a lab FTP account. Students examined troubleshooting methods by inspecting network traffic and adjusting scanner time-out settings. The class identified security weaknesses including clear-text FTP, weak passwords, missing multi-factor authentication and excessive file-system privileges, and discussed the principle of least privilege. It also demonstrated, in the lab, Windows persistence via startup folders and the creation and handling of a reverse Meterpreter payload using Metasploit.

The session practised data transformation and analysis in CyberChef, including Base64 and decimal decoding, URL decoding, identifying zlib compression through file signatures, XOR brute-forcing, entropy analysis, and regular expressions for extracting structured data. It then introduced desktop application security audits, covering audit types, the stages of an audit, test versus production environments, evidence collection, and report preparation. Common Weakness Enumeration entries were used to identify vulnerability categories, while the Common Vulnerability Scoring System (CVSS) was explained as a method for scoring severity according to exploitability and impact. Students set up a virtual-machine toolkit and examined a local inventory application, using file-type detection and string extraction to identify a hard-coded master password. Guidance was also given on organising audit evidence and writing professional vulnerability reports with screenshots, exploitation steps, risk scores, and remediation advice.

The session continued a security audit of a desktop inventory application, identifying insecure configuration secrets, weak and plaintext passwords, excessive database privileges, missing password masking, unlimited login attempts and broken role-based access control. Students used Wireshark to inspect loopback traffic and confirmed that database queries and sensitive data were transmitted without encryption. SQL injection was demonstrated in login and search functions, including Boolean-based authentication bypass and UNION-based extraction of usernames and passwords. Operating-system command injection, dynamic-link library (DLL) side-loading and network traffic tampering were explored using Process Explorer, Process Monitor and an interception tool, alongside discussion of how to document evidence for a penetration-testing report. The next web-application audit was introduced, including configuration of a local hostname in Kali Linux.

The class continued a web-application penetration test by inspecting page source and identifying a concealed web shell that allowed operating-system commands to be executed. Students practised using Windows command-line tools to download and run a payload, then configured a listener to receive a reverse connection. The session examined insecure client-side surveillance-camera authentication, including reversible password obfuscation, hard-coded shared credentials, missing session management and authentication bypasses. It also covered username enumeration, directory discovery through fuzzing, exposed backup files, password cracking, SQL error disclosure and potential SQL injection. Finally, the class discussed secure password storage using unique salts, repeated hashing and modern password-hashing algorithms such as bcrypt, Argon2 and yescrypt.

The session reviewed a web-application penetration-testing exercise, including web shells, reverse shells, client-side authentication flaws, user enumeration, directory listing, weak password storage and unrestricted login attempts. It demonstrated business-logic manipulation, stored cross-site scripting, cookie theft and protections such as HttpOnly, Secure and SameSite cookie attributes. SQL injection was explored manually through UNION queries and database metadata, then automated with SQLMap to enumerate and extract database contents. Further web risks covered temporary-file exposure, local file inclusion, log poisoning and arbitrary file upload. The session then introduced digital forensics and incident response, covering volatile-data capture, containment decisions, chain of custody, disk imaging, timeline construction, and live analysis using memory dumps, process inspection, persistence checks, network monitoring and rootkit detection.

The session covered Windows forensic artefacts, including Prefetch files, registry hives, scheduled tasks, the Recycle Bin, browser databases, UserAssist entries, thumbnail caches and alternate data streams. It explained how file deletion usually marks file-system metadata rather than immediately erasing data, and how inodes, clusters, slack space and MACB timestamps support file recovery and forensic interpretation. Students used forensic tools to inspect Firefox history and downloads, view registry and thumbnail-cache data, create and verify a logical disk image, and mount evidence safely. The class also introduced Autopsy, PhotoRec, Sleuth Kit tools and timeline creation from file-system metadata. Linux disk-image investigation was demonstrated using partition identification, read-only mounting, and examination of configuration files, logs, home directories and shell history.

The session covered forensic handling of disk images, including listing partitions, calculating mount offsets, mounting evidence read-only with execution disabled, and creating file-system timelines using FLS and MAC time. It introduced memory forensics with Volatility, covering operating-system identification, process enumeration, process trees, process scanning, virtual address descriptors, handles and network artefacts. Students practised identifying suspicious processes by examining their names, parent processes, file paths, start times, memory contents and network connections, then related memory evidence to disk-based artefacts. The class also introduced malware categories, common delivery methods, static and dynamic malware analysis, antivirus detection approaches, safe sample handling, sandboxing and useful analysis tools.

