UMS Learning Path
Cybersecurity
Discover how sensors, simple circuits, and code work together.
Cybersecurity
Beginner · 4 weeks
Defensive Cybersecurity: From First Steps to Expert
Proactive digital defense protects everything you build in school, work, and business. This training guides you through identifying system vulnerabilities, stopping malicious software, safeguarding private networks, and setting up unbreakable firewalls.
It is perfect for ambitious minds ready to start without any prior experience, gain advanced technical capabilities, and operate with complete confidence against modern threats.
206 lessons4 weeks$222.60
Create a student account or log in to enroll and track your progress.
Go to student portalYour learning path
Lessons and quizzes unlock in sequence.
Show all 206 steps
- 1How to Use This CourseLesson + quiz
- 2Tracks 1–3 are the core. Track 4 amplifies everything. Track 5 is for anyone whoLesson + quiz
- 32. Never type real secrets into shared tools. When a session says to use aLesson + quiz
- 4free editions cover home needs), email (Week 10 — free providers used; paidLesson + quiz
- 5Week 1 · What Is Cybersecurity & Why You Are a TargetLesson + quiz
- 6The attacker’s playbook has four moves, and everything in this course is aLesson + quiz
- 7Step 3 — The work and social layerLesson + quiz
- 8Read the results the right way. A hit does not mean “I am hacked.” It meansLesson + quiz
- 9Week 2 · Passwords That Actually ProtectLesson + quiz
- 10The number that matters is length, not cleverness. Each extra character addsLesson + quiz
- 11Guided practical — build your master passphrase (20 minutes)Lesson + quiz
- 12WORDS YOU’LL MEET TODAYLesson + quiz
- 13Before next time: install nothing yet; just keep the passphrase out of any note.Lesson + quiz
- 14Week 3 · Password Managers — One Vault to Rule Them AllLesson + quiz
- 15passphrase, lose the vault. That is why this week also sets an offline backup —Lesson + quiz
- 16Once both are logged in, they sync automatically. Test: create a junk entry onLesson + quiz
- 17random words). The vault is the only place the “answer” lives. From now on, noLesson + quiz
- 18Three takeawaysLesson + quiz
- 19Week 4 · Two-Factor Authentication & Passkeys — The Second LockLesson + quiz
- 202FA = know + have. You still type the password (know), then prove you hold theLesson + quiz
- 21phone/PC asks for face or fingerprint > done. – Authenticator app > scan theLesson + quiz
- 22WORDS YOU’LL MEET TODAYLesson + quiz
- 233. Backup codes are the airbag. You set them while calm; you use them inLesson + quiz
- 24Week 5 · Phishing, Scams & Social Engineering — The Con, UpgradedLesson + quiz
- 25The tell is the emotional spike. Legitimate institutions do not create panic —Lesson + quiz
- 26Message 1 — the WhatsApp “card” scamLesson + quiz
- 27Message 3 — the job / investment offerLesson + quiz
- 28Your turn — build your freeze frame (7 minutes)Lesson + quiz
- 29Before next time: this week’s freeze frame is the filter for Week 6 — safeLesson + quiz
- 30Week 6 · Safe Browsing & Downloads — Where You Walk MattersLesson + quiz
- 313. The phone asks, “Install unknown apps?” — a scary-sounding setting that isLesson + quiz
- 32If any app fails the check (wrong publisher, tiny install count, installed from aLesson + quiz
- 33WORDS YOU’LL MEET TODAYLesson + quiz
- 34Before next time: the update habit you just set is half of Week 7 — deviceLesson + quiz
- 35Week 7 · Device Hygiene — Updates, Locks & Lost DevicesLesson + quiz
- 36guess. Six digits (1 million) is the practical floor; a pattern is worse than 4Lesson + quiz
- 37• iPhone: Settings > Face ID & Passcode > keep the 6-digit passcode (theLesson + quiz
- 3848 hours (or confirmed stolen) > erase. Write this tree in week-07 todayLesson + quiz
- 39Three takeawaysLesson + quiz
- 40Week 8 · Backups — The Undo Button for DisastersLesson + quiz
- 41• with 1 copy off-site (the cloud is off-site; the stick can live at a trustedLesson + quiz
- 42Step 2 — The cloud copyLesson + quiz
- 43PRO TIP — THE OLD PHONE IS A LEGITIMATE BACKUP DEVICELesson + quiz
- 44Your turn (7 minutes)Lesson + quiz
- 45Week 9 · GATE PROJECT — Your Personal Security AuditLesson + quiz
- 46Guided practical — run the audit (25 minutes)Lesson + quiz
- 47Section C — The intercept layer (devices, network reach) — Weeks 6, 7Lesson + quiz
