Cybersecurity, from password to incident response.
Eight modules on defending real systems and real people — threats, identity, phishing, ransomware, networks, devices, the ACSC Essential Eight and what to do when something gets through — taught in plain English with real depth. Finish with a 25-question exam and an instant certificate.
What you'll be able to do.
Written as demonstrable outcomes, the way the AQF frames them. On completing this course you will be able to:
- CLO1Explain core security concepts — the CIA triad, assets, threats, vulnerabilities, risk and defence in depth.
- CLO2Secure identities with strong passphrases, a password manager, phishing-resistant MFA and least privilege.
- CLO3Recognise and respond to social engineering — phishing, business email compromise and out-of-band verification.
- CLO4Defend against malware and ransomware with prompt patching, hardened settings and tested 3-2-1 backups.
- CLO5Apply network and device security basics — encryption, Wi-Fi hygiene, updates, BYOD care and data discipline.
- CLO6Operate security at work — Essential Eight controls, Privacy Act/NDB obligations, and a practised incident-response cycle.
Who it's for: everyone with an inbox — staff, team leads, small-business owners — and anyone taking their first step toward a cyber career. No technical background required. Pairs well with Computer Science Foundations (knowing how systems work makes defending them easier).
Eight modules, defence in depth.
Each module states its learning outcomes, teaches the content, and sets an Apply it task. Everything in the exam is covered here.
Module 1Thinking like a defender — threats & the CIA triad
- LO1.1Define the CIA triad — confidentiality, integrity, availability — and apply it to real assets.
- LO1.2Distinguish assets, threats, vulnerabilities and risk.
- LO1.3Explain defence in depth and why layered controls beat any single product.
Core content
Security has a precise goal, and it's the CIA triad: keep information confidential (only the right people see it), keep it integral (nobody alters it undetected) and keep it available (it's there when needed). Every incident you'll ever read about is a failure of one of those three. The vocabulary around it matters too: an asset is what you're protecting (data, systems, money, reputation); a threat is who or what might harm it (criminals, insiders, hacktivists, state actors — mostly criminals, mostly motivated by money); a vulnerability is a weakness a threat could exploit; and risk is the combination — how likely, how bad.
The defining mindset is defence in depth: no single control — not the firewall, not the antivirus, not the training — will hold every time, so you layer controls so that one failure doesn't mean compromise. A phishing email that slips past the filter meets a user who's been trained; a stolen password meets MFA; malware that runs meets a non-admin account and an offline backup. Attackers also think in terms of your attack surface — every account, exposed service, device and person is a door; fewer doors, fewer break-ins.
Module 2Passwords, MFA & identity
- LO2.1Create strong passphrases and explain why length beats complexity theatre.
- LO2.2Use a password manager and unique credentials to defeat credential stuffing.
- LO2.3Rank MFA methods and apply least privilege to accounts.
Core content
Most breaches walk in through the front door with a valid password. Two habits close that door. First, length beats complexity: a long, unique passphrase ("correct-horse-battery-staple-42") is both stronger and more memorable than "P@ssw0rd!" — and short passwords fall to automated guessing in moments. Second, never reuse passwords, because credential stuffing exists precisely because people do: attackers take the email-and-password pairs from one breached site and replay them everywhere else. One reused password turns someone else's breach into yours. Since no human can remember fifty unique passphrases, use a password manager — it remembers, generates and autofills (and its autofill refusing to fire on a look-alike domain is itself a phishing alarm).
Multi-factor authentication adds something you have to something you know — but the methods aren't equal: SMS codes beat nothing, authenticator apps beat SMS, and hardware security keys (FIDO2) are the most phishing-resistant, because they simply won't authenticate to a fake site. Enable MFA first on email (it resets everything else), then banking, then work accounts. Finally, least privilege: people get the access their role needs and no more, reviewed regularly — and nobody does day-to-day work in an admin account, because whatever runs as you runs with your power.
Module 3Social engineering & phishing
- LO3.1Identify phishing and its variants — spear-phishing, smishing, vishing.
- LO3.2Spot the red flags: urgency, authority, unusual requests, mismatched domains.
- LO3.3Counter business email compromise with out-of-band verification, and build a no-blame reporting culture.
Core content
Attackers hack people because it's cheaper than hacking software. Phishing is the mass-mail version; spear-phishing is researched and personal; smishing and vishing do the same job by SMS and phone. The red flags repeat across all of them: manufactured urgency ("in the next hour"), borrowed authority ("it's the CEO"), unusual requests (gift cards, secrecy, new payment details) and mismatched sender domains (support@micros0ft-billing.com). The classic combination — an email from the "CEO" demanding an urgent, confidential gift-card run — is business email compromise (BEC), and it costs Australian businesses more than ransomware does.