The session covered static and dynamic malware analysis using isolated virtual machines, with emphasis on safely restoring clean snapshots and disconnecting external network access. Students examined processes, network connections, persistence mechanisms, mutexes, memory strings, hooks and imported APIs using tools including Process Explorer, Process Hacker, Detect It Easy, PE Studio, Procmon and a debugger. The class reverse-engineered .NET malware to identify encrypted configuration data, anti-analysis checks, persistence through scheduled tasks or registry run keys, and command-and-control settings. It also demonstrated fake network services for observing malware communications, tracing process trees and file activity, identifying information-stealing behaviour, and decoding a weak XOR-obfuscated configuration file.

The session focused on setting up an isolated ethical-hacking lab in VirtualBox. Students configured a network using network address translation (NAT), installed Kali Linux and Windows Server 2016 virtual machines, assigned static Internet Protocol (IP) addresses, enabled shared folders and took snapshots for recovery. The Windows Server was prepared as a deliberately vulnerable practice target by enabling SMBv1, disabling selected security controls and installing web and mail-server services. Students configured MailEnable and Thunderbird accounts to test local email delivery, and were introduced to the course structure, including reconnaissance, scanning, exploitation, malware, web testing and defensive-evasion topics.

The session introduced the MITRE ATT&CK framework, including tactics, techniques, procedures, threat groups, cyber threat intelligence and the Enterprise, Mobile and ICS matrices. It reviewed ethical hacking concepts, attacker categories, advanced persistent threats, insider threats, penetration-testing approaches and the importance of legal, ethical and communication skills. The class covered information assurance, security frameworks, policies, risk management, quantitative and qualitative risk assessment, and incident-response processes from detection through recovery and post-incident review. It then began reconnaissance and enumeration, covering passive and active footprinting, open-source intelligence (OSINT) sources, website metadata, domain records, search techniques, Internet archives, Shodan, Censys, Maltego and theHarvester. Students were shown how to set up a virtual machine and use theHarvester with application-programming-interface-based data sources.

A diagnostic Certified Ethical Hacker quiz revisited network protocols, injection, memory flaws, privilege escalation and social engineering. The session then examined email headers, sender-authentication checks, reply-to anomalies and attachments, using threat-intelligence and sandbox tools to assess indicators. Open-source intelligence work considered public exposure, account aliases and privacy settings. Active reconnaissance introduced network ports, handshakes, discovery and service fingerprinting, alongside firewall-evasion concepts. In virtual-machine activities, students used Wireshark and Nmap to compare discovery traffic with a firewall enabled and disabled, inspect packet fields and examine address-resolution caching. The work connected findings from different tools with the underlying traffic rather than treating a scan result as self-explanatory.

The session covered using Nmap to identify open ports, service versions and operating-system information, with particular attention to FTP, SMB and Redis services. Students practised FTP enumeration, anonymous access, listing directories, downloading files and interpreting FTP response codes. They then used SMB client commands to list accessible shares, connect to them and retrieve files. The class also explored Redis enumeration and database commands, before working through a web-application vulnerability scenario involving a React/Next.js service, reverse shells, SQLite database inspection, password-hash cracking, SSH access and Linux privilege-escalation enumeration with LinPEAS. Students were advised to use documentation, manual pages, search tools and penetration-testing reference resources to develop a systematic methodology.

The session reviewed cybersecurity conference topics, including securing Microsoft Entra ID and Microsoft 365 tenants, managing authentication tokens, conditional access, and tools for assessing cloud configurations. It also covered the security implications of Windows shortcut files, Linux persistence mechanisms, web vulnerabilities, and drone firmware restrictions. Students then repeated a controlled penetration-testing exercise against a practice machine: identifying a vulnerable web application, gaining an initial shell, extracting and cracking a weak password hash, and accessing the system through SSH. The class practised manual Linux privilege-escalation enumeration, including checking user privileges, kernel details, listening ports, scheduled tasks and running processes, before using an automated enumeration tool and exploiting an exposed Node.js debugging service through SSH port forwarding.

The session involved a practical ethical-hacking lab using Kali Linux against Windows Server and Metasploitable virtual machines. Students used Nmap to identify open ports and services, enumerate protocols including SMB, FTP, NFS and RPC, and apply relevant NSE scripts. They used Metasploit modules to investigate services, configure remote and local host settings, manage sessions, and compare results across the two target machines. The class also discussed documenting commands, options, outputs and troubleshooting steps methodically, including the use of global variables and script arguments. Known vulnerabilities and the importance of verifying target versions, payload settings and module suitability were also covered.

