8.1 KiB
FILE: SYLLABUS_Cybersecurity_Applied_Lab.md
SYLLABUS: CYBERSECURITY APPLIED LAB
Apophis Networking - Security Operations Center Training Program
Course Overview
This self-study curriculum transitions theoretical cybersecurity concepts into applied, hands-on experience. By building a functional, segmented enterprise-grade network range within a virtualized environment, you will develop the foundational skills necessary to launch a cybersecurity venture, such as Apophis Networking, or operate within a modern Security Operations Center (SOC).
Program Objectives:
- Master both offensive (Red Team) and defensive (Blue Team) security techniques
- Build and operate a production-grade SOC infrastructure
- Develop incident response and digital forensics capabilities
- Understand real-world attack chains and detection engineering
- Create professional security documentation and reporting
Target Audience:
- Self-learners pursuing cybersecurity careers
- IT professionals transitioning to security roles
- Students preparing for industry certifications (Security+, CySA+, OSCP)
- Aspiring penetration testers and SOC analysts
Core Architecture
The laboratory is built entirely within a Proxmox hypervisor. Network segmentation is achieved via 802.1Q VLAN tagging and routed through a virtualized firewall appliance (pfSense/OPNsense) to ensure malicious traffic remains isolated from your physical home network.
Network Segmentation Strategy
- VLAN 100 (Management): 10.10.1.0/24 - Proxmox Web GUI, Firewall Management.
- VLAN 200 (Red Network): 10.10.2.0/24 - Attacker subnet (Kali Linux).
- VLAN 300 (Blue Network): 10.10.3.0/24 - Defenders/SOC (Security Onion).
- VLAN 400 (Victim Network): 10.10.4.0/24 - Vulnerable targets (Windows/Linux).
Virtual Machine Inventory
- pfSense (Firewall/Router)
- Kali Linux (Red Team Operations)
- Security Onion (Network Security Monitoring)
- Metasploitable 2 (Linux Target)
- Windows Server 2022 (Domain Controller)
- Windows 10 (Domain Endpoint)
Curriculum Structure
| Module | Title | Duration | Key Skills |
|---|---|---|---|
| MOD0 | Prerequisites & Fundamentals | 8-12 hours | Linux CLI, Windows PowerShell, Networking, Virtualization |
| MOD1 | Secure Infrastructure Provisioning | 4-8 hours | VLAN tagging, pfSense, Firewall rules, Network segmentation |
| MOD2 | Reconnaissance & Network Traffic Analysis | 8-14 hours | Nmap, Wireshark, Service enumeration, PCAP analysis |
| MOD3 | Exploitation & Post-Exploitation | 10-17 hours | Metasploit, Reverse shells, Privilege escalation, Persistence |
| MOD4 | Defensive Monitoring & the SOC | 6-10 hours | Security Onion, IDS/IPS, Suricata rules, Alert triage |
| MOD4.5 | SIEM Operations & Log Analysis | 6-10 hours | KQL queries, Kibana dashboards, Alert tuning, Correlation |
| MOD5 | Active Directory Threat Emulation | 8-12 hours | AD deployment, Kerberoasting, Pass-the-Hash, Domain attacks |
| MOD6 | Incident Response & Digital Forensics | 10-15 hours | Disk forensics, Memory analysis, PCAP forensics, IR reporting |
| MOD7 | Web Application Security | 8-12 hours | OWASP Top 10, SQL injection, XSS, Burp Suite, WAF |
| MOD8 | Threat Intelligence & Hunting | 6-10 hours | MITRE ATT&CK, IOCs, Sigma rules, Hypothesis-driven hunting |
| CAPSTONE | APT Simulation Project | 16-24 hours | Integrated Red/Blue exercise, Full IR lifecycle, Reporting |
Total Program Duration: 90-144 hours (12-18 weeks at 8 hours/week)
Course Expectations
Self-Directed Learning
This is a self-paced, self-driven laboratory curriculum. You are expected to:
- Break the environment intentionally (that's how you learn)
- Troubleshoot routing issues, firewall rules, and VM problems independently
- Analyze packet captures and log files for clues
- Rebuild systems from snapshots when something breaks
- Research error messages using Google, Stack Overflow, Reddit
The documentation serves as a guide, not a step-by-step walkthrough. Successful completion requires independent research, critical thinking, and logical problem-solving.