The single defence that defeats BEC is out-of-band verification: confirm the request through a channel you already trusted before the email arrived — call the known number, walk to the office. Never verify via reply, and never use contact details the suspicious message itself provides. The same rule covers the most expensive email a business receives: "our bank details have changed" — call the supplier on the previously known number before a cent moves. And because someone will eventually click something, build a no-blame reporting culture: the person who reports in minutes saves the organisation; the person too embarrassed to report donates the network.
Module 4Malware & ransomware
- LO4.1Describe the malware families and how they get in.
- LO4.2Explain the ransomware playbook, including double extortion.
- LO4.3Build the defences that matter — prompt patching, hardened settings and tested 3-2-1 backups.
Core content
Malware is hostile software in many costumes — viruses and worms that spread, trojans that pretend to be useful, spyware and keyloggers that watch, remote-access tools that hand over control. The one with a business model is ransomware: it encrypts your data and demands payment, and modern crews steal a copy first ("double extortion") so they can threaten publication even if you restore. Entry routes are unglamorous and consistent: phishing attachments, Office macros ("Enable content" is the trap — don't enable macros from untrusted documents), malicious downloads, exposed remote-desktop services and unpatched software — attackers reverse-engineer security fixes within days, so applying updates promptly closes doors they're actively scanning for.
The defence stack: patch promptly, keep reputable endpoint protection on, run as a non-admin, and — the control that decides whether ransomware is a disaster or an inconvenience — backups on the 3-2-1 rule: three copies, two different media, one offsite and offline (or immutable), with restores actually tested. A backup the malware can reach is just another encrypted copy; a restore you've never rehearsed is a hope, not a plan. On paying: the ACSC advises against it — payment funds the next attack, marks you as payable, and buys only a criminal's promise. The real answer is to make paying unnecessary before the question arrives.
Module 5Networks, Wi-Fi & encryption basics
- LO5.1Explain encryption in transit and at rest, and what HTTPS does and doesn't promise.
- LO5.2Use public and private Wi-Fi safely, and harden the router you own.
- LO5.3Describe firewalls, network segmentation and why exposed services attract attacks.
Core content
Encryption protects data in two states: in transit (as it crosses networks) and at rest (on disks and phones — modern device encryption means a stolen laptop is a hardware loss, not a data breach). The browser padlock means the connection is encrypted via HTTPS/TLS — but that's all it means: the connection to that site is private; the site itself can still be malicious. Criminals buy certificates too, so the padlock plus a look-alike domain is still a trap. On public Wi-Fi, treat the network as untrusted: HTTPS protects most traffic, but for anything sensitive prefer your phone's hotspot or a reputable VPN — and remember a VPN only moves your trust from the café to the VPN provider.
The network you own deserves ten minutes of hardening: change the router's default admin password (default credentials are in public lists), keep its firmware updated, use WPA2/WPA3 with a strong passphrase, and put visitors on a guest network — that's segmentation, the same principle businesses use to keep the point-of-sale away from the office laptops. Firewalls filter traffic at the boundary and on each device; leave them on. And every service exposed to the internet — remote desktop, a forgotten admin panel — is a door automated scanners knock on thousands of times a day. Expose nothing you don't have to; protect what you must expose with MFA and updates.
Module 6Securing devices, software & data
- LO6.1Keep systems patched and explain why update lag is the attacker's favourite gift.
- LO6.2Secure mobile and BYOD devices, and manage app permissions.
- LO6.3Practise data discipline — classification, backup, secure disposal — and spot shadow IT.
Core content
Devices are where security becomes a habit. Updates first: operating systems, browsers and apps — turn automatic updates on and let them run, because the gap between a patch shipping and your installing it is exactly the window attackers work in. Phones count: a BYOD phone carrying work email should at minimum have a screen lock, current updates, and the ability to remotely wipe the work data if it's lost. Review app permissions occasionally — the torch app doesn't need your contacts — and install software from official stores, not download portals.
Data needs the same discipline: know what's sensitive (classification can be as simple as public / internal / confidential), keep it where it's managed and backed up, and dispose of it properly — deleting a file doesn't erase it, so old drives and phones get wiped or destroyed, not donated whole. Watch for shadow IT — the apps and services staff adopt without IT's knowledge: every unmanaged spreadsheet-in-someone's-personal-cloud is data nobody is protecting. And tie identity to lifecycle: a leaver process that disables accounts promptly, because ex-employee logins are a breach statistics category of their own.
Module 7Security at work — the Essential Eight & the law
- LO7.1Describe the ACSC Essential Eight and its maturity levels.
- LO7.2Connect controls to policy — access reviews, acceptable use, joiner-mover-leaver.
- LO7.3Outline Australian obligations — the Privacy Act 1988 and the Notifiable Data Breaches scheme.
