Cyber Security - 2026 late autumn
ICB705AS3YE-2 +cy2

Learn cyber security. Link birds-eye view to hands-on.

Master's level course.

This is a master's level course. You can only enroll if you're studying master's degree (YAMK).

Learning objectives # ↑

In this course, you will

• Get an overview of cyber security
• Use threat modeling to identify and priorize key risks for your own organization
• Try some aspects of security with simple hands on exercises
  • Linking theory to practice

Agenda # ↑

Wednesdays 17:40 - 20:30, Zoom video conference. The themes will be updated during the course.

Use of Feedback from Previous Courses # ↑

Open feedback and my analyses of it is in the comments on this page you're reading. Last instance, Cyber Security - 2025 late autumn - 2025 late autumn ICB705AS3YE-1 , received 4.5 /5 excellent feedback, with all but one participant giving feedback.

Feedback from other security courses have been used when creating "Cyber Security" course. This includes feedback from "Tunkeutumistestaus" (Penetration Testing, has reached 5.0/5), "ICT Security Basics - from Trust to Blockchain" (has reached 4.9/5), "Information Security" (has reached 4.8/5) and others. Based on feedback, an attempt is made to: discuss in the class; link theory to practical exercises (that are not highly demanding technically); have homework with both varied reading and applied tasks. Both numeric and free form feedback for these courses is available on https://terokarvinen.com/

Other Infosec Courses # ↑

Emphasis of this course, Cyber Security, is to give a bird's eye, management view to information security.

This course gives you grand overview of cyber security and some practice with tools implementing these principles. Even though you're expected to be able to install and configure programs and troubleshoot some errors, this is not my most technical course.

For demanding technical, non-masters level offensive courses, you should consider other courses such as

• Tunkeutumistestaus (Penetration testing) (Currently in Finnish only)
• Sovellusten hakkerointi ja haavoittuvuudet (Application hacking and vulnerabilities) (*Application hacking is sometimes in English, too)
• Verkkoon tunkeutuminen ja tiedustelu (Network attacks in reconnaissance). (Currently in Finnish only)

Homework # ↑

Homework is due 24 hours before next class starts. Return a link to Laksu and evaluate two. Link to Laksu is in Moodle.

Homeworks are done with a computer and reported at the same time. If some task does not require performing tests with a computer, it's specied writing in the subtask. Computer tests must be done, not imagined.

Each homework is returned

• 24 h before start of next lecture
• you can publish your homework report in any website you like
• return a link to Laksu
• cross-evaluate two other homeworks

To save everyone's time, I will remove those from the course who don't return homework.

Github is a convenient place to publish your reports, others are Gitlab and your own homepage. I highly recommend publishing your work. But if you don't dare or want to publish, you can use a pseudonym or alias. Or in the extreme case, put your web page behind a password (e.g. in Wordpress.com, same password for all reports), and share this password with the whole class. I recomend publishing.

All sources must be refered to: this task page, classes, reports from your classmates, classmate presentations, man pages, the article you found...

Returned link must open the report directly. For example, return link to your "h1-helsec.md", not the front page of your website. Web page must directly open in web browser, so it must be HTML. (Github will automatically convert your Markdown to HTML). Other formats are not accepted (no docx, no pdf, no odx, no xlsx...).

AI and large language models (LLM): You can ask AI or LLM a question and use the answer as facts for your own answer, written in your own words. AI must be marked as a reference, with details such as prompt (and for advanced users system prompts, temperature, jailbreaks...). LLMs tend to hallucinate, so you should check answers from more reliable sources. It's not allowed to generate text with AI or similar technologies. For example, it's not allowed to generate essay answers or summaries with AI, LLM or similar technologies as someone will have to read it.

The homeworks are official after they are given in the class. Don't start them before, because they might change. I will of course give homeworks based on what we actually talked about.

h0 Hello # ↑

Voluntary. This exercise is the first, easy step towards version control systems. Even though you're just clicking buttons on the website, it uses world leading tool git in the background. Git even uses a tree of hashes of blocks, just like Bitcoin.

