Security Fundamentals in AI Era

Real breaches, ordinary fixes: MFA, patching, segmentation, logging, backups and the commands that apply them

Created bySkillmint .

Last updated 10/2026

English

English [Auto],

What you'll learn

Explain any security incident in terms of confidentiality, integrity and availability, and find which property broke
Find every account without MFA and close the gap, including the help-desk reset paths attackers abuse
Prioritise patches by known exploitation and internet exposure, then confirm they were actually applied
Apply default-deny host firewall rules and harden SSH and RDP without locking yourself out
Spot and fix common cloud misconfigurations: over-privileged roles, public storage, leaked keys and unrotated secrets
Inventory and audit software dependencies with an SBOM, npm audit and pip-audit, and scan code for leaked secrets
Turn on logging that someone actually reads, and design offline, tested backups that survive ransomware
Run a practical hardening checklist that maps each command to the real breach it would have stopped

Course content

8 sections • 31 lectures • 2h 0m total length

How breaches really happen3:47
Learn the boring controls and the commands that apply them. They are what would have stopped these breaches.
How to use this course, the sources, and running commands safely2:47

Confidentiality, integrity, availability4:14
For any incident, ask which property broke: who saw what they shouldn't, what changed that shouldn't have, what stopped working.
Identify, protect, detect, respond, recover4:07
Map your defence onto the six functions. Find the weakest one and fix it first.
Attack paths: one step at a time3:56
Think in paths: the first step in, the next step, and the cheapest link to break. Then keep a second link behind it.

The password that shut a pipeline4:04
If it faces the internet, it needs a second factor. Start with the list of every way in.
Every external door needs MFA4:20
Don't ask what the policy says. Ask which accounts have no MFA, and run the report that answers it.
The help desk is a door too4:03
The help desk is part of your MFA. Verify before you reset, and prefer MFA that can't be phished.
Passwords, done the modern way4:06
Long, uncomplicated, checked against a blocklist, changed when exposed. And a second factor on top.
Scenario A — "I lost my phone"4:12
A caller wants Victor's MFA reset before a payment run. Speed against verification, and what each choice costs in week two.

Patch, then prove it4:01
Know what you run. Patch it. Then prove it, with a check that looks in the right place.
What to patch first3:53
Exploited and exposed goes first. Exposure is the factor you can change today.
Edge devices: patch, then assume compromise4:17
Patch the edge device. Then kill every session, reset the credentials it held, and hunt.
Default passwords on the open internet3:49
Change every default. Keep management interfaces off the internet. Check from outside, only on what you own.
Demo — what is listening on this machine?3:57
A real run on a Windows machine: listening ports and firewall profiles, read-only.
Scenario B — The advisory that dropped on Friday4:07
A VPN zero-day is being exploited; Kestrel runs that VPN. Patch tonight, wait for Monday's window, or pull it offline.

Flat networks let attackers walk3:51
A flat network lets one stolen key open every door. Segment what matters, and allow only what's needed between the pieces.
Default-deny, then allow narrowly4:00
Allow what you need first. Preview. Then deny the rest, and keep a second way in.
Remote access without open doors4:01
Keep remote doors few and off the open internet. Keys, not passwords; no root login; a second factor where it matters. Test before you restart.

One role, seven hundred buckets4:06
Give every role only what its job needs, require IMDSv2, and remove unused access with IAM Access Analyzer.
Public by accident4:07
Check what must stay public, then block the rest account-wide; keep sharing links small, read-only and short-lived.
Keys in code4:18
Scan for secrets (gitleaks, TruffleHog), revoke and rotate what you find, remove stale access, and require MFA on code accounts.
The key nobody rotated4:16
Rotate keys automatically, and turn baseline logging on (CloudTrail, the M365 audit log) before you need it.
Demo — finding a leaked key before an attacker does3:44
A real secret scan on a throwaway repository with a planted fake key.
Scenario C — The bucket that was public4:10
Lin finds a storage bucket of shipping manifests open to the internet. Lock it, investigate first, or check who depends on it.

When the update is the attack3:55
Patch promptly, but limit what each tool can reach, and ask vendors how they build and check what they ship.
Where do we use Log4j?3:44
Build the inventory before the next one: scan your projects, write an SBOM, and pin your security tools by digest.
Demo — auditing a project's dependencies3:56
A real npm audit on a deliberately outdated project: 4 vulnerable packages found, nothing installed, no package code run (lockfile only). And npm's own suggestion, --force, is the one to be careful with.

Requirements

No prior security experience needed
Basic comfort with a command line (Linux terminal or Windows PowerShell)
Optional: a Linux or Windows machine you own, plus a free-tier AWS account, to try the commands

Description

Disclaimer: This course contains the use of artificial intelligence

Most breaches don't start with a genius hacker. They start with something ordinary: a missed patch, a password without a second factor, a storage bucket left public, a backup nobody ever tested.

This course takes real incidents, including Colonial Pipeline, Equifax, Capital One, SolarWinds, Log4j, Change Healthcare, Storm-0558 and CrowdStrike, and asks one question of each: which boring control would have stopped it?

You'll learn to think like a defender, then work through identity and MFA, patching and exposure, network segmentation, cloud misconfiguration, the software supply chain, and detection, response and recovery. Every lesson ends with something concrete: a command to run, a report to check, a decision to make.

What makes this course different

Every lesson is traced to named primary sources, not opinion
Real command-line demos on Windows and Linux, run read-only and safely
In-video decision points where you commit to a choice before you hear the answer
Four branching scenarios set at a fictional company, Kestrel, where your choices in week one decide what you can recover later
A final hardening checklist: ten commands, each mapped to the breach it would have shortened

By the end, you won't just know the fixes. You'll know how to check whether they're in place, and where to start this week.

Who this course is for:

IT generalists, sysadmins and help-desk staff who have ended up responsible for security
Developers and DevOps engineers who want the security basics behind cloud, code and dependencies
Beginners starting a cybersecurity career who want practical skills, not just theory
Managers and small-business owners who need to know which security controls matter most

Security Fundamentals in AI Era

What you'll learn

Explore related topics

Course content

Orientation2 lectures • 7min

Thinking like a defender3 lectures • 12min

Identity: passwords, MFA and the help desk5 lectures • 21min

Patching and exposure6 lectures • 24min

Network policy and segmentation3 lectures • 12min

Cloud misconfiguration6 lectures • 25min

Software supply chain3 lectures • 12min

Your hardening checklist3 lectures • 9min

Requirements

Description

Who this course is for: