Module 02Fundamentals2 weeks

Fundamentals

Build the baseline IT and cybersecurity literacy that every later module assumes you already have — covering core IT concepts, foundational cybersecurity vocabulary, personal awareness training, and operational security habits.

Learning outcomes

Understand core IT fundamentals relevant to cybersecurity work
Know foundational cybersecurity vocabulary used throughout the rest of the programme
Understand common social engineering and awareness risks
Understand operational security (OPSEC) principles and apply them personally

What this module covers

IT fundamentalsCybersecurity basicsAwareness trainingOperational security

Lessons

2 weeks

Lesson 1IT Fundamentals — What a Security Professional Needs to Know

Cybersecurity sits on top of IT — you can't secure a system you don't understand. This lesson covers the baseline IT literacy assumed from this point forward in the programme.

Operating systems — basic familiarity with both Windows and Linux environments, since security work regularly involves both; Linux specifically because many security tools run natively on it
Networking basics — what an IP address is, the difference between public and private IP addresses, what a port is, and a basic understanding of how devices communicate over a network (this is deliberately kept introductory here — full network analysis is covered in depth in Module 4)
The command line — basic comfort navigating a terminal on both Windows (Command Prompt/PowerShell) and Linux (Bash), since a significant portion of security tooling is command-line based, not graphical

Teaching point

Frame this lesson honestly as a baseline, not mastery — the goal isn't to turn you into a systems administrator, it's to ensure you have enough IT literacy that the cybersecurity concepts layered on top of it (starting later in this very module) make sense, rather than being taught in a vacuum.

Lesson 2Cybersecurity Basics — Core Vocabulary

This lesson builds the shared vocabulary used throughout the rest of the programme — terms that will be used constantly from Module 3 onward without being re-defined each time.

Term	Meaning
Vulnerability	A weakness in a system that could potentially be exploited
Exploit	A method or piece of code that takes advantage of a vulnerability
Threat	A potential danger that could exploit a vulnerability (could be a person, a piece of malware, or a natural event)
Risk	The likelihood and impact of a threat actually exploiting a vulnerability
Attack surface	The total set of points where an attacker could try to gain access to a system
CIA Triad	Confidentiality, Integrity, Availability — the three core goals of security: keeping data private, keeping it accurate/unaltered, and keeping it accessible to those who need it

The CIA Triad deserves extra emphasis

It becomes a recurring reference point across the entire programme — nearly every security concept from here forward can be understood as protecting one or more of these three properties. A data breach is a confidentiality failure. A website defacement is an integrity failure. A ransomware attack that locks legitimate users out is an availability failure. Asking “which part of the CIA Triad does this affect?” is a genuinely useful analytical habit worth building now.

Lesson 3Awareness Training — The Human Element

A significant proportion of real-world security incidents don't start with a sophisticated technical exploit — they start with a person being tricked. This lesson introduces the human side of security risk, which gets covered in much greater depth later (Module 3 touches reconnaissance techniques that often target human information), but needs foundational coverage here since it shapes so much of what follows.

Social engineering — manipulating people, rather than systems, into giving up access or information
Phishing — fraudulent messages (usually email) designed to trick someone into clicking a malicious link, downloading malware, or revealing credentials
Pretexting — creating a fabricated scenario (a fake identity, a false urgent situation) to manipulate someone into an action they wouldn't otherwise take

Frame this directly and memorably

Technology can be patched, but human judgment under pressure is a permanent attack surface that never fully closes. This is why “awareness training” exists as an entire professional discipline within cybersecurity — organizations invest heavily in training employees precisely because the most sophisticated technical defenses can be undone by one person clicking the wrong link.

Lesson 4Operational Security (OPSEC)

Operational Security (OPSEC) is the practice of protecting information about your own operations, habits, and systems from being discovered and used against you — originally a military concept, now a core cybersecurity principle applied at both organizational and individual levels.

Identify what needs protecting — not everything is equally sensitive; OPSEC starts with knowing what information, if exposed, would actually cause harm
Think like an adversary — consider what an attacker could learn by piecing together seemingly harmless, individually public information (this connects forward directly to Module 3's reconnaissance techniques, which is fundamentally about exactly this kind of information-gathering)
Minimize unnecessary exposure — apply this personally: oversharing on social media, reusing information across accounts, or using predictable patterns all widen an individual's own attack surface

Make this personal

Consider your own digital footprint directly. How much could someone learn about you, your habits, or your organization just from publicly available information? This personal framing makes OPSEC concrete rather than abstract, and sets up the hands-on activity below.

Guided hands-on activity

Controlled environment

Environment Setup and Personal OPSEC Review

1.Part 1 — Set up a basic Linux environment (e.g., a virtual machine running a security-focused distribution) that will be used for hands-on labs in later modules.
2.Practice basic command-line navigation: moving between directories, listing files, creating and editing a simple text file, using both Windows Command Prompt/PowerShell and Linux Bash.
3.Confirm comfort with basic networking concepts by identifying your own device's IP address and distinguishing it from a public IP address.
4.Part 2 — Search your own name and any public social media profiles as an outsider would see them.
5.Make a list of what a stranger could learn about you — location patterns, employer, family members, daily habits — purely from public information.
6.Identify at least three pieces of exposed information that could realistically be tightened (privacy settings, oversharing habits, reused usernames) and note what changing them would involve.

Teaching point

Success criteria: a working Linux lab environment is set up and basic command-line navigation is demonstrated, and a genuine, specific personal OPSEC review has been completed — not a generic list, but one reflecting your own actual digital footprint.

Knowledge Check

Multiple choice • instant feedback

Question 1 of 6

What does the “I” in the CIA Triad stand for, and what does it refer to?

Mark Module 2 complete