MYTHOSMYTHOSAI / LEARNING LIBRARY
Know the risk.
Learn the defence.
Clear, practical guides to protecting accounts, securing systems and understanding the tools. Start with one task. Learn how to check your result.
A stronger security routine.
01Practical steps. Result checks. Official references.
CHOOSE YOUR NEXT SKILL
Explore by topic
Account security
Passkeys, access reviews and recovery routes.
10 guides ↗02Network security
Verify network boundaries and troubleshoot safely.
10 guides ↗03Email and domains
Authentication, mail routing and payment-request checks.
10 guides ↗04Incident recovery
Prepare response, preserve evidence and prove recovery.
10 guides ↗05Privacy and devices
Understand permissions, sharing and retained copies.
10 guides ↗06Security basics
Protect accounts, spot scams and practise recovery.
10 guides ↗07Windows security
Understand the built-in controls on your PC.
10 guides ↗08Linux security
Secure and troubleshoot services without losing access.
10 guides ↗09Tool tutorials
Learn Nmap, Wireshark, Burp, Kali and VirusTotal.
10 guides ↗010Monitoring
Make Wazuh and Zabbix data useful and verifiable.
6 guides ↗011Australian business
Practical protection and official recovery routes.
4 guides ↗THE COMPLETE LIBRARY
One useful task at a time.
Use a guide to understand a task, then verify it in your own authorised environment.
100 guides
How to recognise a phishing email
Check the request, sender and destination before opening a link or approving a payment.
A free password-manager workflow for beginners
Replace password reuse with unique credentials and a recovery plan you can actually use.
Enable MFA without locking yourself out
Add a second sign-in factor and prove you have a usable recovery route.
Check whether your email appears in a data breach
Use the free Have I Been Pwned email search and turn the result into specific actions.
What to do when you suspect ransomware
Contain the affected device, preserve useful evidence and protect unaffected backups.
Clicked a phishing link? Choose the right response
Distinguish viewing a page from disclosing credentials, approving access or running a file.
Recover a compromised email account
Remove attacker access, check hidden mailbox changes and protect password-reset channels.
Build a backup routine that can survive ransomware
Use existing storage, keep a separated copy and test a restore before you need it.
Update software safely without fake update pop-ups
Use trusted update channels, restart deliberately and verify the installed version.
Audit Chrome browser extensions in ten minutes
Remove unnecessary extensions and restrict access to the websites where they are needed.
A practical Windows 11 security checklist
Check the built-in protections first and record what is actually enabled.
Check Microsoft Defender protection status with PowerShell
Inspect real-time protection, signatures and operating mode without changing settings.
Run and verify a Microsoft Defender scan
Choose quick, full or targeted scanning and inspect the result after it completes.
Investigate Windows failed sign-ins with Event 4625
Find the failed account, logon type and source without treating every failure as an attack.
Check Windows Firewall profiles and rules
Confirm the active profile and inspect rules before changing or disabling anything.
Find which Windows process owns a network connection
Use built-in PowerShell to connect an established TCP session to its process.
Review Windows startup entries with free Autoruns
Find automatic launch points and disable a questionable entry reversibly before deleting it.
Check BitLocker status and your recovery-key plan
Confirm which volumes are encrypted before changing firmware, TPM or boot settings.
Check SMBv1 before removing the legacy Windows feature
Identify dependency risk, remove SMBv1 where safe and keep modern file sharing working.
Verify a download with SHA-256 in PowerShell
Compare your file with a checksum from the genuine publisher, without running it.
First security checks on a new Ubuntu server
Inventory the server, apply ordinary updates and reduce exposure without losing remote access.
Configure UFW without locking yourself out of SSH
Allow the real management path before enabling a deny-incoming policy.
Create and test an SSH key for Ubuntu access
Add key authentication first and verify it before removing password access.
Disable SSH password authentication safely on Ubuntu
Validate the effective configuration and test a fresh key-only login before closing access.
Find failed SSH logins on Ubuntu
Use service logs and time windows to distinguish routine errors from hostile patterns.
Find listening ports on Linux with ss
Identify protocol, bind address and owning process using the built-in socket inspection tool.
Check Ubuntu automatic security updates
Inspect unattended-upgrades, test its decision process and verify that important updates complete.
Understand Linux file permissions with a safe example
Practise owner, group and other permissions on a disposable file instead of changing system directories.
Troubleshoot a Linux service with journalctl
Read a bounded service timeline and check the result of a change without clearing evidence.
Configure a basic Fail2ban SSH jail on Ubuntu
Reduce repeated SSH authentication attempts while preserving your trusted management route.
Nmap for beginners: your first controlled scan
Use a narrow TCP scan in your own lab and distinguish open, closed and filtered ports.
Discover devices on your authorised network with Nmap
Use host discovery to compare live responses with an expected device inventory.
Check specific ports and service versions with Nmap
Separate basic reachability, version probing and a real application test.
Your first Wireshark packet capture
Capture a short piece of your own traffic and learn the three main views.
Wireshark display filters you can explain
Find DNS, TLS and one host’s traffic without confusing display and capture filter syntax.
Find the busiest conversations in Wireshark
Use endpoint pairs and byte counts to explain traffic volume without guessing its intent.
Use Burp Suite Community Edition in a free learning lab
Inspect one lab request with the built-in browser and repeat it without buying Pro.
Run Kali Linux in a virtual machine for learning
Practise without replacing your main operating system or interrupting a server workload.
Use VirusTotal without uploading confidential files
Search an existing file hash first and interpret detections as evidence, not a verdict.
Inspect HTTP security headers with curl
Read the response headers from your own site and understand what they do—and do not—prove.
Wazuh for beginners: what runs where
Understand the agent, manager, indexer and dashboard before deploying a monitoring stack.
Install and verify a Wazuh Windows agent
Use the manager-generated enrollment command and prove the endpoint sends fresh data.
Create a small Wazuh file-integrity monitoring lab
Monitor a dedicated test directory and explain a file-change alert without touching business data.
Check Wazuh Windows Event Channel collection
Confirm a specific Windows event channel reaches the manager before writing an alert rule.
Zabbix active and passive agents explained
Choose the connection direction deliberately and match the agent, host and item configuration.
Design useful low-disk-space alerts in Zabbix
Check actual collection, combine practical thresholds and test delivery without filling a real drive.
Essential Eight: a practical starting map for small businesses
Turn the eight mitigation strategies into an evidence-based improvement list.
Check suspicious bank and delivery text messages in Australia
Verify through the genuine app instead of trusting a sender name or a convincing link.
Where to report a scam or cybercrime in Australia
Prioritise containment, then choose the official reporting route for what happened.
A free-first security checklist for a small business
Organise the controls you already have and test whether they protect the business’s actual workflow.
Review Android app permissions by purpose
Find unnecessary access to location, camera and microphone without disabling an essential feature blindly.
Prepare for a lost phone before it disappears
Check remote-device controls and recovery dependencies using the accounts and equipment you already have.
Handle an unknown USB drive without plugging it in
Use an ownership and reporting process instead of exposing a work computer to an untrusted device.
Review clipboard history before copying a secret
Understand where copied passwords, tokens and screenshots may remain or synchronise.
Make a small data-retention inventory
Find redundant copies and assign an owner before deleting business information.
Review website camera, microphone and notification permissions
Remove stale browser permissions without breaking an expected meeting or business workflow.
Understand what private browsing does and does not hide
Choose a browser session for local privacy without mistaking it for anonymity.
Separate work and personal browser profiles
Reduce account mix-ups while understanding that a profile is not a strong device-security boundary.
Sanitise a screenshot before asking for support
Share the error and relevant context while removing credentials and unrelated personal information.
Review who can open a cloud file-sharing link
Distinguish a named recipient from anyone holding a link before sharing business information.
Set recovery-time and data-loss targets
Turn backup frequency into a business decision about how much downtime and lost work are tolerable.
Restore a test file without overwriting the working copy
Prove that a specific backup can deliver usable content through the normal recovery route.
