Ten layers of defence — from a locked-down Linux baseline to a live detection pipeline — so a breach gets caught in minutes, not months.
Your application code passes review, but the box it runs on still allows password SSH logins, its kernel has no syscall filter, and nobody would notice if an attacker added a cron job at 3am. That gap is where most real breaches live. This course works up the stack you actually operate: Linux hardening (discretionary access control, capabilities, SELinux, AppArmor, auditd), Windows and Active Directory (Kerberos, Group Policy, Credential Guard), network defence (nftables, Suricata, WireGuard, Zero Trust), system cryptography (mutual TLS, internal certificate authorities, hardware security modules, secrets management), memory corruption and the mitigations that stop it, kernel sandboxing (seccomp syscall filters, namespaces, extended Berkeley Packet Filter hooks, Falco), container and Kubernetes hardening, cloud identity and key management, and finally a Security Information and Event Management pipeline with detection rules written as code. Everything is anchored in the Center for Internet Security benchmarks, MITRE ATT&CK, and NIST SP 800-53. You pick one of five capstones: a hardened Linux image, remediated Active Directory attack paths, Zero Trust access for an internal service, a Center for Internet Security Level 1 Kubernetes cluster, or a working detection pipeline.
Built by Lakshya Kumar
Paste this into any AI chat. Fill in the bracketed parts with your context — you'll get back a straight answer on whether this belongs on your plate.
We grant free access case-by-case — students, career-switchers, builders on a tight budget. Sign in to send us a note.
Sign in to applyFinished the tasks? Take the prompt to your AI and get tested on it. We copy the prompt and open the app — just paste it in.
Take a default distro install and turn it into a host that survives a stolen SSH key, a hostile package, and an auditor.
A single laptop becomes the whole domain through Kerberos ticket abuse and delegation sprawl — learn to map and close those paths first.
Firewalls, intrusion detection, and segmentation decide whether one compromised container reaches your database or dies on the subnet.
Mutual TLS, an internal certificate authority, and real secret storage — so a leaked config file is not a leaked kingdom.
Read overflows, use-after-free, and return-oriented programming from the defender side, then pick the mitigations that actually stop them.
Syscall filters, namespaces, and kernel-level detection turn a compromised container into a dead end instead of a foothold on the host.
Role-based access control, network policies, admission rules, and signed images — the cluster settings that decide how far a bad pod gets.
Identity, key management, and audit logs are where cloud breaches are won or lost long before anyone touches your application code.
Build a log pipeline and detection rules as code, then measure mean time to detect and false-positive rate until both are respectable.
Complete all modules, then submit the required number of capstone projects. Each must earn a passing rating from an admin reviewer.
Build a Packer (or Ansible) artefact for your distro that produces a Linux baseline image compliant with CIS Level 1. Include SSH key-only + modern KEX/ciphers, SELinux or AppArmor enforcing, auditd rules for credential and sudo events, AIDE file-integrity baseline, fail2ban, automatic security updates, NTP. Run OpenSCAP against the result; capture the report.
I am learning system security — Linux hardening (DAC, capabilities, SELinux / AppArmor, auditd), Windows + Active Directory (Kerberos, GPO, BloodHound), network security (firewalls, IDS, Zero Trust), system cryptography (mTLS, SSH, PKI, HSM, KMS), memory corruption (overflows, ROP, mitigations), kernel sandboxing (seccomp, namespaces, eBPF-LSM, Falco), container + Kubernetes security (RBAC, NetworkPolicy, admission control, image signing), cloud security (IAM, KMS, CSPM), and SIEM + detection engineering. Help me work through the actual mechanics with reference to CIS Benchmarks, MITRE ATT&CK, NIST 800-53, and real-world incident patterns.
Run SharpHound + BloodHound against a lab (or real, with permission) AD environment. Identify the top five shortest paths to Domain Admin. For each, design and implement a remediation (remove unneeded delegation, rotate weak service-account passwords, separate tiers). Re-run BloodHound; verify the paths are eliminated.
Pick an internal service currently reachable via VPN. Stand up Cloudflare Access (or Tailscale, or self-hosted Pomerium) in front of it. Configure SSO + device cert + per-request authorisation. Decommission VPN access. Document the rollout and the user-experience comparison.
Take a real or lab K8s cluster. Apply restrictive RBAC (default-deny + explicit), NetworkPolicies (default-deny + explicit allows), Kyverno or Gatekeeper policies (no privileged, no `:latest`, signed images required, drop ALL capabilities, no hostNetwork), Pod Security Standards (restricted in prod namespaces), and a Falco DaemonSet. Run a CIS K8s benchmark scan; document compliance and accepted deviations.
Build a working SIEM stack (Wazuh / Elastic / Splunk free tier) ingesting from at least 3 log sources (host audit, container runtime, cloud audit log). Deploy 5+ Sigma-based detection rules covering different ATT&CK tactics. Wire alerts to a chat or incident channel. Run for one week; capture MTTD, false-positive rate, and time-to-triage; iterate.
Post-initial-access taxonomy; detection-coverage scoring.