• a) Voluntary. Create a web page using Github. Add a heading, some paragraphs and some code style. Return it to Laksu, and cross evaluate two.

Tips

• Read this first: Karvinen 2023: Create a Web Page Using Github
• Write the page in Markdown. Add headings and paragraphs.
• Add some code style.
• Browse to the page where you can see your new page normally (headings in bigger text than paragraphs). The correct link to return is shown in your browsers address bar.
• Remember to use md suffix, so that the website knows it's Markdown. E.g. "tero.md". If you page file name has multiple words, use kebab case: separate-words-with-dashes.md.
• Normally, the cross evaluation has free form feedback: good, bad, ideas for improvement, tips... But for this h0, there is not much to comment and one sentence is enough. If you can see a page with paragraph and heading, it's a five. (For the rest of the course, in feedback for actual homework (h1, h2...), your classmates will surely appreciate longer and insightful feedback).

h1 CyberScience # ↑

Science wants to be free! And you can have it on the Internet.

Busy? Just read articles that are the real deal, and skip the mundane. Could someone do me a literature review => review article.

• a) Science hunt. Find a review article related to the themes in the course. Detail your process to find and choose the article. For advise, see Karvinen 2025: Start Your Research with a Review Article. (This task does not require technical tests on a computer)
  • The article should be
    • Review article (fi: katsausartikkeli)
    • Published in a reputable peer-reviewed academic journal, with JUFO rating 1, 2 or 3.
    • Preferably fresh, <2 years
  • Some search terms for Google Scholar to get you started (you can also use others). "intitle:review" and
    • threat modeling
    • cloud security
    • penetration testing
    • red teaming
    • social engineering
    • radio equipment directive
    • you can also think about your areas of intrest
      • work
      • hacker hobbies
      • future thesis
• b) Review the review. Read the article and create a brief summary around these questions. Use bullet list format. (This task does not require technical tests on a computer)
  • What are the key areas being researched?
  • What's widely agreed upon?
  • What are the open questions?
• c) Threat modeling quickrun. Create two risks and decide what to do with them. Imagine the details. Be brief, but specific. (This task does not require technical tests on a computer)
  • Company
  • Crown jewels - data, business continuity, reputation, money.
  • Bad guys - What do they want? How are they going to get it? Why us? (COI - Capability, Opportunity, Intent)
  • List risks (only 2 example risks here). Likelyhood x impact = estimated value.
    • Yes, euros please. And percents. Ballpark, but numbers required.
    • Take biggest risk
  • What shall we do with that one biggest risk (META - mitigate, eliminate, transfer, accept)
• d) Voluntary bonus: Create an alert that emails you interesting articles. Good for your future thesis. Start with a wide net, then reduce it after a couple of days; and reduce it more after a week. You want to be happy to get email of a new article.
• e) Voluntary bonus: Install Linux on a virtual machine. Debian or Kali. (Everyone will do this later on the class.)
• f) Voluntary bonus, a technical puzzle.
  • ==gCh8mclRFIs8GbsVGS
  • Can you do it without AI? This task is trivial for AI, and copy-pasting it to an LLM is not interesting.
  • This task requires a computer and some practical command line knowledge. It's not meant to be solved with pen and paper.

Wrong way to save time (meme format): Buys a gym card. [picture of non-athletic person] Does not go to the gym.

So read the article yourself, don't let AI steal your learning.

h2 Scene # ↑

Cyber moves fast. Here, you'll start following the scene.

