Foundations (Lessons 1–10)
Lesson 1 --- Attacker Economics
- Attackers seek scale and profit.
- Most attacks are automated.
- Threat model: Who? Why? Capability?
Lesson 2 --- Internet Layers
- NAT and firewalls block unsolicited inbound traffic.
- An open port does not imply compromise.
- Most attacks start from outbound trust.
Lesson 3 --- Trust
- Attackers steal trust more often than they break into systems.
- Phishing dominates because it’s cheap.
Lesson 4 --- Passwords & MFA
- Unique passwords matter more than complex ones.
- A password manager reduces the blast radius.
- MFA greatly increases attacker cost.
Lesson 5 --- Malware
- Malware needs installation, permissions, and persistence.
- Modern OSes constrain malware.
- Spyware exists but is usually reserved for high-value targets.
Lesson 6 --- Browser Security
- The browser is today’s operating environment.
- Sessions are more valuable than passwords.
- Keep extensions minimal.
Lesson 7A --- Defensive Calm
- Focus on Identity, Recovery and Hygiene.
- Good security should reduce mental load.
Lesson 7B --- Hands-on Curiosity
- Observe before concluding.
- Wireshark shows reality.
- Nmap shows exposure, not compromise.
Lesson 7C --- Attacker Thinking
Attack pipeline:
- Discover
- Enumerate
- Exploit
- Persist
- Monetize
Most attacks fail before exploitation.
Lesson 8 --- Security Map
Four layers:
- Infrastructure
- System
- Identity
- Human / Trust
Always classify before reacting.
Lesson 9 (planned)
- Meaning of “being hacked” and precise terminology.
Lesson 10 --- Security Media
- Headlines omit conditions.
- Distinguish security from security theater.
- Framework: Map → Classify → Discount → Act (or Ignore)
Calm Rules
- Not every vulnerability is your vulnerability.
- Protect identity first.
- Observation beats imagination.
- Security should reduce anxiety.