Network analysis exercise
Deliverable: A written analysis of a supplied packet capture identifying the protocols in use, the anomalous behaviour present, and the evidence supporting each conclusion.
Course
Cyber Security
Networking and Linux foundations, then web application security, SOC monitoring and incident response — practised exclusively in isolated labs, with authorisation treated as a hard rule.
- Duration: 6 months
- Classroom · Online live
- Level: intermediate
What you will be able to do
- Read network traffic and explain what a protocol exchange is doing
- Operate confidently on the Linux command line and harden a basic server
- Identify and demonstrate the OWASP Top Ten in a controlled lab environment
- Triage a security alert and decide whether it is a true positive
- Investigate an incident from logs and write a defensible incident report
- Explain the legal and authorisation boundaries around every technique taught
Who this course is for
- Graduates in computer science, IT or related disciplines
- IT support, network and system administration staff moving into security
- Comfort with computers and a willingness to learn networking and Linux from scratch
- No prior security experience required
Syllabus
7 modules · 6 months
Module 1. Networking foundations
- The TCP/IP model and what each layer actually does
- IP addressing, subnetting and routing
- TCP, UDP, DNS, DHCP and HTTP exchanges
- Reading packet captures in Wireshark
- Firewalls, NAT and network segmentation
Module 2. Linux and systems
- Command line fundamentals and file system layout
- Users, groups and permission models
- Processes, services and system logs
- Shell scripting for repetitive tasks
- Basic server hardening and patch discipline
Module 3. Security fundamentals and the law
- Confidentiality, integrity and availability in practice
- Threat modelling and risk assessment
- Cryptography concepts — hashing, symmetric and asymmetric encryption
- Authentication, authorisation and session management
- Indian IT Act provisions, authorisation, scope and written consent
Module 4. Web application security
- How web applications are structured and where trust boundaries sit
- The OWASP Top Ten, demonstrated in a deliberately vulnerable lab app
- Injection, broken authentication and access control failures
- Cross-site scripting and request forgery
- Using Burp Suite to intercept and analyse requests
- Writing a finding up so a developer can act on it
Module 5. Offensive techniques in a lab
- Reconnaissance and enumeration methodology
- Vulnerability scanning and interpreting the output critically
- Exploitation in an isolated lab, and why only in an isolated lab
- Post-exploitation concepts and privilege escalation
- Scoping, rules of engagement and staying inside authorisation
Module 6. Defensive operations and SOC
- What a security operations centre actually does day to day
- Log sources, collection and normalisation
- SIEM alerting, tuning and reducing false positives
- Alert triage and escalation criteria
- Threat intelligence and indicators of compromise
Module 7. Incident response
- The incident response lifecycle
- Evidence handling and preserving a timeline
- Containment, eradication and recovery decisions
- Writing an incident report for a non-technical audience
- Post-incident review without blame
Tools and technologies you will use
- Kali Linux
- Wireshark
- Nmap
- Burp Suite Community
- Metasploit (lab only)
- A SIEM platform
- Isolated virtual lab environments
Projects you will build
Web application security assessment
Deliverable: A findings report against a deliberately vulnerable lab application, with each issue rated by severity, reproduced step by step, and paired with a concrete remediation recommendation.
SOC alert triage simulation
Deliverable: Triage decisions across a set of simulated alerts, with a written rationale for each true or false positive call and a tuning proposal for the noisiest rule.
Incident investigation and report
Deliverable: A full investigation of a simulated incident from log evidence, producing a timeline, an impact assessment and an incident report suitable for management.
Where this course can take you
- SOC Analyst
- Security Analyst
- Penetration Tester (junior)
- Information Security Executive
- Network Security Engineer
Duration, modes and fees
- Duration
- 6 months
- Delivery modes
- Classroom · Online live
- Fees
- Share your details for the current fee
- Fees vary by batch and delivery mode. Share your details and an advisor will confirm the current fee.
Placement assistance
Every student gets placement assistance — that is what 100% placement assistance means. It is support for all, not a job for all. We do not promise a specific salary, a specific number of interviews, or placement at any named company, and you should be wary of anyone who does.
What is included
- A place in the monthly placement drive, held every third Saturday
- The readiness programme every second Saturday — mock interviews and preparation
- CV review against the specific roles you are targeting
- Portfolio review, so your project work is presented the way a reviewer will read it
- Access to the vacancy pool employers send directly to the Samyak network
- Guidance on which roles realistically fit your background and which do not
- A place in the next drive, with coaching, if you are not selected in this one
What is not included
- Any guarantee of a job, an interview, or a particular salary
- Placement at a named or partner company
- Applying to jobs on your behalf
- Support before you have completed the course and its project work
- Visa, relocation or overseas placement assistance
Foundations first, tools much later
There is a version of this course that opens with Kali Linux and an exploitation demo in week one. It is more exciting and it produces people who can run tools without understanding what the tools are doing — which is both professionally limited and genuinely dangerous.
We spend the first two modules on networking and Linux. If you cannot read a packet capture and say what the exchange is doing, a scanner’s output is just a list of words. If you cannot reason about Linux permissions, privilege escalation is a magic trick rather than a consequence of a misconfiguration.
That grounding is also what interviewers probe. Candidates who can explain a TCP handshake and a permission model do well; candidates who can only name tools do not.
Authorisation is a module, not a disclaimer
Every technique here is practised inside isolated lab environments we provide, against systems we control.
We treat scope and authorisation as a substantive subject: what written permission needs to specify, what rules of engagement mean, what happens when you find something outside the agreed scope, and what the Indian IT Act actually says. Security professionals get this wrong in ways that end careers, and it is not covered by a warning slide.
Defence is where the jobs are
Offensive security gets the attention. SOC and defensive analysis is where most entry-level hiring in India actually happens, and it is where this course puts the weight in the second half — log analysis, alert triage, tuning and incident response.
The offensive modules exist because you cannot triage an alert well without understanding what the attack looks like from the other side. That is the argument for teaching both, and it is why the two halves are sequenced the way they are.
Questions
Cyber Security — frequently asked questions
Is everything in this course legal to practise?
Everything taught here is practised exclusively in isolated lab environments we provide, against systems we control. Running any of these techniques against systems you do not own or have written authorisation to test is a criminal offence under the Indian IT Act. Authorisation and scope are covered as a dedicated module, not a disclaimer.
Do you provide CEH certification?
CEH is an EC-Council certification with its own exam and authorised training partners. This course covers overlapping technical ground and prepares you well for that subject matter, but it is not an accredited CEH training programme and we do not claim otherwise. Ask us directly about our current accreditation status before enrolling on that basis.
Should I aim for SOC analyst or penetration tester roles?
SOC analyst roles are far more numerous at entry level in India, and are the common way in. Penetration testing tends to be entered after a few years of defensive or systems experience. This course covers both sides deliberately, because understanding attack technique is what makes someone good at defence.
Do I need networking knowledge before starting?
No — the first two modules build networking and Linux from scratch, and they are the longest in the course for good reason. Security work without networking fundamentals becomes tool operation without comprehension, which is exactly the profile that struggles in interviews and in the job.
Enquire about Cyber Security
Three details is all we need. A course advisor will call you back.
Related courses
- Full Stack Development
Front end, back end, databases and deployment taught as one connected system, ending with applications you have shipped to a public URL and can walk an interviewer through.
- Python Programming
Python taught as a working tool rather than a syntax tour — you finish able to read unfamiliar code, automate real tasks, call APIs and write tests that catch your own mistakes.
Next step
Talk to a course advisor
Tell us what you want to learn and we will help you pick the right course, batch and mode.