- 48dies, the data is gone. Fix: restore one file from Drive this week. Verified: the fileLesson + quiz
- 49Three takeawaysLesson + quiz
- 50Week 10 · Email — The Master Key to EverythingLesson + quiz
- 51controlled email. The account was never “hacked” directly. It was re-keyedLesson + quiz
- 52Step 4 — App passwords, understoodLesson + quiz
- 53STOP — THE “RECOVERY SUPPORT” CONLesson + quiz
- 54Three takeawaysLesson + quiz
- 55Week 11 · Money Online — Bank Apps, Mobile Money & Card PaymentsLesson + quiz
- 56The OTP, restated for money specifically: the code that appears in yourLesson + quiz
- 57Step 2 — The limits (the damage ceiling)Lesson + quiz
- 58screen could be seen. – Transaction SMS alerts on (the wallet’s own, officialLesson + quiz
- 59Three takeawaysLesson + quiz
- 60Week 12 · SIM Swap & Phone-Number AttacksLesson + quiz
- 612. The social-engineering call or walk-in: “I lost my phone, I need a new SIM,Lesson + quiz
- 62Step 2 — Ask for swap protection (the second layer)Lesson + quiz
- 63PRO TIP — THE “CALL MYSELF” TRAPLesson + quiz
- 64Three takeawaysLesson + quiz
- 65Week 13 · Messaging, Social Media & Your ReputationLesson + quiz
- 66The two attack surfaces, named:Lesson + quiz
- 67Step 2 — The recon-minimal profile trimLesson + quiz
- 68Share it, then run a 5-minute drill: one family member (with permission) sendsLesson + quiz
- 69Your turn (7 minutes)Lesson + quiz
- 70Before next time: the household’s people are now defended. Next week is theLesson + quiz
- 71Week 14 · Your Home Router & Wi-Fi — Own the GatewayLesson + quiz
- 72— and the default is usually admin / admin or admin / password . Anyone onLesson + quiz
- 73secret. (Do not name it after your name/phone; the name is public advertising.) –Lesson + quiz
- 74WORDS YOU’LL MEET TODAYLesson + quiz
- 75Three takeawaysLesson + quiz
- 76Week 15 · Public Wi-Fi, Hotspots & VPNs — The Honest GuideLesson + quiz
- 776) is encrypted and safe from this; any service that still uses plain HTTPLesson + quiz
- 78• The honest setting: you do not need the VPN on for everything. Turn it onLesson + quiz
- 79tracking protection on (the browser’s built-in, free privacy layer — reduces theLesson + quiz
- 80deliberately — confirm the network name, note whether the site you open isLesson + quiz
- 81Week 16 · Malware & Antivirus — The Germs of the InternetLesson + quiz
- 82The honest antivirus picture for 2026: – Windows 10/11 ships with WindowsLesson + quiz
- 83Guided practical — the AV confirmation + the response planLesson + quiz
- 84Page 84Lesson + quiz
- 85STOP — THE “FAKE ANTIVIRUS” IS A SCAM, NOT A VIRUS FIXLesson + quiz
- 86Three takeawaysLesson + quiz
- 87Week 17 · Privacy & Your Data Footprint — Modern Privacy Law in PracticeLesson + quiz
- 88an inference directly — you shrink it by shrinking the inputs (the direct layer)Lesson + quiz
- 89The two rows to interrogate hardest: the location row (which apps haveLesson + quiz
- 90Step 3 — The three free reductions (the practical privacy)Lesson + quiz
- 91PRO TIP — THE “FREE APP IS FUNDED BY YOUR DATA” RULELesson + quiz
- 92Three takeawaysLesson + quiz
- 93Week 18 · GATE PROJECT — The Secure-the-Household ProjectLesson + quiz
- 943. The priority fixes — the top three risks, each with the professional four-lineLesson + quiz
- 95The honest column is “Current defence.” Where you do not know the partner’sLesson + quiz
- 96The ranking is the analysis. The two 9s (the partner’s unprotected line; theLesson + quiz
- 97Step 4 — The 30-day review (the close)Lesson + quiz
- 98The 30-day review is what makes the case file a system rather than a one-off. ItLesson + quiz
- 99Three takeawaysLesson + quiz
- 100Week 19 · How Attacks Actually Work — The Lifecycle in Plain WordsLesson + quiz
- 101The plain-Lesson + quiz
- 1022. An incident is a sequence with a timestamp. “Something went wrong” is notLesson + quiz
- 103Walk it, stage by stage — and at each stage, name the tell, the stage, and theLesson + quiz
- 104In an incident, saying “we are at stage 4 — movement — the email is re-keyingLesson + quiz
- 105highest). Log it stage by stage, with timestamps and the one-line stage names.Lesson + quiz
- 1062. The TLS certificate (who vouches for the site). The padlock means “theLesson + quiz