The session covered enumeration and security considerations for NTP, VoIP/SIP, IPsec VPNs, IPv6 DNS and BGP, including the use of network-scanning and packet-analysis tools. It explained vulnerability scanning, common vulnerability types, scan methods and limitations, result categories such as false positives and false negatives, and sources of vulnerability intelligence including CVE and CVSS data. The class then introduced system-hacking concepts including exploitation stages, privilege escalation, buffer overflows, exploit chaining, reverse shells and post-exploitation activity. Practical demonstrations used Metasploit, search tools and Netcat to identify vulnerabilities, obtain a controlled remote session, inspect processes, transfer files and begin a lab exercise involving web reconnaissance and injection testing.

The session covered local DNS resolution using hosts files and custom DNS records, followed by path traversal, local file inclusion and remote file inclusion vulnerabilities in web applications. Practical exercises demonstrated capturing authentication hashes in a controlled environment, identifying hash formats, cracking passwords with wordlists, and accessing Windows systems through remote management services. The class then examined Linux and Windows credential storage, including passwd and shadow files, SAM databases, NTDS.dIT, password salts, cracking methods, rainbow tables and password-spraying concepts. Students also practised analysing packet captures in Wireshark to identify credentials exposed by unencrypted protocols such as FTP and Telnet.

Students practised reconnaissance of a target, including port scanning, domain and virtual-host enumeration, and using local host mappings. The class demonstrated exploiting an openly accessible cloud storage bucket by listing its contents, uploading a PHP web shell, executing commands, and comparing web shells with reverse shells. Malware concepts covered droppers, stagers, downloaders, polymorphic and metamorphic malware, remote-access trojans, fileless malware, command-and-control infrastructure, and staged versus non-staged payloads. The session also covered malware analysis and detection methods, packet sniffing, network attacks such as MAC flooding, DNS poisoning and DHCP starvation, and social-engineering techniques and defences. Students completed quiz questions on malware analysis, TCP traffic capture, Wireshark interpretation, SSL stripping, port spanning and network attacks.

The session covered broken access control in web applications, including insecure direct object references, horizontal and vertical privilege escalation, and the risks of relying on user-controlled parameters, cookies or hidden fields. Practical exercises used web-security labs to discover unprotected administrative functions through robots.txt, JavaScript-disclosed endpoints and manipulated cookie values. The class also practised finding other users’ identifiers and accessing account data by altering request parameters. Path traversal and local file inclusion were introduced, with examples of using file-path manipulation and encoded payloads to access unintended server files. Learners used Burp Suite to scope targets, inspect web traffic, alter requests and analyse responses during the exercises.

The session practised cross-site request forgery attacks against vulnerable email-change functions, including automatically submitted HTML forms, request-method manipulation, missing token validation and tokens not bound to user sessions. Students used an intercepting proxy and an exploit-hosting server to inspect requests, adapt payloads and test mitigations. The class then introduced server-side request forgery, covering access to local services, internal network scanning, metadata exposure and the use of request tools to identify internal administration interfaces. Finally, it covered insecure file uploads, including web shells, filename-extension bypasses and content-type spoofing, with practical exercises to retrieve a protected file in a lab.

Students practised decoding ASCII and Unicode strings, cracking Windows LM and NT hashes, and working with MD5 hashes using CyberChef, Hashcat, John the Ripper, wordlists and password-mangling rules. The session also covered Caesar ciphers as monoalphabetic substitution ciphers, including testing letter shifts to reveal plaintext. Cryptographic failures in web applications were introduced through the OWASP Top 10, including weak or obsolete algorithms, insecure transport, certificate problems and missing HTTPS protections. Students then examined JSON Web Tokens, their header, payload and signature components, and common weaknesses such as unverified signatures, the “none” algorithm and weak signing keys. They completed guided web-security labs involving JWT modification and authentication-bypass scenarios in a controlled practice environment.

