microsoft/Security-101
Security 101
Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field.
The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of domains, including AI system security, cloud security, zero trust principles, identity and access management, network security, data protection, and security operations. Each module reinforces learning through end-of-module quizzes that test comprehension and direct learners to further reading.
The material spans core cybersecurity areas such as application security, cloud security posture management, data protection and compliance, identity and access management, network security and segmentation, and threat detection and response. It also addresses emerging areas like AI system security, covering data poisoning defense, adversarial attacks, and model hardening, as well as traditional security practices for AI infrastructure. The curriculum is structured to build knowledge sequentially, with each module providing a self-contained learning unit.
Features
- MITRE ATT&CK Analysis - Uses the MITRE ATT&CK framework to catalog adversary tactics, techniques, and procedures for understanding attacks.
- Curricula - Provides a curriculum specifically for learning the MITRE ATT&CK framework for threat analysis.
- Cybersecurity Curriculum - Ships a structured, vendor-agnostic curriculum for learning foundational cybersecurity concepts.
- Foundational Security Concepts - Teaches core security principles like the CIA triad and zero trust through introductory modules.
- Identity and Access Management - Teaches identity and access management as a foundational security domain in its curriculum.
- NIST-Aligned Workflows - Teaches incident response workflows aligned with the NIST Cybersecurity Framework's core functions.
- Curricula - Provides a curriculum specifically for learning the NIST Cybersecurity Framework for incident response.
- Layered Defense Strategies - Teaches deploying overlapping technical, procedural, and physical defenses so a breach in one layer is blocked by others.
- Responsibility Mappings - Teaches shared responsibility model mapping for cloud security deployments.
- Security Framework-Aligned Curricula - Organizes learning modules around MITRE ATT&CK and NIST Cybersecurity Framework for structured security education.
- Knowledge Assessments - Includes end-of-module quizzes to test comprehension of cybersecurity concepts.
- Cybersecurity Training Materials - Provides open-source educational content and structured modules for learning cybersecurity concepts.
- Sequential Module Structures - Structures learning into sequential modules that build knowledge progressively with end-of-module reinforcement.
- Security Risk Assessments - Teaches structured security risk assessment as a core part of the cybersecurity curriculum.
- AI Security - Provides a dedicated curriculum module on AI system security including adversarial attacks and model hardening.
- Threat Protections - Covers defenses against data poisoning, adversarial attacks, and model manipulation unique to AI systems.
- Regulatory Compliance Guides - Teaches regulatory compliance frameworks for data protection and privacy.
- Authentication and Authorization - Covers both authentication and authorization as core identity and access management concepts.
- Behavioral Threat Detection - Teaches how to establish baseline behavior patterns and detect deviations that signal potential threats.
- Cloud Security Posture Management - Teaches cloud security posture management concepts as part of a foundational cybersecurity curriculum.
- Curricula - Provides a structured curriculum for learning cloud security, covering responsibility mapping and posture management.
- Cross-Domain Security Curricula - Provides a comprehensive curriculum covering identity, network, data, cloud, and AI security domains.
- User Identity Verification - Teaches user authentication as a foundational step before granting system access.
- Incident Response Plans - Covers following a tested plan to contain, eradicate, and recover from security breaches effectively.
- Network Segmentation - Teaches network segmentation as a fundamental strategy to isolate zones and contain breaches.
- Posture Assessment Engines - Teaches evaluating and monitoring an organization's overall cybersecurity readiness to identify vulnerabilities.
- Practical Security Framework Applications - Grounds theoretical security concepts in practical frameworks like Zero Trust and cloud responsibility models.
- Role-Based Access Control - Teaches role-based access control as a core mechanism for enforcing least-privilege access policies.
- Role-Based Access Management - Teaches role-based permissions as a key mechanism for enforcing least-privilege access.
- Security Operations Automation - Covers using orchestration tools to streamline repetitive tasks and accelerate incident response.
- Identity Verification - Teaches identity verification as a core component of access control and zero trust principles.
- Multi-User Authorization - Teaches user authorization to determine what authenticated users can access.
- Zero Trust Access Controls - Covers zero trust principles that require continuous identity verification for every access request.
- Zero Trust Networking - Teaches zero trust identity enforcement as a core principle of modern security architecture.
- Curricula - Provides a curriculum specifically for learning zero trust security principles.
- Systematic Vulnerability Management - Teaches the full lifecycle of identifying, assessing, prioritizing, mitigating, and monitoring vulnerabilities.
- Agnostic Security Guidance - Teaches core cybersecurity principles without tying content to specific products or platforms.