- 107= stop, do not proceed. 3. Check one header (below) — HSTS present? The realLesson + quiz
- 108Step 3 — The security headers, read for free (the browser’s dev tools)Lesson + quiz
- 109PRO TIP — THE “TYPED URL, NOT CLICKED” RULE, SHARPENEDLesson + quiz
- 110Your turn (7 minutes)Lesson + quiz
- 111Week 21 · Security for Small Business — The Starter Kit MindsetLesson + quiz
- 112The starter-kit mindset, in three rules: 1. Scope first, then defend. You cannotLesson + quiz
- 113rule), run the scope in week-21 . You are not auditing their internals; you areLesson + quiz
- 114The SMELesson + quiz
- 115That paragraph is the Week 26 “first paying clients” sample — the scope andLesson + quiz
- 116Three takeawaysLesson + quiz
- 117Week 22 · E-Commerce, Payments & Staff — Guarding the Shop That SellsLesson + quiz
- 118(an attacker who gets into the store’s CMS injects a script that harvests theLesson + quiz
- 119Guided practical — the e-commerce sweep + the staff rules (25Lesson + quiz
- 120Step 3 — The five staff rules (the SME’s security basics)Lesson + quiz
- 121The drill (5 minutes, once a month): the owner sends one test “boss transfer” orLesson + quiz
- 122STOP — THE “CARD BY WHATSAPP” FLOW IS A LIABILITY, NOT A CONVENIENCELesson + quiz
- 123Three takeawaysLesson + quiz
- 124Week 23 · Incident Response — The First 60 MinutesLesson + quiz
- 125The clock (the first 60 minutes, the money-incident version):Lesson + quiz
- 126The timeline log (the artefact that makes it professional):Lesson + quiz
- 127The last line is the professional’s habit — every incident ends with what failed,Lesson + quiz
- 128saying the stage name forces the decision), and log every action as it happens,Lesson + quiz
- 129Step 3 — The “what failed” honesty (the improvement loop)Lesson + quiz
- 130Your turn (7 minutes)Lesson + quiz
- 131Week 24 · Recovery & Resilience — Getting Back Up, ProperlyLesson + quiz
- 132email in 1 hour (it re-keys everything).” The RTO is what makes the recoveryLesson + quiz
- 133The “minimum to stay open” (the business’s graceful-degradation list): WhenLesson + quiz
- 134The RTO is the number you rehearse to. The 4-hour wallet RTO means the re-Lesson + quiz
- 135Step 3 — The resilience habits, scheduled (the 30-day system)Lesson + quiz
- 136PRO TIP — THE PAPER BOOK IS THE ULTIMATE BACKUPLesson + quiz
- 137Three takeawaysLesson + quiz
- 138Week 25 · The Legal Lab — Attacker Skills on Authorised GroundsLesson + quiz
- 139it is the ground (whose system, whose data, with whose permission) and theLesson + quiz
- 140theft to cover the private sector. The practical effect for you: you are now theLesson + quiz
- 141Sign it, date it, file it in week-25 . It is the document that makes the rest of thisLesson + quiz
- 142already scanned in Week 6) > read the detection count (how many of the ~70Lesson + quiz
- 143Skill 3 — The vulnerable-app break (OWASP Juice Shop)Lesson + quiz
- 144> start the beginner room > solve the first challenge (it is a reading challenge —Lesson + quiz
- 145encoding/transforming data (Base64, URL-decode,Lesson + quiz
- 146Before next time: the skills are real and the law is the boundary. Next week isLesson + quiz
- 147Week 26 · Careers, Certifications & Your First Paying ClientsLesson + quiz
- 14821–24 — the scope, the starter kit, the IR card, the review calendar. You are notLesson + quiz
- 149Guided practical — the portfolio + the routes + the first offer (25Lesson + quiz
- 150Step 2 — The free study routes (toward the badge, without the price tag)Lesson + quiz
- 151Step 3 — The first-offer letter (the one-paragraph offer, made local)Lesson + quiz
- 152offer to show the files). That is the Week 21 “offer,” turned into a local,Lesson + quiz
- 153the first-5-minutes plan), which is exactly the work of Weeks 21–24. TheLesson + quiz
- 154Week 27 · CAPSTONE GATE — The Small-Business Security KitLesson + quiz
- 155The policy page (Page 5) is the only new content — the standing written rulesLesson + quiz
- 156The delivery (the handover) is the close of the Kit — the owner is not handed aLesson + quiz
- 157The capstone is the certificate: the Kit, delivered, is the proof that you can takeLesson + quiz
- 158Step 2 — The one-page summary (the cover of the Kit)Lesson + quiz
- 159WORDS YOU’LL MEET TODAYLesson + quiz
- 160Three takeawaysLesson + quiz
