Cyber War Gaming

Course Description

CNT4416 is the cyber exercise course — the capstone of a security sequence, where students defend and attack networks in a controlled range rather than reading about it.

Florida's statewide description explains the rationale directly: "Every organization, whether part of the government or the private sector, needs battle-tested IT personnel in order to defend its networks against attack. The most effective way to provide this experience is to recreate the exact scenarios… they will see in the real world. This course provides exercises that use different specialties (network, security, visualization, software) into colour-coded RED and BLUE teams that perform specific roles in attacking and defending IT infrastructures."

⚠ The colours are the field's standard vocabulary. A red team emulates an adversary. A blue team defends, detects and responds. A purple team is the two working together deliberately so that each attack technique is matched against whether the defence actually detected it — which is where most of the learning happens, because an attack nobody noticed is the most important finding of any exercise.

UWF's version carries the same structure and adds a dimension: titled Cyber Operations with Defensive AI, it covers "the authorities, roles and steps associated with cyber operations," red team and blue team work, and then "the application of AI in strengthening defensive cybersecurity measures. Students will learn how AI-driven tools and techniques can improve the detection, analysis, and response to cyber threats." It ends: "Welcome to Purple Team!"

⚠⚠⚠ Before anything else, the thing this course exists to establish: AUTHORISATION. UWF's description leads with "authorities" and that word is doing heavy lifting. The techniques taught here are lawful inside a range you have written permission to operate in, and are serious criminal offences outside it. There is no grey area, no "I was only testing," and no informal permission. See Special Information — it is the most important section on this page and it is not a formality.

Learning Outcomes

Required Outcomes

• ⚠⚠⚠ Explain the legal authorities and authorisation governing cyber operations: what written scope is, who can grant it, and what falls outside it under federal and Florida law.
• Explain the roles and structure of a cyber exercise — red, blue, purple and white teams — and what each is accountable for.
• Describe the phases of an intrusion using a standard framework, and map defensive controls to each.
• ⚠ Perform reconnaissance and enumeration against authorised targets, and explain what an organisation exposes without realising.
• Identify and analyse vulnerabilities, and prioritise them by exploitability and impact rather than by score alone.
• Demonstrate exploitation and post-exploitation concepts within an authorised range.
• ⚠⚠ Build and tune detection — log sources, alerting, and reducing false positives to a level a human can actually work.
• Perform incident response: identify, contain, eradicate, recover, and document.
• Apply network defence — segmentation, filtering, hardening and least privilege.
• Analyse traffic and logs to reconstruct what happened.
• Apply visualisation to make an attack legible to people who are not analysts.
• ⚠ Work under time pressure as a team, with defined roles and a communication plan — which is what an exercise actually tests.
• ⚠⚠ Write the after-action report: what happened, what was detected, what was missed, and what to change. The deliverable that matters professionally.
• Apply professional ethics and understand the responsibilities that come with these skills.

Optional Outcomes

• ⚠ Apply AI and machine learning to defence — anomaly detection, alert triage and automated response. Central at UWF.
• Evaluate adversarial machine learning — how detection models are evaded or poisoned.
• Apply threat intelligence to exercise design.
• Compete in a collegiate cyber defence competition.
• Apply digital forensics to exercise artefacts.
• Defend industrial control or operational technology environments.
• Automate defensive tasks through scripting and orchestration.

Major Topics

Required Topics

• ⚠ Authorities, scope and rules of engagement.
• Exercise structure and team roles.
• Attack frameworks and the phases of an intrusion.
• Reconnaissance and enumeration.
• Vulnerability identification and prioritisation.
• Exploitation and post-exploitation concepts in an authorised range.
• Persistence, lateral movement and privilege escalation — and the detection opportunities each creates.
• Logging, monitoring and detection engineering.
• Incident response process.
• Network defence and hardening.
• Traffic and log analysis.
• Visualisation and communication of security data.
• Team coordination under time pressure.
• After-action reporting.
• Law and ethics of offensive and defensive work.

