Cybersecurity Defence Fundamentals: Encryption & OS Security

This lecture explains how firewalls act as digital gatekeepers for your network. They protect your system by analyzing incoming and outgoing data, only allowing safe and approved traffic to pass through. Firewalls prevent hackers and malicious software from infiltrating your system. The document describes different types of firewalls, such as network firewalls for entire systems and host based firewalls for individual devices like laptops. You can also customize security rules to fit your specific needs. Ultimately, firewalls are an essential line of defense that helps keep your network safe from external threats.

We details the functions of antivirus software. It explains that antivirus software scans your files, programs, and system memory to detect malware by comparing them to a database of known threats. The software also uses behavior analysis to monitor how programs act on your device, which helps it detect new or unknown malware. Additionally, antivirus programs provide real-time protection by running in the background to instantly detect and block threats. If a threat is found, the software removes or isolates the infected files by placing them in quarantine. These programs also update themselves regularly to stay current with new cyber threats.

This lecture highlights why you need both firewalls and antivirus software for comprehensive protection. The page explains that firewalls and antivirus programs work on different security layers. Firewalls function at the network level, blocking unauthorized access and preventing threats from entering your system. Antivirus software, on the other hand, operates at the device level, scanning for and removing malware that has already made it onto your system through downloads and applications. Relying on just one tool leaves you vulnerable. Using both together provides a layered defense that significantly enhances your overall digital security.

Beyond using firewalls and antivirus, there are several key practices you can follow to maximize your digital security. First, always enable your firewall and keep it running in the background, because disabling it can expose your system to unauthorized access and unwanted traffic. Next, make sure your antivirus software is always updated so it can detect the latest threats; most tools have an automatic updates setting that you should turn on. You should also run full system scans routinely, not just quick ones. This can help find and remove hidden or dormant malware that real-time protection might miss. Finally, be cautious when browsing the internet. Avoid clicking unknown links, pop-ups, or downloading files from suspicious sources, as these are common entry points for malware.

Continuing with our security best practices, let's talk about OS hardening and other key habits. You must keep your software current by regularly updating your operating system and all applications. These updates include critical security patches that fix vulnerabilities attackers could otherwise exploit. It's also vital to fortify your digital gates. Use strong, unique passwords for all your accounts, and use a password manager to help. Enable multi-factor authentication (MFA) wherever you can for an extra layer of protection. When using your computer for daily tasks, operate with a standard user account, not an administrator account. This limits potential damage if your account is compromised. Finally, practice digital diligence: be extremely cautious about opening attachments or clicking links from untrusted sources, and research any software before you download it.

This demonstration shows how to use Windows Defender Firewall to block incoming ICMP echo requests, also known as pings. Pinging is a network diagnostic tool used to check if a device is online and to measure the time it takes to receive a response. While useful for troubleshooting, pinging can also be used by attackers to scan networks for active devices, a process known as network reconnaissance.

In the demo, you'll first use the ping command in Command Prompt to successfully ping a target computer on the same network. This confirms that communication is working normally.

Next, you'll navigate to the Windows Defender Firewall with Advanced Security settings. From there, you'll create a new inbound rule or modify an existing one (specifically, the one for "File and Printer Sharing (Echo Request - ICMPv4-In)"). You will configure this rule to block the connection for incoming ICMP traffic.

After applying the new rule, you will try to ping the target computer again. The ping command will now show "Request timed out," demonstrating that the Windows Defender Firewall is successfully blocking the ICMP packets. This action makes the device less visible to network scanners and helps enhance its security posture.

Cryptography is the science of protecting information so only the right people can read it. At its core, it transforms plaintext (readable data) into ciphertext (scrambled data) using mathematical techniques called encryption. This process keeps sensitive details private, whether they’re traveling across the internet or stored on devices. You use cryptography every day, when messaging on WhatsApp, shopping online, or logging into your bank account. Without it, hackers could easily intercept emails, steal passwords, or manipulate personal records. Cryptography is the foundation of online trust, ensuring that information cannot be accessed or altered by unauthorised individuals. In this lesson, we’ll explore how it works, why it’s essential for modern communication, and how it quietly powers the apps and services you rely on. By the end, you’ll clearly understand why cryptography is considered the backbone of digital security in today’s connected world.

