Hands-On Cybersecurity:
A Skills-Based Approach

ISBN Full Course: 978-0-9766304-4-9 – Lab Supplement: 978-0-9766304-5-6
Price (140 day license per student): Full Course $55.00 – Lab Supplement $35.00

Course Outline

This 10-module course uses a skills-based, practice-before-theory model. Instead of learning concepts abstractly and then trying to apply them later, you begin by doing: building secure networks and practicing cybersecurity principles inside NetEmulator®, learning to assess and remediate network vulnerabilities, and experimenting with configurations. These experiences activate curiosity and create mental “anchors,” making the theoretical concepts that follow far easier to understand.

The underlying pedagogical principle is that practice precedes explanation. By performing authentic networking tasks at the outset, students begin developing practical competencies while simultaneously preparing to engage more effectively with theoretical material. Once the lab activities are completed, subsequent conceptual instruction becomes more concrete, meaningful, and accessible.

Modules

Module 1: Security Foundations & Baseline Network Behavior

Introduce core cybersecurity concepts and establish a baseline for normal network activity.

Primary topics:

CIA triad: confidentiality, integrity, and availability
Normal network traffic and expected service behavior
Threat actors, malware, social engineering, and common attack paths
Defense-in-depth and layered security
Basic indicators of suspicious activity

Labs:

Lab 1.1: Identify Normal Network Traffic and Expected Service Behavior
Observe normal DHCP, DNS, ICMP, HTTP/HTTPS, and client/server communication, then compare normal traffic to one simple unusual traffic pattern.
Lab 1.2: Apply Defense-in-Depth on a Working Topology
Apply basic layered controls such as segmentation, firewall filtering, service hardening, access restrictions, and logging to a working network topology.

Module 2: Attack Surface Discovery & Vulnerability Assessment

Introduce students to the process of identifying exposed systems, services, and weaknesses.

Primary topics:

Attack surface, exposed services, and configuration weaknesses
Authorized reconnaissance, scanning, and enumeration
Vulnerability identification and risk assessment
Remediation, validation, and reporting
Vulnerability assessment versus penetration testing

Labs:

Lab 2.1: Discover Live Hosts and Exposed Services
Use basic discovery and scanning tools, such as NMAP to identify active hosts and reachable services on a network. Examine scan results to determine which services are required, unnecessary, outdated, or risky.
Lab 2.2: Reduce Attack Surface and Validate Remediation
Disable or restrict unnecessary services, then rescan the network to confirm that exposure has been reduced.

Module 3: Identity, Authentication & Access Control

Introduce account security, administrative access, and least privilege as core controls for protecting systems and services.

Primary topics:

Authentication versus authorization
Users, groups, roles, and least privilege
Password policies, account lockout, and default credential risks
Secure administrative access
Failed login analysis and account misuse indicators

Labs:

Lab 3.1: Configure Users, Roles, and Password Policy
Create users and roles, assign permissions, and enforce basic password requirements. Restrict administrative functions to authorized users and enforce least privilege for administrative access.
Lab 3.2: Investigate Failed Logins and Account Lockout Behavior
Generate failed login attempts, review authentication logs, and verify lockout or alert behavior.

Module 4: Endpoint Security & System Hardening

Teach students how individual hosts can be secured by reducing unnecessary services, correcting insecure configurations, and validating changes.

Primary topics:

Endpoint hardening principles
Host firewalls and local service control
Disabling risky or unnecessary services
Secure host configuration
Validation through rescanning and testing

Labs:

Lab 4.1: Harden a Workstation by Disabling Risky Services
Identify and disable unnecessary services on a workstation while preserving required functionality.
Lab 4.2: Harden a Server While Preserving Required Services
Secure a server by limiting access to required services and correcting insecure host settings. Rescan hardened systems and compare results to the original vulnerability assessment.

Module 5: Secure Network Services: DNS, Web, and Remote Administration

Secure common network services.

Primary topics:

HTTP versus HTTPS
Basic encryption, hashing, certificates, and encrypted web traffic
DNS recursion, zone transfers, and split-horizon DNS
Secure versus insecure administration protocols
Service access control

Labs:

Lab 5.1: Configure HTTPS and Compare HTTP versus HTTPS Traffic
Configure secure web access and observe the difference between unencrypted and encrypted web traffic. Configure DNS controls to prevent unauthorized recursion or zone transfer behavior.
Lab 5.3: Replace Insecure Administration Protocols with Secure Alternatives
Disable insecure administrative access such as Telnet and configure secure access using SSH and access controls.

Module 6: Stateless Filtering & Default-Deny Controls

Introduce packet filtering and basic access control by allowing or denying traffic based on source, destination, protocol, and port.

Primary topics:

Stateless packet filtering
Standard and extended ACL concepts
Default-deny security policies
Rule order and implicit deny behavior
Testing and troubleshooting access rules

Labs:

Lab 6.1: Implement a Default-Deny Inter-Subnet Policy
Configure a policy that blocks traffic by default between network segments unless it is specifically permitted. Create rules that allow necessary traffic while blocking unauthorized access to selected hosts and services.
Lab 6.2: Troubleshoot Rule Order and Access Control Problems
Diagnose and correct misordered, overly broad, missing, or incorrectly defined filtering rules.

