GIAC Security Essentials

You cannot spot abnormal traffic without knowing normal. This module walks through the protocol stack, addressing, DNS and common application protocols, and trains you to read real captures for what each layer reveals.

• TCP/IP layers and the journey of a packet
• IPv4, IPv6, subnets and routing basics
• TCP handshakes, UDP and what scans look like
• DNS, DHCP and ARP: behavior and abuse
• Reading a capture in Wireshark
• Common application protocols and their risks

You build An annotated packet capture that explains each stage of a normal web session and one abnormal one.

Network controls only help when placed and tuned well. You compare packet filters, stateful firewalls and proxies, learn how network intrusion detection and prevention work, and write rules that catch real activity without burying analysts.

• Packet filtering, stateful inspection and proxies
• Firewall rule design and ordering
• Network intrusion detection: signatures and anomalies
• Writing and tuning detection rules
• Placement of sensors in a network
• Evasion techniques and what they teach about limits

You build A firewall rule set and three detection rules for a small network, with test traffic for each.

Wireless and web traffic are the front door of most organizations. You examine the weaknesses of wireless protocols, then the flaws in cookies, TLS and web access control that attackers use against users and sites.

• Wireless standards and their security models
• Attacks on wireless networks and the matching defenses
• Cookies, sessions and how they get stolen
• SSL and TLS weaknesses and secure configuration
• Web access control failures
• Safe browsing and email controls

You build A wireless and web hardening checklist for a small office, with the risk each item removes.

Most intrusions end in someone else’s credentials. You study access control models and where passwords fit, how password attacks work, and how multifactor authentication and good policy raise the cost for an attacker.

• Access control models and the principle of least privilege
• How passwords are stored and attacked
• Password policy that people can follow
• Password managers and multifactor authentication
• Single sign-on and its risks
• Auditing access rights

You build A password and authentication policy for a company, with the attacks each rule answers.

You do not need the mathematics to use cryptography well, but you do need to know what each tool promises. You learn symmetric and asymmetric algorithms, hashing, VPNs, GPG and public key infrastructure, and what breaks when they are used badly.

• Symmetric encryption and key length
• Asymmetric encryption and key exchange
• Hashing, salting and message authentication
• Digital signatures and certificates
• VPN types and protocols
• Using GPG for email and file protection
• PKI: certificate authorities, trust and revocation

You build An encrypted and signed message exchange between two systems, with a VPN tunnel between them.

Endpoints are where attackers run code. You deploy host firewalls and intrusion prevention, control data leaving the organization, manage mobile devices, and apply basic defenses against malware and exploitation.

• Host firewalls and host intrusion detection and prevention
• Application control and exploit mitigation
• Malware types and how they spread
• Data loss prevention basics
• Mobile device risks and management
• Patch management for endpoints

You build An endpoint protection baseline covering firewall, application control, patching and data loss rules.

Most enterprises run on Windows, so most attacks cross it. You set permissions on files, shares and the registry, design users and groups in Active Directory, enforce settings through Group Policy, and use PowerShell and Azure tools to manage and audit.

• NTFS, share and registry permissions
• Active Directory structure, users and groups
• Group Policy for hardening and control
• Windows updates and patch strategy
• Auditing and event logs on Windows
• PowerShell for administration and security
• Windows in Azure: identity and basic controls

You build A Group Policy baseline and permission model for a small Active Directory domain.

Servers, developer machines and containers often run something other than Windows. You learn Linux structure, permissions and hardening, the built-in protections of macOS, and what containers do and do not isolate.

• Linux file system layout and permissions
• Users, sudo and service accounts
• Visibility on Linux: processes, network and logs
• Linux hardening steps
• macOS built-in security features
• Containers: isolation, images and common mistakes

You build A hardened Linux host and a container image, each with a short audit of what was changed and why.

Logs are the memory of a system, and only useful if they are collected and read. You decide what to log, configure sources, centralize them, and use a SIEM to search, correlate and alert on what matters.

• Why logging fails and what to log instead
• Configuring Windows and Linux logging
• Centralizing logs and time synchronization
• Searching and correlating in a SIEM
• Writing alerts that analysts can act on
• Retention and protecting log integrity

You build A central logging setup with three correlated alerts that trigger on simulated attacker behavior.

Incidents follow a pattern, and teams that follow it recover faster. You learn the incident handling process, from preparation and identification through containment, eradication and recovery, with the documentation each step needs.

• The incident handling lifecycle
• Preparation: policy, team, tools and contacts
• Identification and initial triage
• Containment decisions and trade-offs
• Eradication, recovery and verification
• Lessons learned and reporting

You build An incident handling procedure and a worked case record for a simulated malware infection.

Finding weakness before an attacker does is a core defensive skill. You perform reconnaissance and network mapping, run vulnerability scans and read them critically, and see how a penetration test is planned and carried out.

• Reconnaissance and what an organization leaks
• Network mapping and service discovery
• Vulnerability scanning: authenticated and unauthenticated
• Reading scan results and removing false positives
• The phases of a penetration test
• Turning findings into remediation work

You build A network map and scan report for a lab environment, with findings ordered by risk.

Workloads now live in virtual machines, cloud services and AI-assisted tools. You learn how virtualization and cloud architectures work, where their risks sit, and the basics of AI, so you can judge how it helps and harms a security team.

• Virtualization and hypervisor security
• Cloud service models and the shared responsibility line
• Basic cloud controls: identity, network, logging
• How machine learning and language models work, in outline
• AI risks: data leakage, errors, misuse
• Using AI tools safely in security work

You build A short security review of a cloud-hosted lab application, with a note on safe AI tool use for the team.

Put every layer together in one environment. You design the network, harden hosts, set up identity and logging, scan for weakness, and rehearse the handling of an incident, then explain what you built to a non-specialist.

• Scoping the environment and its risks
• Designing the network and controls
• Hardening hosts and identities
• Collecting and reviewing logs
• Scanning, fixing and retesting
• Running an incident exercise

You build A defended lab enterprise with documented controls, scan results and an incident exercise report.