What Security Teams Do

Monday morning at Kestrel Freight

At twenty past eight on a grey Monday, Megan Hart signs in at the reception desk of Kestrel Freight, a haulage company that moves goods by lorry for shops, factories and farms. It has about fifty staff: planners, drivers' managers, a small finance team, a warehouse office and a handful of IT people. Megan has just been hired as a junior security analyst. It is her first job in security.

Richard Lawson, who leads the security team, meets her at the lift. He has been doing this work for many years and has the calm manner of someone who has seen most things go wrong at least once.

“Welcome aboard,” he says. “Before you touch a single system, I want you to understand what we are actually here for. People think security is about hackers in hoods. Mostly it is about keeping a business running, keeping promises to customers, and noticing small things before they become big ones.”

This course follows Megan through her first weeks. Everything she learns, you learn; every task she is given, you will try yourself.

Why organisations need security people

Almost every organisation now depends on computers. Kestrel Freight plans its routes on a computer system, emails its customers, pays its staff through a payroll system, keeps its invoices on a file server and takes bookings through its public website. If any of these stops working, or falls into the wrong hands, the lorries stop moving and the money stops coming in.

At the same time, criminals have found that attacking organisations pays. They send fake invoices hoping someone will pay them. They steal passwords and read private emails. They lock files and demand money to unlock them. They copy customer records and sell them. Most of these criminals are not interested in Kestrel in particular: they attack thousands of organisations at once and wait to see which ones are easy. A small company is not too small to be a target; it is often simply an easier one.

There are other reasons too. Customers expect their information to be looked after. Data protection laws in many countries require organisations to protect personal information and to report serious breaches. Larger customers often ask their suppliers to show that they take security seriously before signing a contract. And insurers ask the same questions before they will cover a business.

So an organisation needs people whose job is to think about what could go wrong, to put sensible protections in place, to watch for trouble, and to respond calmly when something does happen. That is a security team. At a large bank it might be hundreds of people; at Kestrel it is Richard, Megan and a great deal of help from the IT department.

What a security team does all day

On her first morning Richard hands Megan a printed list: “the work that comes through this desk in a normal week”. It looks like this.

“Notice what isn't on the list,” says Richard. “Breaking into things. We are defenders. Most days are quiet and careful: reading records, asking questions, fixing small weaknesses before anyone uses them. The dramatic days are rare, and they go much better when the quiet days were done well.”

The records a defender reads

Much of a security analyst's work is reading records (often called logs): lines of text that computers write each time something happens. A sign-in system writes a record for every attempt to sign in; an email system writes one for every message it receives; a firewall (a device that decides which network traffic is allowed in and out) writes one for every connection it allows or blocks.

Kestrel keeps five sets of records, and this course gives you a real-looking copy of one full week of them, from Monday 7 to Sunday 13 September 2026:

• signins: every attempt to sign in to mail, files, payroll and the VPN (the secure connection staff use from home);
• firewall: connections between Kestrel's computers and the internet;
• web: every request made to Kestrel's public website;
• endpoint: activity on staff laptops, such as programs starting;
• email: every email that arrived, and whether it was delivered or held back.

Something went badly wrong at Kestrel during that week. You will uncover it piece by piece as the course goes on. For now, try the search box below. It shows the email records. The search verdict=quarantined finds emails that the email filter held back instead of delivering (quarantine means putting something aside so that it cannot do harm). Adding | count by sender counts them for each sender. Try the examples, then look at an ordinary day's email with recipient=susan.pike@kestrelfreight.example.

The email filter held back 44 emails that week: 22 from a prize-draw sender that nobody at Kestrel wanted, and 22 from an address calling itself Kestrel's billing department. If you try the third example, you will see something worrying: 47 emails failed the filter's sender check (a test of whether an email really comes from where it claims), but only 44 were held back. Three emails that failed the check were delivered anyway, and all three came from that so-called billing department. Megan will find out why that matters in Module 2.

Security roles

Security is a wide field, and people specialise. Job titles vary from one organisation to another, but these are the roles you will meet most often. In a small company one person may do several of them; in a large one each may be a whole team.

None of these roles requires you to be a programming genius. They require curiosity, care with detail, clear writing, patience, and the habit of asking “how do we know?” Those are skills this course will help you practise.

Meet the team

By lunchtime Megan has met the people she will work with most. You will see them throughout the course.

• Richard Lawson, security team lead: Megan's manager and mentor. Experienced, unhurried, and fond of answering a question with another question.
• Claire Dunmore, IT manager: runs the servers, the network and staff accounts. Practical and busy; she likes suggestions that come with a plan.
• Ben Archer, help-desk technician: resets passwords, sets up laptops and hears about every problem first.
• Susan Pike, finance director: in charge of payments and payroll, which makes her a favourite target of fraudsters.
• Tom Baxter, transport planner: cheerful, very busy, and about to have a difficult week through no great fault of his own.

Kestrel's network is simple. Staff laptops (named LT-001 to LT-049) have addresses beginning 10.20.1, 10.20.2 or 10.20.3. The servers for email, files and naming sit at addresses beginning 10.20.10. The public website lives on its own at 198.51.100.20, in a separate part of the network that the internet can reach. Staff working from home connect through the VPN and are given addresses beginning 10.20.50.

Just before lunch, an email from Richard arrives in Megan's inbox. It is a genuine message, and a good example of how a security team tries to work. Press the button to see why.

How this course works

Each lesson has a short scene from Megan's working life, clear explanations with examples, and practical pieces you can use as you read:

• Record searches like the one above, on Kestrel's week of records.
• Pretend messages: emails, texts, calls and web pages you can examine, with a button that explains the warning signs (or, like Richard's email, the good practice).
• Practice tools for testing passwords, reading web links, and seeing how scrambling and fingerprinting of data work.
• Exercises, from lesson 1.2 onwards: five in each lesson, in eight different kinds, from choosing an answer to writing a search that finds exactly the right records. Each is checked immediately, with hints when you go wrong and a full answer if you want it.
• A quick check of four questions and a summary at the end of each lesson.

The course has ten modules. It begins with how defenders think, moves through how attacks happen, accounts and passwords, networks, records and monitoring, protecting computers and data, websites and cloud services, and handling incidents, then covers policies, people and careers, and finishes with a full investigation of Kestrel's week.

The defender's promise

This is a course about defence. You will learn how attacks work in enough detail to recognise them, spot them in records, prevent them and respond to them. You will not learn how to carry them out, and nothing here should ever be tried against a system you do not own or have not been given written permission to test.

Richard puts it simply on Megan's first afternoon: “We have a lot of power in this job. We can read people's sign-in records, see what their laptops are doing, look at which emails they received. That power exists to protect them, not to snoop on them. We look only at what we need for the task in hand, we keep what we find to ourselves unless it needs to be shared, and we never blame people for being tricked. Criminals are very good at tricking people. Our job is to make their tricks fail.”

Quick check

Choose an answer to see whether you are right and why.

Found a mistake on this page, or something unclear? Report a problem and mention “Cybersecurity Fundamentals Lesson 1.1”.