• Read/watch/listen and summarize (These subtasks a, b and c do not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like. Add a bullet for your own idea or question.)
  • a) Podcast. Listen and summarize one episode of one the following (Note: yes, just one, single episode out of all of these. More is a voluntary bonus task.)
    • Darknet Diaries podcast, or
    • Herrasmieshakkerit podcast (Podcast is in Finnish, but your summary must be in English), or
    • Covert Access Team podcast, or
    • SANS Stromcast podcast
  • b) Blog. Read one article in one of these blogs (Note: yes, just one, single post out of all of these. More is a voluntary bonus task.)
    • Schneier on Security (author of the book "Applied Cryptography"), Atom feed, or
    • Krebs on Security, or
    • Traficom - NCSC News
      • Traficom is the Finnish Transport and Communications Agency
    • Unit42, or
    • Simon Willison (about AI, pick a security focused post)
  • c) Science that.
    • Link some theory, model or article you read in h1 CyberScience to a blog post or podcast episode you found here. Can you put a fresh security event in the context of larger understanding?
• d) Download Debian. Download Debian 13-Trixie installation image on the computer you'll use in the class. (Yes, this task is literally just downloading the ISO. Installing is a voluntary task for now.)
  • Go to Debian.org. On the Other downloads, under heading "Try Debian live before installing", choose "Live Xfce". The direct link for "Live Xfce" ISO image will soon become obsolete as new versions are published.
  • (Mac users: The linked image is for regular PC's, also known as amd64. If you have an M1, M2, M3, M4... Mac, it uses arm64 processor architecture, and you need to figure it out yourself. I suggest using UTM.)
• e) Voluntary bonus: Install Debian 13-Trixie Linux on a virtual machine. (Everyone will do this later on the class.)
• f) Voluntary bonus: Install a feed reader and follow some RSS / Atom feeds. (If time permits, everyone will do a version of this later.)
• g) Voluntary bonus: Read more blog posts and listen to podcasts. Link those news into larger theory framework, citing relevan articles.

Tips

• Darknet Diaries and other podcasts
  • AntennaPod is convenient Android program for listening podcasts. It's available in F-Droid and Google Play. Of course, there are hundreds if not thousands other programs for podcasts, too.
  • Pick any episode. Check descriptions, and pick one that's likely to be suitable here. It's often good to pick other than the latest or the one on top of the homepage, so we can look at different episodes.

h3 Cyber lab # ↑

You'll take the first steps on your own cyber lab. For us, the lab allows us to safely try the tools used by attackers.

Advanced users build lab environments similar to their targets and test their attack tools in the lab.

Tests required: note that tasks require tests on a computer. For those, you must: write the report while you work; take screenshots; show commands you give and relevant parts of their output; also include problems and their fixes.

I included a password cracking exercise here as you asked, using the actual tool favored by white hat pentesters and criminals alike. We'll have the theory for attacking passwords later, on w49. The approach for try first, learn theory later is similar I have used when teaching IoT and embedded systems, as discussed in (voluntary reading) Karvinen & Karvinen 2018 IoT rapid prototyping laboratory setup.

• x) Read/watch/listen and summarize (This subtasks x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like. Add a bullet for your own idea or question. Reading emphasized, no extensive essays needed for this subtask.)
  • Karvinen 2020: Command Line Basics Revisited
  • Karvinen 2022: Cracking Passwords with Hashcat
• a) Reserve your presentation title in Moodle (If you did not do it earlier. This subtask does not need reported tests on a computer)
• b) Linux. Install Linux on a virtual machine. Use Debian 13-Trixie.
  • I recommend VirtualBox, but you can also use other virtualization systems (UTM, virt-manager, VMWare...) if you know them. If you already have a Linux VM, you can create a new one here for the report.
  • If you already wrote a proper report, you can just link that.
• c) Crack. Crack the hash 6b1628b016dff46e6fa35684be6acc96 . Install hashcat and follow the steps in the article to crack the example hash. Karvinen 2022: Cracking Passwords with Hashcat.
• d) Voluntary bonus: John the Ripper. Install and test John the Ripper Jumbo, see Karvinen 2023: Crack File Password With John. (We might do this together later)
• e) Voluntary bonus: The other John. Create an encrypted file (other than zip) and crack the hash with John.

