Ethical Hacker & Cyber Defence

Ilaria Digital School

Become a cybersecurity specialist, from scratch to professional penetration testing: understand systems and networks, attack ethically within an authorised scope, defend, investigate and secure development. Skills: Master the mathematical foundations of computing and cryptography; Understand computer and operating system architecture, administer Linux; Design and analyse a network; Program in Python and optimise algorithms; Secure an information system; Design and query a database; Use artificial intelligence in attack and defence; Test the security of web and mobile applications; Carry out a complete penetration test and its report; Conduct a digital forensic investigation; Analyse malware; Develop securely; Integrate security into continuous integration and deployment; Analyse risks and audit an organisation's security. Workshops take place in your isolated lab, on training targets and samples you install yourself; no real system is touched, and the data you need is provided.

Play

Open in

214 episodes
Avg 15 min
English

Episodes 214

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

September 4 · 15 min
STRIDE method — description and examples
The STRIDE method is a structured approach to threat modeling. It was developed at Microsoft to help teams systematically identify the ways an application or system can be attacked. You have already studied why we model threats, how to break an appli...
September 3 · 15 min
Break down the simplified Blog application into components
THEORETICAL RECAP Threat modeling always starts with understanding what you are protecting. Before you can identify threats, you must decompose the application into its components. A component is any distinct part of the system that stores, processes...
September 3 · 15 min
Why model threats? Benefits and key steps
Threat modeling is a structured way of thinking about what can go wrong with an application before attackers find out for you. In the previous activities, you learned about assets (things worth protecting), the Confidentiality, Integrity and Availabi...
September 1 · 15 min
Associate risk scenarios with OWASP Top 10 (maps)
THEORETICAL RECAP The OWASP Top 10 is a consensus-based, regularly updated list of the ten most critical web application security risks. It is not a checklist of individual bugs but a set of risk categories, each grouping many concrete weaknesses. Th...
September 1 · 15 min
Light introduction to OWASP Top 10 (risk vision)
The OWASP Top 10 is a reference document published by the Open Worldwide Application Security Project, a nonprofit foundation dedicated to improving software security. This document lists the ten most critical security risks for web applications. It ...
August 31 · 15 min
Classify CIA impacts on Todo List assets
THEORETICAL RECAP The CIA triad describes three security properties every asset can require: Confidentiality (only authorized parties can read the data), Integrity (data cannot be altered or destroyed without authorization or detection), and Availabi...
August 31 · 15 min
Actor vs Attacker — clarifying roles
In the previous activities you learned the essential vocabulary of security — asset, threat, vulnerability, risk — and you explored the three foundational properties of information security: Confidentiality, Integrity, and Availability. You also prac...
August 28 · 15 min
Confidentiality, Integrity, Availability (CIA) — foundations
In the previous activities, you learned the essential vocabulary of security: asset, threat, vulnerability, and risk. You also practiced locating assets inside a simple application such as a Todo List. Now we build on that foundation with the single ...
August 27 · 15 min
Locate assets in a “Todo List” application
THEORETICAL RECAP In threat modeling, an 'asset' is anything of value that an attacker might want to steal, alter, destroy, or misuse — and that you must therefore protect. Assets are not only files or databases; they include data (user credentials, ...
August 26 · 15 min
Essential vocabulary — active, threat, vulnerability, risk
Welcome to the first true building block of application security. Before you can defend an application, run a penetration test, or set up a secure delivery pipeline, you must master a small set of words used every single day by security professionals...
August 26 · 15 min
Welcome and chapter goals
Welcome to the chapter on Application Security Principles and Threat Modeling. This chapter is the foundation of the entire training path that will turn you into a CyberSecurity and DevSecOps professional. Before you learn how to attack applications,...
August 25 · 15 min
Conclusion, resources and next steps
This chapter closes the module dedicated to advanced Linux for security. You have travelled a long way: from user and group management, sudoer configuration, and the creation of restricted accounts, to writing executable scripts scheduled with cron, ...
August 24 · 15 min
Apply a hardening checklist on VM labo
Project Overview In this mini-project, you will apply a complete security hardening checklist to a Linux virtual machine (VM) in a lab environment. This project consolidates every skill covered in the 'Linux advanced for security' chapter: user and s...
August 24 · 15 min
Hardening principles: CIS Benchmarks & minimization
Hardening a Linux system means reducing its attack surface and configuring it so that it resists attacks as much as possible. Until now you have written scripts, managed users and sudoers, configured logging, and audited authentication logs. Hardenin...
August 21 · 15 min
Scan /var/log/auth.log for detections
THEORETICAL RECAP On Debian-based Linux systems, /var/log/auth.log records authentication and authorization events: SSH connections (successful and failed), sudo invocations, su attempts, PAM messages, and session open/close events. On RHEL-based sys...
August 20 · 15 min
Logging & auditing: syslog, journald, logrotate
Logging and auditing are the backbone of security operations on a Linux system. Logs are the recorded traces of what happens on a machine: services starting and stopping, users logging in, commands executed with elevated privileges, failed authentica...
August 19 · 15 min
Create a restricted pentest user
THEORETICAL RECAP On Linux, every process runs with the privileges of a user and its groups. The principle of least privilege dictates that an account should hold only the permissions strictly required for its tasks—nothing more. A pentester frequent...
August 19 · 15 min
Advanced user and sudoer management
Advanced user and sudoer management is a cornerstone of Linux security. On a Linux system, every process and every file is tied to an identity. Understanding how users, groups, and privilege elevation work allows you to reduce the attack surface, app...
August 18 · 15 min
Make it executable and schedule via cron
THEORETICAL RECAP A Bash script is just a text file until you grant it execute permission and provide an interpreter. The shebang line (#!/bin/bash) on the first line tells the system which interpreter to use. Permissions are managed with chmod: chmo...
August 17 · 15 min
Best practices & pitfalls in scripting
Scripting is one of the most powerful tools a security professional has. A well-written Bash or Python script can automate reconnaissance, parse thousands of log lines, back up critical files, or orchestrate a deployment. But a poorly written script ...

Showing 41–60 of 214 episodes