Module 1: Computing & digital foundations

Estimated time: 3-4 hours (including the lab) · Prerequisites: M0

You can't secure what you don't understand. This module builds the mental model of how a computer actually works that everything else in cyber sits on top of. It ends with your first hands-on lab, a safe practice environment you'll reuse for the rest of the course.

What you'll get from this module

• Explain the main parts of a computer and what each does.
• Describe what an operating system is and compare Windows, Linux and macOS.
• Understand virtualisation and why it's essential for safe security practice.
• Understand files, file systems and permissions at a basic level.
• Read binary and hexadecimal well enough to not be scared by them.
• Build a Linux virtual machine to use as your lab.

---

1. The parts of a computer

Think of a computer as an office:

Part	Office analogy	What it does
CPU	The worker	Executes instructions: the actual "computing."
RAM (memory)	The desk	Fast, temporary workspace for whatever is running now. Cleared when powered off.
Storage (SSD/HDD)	The filing cabinet	Slower, permanent storage for files and programs.
Operating System	The office manager	Coordinates everything (see below).
Network interface	The mailroom	Sends/receives data to other computers (covered in M2).

Why security cares: attacks target each of these. Malware runs on the CPU; secrets can be stolen from RAM; data is encrypted or exfiltrated from storage; attackers move across the network. Knowing where things live tells you where to defend.

---

2. What an operating system (OS) does

The OS is the software that sits between hardware and the programs you use. It manages memory, runs programs (as processes), controls the file system, and (crucially for security) enforces permissions: who is allowed to do what.

The three you'll meet:

• Windows: dominant on corporate desktops. Most enterprise attacks you'll investigate happen here (Active Directory, etc.).
• Linux: runs most servers, cloud workloads and security tools. You will use Linux constantly in cyber. This module gets you a Linux machine.
• macOS: common on developer/creative fleets; Unix-based, so it feels similar to Linux at the command line.

Want to go deeper? Microsoft's free documentation on Windows security fundamentals is a good reference for how a modern OS enforces security.

---

3. Virtualisation: your safety net

A virtual machine (VM) is a complete computer running as software inside your real computer. The software that runs VMs is a hypervisor (e.g. VirtualBox, VMware, Hyper-V).

Why this matters enormously in security:

• Isolation: you can run risky things (malware samples, deliberately vulnerable apps) inside a VM without touching your real system.
• Snapshots: save a "known good" state and roll back instantly if something breaks.
• Disposability: delete and rebuild in minutes.
• Free practice: run Linux without wiping your Windows/Mac.

Related idea: containers (e.g. Docker) do something similar but lighter-weight, packaging one app and its dependencies. You'll use Docker later to run OWASP Juice Shop on your own machine.

---

4. Files, file systems and permissions

• A file system organises data into files and folders (directories) on storage.
• Every file has metadata: name, size, timestamps, and permissions.
• Permissions decide who can read, write, or execute a file. On Linux you'll see notation like rwxr-xr-x.
• The principle behind good security here is least privilege: give each user and process only the access it needs, nothing more. This idea returns in M6 (Identity) and M10 (GRC).

---

5. Binary and hex (don't panic)

Computers store everything as bits: 1s and 0s.

• Binary is base-2: each digit is a bit. 8 bits = 1 byte.
• Hexadecimal (hex) is base-16 (digits 0-9 then a-f). It's just a compact way to write binary: one hex digit = 4 bits. You'll see hex in memory addresses, hashes, and colour codes.

You don't need to do mental arithmetic in binary. You do need to recognise them and know a converter exists. Example: the decimal number 255 is 11111111 in binary and FF in hex.

---

🧪 Lab 1: Build your Linux practice VM

This lab runs entirely on your own machine, nothing to pay for, nothing hosted by us.

You'll need: a computer with ~40 GB free disk and 8 GB+ RAM ideally.

Steps:

1. Install a hypervisor. Download and install VirtualBox (free, open-source) from virtualbox.org. On Windows 11 with Hyper-V you can use Hyper-V instead, but VirtualBox is the simplest cross-platform choice.
2. Get a Linux image. Download Ubuntu Desktop LTS (beginner-friendly) from ubuntu.com/download/desktop, or Kali Linux (security-focused, more advanced) from kali.org/get-kali. Start with Ubuntu if you're new.
3. Create the VM in VirtualBox: New → give it 2+ CPUs, 4096 MB+ RAM, a 25 GB+ virtual disk, and attach the downloaded .iso.
4. Install Linux by booting the VM and following the installer.
5. Take a snapshot once it boots to the desktop (VirtualBox → Machine → Take Snapshot). Name it clean-install. Now you can always roll back.
6. Open a terminal in your Linux VM and run these three commands to confirm it works:

   whoami      # prints your username
   pwd         # prints your current directory
   ls -la      # lists files, including permissions like rwxr-xr-x

Prefer not to install anything yet? You can also get a free browser-based Linux machine later via TryHackMe (M3), but building your own VM is worth doing once, because it's yours to keep and break.

Lab success = you have a Linux VM that boots, you took a snapshot, and the three commands above ran.

---

Self-check

Answer before you reveal. The attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 6A compromised laptop is about to be powered off, and a senior investigator says “capture the memory first”. Why the urgency?

Storage is wiped when power is lost, so the files need saving firstRAM is temporary and cleared at power-off, so evidence living only in memory disappearsThe CPU keeps a permanent log of every instruction it has run

Question 2 of 6First week in a SOC at a large Australian organisation. Which OS will most of the enterprise attacks you investigate live on, and which one runs most of your security tools?

Windows for both: it dominates the corporate worldAttacks mostly on Windows; tools mostly on LinuxBoth mostly on macOSAttacks mostly on Linux; tools mostly on Windows

Question 3 of 6You’ve been handed a suspicious file to examine. Why is running it inside a VM safer than running it on your real machine?

A VM automatically detects and deletes any malware inside itMalware simply cannot execute inside a VMThe hypervisor encrypts the suspicious file so it can’t do harmThe VM is isolated from your real system, and a snapshot lets you roll back. Damage stays inside the disposable VM

Question 4 of 6A new starter in accounts asks for full admin rights on the file server “just in case”. Which principle says no, and why?

Least privilege: give each user only the access they need, nothing moreIsolation: risky users should be moved into a VMMetadata: the file server already records who owns each file

Question 5 of 6A memory address in a report ends in FF, and a teammate asks what FF means in decimal. What do you say?

255, and if I ever forget, a converter exists; nobody does this arithmetic in their head16, because hex is base-16It can’t be converted: hex and decimal are unrelated systems

Question 6 of 6Lab 1: your Ubuntu VM has just booted to the desktop for the first time. What’s the very next move before you start experimenting?

Install Kali as a second VM straight awayStart running risky files to test the isolationTake a snapshot named clean-install so you can always roll back

These parts and terms (CPU, RAM, hypervisor, rwxr-xr-x) are the mental model every later module quietly builds on, so drill them until naming them is reflex, not recall.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 18

Prompt

CPU: office analogy and job?

---

Next module

➡️ M2: Networking fundamentals: how data actually moves between computers: TCP/IP, DNS, and ports.