Tips:

• Present
  • You can see your presentation date in the agenda.
  • Your presentation should
    • Fit the course - be about cyber security
    • Serve the audience - useful, entertaining, interesting, provoking discussion
    • Use your strenghts - what you do at work, in your hobbies (If you want, also less familiar areas are allowed)
  • For longer time slot, email me beforehand.
• Install Linux
  • VirtualBox installer is available on VirtualBox.org
  • Debian 13-Trixie install image. Go to Debian.org. On the Other downloads, under heading "Try Debian live before installing", choose "Live Xfce". The direct link for "Live Xfce" ISO image will soon become obsolete as new versions are published.
• Virtualization
  • VT-x. Tip to make virtualization much faster.
    • If you have never used virtualization on your computer, you should enable VT-x (aka AMD-X)
    • Boot your computer, press a button like F1 or F12 to enter BIOS/UEFI setup
    • Browse the menus, find VT-x or similar.
    • Enable VT-x
    • Take photos with your cell phone, you can't take screenshots on BIOS/UEFI setup.
  • Disable unattended installation in VirtualBox, it usually fails.
  • OS type: Debian (64-bit)
    • Or similar
    • 32-bit does not work, and such computers are no longer in use.
  • RAM for VM - 2 GB (1 GB is manageable but slow, 4 GB is nice)
  • Disk: 40 GB - 60 GB (VirtualBox only uses space on the host system if you actually store files there)
  • CPUs: 2+
  • Always use good, unique passwords.
    • Never use bad passwords.
    • Always practice doing it right. Never practice doing it wrong.
    • Most professionals use a password manager to store the passwords.
• Got stuck?
  • Computers have problems. If not, everyone would be a hacker.
  • Document everything.
  • Google / Duck.
  • Try some approaches and document results.
  • Write down and screenshot exact error messages. These are great search strings.
  • Remind me on the class and we'll look at it together. Technically advanced students usually enjoy troubleshooting together, so it's entertaining and useful to both those who got stuck and those who did not.

h4 Feed me # ↑

Follow the scene. We've looked at science earlier, now we turn to blogsphere. Yes, I have Krebs and Schneier here.

How could the criminals know what services your employer is running? Read the tips. And be careful with port scanner!

• x) Why would you want to use a feed reader (and RSS/Atom)? Couldn't you just browse to each website? (This task does not require tests with a computer. Find suitable sources yourself if needed.).
• y) Supreme court of Finland, case Osuuspankkikeskus port scan KKO:2003:36. Have a brief look, summarize the key thing in a couple of bullets or sentences. It's in Finnish, but Firefox has offline machine translation from Finnish to English. (This task does not require tests with a computer. This task does not require thorough legal analysis of the case.)
• a) Install a feed reader. Show that it can read a feed (RSS or Atom). Include a screenshot of this. You can use any feed reader you like, and you can install the feed reader in your host OS if you like.
• b) Add the feed for Krebs. This is the one we discussed in the class. https://krebsonsecurity.com/feed/
• c) Add a feed for Schneier on Security. Find the blog, and locate the feed.
• d) Find and add two more security related feeds. Explain how you found them, and why you chose them.
• e) Follow security feeds for a while. What did you learn? What are the benefits and downsides of following feeds with a reader, compared to some other methods of following cyber security scene?
• f) Port scan. How can criminals know what services your employer has? Disconnect your computer from the internet while doing the test (after you have installed the required software). Do the test inside your virtual machine.
  • Install nmap port scanner
  • Disconnect from the internet. Show that 'ping 8.8.8.8' does not work.
  • Port scan your own computer. Use "localhost" as the address.
  • Install a daemon
  • Port scan again
  • Analyze and explain the results
  • Do not scan random computers.
• g) Voluntary bonus, a bit hard: Identify a port scan against Apache on the host being scanned, e.g. in logs. Perform the test against "localhost" address and disconnect the internet while port scanning.
• h) Voluntary bonus, a bit hard: Modify nmap scan so that it cannot be detected by the method you found above.

