Cyber Defender

Broadly speaking, there are three categories of prerequisites:

Although you need not be an IT professional or programmer, you should have strong basic computer skills.

You should have the right personality; specifically, you should be:

• intensely curious about how things work
• unwilling to give up on a problem no matter how difficult it is
• highly attentive to detail
• predisposed to independent learning.

You should be able to devote an honest 25 hours/week to the program.

You don't need to have an IT or computer science background to succeed in cybersecurity. But, successful students need strong basic computer skills, such as the ability to install and run complex applications. If you are unfamiliar with computer networks and protocols, we will recommend materials for you as pre-work. In addition, there are several online tutorials, including some on YouTube that will also be preparation for the kind of research you will perform in the courses.

If you are unsure of your computer skills, we will be glad to provide a pre-assessment.

Immediate Immersion is primarily to enable a person to self-assess if they like the work and believe they will be good at it and also to allow us to assess their likelihood of professional success. It also teaches thinking like an attacker and the basic skills of network traffic analysis.

Cyber Defender 1 focuses on security operations center analyst skills, specifically more advanced network traffic analysis, log analysis, and "lightweight" malware analysis.

Cyber Defender 2 focuses on digital forensics and incident response -- skills that are employed after a breach is discovered.

You must successfully complete all three courses to earn the Cyber Defender Certificate.

A career switcher should certainly take all three courses. A working IT professional, who is specifically interested only in the security operations center role might opt to take only Immediate Immersion and Defender 1; it would be preferred, however for that person to broaden his or her knowledge and skills by taking all three courses.

The three courses build on each other, so they must be taken in order.

Rather than being a progression of typical lecture courses, the Cyber Defender Certificate is 100% project-based learning by doing. Students work through a progression of realistic tasks online in a private cloud environment, learning the necessary knowledge and skills just in time as the knowledge and skills are relevant to what the student is trying to accomplish. As they work, students are supported by help, advice, and feedback from a knowledgeable mentor and extensive online learning resources.

The courses run in cohort form with specific start and end dates. There will be one or two weekly meetings while a course is running that students are required to attend. The course instructor will work with the cohort to determine convenient meeting dates and times. The meetings are required because there are significant benefits to peer-to-peer experience sharing that will only be achieved if students are going through a course together. However, the majority of a student's time during the week is self-scheduled.

The scheduled meetings will take 1-2 hours/week; they are typically held on weekday evenings.

The total time commitment required is 25 hours/week including scheduled mentor meetings and independent work. (Some students opt to spend more time than this.)

Each course is six weeks long at 25 hours/week or 10 weeks long at 15 hours/week. The duration of a course is approximately 150 hours.

Wendy Lehnert, a retired professor from UMass Amherst, is the senior mentor for the program and mentors the Immediate Immersion course. Two other mentors are cybersecurity professionals whose only job is to help you to succeed in the program.

Only the Immediate Immersion course has a required textbook: Practical Packet Analysis: Using Wireshark to Solve Real-world Network Problems (3rd edition) by Chris Sanders. The book is available in printed and electronic form from the publisher, No Starch Press, and from Amazon. You are required to purchase this book, and we suggest that you purchase it from the publisher because the Amazon Kindle version does not have page numbers (which the Immediate Immersion course references) and also because the author receives a higher royalty if you buy the book from the publisher.

You will gain extensive experience with a wide range of professional tools. These include:

• NetworkMiner
• Wireshark
• Splunk
• Snort
• Volatility
• Autopsy
• Burp Suite
• HybridAnalysis
• VirusTotal
• Any.run

The focus of our program is to give you job-ready skills for an entry-level position, not to teach you to pass a multiple-choice test. If a graduate of the program wants to obtain a certification, we recommend CompTIA Security+ and an inexpensive (~$15) online course to cram for the test. If you opt to self-study for this test, we will provide additional mentoring at no cost.