Optional Topics

• AI and machine learning applied to detection and response.
• Adversarial machine learning and model evasion.
• Threat intelligence and adversary emulation.
• Collegiate competition preparation.
• Digital forensics.
• Operational technology and industrial control security.
• Security automation and orchestration.

Resources & Tools

• ⚠⚠⚠ Your institution's authorised range. Everything practical in this course happens inside it, and nothing happens outside it. Learn the rules of the range in week one and treat them as the professional standard they represent.
• MITRE ATT&CK — ⚠⚠ free, and the common vocabulary of the field. It maps adversary techniques to detection opportunities, and it is what an after-action report should be written against.
• NIST SP 800-61 (incident handling) and SP 800-115 (security testing) — free, authoritative, and the basis of most organisational procedure.
• The NIST Cybersecurity Framework and the NICE Workforce Framework — ⚠ the latter maps skills to actual job roles and is genuinely useful for career planning.
• Security Onion, Suricata, Zeek, Wireshark, the ELK stack — free defensive tooling used in real security operations centres.
• Purpose-built vulnerable environments — ⚠ deliberately vulnerable virtual machines and lab platforms designed to be attacked legally. Use these for practice outside class; never anything else.
• Collegiate cyber defence competitions — ⚠⚠ CCDC and its regional events, plus capture-the-flag competitions. Recruiters attend these, and competition experience is among the strongest signals an entry-level candidate can offer.
• ⚠ Check whether your institution holds an NSA/DHS National Center of Academic Excellence in Cybersecurity designation. It matters for federal scholarship and hiring programmes, and several Florida institutions hold one.
• Certifications — CompTIA Security+ as a baseline (⚠ it satisfies a US Department of Defense workforce requirement), then defensive or offensive specialisations.

Career Pathways

• Security operations centre analyst — ⚠ the most common entry point, and the blue-team half of this course is direct preparation.
• Incident responder and threat hunter.
• Detection engineer — ⚠ building and tuning the rules that catch attacks; a growing and well-paid speciality that this course's detection work leads to.
• Penetration tester and red team operator — ⚠⚠ competitive, and almost always entered after defensive or systems experience rather than straight from a degree. Students frequently want this job first; the realistic route is through the blue side.
• Vulnerability management and security engineering.
• Digital forensics and malware analysis.
• Federal and defence roles — ⚠ civilian agencies, the military services' cyber components, and contractors. A security clearance is frequently required; processing is slow, so plan the timeline early.
• ⚠⚠ Florida context, and it is strong for this field. US Central Command and US Special Operations Command are at MacDill Air Force Base in Tampa and US Southern Command is in Doral, with a substantial defence contracting sector around them. Orlando has a large simulation and training industry; Miami is a major interconnection hub with significant financial and carrier infrastructure; and Florida's healthcare systems, utilities and municipalities are all under sustained pressure to build security capability. Several Florida universities hold federal cybersecurity education designations and run scholarship programmes attached to them.
• ⚠ Realistic framing on the "shortage". There is genuine unmet demand for EXPERIENCED security staff, and considerably more competition at entry level than the headline figures imply. What distinguishes a graduate is demonstrable practical work — competition results, a home lab, a certification, an internship. This course produces exactly that kind of evidence; keep the after-action reports.

Special Information

⚠⚠⚠ Authorisation is the whole professional boundary — understand it before the first exercise

This is the most important thing in the course, and UWF puts it first in its description for good reason.

The techniques taught here are lawful in one circumstance only: inside a system you own, or one you have explicit written authorisation to test, within a defined scope. ⚠⚠⚠ Outside that, the same actions are criminal offences — under the federal Computer Fraud and Abuse Act and under Florida's own computer crimes provisions in Chapter 815 of the Florida Statutes. Consequences include felony prosecution, and for a student also expulsion and the permanent loss of any prospect of a security clearance.