Tips:

• Port scan (notes from memory)
  • sudo apt-get update; sudo apt-get -y install nmap
  • ping 1.1.1.1 # quit with Ctrl-C
  • sudo nmap -A -v localhost
  • sudo apt-get install apache2; sudo systemctl start apache2;
  • Do not scan computers you don't own. Disconnect computer from the internet while port scanning.
• Feed readers
  • Thunderbird is the easiest choice
  • Brief is a Firefox extension, maybe it's also available for Chromium.
  • Newsboat 'nb' is a fast and versatile tool with proper APIs. It has some learning curve, it's Linux only and uses TUI (text user interface).
  • There are many other feed readers, too.
  • Thunderbird. Easy to install, simple graphical user interface, established project. But it's an email app first, feed reader third.
    • Install: Linux 'sudo apt-get update; sudo apt-get -y install thunderbird'. Windows and Mac: download installer. They even have an Android version.
    • Add Feed Account
      • Click Alt to show menu bars.
      • File: New: Feed Account.
    • Add a Feed (RSS/Atom for specific website)
      • "Blogs & News Feeds" is shown on Folder pane "All Folders" on the left.
        • Right click "Blogs & News Feeds" for context menu: Subscribe... (Same as "Manage feed subscriptions")
      • Feed URL: https://terokarvinen.com/index.xml
        • Click "Add" on the left. Only click blue "Close" after you have clicked "Add" on the left.
      • "Tero Karvinen..." feed appears on folder pane "All Folders", inside "Blogs & News Feeds". You can see latest articles from the website.
    • River of News
      • "River of news" means a single view that shows posts from all your subscriptions, latest first. It's quite an obvious feature of a feed reader, but in Thunderbird you have to set it up yourself.
      • Right click "Blogs & News Feeds" for context menu: Search Messages...
      • "Age in Days" "is less than" "30"
      • Save search as folder (button)
      • Name: "month". Create.
      • Close the search modal.
      • "month" appears in folder pane "All Folders", in "Blogs & News Feeds". You can see latest posts from all of the feedds you follow. It's even more interesting if you follow more than one feed.
• Finding feeds
  • Website often has a button for RSS feed
  • Search the page for text: "RSS", "Atom", "Feed", "Subscribe"
  • Check for RSS icon, a dot with two concentric arcs
  • Try common URLs, like /feed/ - https://example.com/feed/
  • Use an addon to detect feeds, like RSSPreview
  • View HTML source code, search for "rss", "atom", "xml", "alternate"

h5 Alice and Bob # ↑

You're using public key encryption every day. If you know what you're doing, it can help you even more.

Can you guess what's my favourite book on crypto basics?

• x) Read and summarize (with some bullet points)
  • € Schneier 2015: Applied Cryptography:
    • Chapter 1 - Foundations
      • 1.1 Terminology
        • Sender and Receiver, Messages and Encryption, Algorithms and Keys, Symmetric Algorithms, Public-Key Algorithms (From start until the end of Algorithms; not Cryptoanalysis and onwards)
    • Chapter 2 - Protocol Building Blocks, sections
      • 2.5 Communications Using Public-Key Cryptography (From the start of "Communications using Public Key" until the start of "Digital signatures with encryption")
  • Karvinen 2023: PGP - Send Encrypted and Signed Message - gpg
• a) Pubkey today. Explain how you have used public key cryptography today or yesterday, outside of this homework. In addition to naming the system, identify how different parties use keys in different steps of the system. (Answering this question likely requries finding sources on your own. This subtask does not require tests with a computer.)
• b) Encrypt a message. Explain how different parties use different keys at different stages of operation. Evaluate the security of the tool you've chosen.
• c) Eve and Mallory. In many crypto stories, Eve is a passive eavesdropper, listening on the wire. Mallory malliciously modifies the messages. Explain how PGP protects against Mallory and Eve. Be specific what features, which use of keys and which flags in the command are related to this protection. (This subtasks does not require tests with a computer)
• d) Password management. Demonstrate use of a password manager. What kind of attacks take advantage of people not using password managers? (You can use any password manager, some examples include pass and KeePassXC.)
• e) Refer to sources. Verify each homework report (this and the earlier ones) refers to sources. Every homework report should refer to this task page. It should also have references to any other source used, such as web pages, LLMs, man pages, other reports... References are mandatory, and must be present in every report. (This subtask does not need a report, you can just do it and write "Done." as the answer for this subtask.)
• f) Voluntary: Details of PGP. Send an encrypted and signed message using PGP, then verify and decrypt it. (You can use folders to simulate users, or use two computers or two different OS users. Don't use Tero as a name of any party, unless that's your given name. Many tools automate the use of PGP, my article allows you to do each step by hand.)
• g) Voluntary, challenging, requires coding: Cryptopals: Challenge Set 1:
  • 1 Convert hex to base64 (feel free to use a library for base64)
  • 2 Fixed XOR
  • 3 Single-byte XOR cipher
  • 4 Detect single-character XOR (This looks tough before you have solved 1-3)

