Unit 1: Cybersecurity I Review and Advanced Lab Orientation
Lesson at a glance
| Item | Detail | | --------------------- | ------------------------------------------------------------------------- | | Suggested length | 4 × 60 minutes | | Recommended placement | Week 1 of Cybersecurity II | | Prerequisite | Cybersecurity I (or equivalent) | | Materials | Workstations, hypervisor, refreshed VM images, updated Lab Safety + RoE | | Required forms | Re-signed Lab Safety Agreement (advanced edition) and Rules of Engagement |
Safety: Cyber II re-signs everything. Later units teach authorized offensive technique (Unit 6 exploitation, Unit 7 web testing) and SOC investigations (Unit 8) against fictional lab targets only. The signed forms are the gate. No real networks. No live internet targets.
Standards & credential alignment
- EHE / OffSec PEN-100 / SOC-100: bridge orientation.
- VA CTE Advanced Cybersecurity: lab safety, professional documentation.
Learning objectives
By the end of this unit, students can:
- Rebuild the cyber range with a segmented multi-VM topology (attacker, target, victim, monitoring).
- Validate networking, snapshots, and out-of-band recovery.
- Re-articulate the three-question test and demonstrate updated RoE understanding.
- Establish documentation expectations: every action timestamped, every command logged, every snapshot named.
- Operate in a 2-person team with defined roles (operator, recorder).
Vocabulary refresh + new
- Cyber range - Isolated lab environment for safe offensive/defensive practice.
- Out-of-band - A communication or recovery path independent of the system being managed.
- Baseline - Known-good configuration of a system.
- Operator / Recorder - Two-person engagement roles. Operator runs commands; recorder logs everything.
- Engagement notes - Single source of truth for an engagement; every action goes in.
Pacing
| Day | Focus | Deliverable | | --- | ------------------------------------------ | ----------------------------------------------- | | 1 | Rebuild and segment the range | Three working VMs, host-only network, snapshots | | 2 | Validate baselines | Documented baseline for Windows + Linux targets | | 3 | Documentation expectations + team workflow | Operator/recorder dry run | | 4 | Updated RoE + signing ceremony | Signed RoE on file |
Day 1 - Range topology
Build out:
[Kali attacker] --- host-only-1 (192.168.56.0/24) --- [Win10 target]
--- [Ubuntu target]
--- [SIEM/monitoring VM]
Each student team confirms:
- All four VMs boot.
- Each has a static or DHCP-reserved IP on the lab network.
- All have a
clean-installsnapshot. - Inter-VM ping works in both directions.
Day 2 - Baselines
Document the known good state of the Windows and Ubuntu targets:
- OS version, patch level
- Local accounts (full list)
- Listening ports (
netstat -ano/ss -tlnp) - Running services (
Get-Service/systemctl) - Installed software inventory
- File hash of critical configuration files
Save as baseline-YYYY-MM-DD.md in the engagement folder. Future investigations will diff against this.
Day 3 - Operator / recorder workflow
Pair up. Roles:
- Operator: runs commands. Says them aloud before pressing Enter ("running
nmap -sVagainst192.168.56.20"). - Recorder: logs each command into the engagement notes file with timestamp. No "you should remember it" - write it down.
Practice on a simple recon dry-run. Switch roles halfway. Land the line: "In professional engagements, your notes are evidence. Treat them like it."
Day 4 - RoE re-signing ceremony
Read the advanced RoE aloud, line by line. Differences from Cyber I:
- Authorizes exploitation, password attacks, privilege escalation inside the lab range only.
- Authorizes use of Metasploit, Burp Suite Community, john/hashcat against teacher-issued hash sets only.
- Mandates engagement notes for every action.
- Establishes a "stop and call" protocol: any unexpected behavior = stop immediately, record state, get teacher.
Students sign. Both signatures (advanced RoE + advanced Lab Safety) get filed.
Teacher background (read this before the lesson)
Cyber II fails when last year's VMs are treated as "good enough." Snapshots rot, passwords drift, and students who remember the three-question test still skip it under time pressure. Your job this week is not novelty. It is to rebuild a clean range, reinstall documentation habits, and make the advanced RoE feel like a professional gate — not a signature they race through.
Land two frames on Day 1 and leave them on the wall:
- Undocumented work did not happen. Engagement notes are evidence.
- Authorized technique, fictional targets. Unit 6 and Unit 7 will use real tools against lab systems only. Anyone who cannot say that sentence out loud is not ready for those units.
Watch for the student who says "I already know this." Put them on recorder first. Recorders who write sloppy timestamps become operators who skip snapshots.
Materials checklist
- [ ] Fresh Kali, Windows, Ubuntu, and monitoring/SIEM images (or last year's images marked for rebuild)
- [ ] Printed advanced Lab Safety Agreement and advanced RoE (one per learner, plus a guardian copy for K–12)
- [ ] Worksheet PDFs and engagement-notes template
- [ ] Wall poster: three-question test + "stop and call" protocol
- [ ] Snapshot naming convention posted:
clean-install,pre-lab-YYYY-MM-DD,end-of-day
Differentiation, IEP, and 504 supports
- Reading support: RoE can be read aloud; learners annotate a large-print copy.
- Processing time: Pair a faster operator with a recorder who needs more time; switch roles at the halfway mark so both practice both jobs.
- Executive function: The Day 1 topology checklist is the accommodation — do not skip it for anyone.
- EL learners: Label the four VMs with color cards (attacker / target / victim / monitor) and keep those colors on worksheets.
- Adult / professional overlay: Use the Participant Acknowledgment instead of a guardian form. Same RoE standard.
Common misconceptions
- "I already did this last year." - The range needs to be rebuilt fresh; old VMs may have decayed snapshots and stale passwords. Time spent here saves the entire semester.
- "Documentation is optional." - In professional engagements, undocumented work didn't happen. Same here.
- "If it boots, the range is ready." - Boot is necessary, not sufficient. Ping both directions, confirm reserved IPs, and take a named snapshot before any tool runs.
- "Advanced RoE means I can try anything interesting." - Advanced RoE widens technique inside the lab range. It does not widen targets.
Assessment
Use this rubric (each 1–4) on the Day 1–3 packet:
| Criterion | 4 | 2 | 1 | | --- | --- | --- | --- | | Range readiness | Four VMs, addressing, bidirectional ping, named snapshots | Missing one check | Missing two or more | | Baseline quality | Accounts, ports, services, hashes recorded | Partial inventory | Screenshot only | | Engagement notes | Timestamp, command, target, result | Commands without timestamps | Memory / "we did nmap" | | RoE fluency | Can apply three-question test to a new scenario | Recites the test | Cannot apply it |
- Day 1 deliverable: screenshot of all four VMs + ping success.
- Day 2 deliverable: baseline markdown file submitted.
- Day 3 deliverable: a sample engagement notes file from the dry run.
- Day 4 deliverable: signed RoE on file. No Unit 2 lab access without it.
Career connection
Real engagements always start with environment validation. Skipping it produces false findings, missed evidence, and blown engagements. Senior operators are the ones who insist on Day-1 baselines.
Homework / next class
Read NIST SP 800-115 §2 (planning) and §5 (test control and evidence). One paragraph: which control in §5 would have prevented a teammate from "just trying a scan" on the wrong interface? Be ready to discuss.