Encryption comes in two main flavors: symmetric and asymmetric. Symmetric encryption uses one shared key for both locking (encrypting) and unlocking (decrypting) information. It’s fast and efficient, making it ideal for protecting large files or databases, but the challenge is securely sharing that key with the other person. Asymmetric encryption, on the other hand, uses two keys: a public key to lock the message and a private key to unlock it. Only the person with the private key can read the information, making it perfect for communication across the internet where trust isn’t guaranteed. Today’s secure systems often combine both methods—using asymmetric encryption to exchange a shared secret, then switching to symmetric encryption to handle the heavy lifting. This hybrid approach powers everything from HTTPS websites to secure messaging apps. Understanding these two methods is key to mastering how digital security systems operate.

Cryptography isn’t just about theory it’s powered by algorithms that protect our data every day. AES (Advanced Encryption Standard) is a widely used symmetric algorithm that keeps files, databases, and even government communications secure. RSA is a classic asymmetric algorithm that helps secure web traffic and digital signatures. SHA (Secure Hash Algorithm) plays a different role: instead of encrypting, it produces a digital fingerprint of data, ensuring integrity and detecting tampering. Meanwhile, ECC (Elliptic Curve Cryptography) provides the same strong protection as RSA but with much smaller keys, making it ideal for mobile devices with limited power. Each of these algorithms has strengths and specific use cases, and together, they form the building blocks of cybersecurity. In this lesson, you’ll see how these algorithms are applied in real-world systems to secure communication, verify identities, and maintain trust across the internet.

Cryptography isn’t just about secret codes, it’s about creating trust in the digital world. First, it keeps private data safe, protecting things like bank details, passwords, and personal messages. Second, it provides authentication, making sure that when you log in, the system knows it’s really you. Third, it ensures integrity, guaranteeing that data hasn’t been tampered with along the way. Cryptography also secures communication, from emails to VPN connections to video calls. Imagine sending information without encryption anyone could intercept and misuse it. Thanks to cryptography, we can shop online, bank digitally, and use apps with confidence. Ultimately, it’s the invisible shield that allows the internet to function securely. By the end of this section, you’ll understand why cryptography is more than just a technical process, it’s what makes modern digital life safe, reliable, and trustworthy.

No security system is perfect, even cryptography has weaknesses. Some algorithms, like MD5 or DES, are now outdated and can be cracked in seconds. Even strong encryption is useless if the keys are stolen or leaked. Poor implementation—like bad random number generators or misconfigured software—can open the door to hackers. On top of that, human mistakes such as reusing weak passwords or storing keys carelessly often cause breaches. Real-world incidents, like the Heartbleed bug, prove that widely used encryption systems can still have critical flaws. That’s why it’s vital to keep cryptographic tools updated, use strong modern algorithms, and follow best practices. In this lesson, you’ll see that cryptography is powerful but not infallible. By understanding these risks, you’ll learn how to avoid common pitfalls and apply encryption in a way that truly protects sensitive information in the real world.

In this lab, you’ll get hands-on experience with John the Ripper, a powerful and widely used password-cracking tool. We’ll walk through a realistic penetration testing scenario, where the objective is to recover a password from its hashed form.

We begin by generating a hash to simulate real-world conditions. Using the openssl passwd -1 command, we’ll create an MD5-based Unix hash of a simple password, then save it in a format John the Ripper can understand. This mirrors how hashes often appear in systems’ shadow files.

Once our hash is ready, we’ll launch a dictionary attack using the famous rockyou.txt wordlist. This file contains millions of leaked passwords collected from real breaches, making it a go-to resource for password-cracking demonstrations. John the Ripper will test each candidate password against the hash until it finds a match.

Finally, we’ll reveal the cracked password with john --show and discuss the results. This exercise clearly demonstrates why weak, predictable passwords like “password123” are easily defeated. By completing this lab, you’ll gain insight into attacker techniques and develop a stronger understanding of why robust password policies, salting, and modern hashing algorithms are essential for security.