Time Commitment
- Minimum: 8-10 hours per week for 12-14 weeks
- Recommended: 12-15 hours per week for faster progress
- Intensive: 20+ hours per week to complete in 6-8 weeks
Documentation Requirements
Every module requires:
- Lab Report: Following LAB_REPORT_TEMPLATE.md format
- Screenshots: Minimum 5 per module (more for complex modules)
- Command History: Export of all commands executed
- PCAP Files: Network traffic captures of key activities
- Deliverables: Specific outputs listed in each module
Assessment
- Module Completion: Each module graded on 100-point rubric (see ASSESSMENT_RUBRICS.md)
- Capstone Project: 200 points (comprehensive assessment)
- Overall Grade: Total 1200 points across all modules
- Passing Grade: 70% (840/1200 points)
- Excellence: 90%+ (1080/1200 points) - ready for OSCP-level challenges
Professional Development
Certification Pathways
After completing this curriculum, you will be prepared for:
Entry-Level Certifications:
- CompTIA Security+ (if not already obtained)
- CompTIA CySA+ (Cybersecurity Analyst)
- CompTIA PenTest+ (Penetration Testing)
Advanced Certifications (with additional study):
- Offensive Security Certified Professional (OSCP) ← Highly recommended next step
- GIAC Certified Incident Handler (GCIH)
- Certified Ethical Hacker (CEH)
Career Roles
- SOC Analyst (Tier 1/2)
- Penetration Tester
- Incident Responder
- Detection Engineer
- Threat Hunter
- Security Consultant
Module Files
All module documentation is located in the .claude/ directory:
- MOD0_Prerequisites.md - Linux, Windows, Networking, Virtualization fundamentals
- MOD1_Secure_Infrastructure.md - Proxmox, pfSense, VLAN configuration
- MOD2_Recon_and_NTA.md - Nmap, Wireshark, Service enumeration
- MOD3_Exploitation.md - Metasploit, Post-exploitation, Persistence
- MOD4_Defensive_Monitoring.md - Security Onion, IDS/IPS, Custom rules
- MOD4.5_SIEM_Operations.md - KQL, Kibana dashboards, Log correlation
- MOD5_Active_Directory_Emulation.md - AD attacks, Kerberoasting, Lateral movement
- MOD6_Incident_Response.md - Forensics, Timeline analysis, IR reporting
- MOD7_Web_Application_Security.md - OWASP Top 10, Burp Suite, WAF
- MOD8_Threat_Intelligence.md - MITRE ATT&CK, IOCs, Threat hunting
- CAPSTONE_APT_Simulation.md - Integrated Red/Blue team exercise
Supporting Documentation
- LAB_REPORT_TEMPLATE.md - Standard format for all lab reports
- ASSESSMENT_RUBRICS.md - Grading criteria for all modules
- SYLLABUS_Cybersecurity_Applied_Lab.md - This file
Resources & Support
Required Software (All Free/Open Source)
- Proxmox VE (hypervisor)
- pfSense (firewall)
- Kali Linux (penetration testing)
- Security Onion (SIEM/IDS)
- Metasploitable 2 (vulnerable target)
- Windows Server 2022 (evaluation license)
- Windows 10 (evaluation license)
Recommended Study Materials
-
Books:
- "The Linux Command Line" by William Shotts (FREE PDF)
- "The Web Application Hacker's Handbook" by Stuttard & Pinto
- "Practical Malware Analysis" by Sikorski & Honig
-
Videos:
- Professor Messer (Network+, Security+)
- IppSec (HackTheBox walkthroughs)
- HackerSploit (YouTube channel)
-
Practice Platforms:
- TryHackMe (guided learning paths)
- HackTheBox (realistic VMs)
- PentesterLab (web app security)
Academic Integrity
Authorized Use Policy
All tools and techniques taught in this curriculum are for AUTHORIZED USE ONLY:
- ✅ Allowed: Using these techniques on VMs in YOUR lab that YOU own
- ✅ Allowed: Authorized penetration tests with written permission
- ✅ Allowed: CTF competitions and training platforms
- ❌ ILLEGAL: Using these techniques on unauthorized systems (18 U.S.C. § 1030)
GOOD LUCK, AND WELCOME TO APOPHIS NETWORKING!
"Order from Chaos" - Building security professionals one lab at a time.
END OF SYLLABUS