NXFury Information Security

Path to a free self-taught education in Information Security!

Contents

• Summary
• Community
• Curriculum
• Code of Conduct
• Credits

Summary

The NXFury curriculum is a complete education in information security using online materials. It's not merely for career training or professional development. It's for those who want a proper, well-rounded grounding in concepts fundamental to all information security disciplines, and for those who have the discipline, will, and (most importantly!) good habits to obtain this education largely on their own, but with support from a worldwide community of fellow learners.

It is designed based on the Open Source Society's Computer Science curriculum, and it is assumed most of the people following this curriculum are already vaguely familiar with the world of computing. The courses themselves are hand selected for the highest quality, but specifically chosen to meet the following criteria.

Courses must:

• Be open for enrollment
• Run regularly (ideally in self-paced format, otherwise running multiple times per year)
• Be of generally high quality in teaching materials and pedagogical principles

When no course meets the above criteria, the coursework is supplemented with a book. When a student wishes to pursue industry, level certifications, the curriculum shall include opportunities to substitute training for those in place of pre-existing course materials. When there are courses or books that don't fit into the curriculum but are otherwise of high quality, they belong in extras/courses or extras/readings.

Organization. The curriculum is designed as follows:

• Introductory Materials: for students to gain a basic foundation in programming, usage of certain software, logic, and critical thinking.
• Core Curriculum: The essential core of Information Security, required knowledge for well rounded adequate advancement in the field.
• Advanced Information Security: A more advanced set of skills required for high-fidelity or more masterful work, where students are able to pick what they wish to concentrate on.
• Specialization: Students must pick a specilization and complete the listed courses in it in order to better understand a particularly relevant niche.
• Final Project: A project for students to validate, consolidate, and display their knowledge, to be evaluated by their peers worldwide.

Duration. It is possible to finish within about 2 to 2.5 years if you plan carefully and devote roughly 20 hours/week to your studies. Remember, the more time you commit, the faster you'll progress!

Cost. All or nearly all course material is available for free. However, some courses may charge money for assignments/tests/projects to be graded. Note that both Coursera and edX offer financial aid.

Decide how much or how little to spend based on your own time and budget; just remember that you can't purchase success!

Process. Students can work through the curriculum alone or in groups of up to 5, ideally following the suggested order.

• We recommend doing all courses in the Core Curriculum, only skipping a course when you are certain that you've already learned the material previously.
• For simplicity, we recommend working through courses (especially the Core Curriculum) in order from top to bottom, as they have already been topologically sorted by their prerequisites.
• Courses in Advanced Information Security are electives. Choose one subject (e.g. Advanced Programming) you want to become an expert in and take all the courses under that heading. You can also create your own custom subject, but we recommend getting validation from the community on the subject you choose.
• Courses in Specialization are also a form of elective. However, you are picking a particular niche rather than a set of classes.

Content policy. If you plan on showing off some of your coursework publicly, you must share only files that you are allowed to. Do NOT disrespect the code of conduct that you signed in the beginning of each course!

How to contribute

Getting help (Details about our FAQ and chatroom)

Community

• We have a discord server! This should be your first stop to talk with other NXFury students. Why don't you introduce yourself right now? Join the NXFury Discord
• You can also interact through GitHub issues. If there is a problem with a course, or a change needs to be made to the curriculum, this is the place to start the conversation. Read more here.

Curriculum

Curriculum version: 0.0.1 (see CHANGELOG)

• Prerequisites
• Introductory Materials
  • Introduction to Programming
  • Introduction to Computer Science
  • Introduction to Critical Thinking and Basic Logic
• Core Curriculum
  • Basics
  • Core ethics
  • Databases
  • Core Security
• Advanced Information Security
  • Advanced Programming
  • Advanced Information Security
• Specialization
  • Digital Mobile Forensics
  • Software Reverse Engineering
  • Secure Software Development
  • Security Compliance
  • Cryptography
• Final project

---

Prerequisites

• Core Curriculum assumes the student has already taken high school math. This includes algebra, geometry, and pre-calculus.
• Advanced Information Security and Specialization assumes the student has already taken the entirety of the Core Curriculum and is knowledgeable enough now to decide which electives to take.

Introductory Materials

Introduction to Programming

If you've never written a for-loop, or don't know what a string is in programming, start here. This course is self-paced, allowing you to adjust the number of hours you spend per week to meet your needs.

Topics covered: simple programs simple data structures

Courses	Duration	Effort	Prerequisites
Python for Everybody	10 weeks	10 hours/week	none

Introduction to Computer Science

This course will introduce you to the world of programming. Students who have been introduced to programming, either from the courses above or through study elsewhere, should take this course for a flavor of the material to come. If you finish the course wanting more, Information Security is likely for you!