h6 Mature # ↑

Don't build a giant fence and leave the door open.

Spreadsheets don't think. You think - hopefully together with stakeholders from other areas of your company.

• x) Read and summarize (With some bullet points. No tests on computer required.)
  • Traficom: Cybermeter - User guide:
    • Summary and checklist of the assessment process (p 10)
    • 3 Cybermeter maturity model (p 11-14)
    • The Cybermeter maturity report (p 23)
  • Traficom: Kybermittari spreadsheet (The actual tool)
    • Have a brief overview. (No need to read everything)
  • (Feel free to check Tero's short Kybermittari page if you need extra material.)
• a) Make-belief analysis. Write a short story for choosing a couple of subpoints in Kybermittari. Have imaginary persons with roles, write a story by having them speak, decide and comment on maturity. Make sure they have different expertice, e.g. also outside cybersecurity. You can choose a couple of subpoints (2d, 2e...) on any domain (critical, asset...). Add a screenshot of what they ended up with. (No technical tests on computer required, apart from using the spreadsheet.)
• b) Sucks or succeeds. How could Kybermittari process be really useless? How could it be really useful? (No tests on computer required.)
• c) Competition. What approaches, models or tools could compete with Kybermittari? Are there any benefits or downsides for those? Feel free to find your own sources. (No tests on computer required. 1-2 examples are enough.)

h7 SecuDream # ↑

• a) SecuDream(tm). Cyber security course ... of my dreams.
  • Outline a cyber security course - for you.
    • Goals (2-5. After the course, the student...)
    • Outline/Agenda (what's the theme each time)
    • Exercises (No need to figure out the technical details, you can just describe them or give examples. You don't need to be able to solve those exercises. Are they written, hands-on labs, group work, facilitated discussions, roleplay, capture-the-flag...)
    • Models of frameworks you like (if you don't know the name, you can just describe the purpose of any wouldnt-it-be-nice framework)
    • Visiting lecturers, excursions and other special events (You can describe them, don't need to name the person or company unless you know one on the top of your head)
    • Rationale for some choices, if you want. (Need this at work, always wanted to know, my favourite approach, I believe this is the future...)
  • Think outside the box
    • Never mind the budget
    • This is not the feedback for my course, this is you dreaming. Dream course does not have to fit other students, Haaga-Helia budget or our master's studies goals. Just yours.

The deadline for voluntary h8 is the same as h7.

h8 Bonus # ↑

• a) Voluntary: Improved. List and link the tasks you have significantly improved after they have been cross evaluated.
• b) Voluntary: Extras: List and link voluntary extra tasks you have completed.

The deadline for voluntary h8 is the same as h7.

Adminstrivia # ↑

Updates to this page could happen before, during and after the course. First realization of the course, there could be major changes before committing to course description. Picture of Mika's cryptomining rig by Mika Hirvelä.

RSS Feed icon ic:sharp-rss-feed received under the Apache 2.0 license, part of "Google Material Icons" collection.