The session practised exploiting a deliberately vulnerable machine, including identifying SQL injection, using SQLMap, gaining a shell, retrieving credentials from web application files, connecting via SSH, and escalating privileges through an improperly permitted editor binary. It then introduced API penetration testing, covering endpoint discovery, API documentation, HTTP methods, authentication, request bodies, JSON and XML content types, and the use of Burp Suite tools for investigation. Practical API exercises demonstrated modifying requests, identifying hidden endpoints, manipulating product prices, and testing mass-assignment weaknesses. The class also covered defensive API design, including restricting methods and updateable fields, validating content types, protecting documentation, and using non-revealing error messages. Finally, server-side parameter pollution was introduced, including truncating, injecting and overriding parameters in internal API requests.

Students continued practical ethical-hacking labs, including work on Windows targets and Active Directory enumeration, with attention to synchronising system time for domain-related tools. The session compared wireless-testing hardware, including a Wi-Fi antenna and a specialised rogue-access-point device, and introduced the capabilities and limitations of a multi-tool device for NFC, radio-frequency, infrared and GPIO functions. Practical physical-security topics covered pin-tumbler lock operation and basic lock-picking practice on a training lock. A USB keyboard-emulation device was demonstrated using a harmless script, alongside discussion of how scripted keystrokes can automate commands. Wireless-testing setup was also introduced, including drivers, monitor mode, processes that can interfere with a wireless interface, and use of a tool that automates Wi-Fi reconnaissance and attack workflows.

The session introduced the legal, ethical and geopolitical issues raised by data and artificial intelligence, emphasising that regulation varies across jurisdictions and societal contexts. It explored why artificial intelligence (AI) and data engage areas including data protection, liability, intellectual property, constitutional law, international law and discrimination. Students considered the limits of using AI in legal decision-making, including predictive systems for human-rights cases, balancing legal certainty and efficiency against human interpretation and the evolving nature of law. The class also examined definitions of AI, the distinction between narrow and general AI, calls to regulate future technological risks, and the possible legal personhood of robots. A case discussion considered arguments for and against a conversational robot inheriting an owner’s assets.

The session examined the development and purpose of the European Union (EU) AI Act, including tensions between innovation, competitiveness, sovereignty, public regulation and private ethical codes. It distinguished legal obligations from voluntary ethical commitments, explaining why enforceable rules and sanctions are significant. The class explored the Act’s risk-based model, covering prohibited, high-risk, limited-risk and minimal-risk AI systems, alongside the duties imposed on providers and other actors. It also considered the Act’s extraterritorial reach, exclusions such as military and research uses, enforcement mechanisms, regulatory sandboxes, and the particular rules for general-purpose AI models. Students discussed practical difficulties in assessing risks to fundamental rights, democracy and human dignity, as well as potential conflicts between European and international regulatory approaches.

The session introduced data protection law through discussion of children’s data, profiling, algorithmic bias and the limits of consent in digital services. It examined why data protection is important for AI, comparing the European rights-based approach with the more sector-specific approach in the United States. The class covered privacy as a broader concept than information control, including dignity, intimacy, home and communications, and considered the EU Charter rights to privacy and personal-data protection. It then introduced the General Data Protection Regulation (GDPR), including personal data, identifiable natural persons, processing activities, material and territorial scope, and the basic obligations on organisations processing data. Students discussed examples involving health data, policing, profiling, data transfers and cross-border services.

The session examined GDPR data-subject rights in AI systems, including access, rectification, erasure, restriction of processing, portability and objection, and explained privacy by design across training and deployment. It considered how biased datasets and algorithmic design can create or reinforce discrimination, and discussed fairness, auditing, impact assessments and ethics by design. The class then introduced the EU Data Act, its application to data from connected products and related services, its relationship with the GDPR, and rules on user-led data sharing, competition, gatekeepers, contracts, compensation and dispute resolution. The final section used neurotechnology to explore mental privacy, brain data, cognitive liberty, and the need for ethical and legal safeguards against misuse by companies or governments.

The session examined the ethical, legal and professional responsibilities of scientists and data specialists in relation to autonomous lethal weapons and AI used in conflict. It considered the limits of existing regulation, particularly the military exemption in the AI Act, and debated whether emerging technologies should be regulated or prohibited before they are fully developed. The class compared arguments for and against autonomous weapons, including meaningful human control, bias, accountability, international consensus and historical preventive bans on certain weapons. It also discussed whether advanced AI systems merely imitate reasoning or might develop forms of understanding or consciousness, and considered the implications for law and responsibility. Finally, the session explored corporate due diligence, value-chain oversight and contractual controls through examples of technology companies supplying tools that may be used for immigration enforcement, surveillance or defence.