Cyber Security

Why this programme exists

Tanzanian institutions are being held to security standards that did not apply to them five years ago. Banks and financial institutions answer to the Bank of Tanzania Cybersecurity Framework. Anyone handling card data answers to PCI-DSS. The Personal Data Protection Act 2022 created obligations that are audited rather than assumed. The requirements arrived faster than the people who can meet them.

Most security training available locally is either a certification cram or a vendor product demonstration. This programme is neither. It teaches how attacks actually work, how defences are actually built, and what the frameworks actually require in evidence — in eight weeks, on real systems.

At a glance

Duration	8 weeks
Structure	6 modules, 50 contact hours
Level	Intermediate
Frameworks	MITRE ATT&CK, OWASP, CIS, NIST SP 800-61, BOT, PCI-DSS, ISO 27001
Tools	Nmap, Nessus, SIEM, Linux and Windows hosts
Delivery	Face-to-face, Mbezi Mshikamano, Dar es Salaam
Certificate	Kevajopa Cyber Security Professional Certificate
Fee	TZS 550,000, full programme

What you will be able to do

Map a real attack onto the Cyber Kill Chain and identify which control should have stopped it, and at which phase.
Recognise the OWASP Top 10 in live application behaviour rather than only in a list.
Design a firewall and DMZ architecture, and write the rule set in an order that does what you intended.
Deploy and tune IDS or IPS without drowning the team in false positives.
Harden a Linux and a Windows host against the CIS Benchmarks and prove the changes took effect.
Run a vulnerability scan with Nmap and Nessus, then read the result critically — including working out what the scan never looked at.
Choose correctly between symmetric encryption, asymmetric encryption and hashing for a given problem.
Diagnose a TLS or certificate error properly instead of telling the user to click through it.
Work an incident through the full NIST lifecycle without destroying the evidence in the first ten minutes.
Assess an institution against the BOT Cybersecurity Framework, PCI-DSS or ISO 27001 and say what evidence is missing.

Who should attend

IT administrators and network engineers
Bank and financial institution staff working under BOT requirements
Government ICT officers
Software developers who need to understand what they are defending against
Risk, audit and compliance staff with security in scope

Entry requirements. Comfortable with computers and networks at a working level — you should know what an IP address is and be able to find your way around a file system. No programming is required. Some Linux exposure helps in Module 3 but is taught from the ground where it is needed. Adequate English, since tool output and framework documentation are in English.

How the programme is taught

Roughly a third instruction, the rest practical. Attack technique is demonstrated against systems we control, so that the defence being taught can be tested rather than described. Every module ends with something configured, scanned, hardened or investigated.

The compliance work in Module 6 is done the way an assessor would do it: take the control, find the evidence, and decide whether the evidence would survive somebody else's scrutiny.

Module by module

Module 1 · Weeks 1–2 · 10 hours

Threat Landscape and Attack Methodologies

Defence starts with understanding how an attack is actually carried out — in sequence, phase by phase, rather than as a vague sense that hackers exist.

The Cyber Kill Chain and MITRE ATT&CK: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and action on objectives — with the defensive control that belongs at each phase
Malware families and what each is built to do, and social engineering as the delivery mechanism that bypasses every technical control you own
The OWASP Top 10 web application vulnerabilities, worked through against real vulnerable applications

Module 2 · Weeks 3–4 · 10 hours

Network Security and Perimeter Defence

The controls between the outside and the inside, and the honest question of what a perimeter still means when half the staff are working from home.

Firewall architecture and DMZ design: what belongs in the DMZ, what must never be there, and the rule order that decides whether either happens
IDS and IPS: detection against prevention, and the cost of a false positive on a production network
SIEM — collecting logs from everywhere, and the harder problem of knowing which of the alerts matters
Zero Trust in practice, not as a marketing term

Module 3 · Week 5 · 8 hours

System Hardening and Vulnerability Management

Reducing what is exposed before anyone attacks it, and knowing what is exposed in the first place.

Operating system hardening on Linux and Windows against the CIS Benchmarks
Patch management as a process rather than an intention: what to patch first, and how to know a patch actually applied
Vulnerability scanning with Nmap and Nessus, and reading a scan result critically — including what the scan did not cover

Module 4 · Week 5 · 6 hours

Cryptography and PKI

Enough applied cryptography to make correct decisions, without the mathematics that makes the subject unapproachable.

Symmetric and asymmetric encryption, hashing, and where each is the right tool
TLS: what the handshake actually establishes, and what a padlock does and does not prove
Certificates, certificate authorities and PKI — issuing, renewing, and diagnosing the errors users report

Module 5 · Week 6 · 8 hours

Incident Response and Digital Forensics

What to do in the hour after something has happened, when the instinct to fix it immediately is usually the wrong one.

The NIST SP 800-61 lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned
Evidence preservation basics — why rebooting the machine can destroy the only record of what happened
Log analysis, timeline reconstruction, and writing an incident report management can act on

Module 6 · Weeks 7–8 · 8 hours

Compliance and Governance

The frameworks a Tanzanian institution is actually held to, and what each demands in evidence rather than in intention.

The Bank of Tanzania Cybersecurity Framework and what it requires of a regulated institution
PCI-DSS for anyone handling card data, and ISO/IEC 27001 as a management system rather than a certificate on a wall
Comparing the frameworks: where they overlap, where they conflict, and how to satisfy several at once
Security policy, awareness training and the human side of governance

Assessment and certification

Assessment is continuous and practical, combining the work produced during each module with a final assessment of multiple choice, short written answers and a practical task. The practical component carries the most weight — nobody passes on written work alone.

A Kevajopa Technologies Limited Cyber Security Professional Certificate is awarded on satisfactory completion, with a minimum 80% attendance recorded per session. The certificate is a Kevajopa award. It is not a CISSP, CEH or CompTIA Security+, and we do not represent it as one — though the ground it covers maps closely onto those syllabi and is useful preparation for them.

The three-week fast-track

The same curriculum is also delivered as a three-week intensive for participants who can commit full time — same modules, same assessment, same certificate, compressed timetable. The full prospectus for that route is available as a document.

Cyber Security Fast-Track prospectus (PDF) →

Where it leads

Cybersecurity Analyst SOC Analyst Penetration Tester IT Compliance Officer Security Administrator

What this programme does not cover

Full digital forensics — evidence imaging, chain of custody and courtroom-grade examination are the subject of our IT Audit and Digital Forensics programme.
IT audit methodology and controls assurance — that is IT Auditing and Controls Assurance.
Offensive security as a career path. Attack technique is taught so that it can be defended against, not as a service to sell.
Any vendor certification examination. The certificate is a Kevajopa award, not a CISSP, CEH or Security+.
Network engineering beyond what security requires — our Digital Networking programme covers that ground.

Fees and enrolment

TZS 550,000 for the full eight-week programme, including all instruction and practical time, use of lab systems, course materials, all assessment and marking, and the certificate. Kevajopa Technologies Limited is not VAT-registered; no VAT is charged and none should be added. Public entities deduct 2% withholding tax at source in accordance with Tanzanian law — the withholding certificate should be issued to Kevajopa Technologies Limited, TIN 172-177-301.

We do not publish a fixed calendar. An intake is scheduled once a group has confirmed, and confirmed participants receive at least ten working days' notice of the start date. Group rates are available for three or more registering together, and corporate cohorts can be delivered at the client's premises.