The Red Team represents the offensive side of cyber security. Their main role is to simulate real-world attacks in order to uncover weaknesses before malicious actors do. By replicating the tools, techniques, and behaviour of hackers, they provide organisations with an accurate picture of how resilient their defences really are. Red Teams conduct phishing campaigns, deploy malware, escalate privileges, and move laterally through networks to expose gaps. Their toolkit includes industry standard frameworks such as Metasploit and Cobalt Strike, as well as reconnaissance tools like Nmap and bespoke scripts. A defining characteristic of Red Teams is stealth, remaining undetected allows them to mimic advanced persistent threats more realistically. The ultimate aim is not just gaining access, but demonstrating the potential consequences of a successful breach, from stolen intellectual property to service disruption. Their findings give leadership vital insights into where improvements must be prioritised.

The Blue Team serves as the organisation’s defenders. Their mission is to protect, detect, and respond to cyber threats in real time. Unlike the Red Team, which actively seeks to break in, the Blue Team works continuously to ensure systems remain secure and resilient. They monitor logs, scrutinise network traffic, and analyse behaviour for suspicious activity. Key tools include Security Information and Event Management (SIEM) platforms such as Splunk or QRadar, as well as firewalls and endpoint detection solutions. When an incident occurs, the Blue Team investigates alerts, contains intrusions, eradicates malicious activity, and restores affected systems. Preventative measures are equally important: patching vulnerabilities, hardening configurations, and enforcing strong security policies reduce exposure to attacks. In short, the Blue Team provides the organisation’s defensive backbone. Their ongoing vigilance ensures that even if an attacker gains a foothold, the impact is minimised and recovery is swift.

Although the Red and Blue Teams appear to be working against each other, their objectives are deeply interlinked. The Red Team’s purpose is to simulate cyber attacks and expose vulnerabilities, while the Blue Team’s responsibility is to detect and mitigate those same threats. On the surface their roles are opposites—one side exploits weaknesses, the other defends against them. However, both share a common mission: strengthening organisational security. Collaboration is essential. Findings from Red Team exercises provide invaluable intelligence to Blue Teams, helping them close gaps and reinforce defences. Likewise, data gathered by the Blue Team can inform Red Team simulations, ensuring attack scenarios mirror current threats. This feedback loop drives continual improvement, allowing organisations to adapt to the evolving threat landscape. Ultimately, the partnership ensures greater resilience and builds an environment where both attack and defence contribute to long-term security maturity.

The Red Team uses offensive frameworks like Metasploit and Cobalt Strike for exploiting vulnerabilities. They also use tools like Nmap and Burp Suite for reconnaissance and scanning. In contrast, the Blue Team uses defensive tools like SIEM platforms (e.g., Splunk, QRadar) to collect and analyze security data. They also rely on network defenses such as firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), and Endpoint Detection & Response (EDR). While both teams use automation, their goals differ: Red Team uses it for stealthy attacks, while the Blue Team uses it for real-time alerts and responses.

Beyond the common Red and Blue Teams, introduces several other cybersecurity teams. The Green Team focuses on long-term improvements and works with Blue Teams to fix vulnerabilities and harden systems. The Yellow Team consists of developers or architects who build systems with security in mind, embodying a "DevSecOps" approach. The Orange Team acts as a link between the Red (attack) and Blue (defense) teams to encourage collaboration and shared learning. The Black Team is a rarely used label for ultra-covert operations, often in classified or military contexts. Other emerging concepts include the Aqua Team, which is sometimes tied to cloud-native or AI security roles , and the Lilac/Violet Team, which is similar to a Purple Team but may follow different testing or collaboration methods.

This lecture explains different roles of hackers based on their intent and permission. White Hat Hackers are the "good guys" who use their skills to test and improve security with permission. They often work as ethical hackers or penetration testers. In contrast, Black Hat Hackers are the "bad guys" who break into systems illegally for personal gain, data theft, or to cause damage. Their actions are considered criminal. The Grey Hat Hacker is in between; they may find and report vulnerabilities without permission , which is not always malicious, but not fully legal either. Understanding these roles is crucial for recognising legal boundaries in cybersecurity and the ethics behind hacking.

