Roadmaps Security roadmaps Core domains
Network Security
Design, build and watch the networks everything else runs on, so attackers cannot get in easily or move around once they do.
Estimated time: 25–43 months · At about 10 hours a week.
- BeginnerHow networks work, and how to see the traffic3–4 months
- IntermediateFirewalls, segmentation, VPNs and detection4–6 months
- AdvancedSecure architecture and zero trust6–9 months
- ExpertArchitecture leadership and research12–24 months
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Overview
Network security protects the connections between systems: the routers, switches, firewalls, VPNs, wireless access points and the traffic that flows through them.
It covers prevention (segmentation, firewall rules, secure remote access), detection (intrusion detection and network security monitoring) and design (zero trust architectures where no network location is trusted by default).
Why it matters
Almost every attack crosses a network at some point: to get in, to move between machines, and to send stolen data out. Good network design limits how far an attacker can go, and network logs often show an intrusion that endpoints missed.
Typical job roles
- EntryNetwork administrator / junior network security engineer Configures switches, firewalls and VPNs and keeps them patched.
- Mid-levelNetwork security engineer Designs and runs firewalls, segmentation, remote access and IDS.
- Mid-levelNetwork security monitoring analyst Watches network traffic and investigates suspicious connections.
- SeniorSenior network security engineer / firewall architect Owns the network security design across sites and clouds.
- LeadNetwork security architect / zero trust lead Sets the long-term architecture, standards and vendor choices.
Prerequisites
- The OSI and TCP/IP models, and what happens at each layer.
- IP addressing and subnetting (IPv4 and the basics of IPv6).
- Common protocols: DNS, DHCP, HTTP and HTTPS, SSH, SMTP.
- The Linux command line, enough to run and read the output of networking tools.
Learning path
Show
-
Beginner How networks work, and how to see the traffic 3–4 months
Topics
Skills
- Subnet a network and plan addresses for a small office.
- Capture traffic with Wireshark or tcpdump and follow a TCP conversation.
- Scan your own network with Nmap and explain each open port.
- Write simple allow and deny firewall rules.
Hands-on projects and labs
- Build a virtual network in GNS3 or Cisco Packet Tracer with two VLANs and a router between them.
- Capture your own browsing with Wireshark and find the DNS lookup, the TLS handshake and the HTTP request.
- Scan your home lab with Nmap and write a short inventory of every device and service.
Done when you can…
- Draw your home network with every device, address and connection.
- Explain what happens, packet by packet, when you open a website.
- Read a packet capture and point out the protocols and any plain-text passwords.
-
Intermediate Firewalls, segmentation, VPNs and detection 4–6 months
Topics
Skills
- Design and configure a segmented network with a firewall between zones.
- Set up a site-to-site and a remote-access VPN.
- Deploy Suricata and Zeek and investigate their alerts and logs.
- Recognise scanning, brute force, beaconing and data exfiltration in traffic.
Hands-on projects and labs
- Build a pfSense or OPNsense firewall in a VM with LAN, DMZ and guest zones, and a WireGuard VPN for remote access.
- Add Suricata with community rules and Zeek, then generate test traffic from an attacker VM inside your own lab.
- Work through the packet capture exercises on Malware-Traffic-Analysis.net and write up each one.
Done when you can…
- Explain why each firewall rule in your lab exists, and remove the ones that do not need to.
- Find the infected host and its command-and-control server in a packet capture.
- Show that a guest device in your lab cannot reach your servers.
-
Advanced Secure architecture and zero trust 6–9 months
Topics
Skills
- Design a zero trust access model that checks identity and device health, not network location.
- Automate firewall and network configuration with code and version control.
- Secure cloud networks and connect them safely to on-premises networks.
- Hunt for threats in network data, including encrypted traffic metadata (JA4, certificates, SNI).
Hands-on projects and labs
- Replace a VPN in your lab with identity-aware access using an open-source zero trust tool or a free tier of a commercial one.
- Write Ansible or Terraform code that builds your firewall rules, and review every change through a pull request.
- Build a small AWS or Azure network with public and private subnets, and test that only the intended paths work.
Done when you can…
- Present a segmentation design for a 500-person company with on-premises and cloud systems.
- Show your network as code, with a change history and reviews.
- Explain how an attacker would move laterally in your design, and how you would detect it.
-
Expert Architecture leadership and research 12–24 months
Topics
Skills
- Set network security standards for a large organisation and get teams to adopt them.
- Evaluate vendors and architectures on evidence, not marketing.
- Research protocol weaknesses and publish or report them responsibly.
Hands-on projects and labs
- Write a reference architecture for a multi-site organisation, including OT or IoT networks, and get it reviewed by peers.
- Contribute rules to Suricata or scripts to Zeek, or publish an analysis of a protocol.
Done when you can…
- Defend a network security architecture to engineers, auditors and leadership.
- Plan a multi-year migration, for example from a flat network to zero trust, with milestones and risks.
Tools and technologies
- Wireshark The standard tool for capturing and analysing network traffic.
- tcpdump Command-line packet capture, available on almost every Unix system.
- Nmap Network discovery and port scanning.
- Zeek Network security monitoring that produces detailed connection logs.
- Suricata Intrusion detection and prevention engine.
- Snort The original open-source intrusion detection system, now maintained by Cisco.
- pfSense CE Open-source firewall and router.
- OPNsense Open-source firewall and router, a fork of pfSense.
- WireGuard A modern, simple and fast VPN.
- Arkime Full packet capture and search at scale.
- GNS3 Network emulator for building virtual labs.
- Cisco Packet Tracer Free network simulator from Cisco Networking Academy.
- Ansible Automation for configuring network devices and servers as code.
Certifications
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
- Entry CompTIA Network+ CompTIAVendor-neutral networking basics.
- Entry CCNA CiscoThe best-known networking certification.Cost and exam details
- Entry Security+ CompTIAAdds the security side.Cost and exam details
- Intermediate GIAC Certified Intrusion Analyst (GCIA) GIACNetwork traffic analysis and intrusion detection.
- Advanced CCNP Security CiscoFor engineers working with Cisco security products.
- Advanced CISSP ISC2For architects and leads.Cost and exam details
Resources
- Computer Networks: A Systems Approach
- Network+ and Security+ video courses
- Cisco Networking Academy courses
- Wireshark documentation
- Zeek documentation
- Suricata documentation
- Nmap Network Scanning (online book)
- Malware-Traffic-Analysis.net exercises
- Zero Trust Architecture (SP 800-207)
- Practical Packet Analysis, 3rd edition
- The Practice of Network Security Monitoring
- SEC503: Network Monitoring and Threat Detection
Frameworks and standards
- CIS Critical Security Controls A prioritised list of 18 practical defences, grouped so smaller organisations know what to do first.
- NIST SP 800-207 Zero Trust Architecture Defines zero trust: never trust a request because of where it comes from, check identity and context every time.
- NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
- MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
- MITRE D3FEND A knowledge graph of defensive techniques, mapped to the ATT&CK techniques they counter.
- CIS Benchmarks Free, consensus hardening guides for operating systems, cloud accounts, network devices and software.
- ISO/IEC 27001 The international standard for an information security management system (ISMS), and the one organisations get certified against.
Career path
A common progression. Titles vary between companies.
- IT support or network technician0–2 years
- Network administrator or junior network security engineer1–3 years
- Network security engineer3–6 years
- Senior engineer or network security architect6–10 years
- Enterprise security architect10+ years
Related domains to move into
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact