Course description

This course aims to give students a solid understanding of the basics of modern internet technologies and an introduction to the most common types of attacks used in cybercrime and cyberwarfare. Taught by a long-time cybersecurity practitioner, each session will begin with a lecture covering the basics of an area of technology and how that technology has been misused in the past. After a short break, students will then begin a hands-on lab section, with the guidance of the instructor, where they attack a known insecure system using techniques and tools seen in the field. By the end of the course, students are expected to have a basic understanding of some of the most common offensive techniques in use today as well as the impact of AI on cybersecurity. No computer science background is required. All students must bring a Windows, Mac OS X or Linux laptop to class.

Prerequisites and equipment

No computer science background is required. Students must have a Windows, macOS, or Linux laptop capable of running the required course clients. Any remote systems, virtual machines, software, or accounts needed for labs will be provided or specified by the course.

Lecture and lab are combined in a required, in-person session on Fridays from 1:30–3:20 PM in the MIP Policy Studio (Encina Hall basement).

Learning goals

Students who complete the course should be able to:

  • Explain the basic operation of network protocols, web applications, cryptography, and common enterprise systems.
  • Use standard security tools within an explicitly authorized lab environment.
  • Recognize common attack paths and connect technical failures to real-world cybercrime and cyber conflict.
  • Document observations, validate results, and clean up an experimental environment.
  • Distinguish authorized security research from unsafe, unethical, or illegal activity.

Grading

Course grading is distributed as follows:

  • 10% weekly lecture/lab attendance
  • 30% weekly lab assignments
  • 25% take-home midterm exam
  • 35% take-home final exam

Quizzes, exams, and separate course administration will remain in Canvas. The public website provides the syllabus, schedule, and public resources; lecture slides will be linked from the schedule as they are released. Lab instructions, assigned systems, answer submissions, and lab grading are available through the authenticated course console.

Lab work and late work

Students will receive individual invitations to the course console before the first lecture-and-lab meeting. Each released lab in the console states its deadline and any applicable late-work policy.

The goal is for every student to complete every lab. Students should use office hours, the course discussion board, and appropriate collaboration when they encounter difficulty. Extensions for illness, disability accommodations, or serious extenuating circumstances must be arranged with the instructional team. Infrastructure availability can limit how long a lab remains open.

Collaboration and submitted work

Students may discuss concepts and troubleshoot course infrastructure together unless an assignment states otherwise. Submitted answers and exam work must be the student’s own. Do not share answer keys, screenshots that reveal answers, credentials, or access to assigned systems.

Use of AI systems

Unless an assignment explicitly authorizes it, students may not use large language model or code-generation systems to write or supplement answers submitted for labs, quizzes, or exams. Permitted uses, if any, will be stated on the individual assignment.

Regrade requests

Requests to review an assignment or exam score must be made within one week of receiving the grade and should identify a specific scoring or submission issue. Requests made after that period may not be considered absent extenuating circumstances.

Responsible use

The tools and techniques used in this course can damage systems, expose private information, or violate law and policy when used outside an authorized environment.

  • Test only systems and accounts explicitly assigned for a course exercise.
  • Stay within the scope and time window stated in the course console for each lab.
  • Never target Stanford production systems, public services, classmates, or third parties.
  • Do not retain, publish, or share credentials, captured traffic, private data, malware, or vulnerable-system details.
  • Stop immediately and notify the instructional team if a lab appears to reach an unintended system or expose real personal data.
  • Complete the cleanup steps for every lab.

Violations of these boundaries may be referred under Stanford’s academic, acceptable-use, or conduct processes and may also carry civil or criminal consequences.

Accessibility

Students who may need an academic accommodation should contact Stanford’s Office of Accessible Education as early as possible. The instructional team will work with OAE accommodation letters and will provide course materials in accessible formats where practical.

Changes to this syllabus

The schedule and policies may be updated as infrastructure, guest availability, or course needs change. Material changes will be announced through the course communication channel and reflected on this site.