Check who can delete your backups
Find whether an ordinary compromised account could remove the recovery copies you rely on.
Plan a known-good rebuild of an affected computer
List trusted installation sources, recovery data and account changes before reusing a compromised device.
Close an incident with evidence and follow-up actions
Distinguish restored service from a complete response and assign the remaining improvements.
Write a useful first-hour incident note
Capture observations and actions without turning an early suspicion into an unsupported conclusion.
Plan device isolation during a suspected incident
Reduce further connectivity while documenting what isolation can interrupt or change.
Preserve security logs before routine cleanup
Keep a reproducible evidence copy with its collection context and access controls.
Make an incident contact sheet that works offline
Prepare verified contacts and decision owners before email or the network becomes unavailable.
Run a small ransomware tabletop exercise
Practise decisions and recovery dependencies without encrypting files or deploying malware.
Verify a supplier bank-detail change
Use an independent approval route before an authentic-looking invoice redirects payment.
Inspect the real domain in an email link
Separate a convincing label, subdomain and redirect from the service you intended to visit.
Handle an unexpected attachment without running it
Verify the business request and file type before allowing an attachment to become an executable action.
Review DNS changes for a business domain
Check authoritative settings and important records before blaming a website or mail outage on propagation.
Protect the account that controls your domain
Review registrar access, recovery and change alerts for a critical business dependency.
Read an email authentication result without overtrusting it
Use trusted message headers to understand SPF, DKIM and DMARC while still checking the request.
Plan an SPF record from a sender inventory
List legitimate sending services before editing the DNS policy for your domain.
Verify DKIM signing for a domain you manage
Check the selector, DNS publication and real-message result before declaring signing complete.
Introduce DMARC monitoring before enforcement
Use aggregate evidence to find legitimate senders before applying a stricter domain policy.
Check mailbox forwarding and filters after suspicious activity
Find rules that copy, hide or redirect messages without deleting useful evidence.
Check what encrypted DNS protects
Separate DNS transport privacy from malware filtering, browser security and VPN behaviour.
Test a free threat-filtering DNS service safely
Use a provider's harmless test domain instead of browsing a real malicious website.
Test a specific connection with PowerShell
Separate a reachable host from a reachable application port using a focused read-only check.
Document a small-business network boundary
Turn a vague trusted network into a list of permitted connections and owners.
Use public Wi-Fi with a practical safety routine
Verify the network, protect sign-ins and remove unnecessary sharing on a device you already own.
Create a passkey and test your recovery route
Practise a phishing-resistant sign-in without losing your existing account recovery options.
Review apps connected to your Google account
Distinguish signing in with Google from giving an app access to account data.
Review account sessions and sign out old devices
Identify stale sessions without treating every unfamiliar device label as an attacker.
Separate administrator access from everyday work
Reduce the tasks that run with elevated privileges while retaining a tested administration route.
Build a network inventory before changing security settings
Identify the devices, owners and dependencies already present on your network.
Secure router administration without losing access
Review management exposure, credentials and firmware with a safe recovery route.
Test whether guest Wi-Fi isolates local devices
Check what a guest can reach instead of assuming a separate network name creates separation.
Review port forwarding and automatic port mappings
Find unnecessary inbound exposure without breaking a service that still has an owner.
Use nslookup to check a DNS answer
Compare a hostname, resolver and response before changing network settings.
Make an account recovery map without exposing secrets
Find circular dependencies before a lost phone prevents access to every important account.
Respond to an MFA prompt you did not initiate
Handle repeated approval requests without accidentally authorising an attacker.
Find and retire old app passwords
Reduce long-lived credentials left behind by mail clients and retired integrations.
Offboard a user with an access inventory
Remove access systematically while preserving required business records.
Store recovery codes for a lost-device scenario
Keep emergency sign-in material available without leaving it beside an exposed password.
Verify a support caller before granting remote access
Create a callback process that prevents a convincing voice from becoming administrator access.
No guides match. Try a tool name or choose All topics.