Ethical Hacker & Cyber Defence

Ilaria Digital School

Become a cybersecurity specialist, from scratch to professional penetration testing: understand systems and networks, attack ethically within an authorised scope, defend, investigate and secure development. Skills: Master the mathematical foundations of computing and cryptography; Understand computer and operating system architecture, administer Linux; Design and analyse a network; Program in Python and optimise algorithms; Secure an information system; Design and query a database; Use artificial intelligence in attack and defence; Test the security of web and mobile applications; Carry out a complete penetration test and its report; Conduct a digital forensic investigation; Analyse malware; Develop securely; Integrate security into continuous integration and deployment; Analyse risks and audit an organisation's security. Workshops take place in your isolated lab, on training targets and samples you install yourself; no real system is touched, and the data you need is provided.

Play

Open in

214 episodes
Avg 15 min
English

Episodes 214

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Monday · 15 min
Snapshots: going back after a mistake
What a snapshot is and why you need one You have created your first Linux virtual machine (VM) in your virtualisation software. You will soon break it, and that is normal. You will install the wrong package, misconfigure the network, delete a system ...
Sunday · 15 min
Choose and download a security-focused Linux distribution
What a security-focused Linux distribution is You now have virtualisation software installed on your computer. The next step is to choose the operating system (OS) that will run inside your first virtual machine (VM). In cybersecurity, that OS is alm...
Friday · 15 min
Virtualisation: running several computers inside yours
What virtualisation is and why your lab depends on it In the previous activity, you saw why an ethical hacker always trains in a lab and never on a real system. You now need the technology that makes this lab possible on a single laptop: virtualisati...
Friday · 15 min
Why a lab: training without ever touching a real system
The lab answers the authorisation problem In the previous activities, you learned one central rule. The only difference between a penetration test and an attack is written authorisation from the owner of the system, within a defined scope. This rule ...
November 4 · 15 min
Cybersecurity jobs: attacking, defending, investigating, auditing
Four families, one shared incident In your previous activities, you followed an incident from start to finish: someone attacks, someone detects and responds, someone investigates, and the organisation then fixes its weaknesses. Each of these moments ...
November 3 · 15 min
Scope and rules of engagement: what you are allowed to test
From authorisation to scope In the previous activities, you learned that the only difference between an ethical hacker and an attacker is authorisation. Authorisation alone is not enough, though. An authorisation always applies to something precise: ...
October 30 · 15 min
The legal framework: what the law forbids and what written authorisation allows
Why the law is your first tool In the previous activity, you saw that the only thing separating an ethical hacker from a criminal is authorisation. This lesson explains what that means in law. The commands, tools and techniques used by a penetration ...
October 30 · 15 min
Ethical hacker: the difference between testing and attacking is authorisation
Same techniques, opposite status In the previous activities you studied attackers, their motivations, attack families and how an incident unfolds from intrusion to investigation. Here is the key idea of this lesson. An ethical hacker uses exactly the...
October 28 · 15 min
Attack, defence, investigation: an incident from start to finish
Why follow an incident from start to finish You already have the basic vocabulary of cybersecurity. You can tell a threat from a vulnerability and a risk. You know who attacks and why, and which property of confidentiality, integrity and availability...
October 27 · 15 min
Attack families: phishing, malware, intrusion, denial of service
Phishing: attacking the human You now know how to name a threat, a vulnerability and a risk. You know who attacks and why, and which property is hit: confidentiality, integrity or availability (the CIA triad). This lesson adds the missing piece, whic...
October 23 · 15 min
Confidentiality, integrity, availability: what security protects
Why security needs a clear target In the previous activities you learned to separate a threat, a vulnerability and a risk, and you met the attackers who exploit them. One question remains: what exactly is damaged when an attack succeeds? Cybersecurit...
October 22 · 15 min
Analyse three well-known cyberattacks using this vocabulary
Core Concepts Recap You have recently learned the crucial difference between threat, vulnerability, and risk. A threat is a potential cause of an unwanted incident, like a hacker. A vulnerability is a weakness in a system, such as outdated software. ...
October 22 · 15 min
Who attacks and why: attacker profiles and motivations
Why you must know your attacker In the previous lesson, you learned to separate three words: a threat is what can cause harm, a vulnerability is the weakness that harm exploits, and a risk combines the likelihood of an attack with its impact. This le...
October 21 · 15 min
Threat, vulnerability, risk: three words not to confuse
Why these three words matter In the welcome activity, you saw that cybersecurity protects information and the systems that carry it. To do that job, professionals use a precise vocabulary. Three words come up in every meeting, audit report and penetr...
October 21 · 15 min
Welcome: what cybersecurity is for, and the computer you need
Welcome to the Ethical Hacker and Cyber Defence course. You are starting from scratch, and that is fine. By the end of this path you will understand how systems and networks work, how attackers think, how defenders respond, and how to carry out a com...
September 23 · 15 min
Red thread 2 — Model and document the threats of a Weather API
Context You are hired as a junior security analyst for a startup that publishes a public REST **Weather API**. This API exposes endpoints such as `GET /weather?city=`, `GET /forecast?lat=&lon=`, `POST /users` (registration), `POST /login` (authentica...
September 23 · 15 min
Model documentation and versioning best practices
Threat modeling is only useful if the results are captured, shared, and kept up to date. A threat model that lives in someone's head or in an outdated diagram provides no value to the team. This chapter explains how to document a threat model properl...
September 23 · 15 min
Getting started with OWASP Threat Dragon on the Blog project
THEORETICAL RECAP Threat modeling is the structured practice of identifying, communicating, and understanding threats and mitigations within the context of protecting an application. OWASP Threat Dragon is a free, open-source tool that lets you draw ...
September 23 · 15 min
Tools for modeling threats — Threat Dragon, Draw.io, others
Threat modeling is only as effective as the tools you use to draw, document, and share it. Up to now, you have learned the concepts: confidentiality, integrity and availability (the CIA triad), the STRIDE categories, attack surface analysis, security...
September 22 · 15 min
Adapting the checklist to a third party public API
THEORETICAL RECAP A security test checklist derived from a threat model is not a fixed artifact: it must be adapted to the specific context of the target. A third-party public API differs sharply from an internal service. Key definitions: a 'third-pa...

Showing 1–20 of 214 episodes