Core content
Australia's baseline is the Essential Eight — the Australian Cyber Security Centre's eight mitigation strategies, measured in maturity levels: application control, patch applications, configure Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. Notice how much of it you now recognise — this course has been teaching the Essential Eight in civilian clothes. Restricting admin privileges earns its place because malware running as an admin can do far more damage; everyday work in a standard account caps the blast radius of any mistake.
Controls live inside obligations. The Privacy Act 1988 and the Australian Privacy Principles govern how organisations handle personal information — including keeping it secure. Under the Notifiable Data Breaches (NDB) scheme, a breach likely to cause serious harm must be notified to the affected individuals and to the OAIC (the privacy regulator) — promptly, not after the annual report. Policy is how it operationalises: acceptable-use rules people have actually read, access reviews that catch privilege creep, and a joiner-mover-leaver process so access tracks reality. Boring on purpose; breaches are exciting.
Module 8Detecting, responding & recovering
- LO8.1Recognise the signs of compromise and act on them early.
- LO8.2Run the incident-response cycle — prepare, identify, contain, eradicate, recover, learn.
- LO8.3Know who to notify in Australia, and recover personal accounts from a clean device.
Core content
Assume something eventually gets through; the difference between a bad day and a catastrophe is the response. The cycle is prepare → identify → contain → eradicate → recover → lessons learned — and the order matters. If you suspect a device is compromised, the first move is contain: disconnect it and report through your incident process — don't keep working on it, and don't wipe it immediately either, because reformatting destroys the evidence that tells you what happened and what was taken. Preparation is what makes the rest possible: a one-page plan with names and phone numbers, printed, because the plan that lives only on the encrypted server is part of the incident.
Know your notifications before you need them: internally, whoever owns IT/security; externally in Australia, ReportCyber (the ACSC's reporting portal), your bank immediately if money moved, and the OAIC plus affected individuals if personal information triggered the NDB scheme. For personal compromise: from a known-clean device, reset passwords starting with your email (it resets everything else), enable MFA as you go, and check mailbox forwarding rules — attackers add them to keep reading after you change the password. Identity-theft victims can get free help from IDCARE. Then the step everyone skips: the no-blame debrief that turns the incident into the control that prevents the next one.
How this course maps to AQF Level 4.
The Australian Qualifications Framework defines each level by three criteria — knowledge, skills, and application of knowledge and skills. This course's outcomes and exam are designed against the Level 4 criteria (the level of the Certificate IV), quoted below from the framework.
| AQF Level 4 criterion | The framework says… | How this course addresses it |
|---|---|---|
| Knowledge | "Graduates at this level will have broad factual, technical and some theoretical knowledge of a specific area or a broad field of work and learning." | Modules 1, 5 and 7 build broad factual, technical and some theoretical knowledge of the field — the CIA triad and risk concepts, encryption and network fundamentals, and the Essential Eight and NDB scheme (CLO1, CLO5, CLO6). |
| Skills | "A broad range of cognitive, technical and communication skills to select and apply a range of methods, tools, materials and information to: complete routine and non-routine activities; provide and transmit solutions to a variety of predictable and sometimes unpredictable problems." | Identity hardening with managers and MFA (M2), phishing recognition, out-of-band verification and reporting (M3), backup and patching routines (M4, M6), and the communicate-it Apply it tasks train selecting, applying and transmitting solutions to predictable and unpredictable problems (CLO2, CLO3, CLO4). |
| Application of knowledge and skills | "Graduates at this level will apply knowledge and skills to demonstrate autonomy, judgement and limited responsibility in known or changing contexts and within established parameters." | Applied tasks demand autonomous work with judgement inside set parameters — risk-assessing real assets (M1), verifying changed bank details out-of-band (M3), testing a 3-2-1 backup scheme (M4), scoring an environment against the Essential Eight (M7) and drafting an incident plan (M8) (CLO3, CLO4, CLO6). |
Criteria quoted from the AQF levels published at aqf.edu.au. The AQF also specifies volume of learning for qualification types (typically 0.5–2 years for a Certificate IV); at ~10 hours plus practice, this course aligns its outcome design to Level 4 descriptors but does not approach a qualification's volume of learning — one more reason it is not, and does not claim to be, an AQF qualification.
Plain-English status: this is a non-accredited course. Its certificate is a completion certificate issued by Course Contact, designed with reference to AQF Level 4 descriptors. It is not an AQF qualification (only ASQA/TEQSA-accredited providers can issue those), confers no licence, and Course Contact is not a registered training organisation. Want an accredited Certificate IV in Cyber Security or similar? We'll match you with providers, free →
Defences up. Prove them.
25 questions across all eight modules — 80% to pass, options shuffle every attempt, certificate issued instantly.