Topics covered: computation imperative programming basic data structures and algorithms and more

Courses	Duration	Effort	Prerequisites
Introduction to Computer Science and Programming using Python (alt)	9 weeks	15 hours/week	high school algebra
The Missing Semester of Your CS Education	2 weeks	12 hours/week	-

Introduction to Critical Thinking and Basic Logic

This course will introduce you to basic logic to be applied to your decision making process. While not a course in complete, formal logic, it aims to introduce core concepts in order to instill critical thinking skills in the student. This will ideally aid in your decision making and approach to problem solving.

Topics covered: arguments deductive reasoning boolean logic reasoning and more

Courses	Duration	Effort	Prerequisites
Introduction to Logic and Critical Thinking Specialization	16 Weeks	5 hours/week	none

Core Curriculum

All coursework under Core Curriculum is required, unless otherwise indicated.

Basics

Topics covered: functional programming unit testing object-oriented design static typing dynamic typing manual memory management boolean algebra gate logic memory computer architecture and more

The How to Code courses are based on the textbook How to Design Programs. The First Edition is available for free online and includes problem sets and solutions. Students are encouraged to do these assignments.

Courses	Duration	Effort	Prerequisites
How to Code - Simple Data	7 weeks	8-10 hours/week	none
How to Code - Complex Data	6 weeks	8-10 hours/week
Object-Oriented Design	4 weeks	4 hours/week	Basic Java
Design Patterns	4 weeks	4 hours/week	Object-Oriented Design
Software Architecture	4 weeks	2-5 hours/week	Design Patterns
Build a Modern Computer from First Principles: From Nand to Tetris (alt)	6 weeks	7-13 hours/week	-
Build a Modern Computer from First Principles: Nand to Tetris Part II	6 weeks	12-18 hours/week	-
C For Everyone: Programming Fundamentals	3-4 weeks	12-15 hours/week	-
C For Everyone: Structured Programming	2 weeks	5 hours/week	-
Computer Networking	12 weeks	5-8 hours/week	-

Core ethics

Topics covered: Privacy and Civil Liberties and more

Courses	Duration	Effort	Prerequisites
Data Privacy Fundamentals	3 weeks	3 hours/week	none

Databases

Topics covered: REST refactoring relational databases transaction processing and more

Courses	Duration	Effort	Prerequisites
Databases: Modeling and Theory	2 weeks	10 hours/week	core programming
Databases: Relational Databases and SQL	2 weeks	10 hours/week	core programming
Databases: Semistructured Data	2 weeks	10 hours/week	core programming

Core security

Topics covered Confidentiality, Integrity, Availability Secure Design Defensive Programming Threats and Attacks Network Security Cryptography and more

Courses	Duration	Effort	Prerequisites
Cybersecurity Fundamentals	8 weeks	10-12 hours/week	-
Principles of Secure Coding	4 weeks	4 hours/week	-
Identifying Security Vulnerabilities	4 weeks	4 hours/week	-

Courses	Duration	Effort	Prerequisites
Identifying Security Vulnerabilities in C/C++Programming	4 weeks	5 hours/week	-
Debuggers 1011: Introductory WinDbg	2 weeks	10-15 hours/week	-
Debuggers 1012: Introductory GDB	2 weeks	10-15 hours/week	-
Exploiting and Securing Vulnerabilities in Java Applications	4 weeks	5 hours/week	-

Advanced Information Security

After completing every required course in the Core Curriculum, students should choose a subset of courses from Advanced Information Security based on interest. Not every course from a subcategory needs to be taken. But students should take every course that is relevant to the field they intend to go into.

Advanced programming

Topics covered: debugging theory and practice goal-oriented programming parallel computing object-oriented analysis and design UML large-scale software architecture and design and more

Courses	Duration	Effort	Prerequisites
Architecture 1001: x86-64 Assembly	8 weeks	10-15 hours/week	C programming
Architecture 2001: x86-64 OS Internals	6 weeks	10-15 hours/week	x86-64 Assembly Programming
Parallel Programming in Java	4 weeks	5 hours/week	Java programming
Software Testing	4 weeks	6 hours/week	Python, programming experience

(*) book by Blackburn, Bos, Striegnitz (compiled from source, redistributed under CC license)

Advanced Information Security

Courses	Duration	Effort	Prerequisites
Web Security Fundamentals	5 weeks	4-6 hours/week	understanding basic web technologies
Security Governance & Compliance	3 weeks	3 hours/week	-
Digital Forensics Concepts	3 weeks	2-3 hours/week	Core Security

Specialization

After completing the curriculum above, you are finally ready to pursue a specialization in Information Security! Choose at least one of the below subcategories to complete:

Digital Mobile Forensics

Learn to extract data from mobile devices, with (or without) credentials.

