Cybersecurity Foundations
Build safer online habits through three short lessons, realistic examples, and focused practice labs.
Start here
Course introduction
Security advice is easier to remember when it connects to a decision you actually make. This course covers three of those decisions: whether to trust a message, how to protect an account, and when to trust a download.
Each short lesson is followed by an existing BLT University lab. Read the idea, try the scenario, and return here to see your course progress update.
By the end of this course, you can
- Spot pressure tactics and verify suspicious messages before acting.
- Build stronger password and MFA habits.
- Practice safe browsing and account-recovery decisions.
Learn, then practice
Course lessons
Work through these 3 lessons in order. Each lesson introduces one concept, then gives you a practical activity or lab to apply it.
Read the pressure before the message
Not startedPhishing works by making an ordinary request feel urgent enough to skip verification.
Start with the request, not the logo. A message can look polished and still ask you to do something unsafe. Pause when it asks for a password, payment, recovery code, or quick download.
Check the sender using a channel you already trust. If the message claims to come from your bank or workplace, open the official site yourself instead of following its link.
Your account closes in 10 minutes.
Confirm your password at secure-account-check.example.
The deadline and password request matter more than the professional-looking wording.
This is the part people usually overlook. Urgency is evidence, not a reason to move faster.
Put it into practice
Practice labs
Protect the account, not just the password
Not startedA unique password and a second factor limit how far one stolen credential can travel.
Password reuse turns one breach into several account takeovers. A password manager helps because it can create a different password for every service without asking you to remember each one.
Multi-factor authentication adds another check. Prefer an authenticator app or security key when the service supports one, and keep recovery codes somewhere separate from the device you use every day.
shopping site leaked password
↓
same password opens email
↓
email resets other accounts
The first compromised site does not need to be important if the password is reused elsewhere.
Put it into practice
Practice labs
Make downloads earn your trust
Not startedA familiar-looking page does not make its download, permission request, or public network safe.
Prefer official stores and vendor pages. Check the domain, file type, and reason for the download before opening it. Unexpected browser notifications and extension permissions deserve the same pause.
Updates close known weaknesses, but fake update prompts are common. Open the application or device settings and update from there when a website suddenly claims your software is outdated.
Before moving on, ask what the site gains from the permission it requests. If the answer is unclear, deny it.
Put it into practice
Practice labs
Continue learning
Up next: Introduction to Web Application Security
Learn where web applications lose trust, then practice each idea in the existing hands-on security labs.