- 161AI Session 1 · AI as Your Security Tutor — Prompting, with the Iron RuleLesson + quiz
- 162service does with the input, and the cost of one leak (a full card number, aLesson + quiz
- 163Step 2 — The first four-part brief (a real security task, redacted)Lesson + quiz
- 164Then, the verify step (the tutor-vs-oracle rule): take the AI’s five items andLesson + quiz
- 165Your turn (7 minutes)Lesson + quiz
- 166AI Session 2 · AI as Scam Detective — Analysing Suspect Messages SafelyLesson + quiz
- 167values for placeholders (the redaction habit, AI-1) before you paste: the realLesson + quiz
- 168The redaction is the ground rule (Week 1) applied to the AI (the Iron Rule): theLesson + quiz
- 169Message 2 (the “family” WhatsApp) — the AI should find: – Sender: a familyLesson + quiz
- 170defence targets the structure of the con, not its writing quality. That is the 2026Lesson + quiz
- 171AI Session 3 · The Professional AI Workflow — Audits, Policies & Drills, DeclaredLesson + quiz
- 172drill script’s steps, the audit’s checklist scaffolding. It is not the author of theLesson + quiz
- 173Guided practical — the professional AI workflow (25 minutes)Lesson + quiz
- 174The review step (the verify, the Weeks 1–27 as the answer key): take the AI’sLesson + quiz
- 175Step 3 — The two-sentence disclosure, stampedLesson + quiz
- 176Three takeawaysLesson + quiz
- 177Lab Session 1 · The Home Lab — VirtualBox, Kali & Your Own Isolated NetworkLesson + quiz
- 178The plain-words partLesson + quiz
- 179Guided practical — build the lab (the ~60-minute build, in fourLesson + quiz
- 180The seal, in one line: the lab is a sealed room. The vulnerable machines andLesson + quiz
- 181Step 4 — The first capture (Wireshark — seeing the traffic)Lesson + quiz
- 182STOP — THE SEAL IS THE WHOLE GAMELesson + quiz
- 183unencrypted traffic). The defender’s habit: do the attacker’s first move first,Lesson + quiz
- 184Lab Session 2 · Web Apps That Break — Juice Shop, DVWA & the OWASP Top 10:2025Lesson + quiz
- 185The 2025 list (the current edition — the 2021 edition is outdated; use the 2025Lesson + quiz
- 186most common real risk). The point of the list is not the names — it is the habit:Lesson + quiz
- 187Step 2 — Break three intentional vulns, by hand (the manual attacker’sLesson + quiz
- 188check who is asking). Name it: A01. (This is the “admin page a user should notLesson + quiz
- 189Step 4 — Map to the OWASP Top 10:2025 (the why, the free reading)Lesson + quiz
- 190PRO TIP — THE “LOCALHOST IS THE SEALED ROOM”Lesson + quiz
- 191SSRF is folded into A01; A02 misconfiguration is up to #2). The habit: breakLesson + quiz
- 192Lab Session 3 · Vulnerable Machines & CTF — Metasploitable, TryHackMe & the Flag HabitLesson + quiz
- 193The plain-words partLesson + quiz
- 194step). – VulnHub ( vulnhub.com , free) — the downloadable vulnerable VMs (theLesson + quiz
- 195Step 2 — One full exploit chain (Metasploit, the free framework, on Kali)Lesson + quiz
- 196prompt on the target). This is the full exploit chain, end to end — the attackLesson + quiz
- 197Step 3 — The flag habit (the free CTF, the lab notebook, the one-line note)Lesson + quiz
- 198Three takeawaysLesson + quiz
- 199Lab Session 4 · The Blue-Team Corner — Real Logs, Real Alerts, a Free SIEMLesson + quiz
- 200Guided practical — Wazuh, the alerts, the readout (30 minutes)Lesson + quiz
- 201Step 3 — Watch the alerts fire (the real alerts, on the real activity)Lesson + quiz
- 202Step 4 — The first incident readout (the defender’s artefact, the Gym’sLesson + quiz
- 203The readout is the Gym’s capstone — the defender’s artefact, the mirror of theLesson + quiz
- 204THE GYM, COMPLETE — THE ATTACK AND THE DEFENCE, ON GROUND YOU OWNLesson + quiz
- 205Three takeawaysLesson + quiz
- 206with the artefacts (the flag habit + the readouts) — the hands-on proof thatLesson + quiz
Defensive Cybersecurity: From First Steps to Expert
Proactive digital defense protects everything you build in school, work, and business. This training guides you through identifying system vulnerabilities, stopping malicious software, safeguarding private networks, and setting up unbreakable firewalls.
It is perfect for ambitious minds ready to start without any prior experience, gain advanced technical capabilities, and operate with complete confidence against modern threats.
Ready to start?