Courses	Duration	Effort	Prerequisites
Android Forensics and Security Testing	3 weeks	10-15 hours/week	-
Introduction to ARM	8 weeks	10-15 hours/week	x86-64 Assembly Programming

Software Reverse Engineering

Become good at understanding how software works, with limited to no available source code.

Courses	Duration	Effort	Prerequisites
Reverse Engineering 3011: Reversing C++ Binaries	5 weeks	10-15 hours/week	C and Assembly Programming
Reverse Engineering 3201: Symbolic Analysis	5 weeks	10-15 hours/week	C, Python, Assembly Programming

Secure Software Development

Develop Secure Software that's hard to exploit.

Courses	Duration	Effort	Prerequisites
Secure Software Development: Requirements, Design, and Reuse	7 weeks	1-2 hours/week	Core Programming and Core Security
Secure Software Development: Implementation	7 weeks	1-2 hours/week	Secure Software Development: Requirements, Design, and Reuse
Secure Software Development: Verification and More Specialized Topics	7 weeks	1-2 hours/week	Secure Software Development: Implementation

Security Compliance

Learn security standards in which the industry builds networks and systems, and how to implement them effectively. We have elected to train to NIST standards, as we believe risk evaluation, a core piece of NIST standards, to be an important component in information security.

Courses	Duration	Effort	Prerequisites
NIST CSF	1 week	4 hours/week	-
NIST DoD RMF	1 week	4 hours/week	NIST CSF
NIST 800-171	2 weeks	3 hours/week	NIST DoD RMF

Cryptography

Design and implement cryptographic systems, learn how they work, and learn what makes certain encryption algorithms more secure than others.

Courses	Duration	Effort	Prerequisites
Cryptography I	7 weeks	2.5 hours/week	-
Applied Cryptography	20 weeks	2 hours/week	-
Mathematical Foundations for Cryptography	4 weeks	4 hours/week	-

Final project

The NXFury Information Security curriculum is project-focused. The assignments and exams for each course are to prepare you to use your knowledge to solve real-world problems.

After you've gotten through the above curriculum, you should think about a problem that you can solve using the knowledge you've acquired. Not only does real project work look great on a resume, but the project will also validate and consolidate your knowledge. You can create something entirely new, or you can find an existing project that needs help via websites like CodeTriage or First Timers Only.

Evaluation

Upon completing your final project:

• Submit your project's information to PROJECTS via a pull request.

• Put the NXFury Information Security badge in the README of your repository!

  • Markdown: [![NXFury- Information Security](https://img.shields.io/badge/NXFURY-Information%20Security-blue.svg)](https://github.com/TheNXFury/NXFuryInfoSec)
  • HTML: <a href="https://github.com/TheNXFury/NXFuryInfoSec"><img alt="NXFury- Information Security" src="https://img.shields.io/badge/NXFURY-Information%20Security-blue.svg"></a>

• Use our community channels to announce it to your fellow students.

Solicit feedback from your NXFury peers. You will not be "graded" in the traditional sense — everyone has their own measurements for what they consider a success. The purpose of the evaluation is to act as your first announcement to the world that you are an information security specialist and to get experience listening to feedback — both positive and negative.

The final project evaluation has a second purpose: to evaluate whether NXFury, through its community and curriculum, is successful in its mission to guide independent learners in obtaining a world-class information security education.

Cooperative work

You can create this project alone or with other students! We love cooperative work! Use our channels to communicate with other fellows to combine and create new projects!

Which programming languages should I use?

My friend, here is the best part of liberty! You can use any language that you want to complete the final project.

The important thing is to internalize the core concepts and to be able to use them with whatever tool (programming language) that you wish.

How we grade your project

In our Discord Server, please submit your project as a github repo to our staff. Your project will be graded on the following:

• Demonstration of skills you have learned throughout the curriculum
• Project is of sufficient size for the quantity of people involved in the project

Students should note that the following will not be accepted as submissions:

• Projects involving any illegal activity whatsoever
• Attempts to "rank up" in penetration testing labs online.
• Projects that contain excessive copying of others' work.

Congratulations

After completing the requirements of the curriculum above, you will have completed the equivalent of a full bachelor's degree in Computer Science. Congratulations!

What is next for you? The possibilities are boundless and overlapping:

• Look for a job in information security!
• Check out the readings for classic books you can read that will sharpen your skills and expand your knowledge.
• Join a local hacker meetup (e.g. via meetup.com).
• Engage in bug bounties to make software more secure (e.g. via HackerOne).

Code of conduct

NXFury Code Of Conduct.

Credits

The original template for this course generously provided by the Open Source Society University. Security-related courses provided by OpenSecurityTraining.