⚠⚠ The specific misunderstandings that get people into trouble are worth naming, because they are common and they sound reasonable:

• "I was only looking." ⚠ Unauthorised access is the offence. Reading is access.
• "I did not damage anything." Damage is an aggravating factor, not an element.
• "I was trying to help." ⚠⚠ Unsolicited testing of someone else's system is not a favour and is not treated as one. Report a suspected weakness; do not go and verify it.
• "My friend said it was fine." ⚠ Authorisation comes in writing from someone with the authority to grant it, and it defines scope, timing and method. Verbal permission from someone who does not own the system is worth nothing.
• "It is my employer's network and I work in IT." ⚠⚠ Employment is not authorisation to test. Scope is granted for a specific engagement.

⚠ The professional habit to build now: never touch a system without written scope, and when in doubt, ask and wait. Every legitimate employer in this field will respect that; none will respect the alternative. Your institution's range exists precisely so you can learn these techniques lawfully — use it, and only it.

⚠⚠ UWF adds defensive AI — a course whose subject is AI, not a course that mentions it

The two carriers differ, and the difference is an addition rather than a substitution.

FAMU — Cyber War Gaming	UWF — Cyber Operations with Defensive AI
Matches the statewide description: red and blue team exercises recreating real-world attack scenarios across network, security, visualisation and software specialities.	⚠ That, plus the "authorities, roles and steps associated with cyber operations", explicit red and blue team operations, and the application of AI to detection, analysis and response. Explicitly purple team.

⚠ This is scope breadth rather than divergence — UWF's version fully contains the statewide subject. A syllabus test: look for machine learning content as its own unit, and for the word "purple."

⚠⚠ The AI content is worth seeking out rather than tolerating. Security operations is one of the few fields where machine learning is genuinely load-bearing in production today — alert triage, anomaly detection and automated response are deployed at scale because the volume of events exceeds what humans can review. A graduate who understands both how those systems help and how they fail is more employable than one who knows only the traditional toolset.

⚠⚠⚠ And the part a good course will insist on: detection models are themselves a target. Adversarial machine learning — evading a classifier, poisoning its training data, or exploiting the fact that defenders now trust its output — is an attack surface that did not exist a decade ago. Red teaming an organisation's AI-based defences is becoming a real engagement type, and this is the course where a student should first meet the idea.

⚠⚠ The prerequisite chain is substantial, and the statewide version does not resolve

Source	Prerequisite	Resolves at UWF?
Florida statewide	CNT4403, CIS4385 AND CDA3101, minimum grade C-minus	⚠⚠ No — UWF does not carry CIS4385 (its public carriers are Pensacola State and FSU)
UWF	⚠ (CIS 4385 OR CIS 4221) AND CNT 4403	✅ yes — UWF wrote an alternative into its own prerequisite

⚠ This is a pattern seen repeatedly across Florida's course file: statewide prerequisites are contributed by institutions, and one written from another institution's curriculum does not resolve elsewhere. UWF handled it the sensible way, by offering an OR — which is worth noticing, because an institution hedging its own prerequisite is usually a sign it knows the numbering does not line up.

What you actually need, whichever institution you are at: ⚠⚠ network security (CNT4403, carried by seven Florida public institutions under seven different titles), plus either digital forensics or an equivalent security course. Take your own catalogue's version, and do not attempt this course without the security prerequisite — it is a capstone and it assumes you can already read traffic and configure a defence.

Offering Notes

Institution	Its title	Credits	Contact hours	Notes
University of West Florida (SUS)	Cyber Operations with Defensive AI	3	not published	⚠ Prerequisite (CIS 4385 OR CIS 4221) AND CNT 4403; may not be repeated for credit; Department of Cybersecurity and Information Technology, College of Science and Engineering
Florida A&M University (SUS)	Cyber War Gaming	3	not published	⚠ catalogue not readable — matches the statewide title and description

Both carriers award three credits and neither publishes a contact-hour figure, so the 45 hours recorded here is Florida's convention for a three-credit course with no C or L suffix.