This lecture section explores primary threats to endpoint devices, which serve as entry points for cyberattacks. Malware infections, such as viruses, trojans, spyware, and ransomware, can infiltrate devices and rapidly spread across networks, causing significant harm. Phishing attacks deceive users into clicking malicious links or downloading files that steal credentials or install harmful software. Unauthorised devices, like unapproved USBs or portable drives, risk introducing hidden malware into secure environments. Weak or reused passwords are a vulnerability, easily exploited by attackers to gain unauthorised access. Finally, unpatched systems with outdated software are prone to known vulnerabilities that hackers can target. This section emphasises the critical need for robust endpoint security to protect devices and networks from compromise, highlighting proactive measures to mitigate risks in increasingly connected digital environments, where vulnerabilities can lead to severe consequences for organisations.

This section details essential tools for securing endpoints against cyber threats. Endpoint Detection and Response (EDR) systems, such as CrowdStrike and SentinelOne, monitor devices in real-time, swiftly detecting and responding to suspicious activities. Antivirus software remains a vital first line of defence, blocking known malware, viruses, and trojans. Firewalls serve as gatekeepers, controlling device traffic to prevent unauthorised access or data leaks. Encryption safeguards sensitive data by scrambling it, ensuring it remains unreadable if a device is lost or stolen. Mobile Device Management (MDM) allows IT teams to remotely manage, lock, or wipe compromised corporate devices. Patch management tools automate software updates to close security gaps, minimising vulnerabilities. Together, these solutions form a layered defence strategy, integrating proactive monitoring, threat prevention, and data protection to ensure endpoint security and maintain network integrity in evolving threat landscapes.

This lecture section outlines best practices for users to bolster endpoint security. Users should adopt strong, unique passwords for each device and account, ideally using a password manager to ensure complexity. Keeping software and operating systems updated is essential, as patches address known security vulnerabilities. Users must exercise caution, installing applications only from trusted sources, such as official app stores or IT-approved platforms, to avoid malicious software. Unknown USBs should never be connected, as they may harbour malware. System warnings or popups should not be ignored, as they may signal underlying issues. Finally, users are encouraged to report suspicious activities, such as unusual login prompts or system lag, to IT teams promptly. By following these practices, users can significantly reduce the risk of endpoint compromise, contributing to a secure digital environment and protecting sensitive organisational data.

This section underscores the importance of endpoint security in safeguarding organisational networks. Devices like laptops, smartphones, and tablets act as entry points to company systems, each representing a potential vulnerability for attackers to exploit. A single compromised endpoint can trigger a massive data breach, allowing attackers to access critical systems laterally. The rise of remote work has increased risks, as employees connect from less secure environments, heightening device exposure. Endpoint security integrates with firewalls, antivirus, and network monitoring to create a comprehensive, layered defence strategy. Investing in robust endpoint protection prevents malware, data theft, and unauthorised access, halting threats before they spread. Ultimately, strong endpoint security protects sensitive data, preserves brand reputation, and maintains customer trust in a competitive digital landscape, ensuring organisations remain resilient against evolving cyber threats and their potentially devastating consequences.

This lecture section highlights specific endpoint security tools designed to protect devices from cyber threats. Carbon Black continuously monitors devices to detect and stop suspicious behaviour before attacks escalate. CrowdStrike Falcon utilises cloud-based AI to identify and block threats in real-time across laptops, desktops, and servers. SentinelOne combines AI and automation for instant detection and response to malware and ransomware. Symantec Endpoint Protection provides multi-layered defence against viruses, malware, and hacking attempts. Microsoft Defender for Endpoint, integrated into Windows, employs AI to detect and neutralise threats proactively. Sophos Intercept X uses deep learning AI to counter advanced threats like ransomware and file-less attacks. These tools offer robust, proactive protection, leveraging advanced technologies like AI and automation to ensure real-time threat detection and response, safeguarding endpoints and preventing network-wide breaches in today’s complex cybersecurity landscape.