Cybersecurity fundamentals

Time

30–38 weeks + Ongoing

Before this

Foundations of computer science

Leads to

SOC analyst, Penetration tester, Security engineer, AI security researcher

Curious people who like taking things apart and want to protect people and systems.

Only test systems you own or have written permission to test. Use the practice labs below; attacking other systems is illegal almost everywhere.

1. Stage 1: Networking and Linux for security , 6–8 weeks

   What to learn

   • The TCP/IP model and common ports
   • DNS, HTTP and TLS on the wire
   • Reading traffic in Wireshark
   • Linux users, permissions and logs
   • Shell scripting

   Free resources

   • OverTheWire: Bandit Practice, OverTheWire
   • Wireshark documentation Docs, Wireshark Foundation
   • Computer Networks: A Systems Approach Book, Larry Peterson and Bruce Davie

   Build: Capture your own browsing in Wireshark and write a short explanation of what each part of the traffic is.

   Move on when: You can read a packet capture and say what happened, and you have finished most of OverTheWire Bandit.

2. Stage 2: Security fundamentals , 6–8 weeks

   What to learn

   • Confidentiality, integrity and availability
   • Authentication and access control
   • Hashing, encryption and certificates
   • Common attacks and malware
   • Risk and security frameworks

   Free resources

   • Security+ (SY0-701) video course Video, Professor Messer
   • Cryptography I Course, free to audit, Stanford University (Coursera)
   • Cybersecurity Framework Docs, NIST

   Build: A one-page threat model for an app you built: what could go wrong, how likely it is, and what you would fix first.

   Move on when: You can explain how TLS protects a login and why passwords are hashed, not encrypted.

3. Stage 3: Web application security , 8–10 weeks

   What to learn

   • SQL injection
   • Cross-site scripting
   • Broken access control
   • Authentication flaws
   • Server-side request forgery
   • Using Burp Suite

   Free resources

   • Web Security Academy Practice, PortSwigger
   • OWASP Juice Shop Practice, OWASP Foundation
   • OWASP Top 10 Docs, OWASP Foundation

   Build: Find and write up at least ten vulnerabilities in OWASP Juice Shop, including how to fix each one.

   Move on when: You can explain, exploit in a lab, and fix each class in the OWASP Top 10.

4. Stage 4: Pick a side: defend or attack , 10–12 weeks

   What to learn

   • Defence: logs, SIEM and alert triage
   • Defence: incident response
   • Attack: reconnaissance and exploitation
   • Attack: privilege escalation
   • Both: MITRE ATT&CK
   • Both: writing clear reports

   Free resources

   • MITRE ATT&CK Docs, MITRE
   • Security Onion documentation Docs, Security Onion Solutions
   • picoCTF Practice, Carnegie Mellon University
   • 6.858 Computer Systems Security Course, MIT OpenCourseWare

   Build: Defence: a home lab that collects logs and detects three ATT&CK techniques. Attack: solve 20 picoCTF challenges and publish write-ups.

   Move on when: You can show your lab or write-ups to an employer and talk through your reasoning.

5. Stage 5: Specialise and keep up , Ongoing

   What to learn

   • Cloud security
   • AI and LLM security
   • Malware analysis
   • Governance, risk and compliance
   • Following advisories

   Free resources

   • OWASP Top 10 for LLM Applications Docs, OWASP Foundation
   • MITRE ATLAS (attacks on AI systems) Docs, MITRE
   • AI Risk Management Framework Docs, NIST
   • Free cybersecurity training Course, CISA

   Build: Publish something others can use: a write-up, a detection rule, or a small tool.

   Move on when: This stage never ends. Security changes every month.

Specialise: security roadmaps Certification roadmaps Back to all paths