- Centralized Logging Systems - Explains aggregating logs from diverse sources into a central repository for analysis and incident response.
- Automated Incident Response Workflows - Covers automated workflows triggered by suspicious activity to reduce manual incident response effort.
- Incident Response Workflows - Explains executing a continuous cycle of identifying, protecting, detecting, responding, and recovering from incidents.
- AI Red Teaming - Teaches probing AI systems for security flaws, behavioral failures, and prompt injection risks.
- Defense Strategies - Teaches defenses against data poisoning attacks that manipulate training data to alter model behavior.
- Security Terminology Definitions - Teaches security terminology definitions to align security discussions.
- Vulnerability Scanning - Teaches penetration testing, code reviews, and automated scanning to find and fix security weaknesses.
- Design Integration - Teaches integrating security into application architecture from the start, not as an afterthought.
- Post-Authentication Controls - Teaches post-authentication permission control as a concept within the identity and access management curriculum.
- Security-as-a-Service Models - Covers cloud-based security services that combine network security and wide-area networking.
- Continuous Security Monitoring - Teaches continuous monitoring of network and system activities to detect and respond to security incidents.
- DDoS Mitigation - Teaches DDoS mitigation strategies to filter malicious traffic and maintain availability.
- Honeypots and Deception - Covers planting fake assets to mislead and detect intruders before they reach real systems.
- Lifecycle Governance - Teaches identity lifecycle governance as a concept within the identity and access management curriculum.
- Pre-Access Verification - Teaches pre-access identity verification as a concept within the identity and access management curriculum.
- Malware Detection - Teaches how to identify malicious software like ransomware and viruses as part of security education.
- Runtime Analysis - Teaches combining static and dynamic analysis to detect vulnerabilities during application execution.
- Penetration Testing - Teaches emulating attacker techniques to discover vulnerabilities and assess application security posture.
- AI System Testing - Teaches automated tools and adversarial testing techniques for evaluating ML model and data pipeline vulnerabilities.
- Feed Integrations - Teaches how to integrate external threat intelligence feeds to improve detection accuracy.
- Zero-Day Response Strategies - Teaches response strategies for attacks targeting unknown vulnerabilities before patches are available.
- Application Security Monitoring - Teaches monitoring and responding to security threats as they occur during application execution.
- Backup and Recovery - Teaches backup and recovery strategies for data availability protection.
- Data Lifecycle Management - Teaches data lifecycle policies for creating, storing, archiving, and disposing of data securely.
- Dependency Patching Utilities - Teaches updating third-party libraries with security fixes to close known vulnerabilities.
- Availability Defenses - Teaches strategies to defend against availability attacks such as DDoS as part of security operations.
- Security Event Correlation - Teaches how to aggregate and link disparate security signals to identify complex attack patterns.
- Patch Management - Teaches updating software and firmware to fix vulnerabilities and reduce the attack surface.
- Module Quizzes - Includes end-of-module multiple-choice quizzes that test comprehension and reinforce learning.
- Secure Coding Guides - Provides educational resources and frameworks for teaching developers secure coding practices.
- Security Procedures - Teaches security procedure definition for executing security tasks.
- Infrastructure Security Measures - Covers specialized security measures for AI cloud and hardware infrastructure beyond standard IT protections.
- Model Hardening Techniques - Teaches techniques to secure ML models against adversarial inputs and reverse-engineering.
- Traditional Security for AI Systems - Applies established cybersecurity practices like access control and vulnerability management to AI systems.
- Adaptive Authentication - Teaches adaptive authentication as a concept within the identity and access management curriculum.
- User Behavior Anomaly Detection - Teaches how to detect anomalous user behavior as part of security monitoring education.
- Cloud-Native Application Protection Platforms - Covers cloud-native application protection as a topic within the security curriculum.
- Container Security - Teaches container security principles including image scanning and runtime isolation.
- Credential Stuffing Protections - Teaches credential stuffing protections as a defense mechanism within the security curriculum.
- Cross-Site Scripting Prevention - Teaches techniques to prevent malicious script injection into web applications that execute in users' browsers.
- Denial of Service Prevention - Covers denial of service prevention as a key network security defense.
- Denial-of-Service Vector Detections - Teaches defending against attacks that aim to disrupt access to systems and data, such as DDoS.
- Dynamic Application Security Testing - Teaches sending input requests to live applications and analyzing responses to find security weaknesses.
- Encrypted Tunneling - Teaches VPN encrypted tunnels as a method for secure remote communication.
- Error Handling Security - Teaches preventing sensitive information from leaking through error messages and maintaining secure audit logs.