⚠⚠ Treat that as a substantial understatement. Exercise-based courses do not fit a timetable. A scenario runs until it is resolved; range access is often outside scheduled hours; and an after-action report on an exercise you have just spent six hours inside takes as long again. Plan the term around this course rather than fitting it in.

⚠ FAMU's catalogue could not be read for this guide — it runs on a platform that serves front pages while returning empty responses for course content — so its own description and prerequisite are unavailable, and its title matching the statewide one is the basis for the characterisation above.

Position in the curriculum and transfer

A capstone-level course, taken last in a cybersecurity sequence after networking, network security and forensics. ⚠ It is where the separate courses are supposed to combine, and it will expose whichever of them you did not learn properly.

Florida's statewide record classifies it as transferable to an institution offering the same course, with no Gordon Rule designation and no general-education category, and marks it for dual enrolment with elective high-school credit — ⚠ boilerplate across the prefix. The (U) means upper division only.

⚠⚠ On transfer and on hiring, the artefacts matter more than the transcript. Keep your after-action reports, your detection rules and any competition results — in security these are the portfolio, and an interviewer will ask what you found and how you found it rather than what grade you received.

AI Integration

⚠⚠⚠ This is the rare course where AI is simultaneously the subject, the tool and the threat — and a student should be able to distinguish the three by the end of it.

As the subject. UWF's version makes defensive AI explicit, and the reason is that security operations is genuinely dependent on machine learning in production: event volumes long ago exceeded human review capacity, so anomaly detection, alert triage and automated enrichment are load-bearing rather than experimental. ⚠ The professional skill is knowing what these systems are good at — finding statistical outliers across enormous data — and what they are bad at, which is anything novel, anything deliberately disguised, and explaining themselves.

As the tool, in your own coursework. Explaining an unfamiliar log format or protocol artefact; drafting a detection rule to then test and refine; summarising a long threat report; producing the routine sections of an after-action report; and ⚠ explaining an attack technique in terms a non-technical audience will follow, which is a genuinely hard writing task and a real part of the job.

⚠⚠⚠ As the threat, and this is the part that belongs to this course rather than any other.

• Attackers use the same tools. ⚠ Phishing that no longer contains the tell-tale errors, at scale and in any language; faster reconnaissance; assistance writing tooling. The defensive consequence is concrete: "look for bad grammar" is dead as user-awareness advice, and training built on it should be replaced.
• ⚠⚠ Detection models are an attack surface. Adversarial machine learning — crafting inputs a classifier misses, poisoning training data, or exploiting defender over-trust — targets the defence itself. Red teaming an organisation's AI-based controls is an emerging engagement type.
• Automation bias is a defensive failure mode. ⚠⚠ An analyst who trusts the queue stops looking at what the queue does not surface. The attacks that matter most are the ones no rule fired on — which is exactly why a purple-team exercise asks "what did we miss?" rather than "what did we catch?"

⚠⚠ Two absolute limits on your own use, and they are professional rather than academic.

• Never put real security data into a consumer chat interface — logs, configurations, vulnerability findings, incident details, client information, or anything from an engagement. ⚠ Findings are usually covered by a non-disclosure agreement, and an incident is confidential while it is being handled. Employers have approved tooling; use it.
• ⚠⚠⚠ A tool's willingness to generate something is not authorisation to run it. The legal boundary described above is unchanged by how the technique was produced, and "the model wrote it" is not a defence anyone has ever successfully offered.

⚠ Finally, the honest career note. Routine triage is being automated, which affects the entry-level tier this course leads to. What is not being automated is investigating something nobody has seen before, deciding what an ambiguous signal means, and being accountable for the call. Those are what an exercise trains, and they are the reason this course is the most valuable one in the sequence.