Module 7: Segmentation, Stateful Firewalls & Security Zones

Teach students how segmentation and stateful inspection are used to isolate systems and control traffic between trusted and untrusted areas.

Primary topics:

VLANs and network segmentation as security controls
Security zones such as inside, outside, and DMZ
Stateful inspection and return traffic
North-south and east-west traffic control
Inter-zone firewall policies

Labs:

Lab 7.1: Create Inside, Outside, and DMZ Security Zones
Assign network segments to security zones and define the intended trust relationships between them. Configure stateful firewall behavior and verify that permitted outbound sessions allow appropriate return traffic.
Lab 7.2: Block Unauthorized DMZ-to-Inside Traffic
Configure and test rules that allow public access to DMZ services while preventing unauthorized access from the DMZ to internal systems.

Module 8: NAT, PAT & Secure Service Publishing

Show how NAT and firewall rules are used together to support outbound access and controlled exposure of public-facing services.

Primary topics:

Static NAT, dynamic NAT, and PAT
NAT versus firewall security
Publishing services in a DMZ
Public-to-private address translation
Troubleshooting NAT and firewall interactions

Labs:

Lab 8.1: Configure PAT for Outbound Client Access
Allow internal clients to access external resources using port address translation.
Lab 8.2: Publish a DMZ Web Server Using Static NAT and Firewall Rules
Configure static NAT and firewall rules so an external client can reach a public-facing DMZ server.
Lab 8.3: Identify and Fix an Unintended Service Exposure
Analyze a misconfigured NAT or firewall policy that exposes more services than intended, then correct and validate the configuration.

Module 9: Monitoring, Logging & IDS/IPS Detection

Introduce students to security monitoring by using logs, alerts, and IDS/IPS behavior to detect and analyze suspicious activity.

Primary topics:

Firewall, NAT, DNS, authentication, and endpoint logs
IDS/IPS signatures and alerts
Detect mode versus prevent mode
False positives and tuning
Log correlation and attack reconstruction

Labs:

Lab 9.1: Configure IDS/IPS Signatures in Detect Mode
Enable IDS signatures for selected attack patterns and verify that alerts are generated without blocking traffic. Configure IPS prevention for selected threats and verify that malicious or suspicious traffic is blocked.
Lab 9.2: Correlate Logs to Reconstruct Suspicious Activity
Review firewall, NAT, DNS, authentication, and endpoint logs to identify unusual or unauthorized behavior. Use multiple logs and alerts to determine the source, target, timeline, and likely purpose of suspicious activity.

Module 10: Incident Response & Introductory Penetration Testing Workflow

Bring together assessment, exploitation validation, detection, response, remediation, and retesting in a controlled lab environment.

Primary topics:

Authorized penetration testing scope and rules of engagement
Reconnaissance, scanning, enumeration, and controlled exploit validation
Incident response process: identify, contain, eradicate, recover
Evidence collection and attack-path analysis
Remediation, retesting, and reporting

Labs:

Lab 10.1: Perform an Authorized Introductory Penetration Test Against a Lab Network
Follow a defined scope to discover hosts, enumerate services, identify weaknesses, and document findings.
Lab 10.2: Validate or Exploit a Simulated Weakness and Document Impact
Use a controlled exploit or exploit simulation to demonstrate the risk of an identified weakness. Review logs, alerts, and system behavior to determine what happened and which systems were affected.
Lab 10.3: Remediate, Retest, and Validate Recovery
Correct the weakness, retest the environment, and verify that required services still function securely.

Capstone Project –
Secure, Assess, Attack-Test, Monitor, Respond, and Validate an SMB Network

Students design, secure, assess, test, monitor, troubleshoot, and validate a segmented small-business network using the major cybersecurity concepts and tools covered throughout the course.

Primary capabilities used:

Firewall rules, stateful inspection, NAT, and DMZ publishing
VLAN segmentation, security zones, and ACLs
DHCP, DNS, HTTPS, and secure administrative access
Identity, access control, and endpoint hardening
Logging, IDS/IPS, incident response, and validation testing

Student tasks:

Design the network
Build a segmented SMB topology with internal users, servers, a DMZ, Internet access, and required network services.
Secure the environment
Configure VLANs, zones, ACLs, firewall rules, NAT, identity controls, endpoint hardening, secure services, and monitoring.
Assess the environment
Perform vulnerability assessment activities to identify exposed services, weak configurations, and unnecessary attack surface.
Perform controlled attack testing
Conduct authorized testing against the lab environment to validate selected weaknesses and generate observable security events.
Monitor and investigate
Analyze firewall, NAT, DNS, authentication, endpoint, and IDS/IPS logs to reconstruct suspicious or malicious activity.
Respond and remediate
Contain the issue, correct the weakness, improve controls, and document the response process.
Retest and validate
Confirm that the weakness has been corrected and that required business services still operate as intended.

Capstone deliverables:

Final topology diagram
Rules of engagement/testing scope
Firewall, NAT, ACL, VLAN, and zone configuration summary
Vulnerability assessment findings
Controlled attack-test results
Log and IDS/IPS analysis summary
Remediation and retest evidence
Final security validation report

Hands-On Cybersecurity: A Skills-Based Approach