- Policy Definitions - Teaches security policy definition for governing organizational security posture.
- Security Standards - Teaches security standard definition for implementing technical controls.
- General Security Hygiene Practices - Teaches fundamental cybersecurity practices like updating software and using multi-factor authentication.
- Unified Incident Investigation Consoles - Teaches how to use centralized consoles for faster incident assessment from diverse telemetry sources.
- Least Privilege Enforcement - Teaches least privilege enforcement as a concept within the identity and access management curriculum.
- Granting Principles - Teaches the least privilege principle as a concept within the identity and access management curriculum.
- Principle - Teaches the least privilege principle as a foundational concept within the security curriculum.
- Microservices Security - Covers authentication, authorization, and data protection measures for APIs and microservice architectures.
- Misconfiguration Scanning - Teaches scanning for misconfigurations and security weaknesses as part of vulnerability management.
- Multi-Factor Authentication Providers - Teaches multi-factor authentication as a concept within the identity and access management curriculum.
- Bastion Host Deployment - Teaches bastion host deployment as a method for secure administrative remote access.
- Micro-Segmentation Techniques - Teaches micro-segmentation as a technique to contain breaches and limit lateral movement.
- Network Traffic Filters - Covers traditional firewall traffic filtering as a basic network security control.
- Awareness Training - Educates users to recognize and avoid social engineering and phishing attacks through training.
- Phishing Recognition Guides - Teaches users to recognize phishing attempts as part of security awareness training.
- Privileged Access Management - Teaches privileged access management as a concept within the identity and access management curriculum.
- Account Management - Teaches privileged account management as a concept within the identity and access management curriculum.
- Cloud Security Group Rules - Teaches security group access control rules for cloud resource protection.
- Secure Session Management - Teaches protecting user sessions from hijacking and unauthorized access through secure session handling.
- Provider Security Audits - Covers cloud provider security audits as part of vendor risk management education.
- Dependency Vulnerability Scanning - Teaches scanning project dependencies for known security vulnerabilities as part of application security.
- Security Baselines - Teaches security baseline definition as a foundational governance practice.
- Security Control Classifications - Teaches categorizing safeguards as administrative, technical, physical, operational, or legal for a comprehensive defense.
- Security Operations Teams - Defines a dedicated team responsible for monitoring, detecting, investigating, and responding to cybersecurity threats.
- Output Encoding Protections - Teaches transforming data sent to clients so it cannot be interpreted as executable code, preventing injection attacks.
- Security Guidelines - Teaches security guideline creation for handling situations beyond existing standards.
- Security Team Coordination Models - Describes models for distributing security responsibilities across operations, development, and security teams.
- Operations and Incident Response - Teaches threat detection and response workflows aligned with the NIST framework.
- Security Operations Distinctions - Explains separating security operations from traditional IT by focusing on threat detection and risk mitigation.
- Single Sign-On - Explains single sign-on as a method to reduce password fatigue and improve user experience.
- Social Engineering Recognition Guides - Teaches users to recognize social engineering tactics as part of security awareness training.
- SQL Injection Prevention - Covers best practices for preventing SQL injection through input validation and parameterized queries.
- Security Audits - Teaches how to verify third-party security posture through audits and compliance checks before integration.
- Continuous Anomaly Monitoring - Teaches continuous monitoring techniques for detecting anomalies and potential threats.
- Insider - Teaches how to monitor user behavior and access patterns to identify suspicious insider activities.
- Traffic Filtering - Describes traffic filtering as a protective layer that blocks harmful requests before they reach applications.
- Biometric Verification - Teaches biometric identity verification as a concept within the identity and access management curriculum.
- Directory Service Authenticators - Teaches directory service authentication as a concept within the identity and access management curriculum.
- Data Privacy Compliance - Covers data protection and compliance as a core curriculum domain.
- Web Application Firewalls - Explains how web application firewalls inspect HTTP traffic to block common web attacks.
- Code Review Practices - Teaches systematic code review practices for identifying security vulnerabilities and enforcing coding standards.
- Integration Practices - Teaches building security into software architecture and design from the start, not as an afterthought.
- Secure Development Lifecycles - Teaches weaving security practices into every phase of software development from requirements through deployment.
- Segregation of Duties Enforcements - Teaches segregation of duties as a security control within the identity and access management curriculum.
- Static Code Analysis - Teaches automated source code scanning to detect security flaws before application execution.
- Input Validation - Teaches checking every user-supplied input against expected formats to block malicious code or data.
- Authenticity Verification - Teaches entity authenticity verification as a concept within the security curriculum.
- Security Testing - Foundational security learning materials.
