Roadmaps / Security roadmaps / IT security and infrastructure
Web, DNS and Edge Security
Protect the edge where users meet the internet: DNS, web gateways, WAF, DDoS protection, and the move to SASE and zero trust network access.
Estimated time: 15–26 months · At about 10 hours a week.
Beginner Time: 2–3 months
DNS and web edge basics
Skills
Set up DNS filtering and logging. Configure modern TLS and automatic certificates. Deploy a WAF with the OWASP Core Rule Set.
Hands-on projects and labs
Set up a reverse proxy with automatic TLS in front of a lab web app. Deploy the OWASP Core Rule Set in front of a deliberately vulnerable app and watch it block attacks. Set up protective DNS for a lab network and test that it blocks known-bad domains.
Done when you can…
Explain how DNS, TLS and a WAF each protect the edge. Show a web app behind a WAF and TLS that blocks common attacks.
Beginner
DNS security
DNS is how everything is found, and attackers abuse it for command and control and data theft. Learn DNS filtering, logging and how to spot abuse.
Resources
Beginner
DNSSEC, DoH and DoT
DNSSEC proves answers are genuine; DoH and DoT encrypt queries. Learn what each protects, and how encrypted DNS can also hide attacker traffic.
Resources
Beginner
TLS at the edge
Terminate TLS securely, use modern settings, manage certificates and renew them automatically. Expired or weak TLS is a common, avoidable failure.
Resources
Beginner
Web application firewalls
A WAF filters malicious web requests. Learn what the OWASP Core Rule Set catches, and why a WAF is a layer, not a replacement for secure code.
Resources
Beginner
CDNs and reverse proxies
CDNs and reverse proxies sit in front of your services for speed and protection. Learn how they hide origins, cache safely and block bad traffic.
Resources
Beginner
DDoS protection basics
Denial-of-service attacks flood a service until it fails. Learn the main types and the defences: absorbing, filtering and rate limiting.
Resources
Intermediate Time: 3–5 months
Secure access and the shift to SASE
Skills
Deploy and tune a secure web gateway. Use a CASB to find and control cloud app use. Design zero trust access to replace broad VPN access. Harden browsers and control extensions.
Hands-on projects and labs
Set up outbound DNS and web filtering for a lab network and test the policy. Deploy a self-hosted ZTNA tool to reach a lab app without opening a port. Tune the OWASP Core Rule Set to remove a false positive without losing protection.
Done when you can…
Explain SASE and what perimeter controls it replaces. Give per-application access without a traditional VPN in a lab.
Intermediate
Secure web gateways
A secure web gateway filters users' outbound web traffic: blocking malware, phishing and risky categories, and logging what is accessed.
Resources
Intermediate
Cloud access security brokers
A CASB gives visibility and control over the cloud apps people use, including shadow IT, and can enforce data and access policy.
Resources
Intermediate
Zero trust network access
ZTNA replaces broad VPN access with per-application access checked on identity and device health. Learn how it differs from a traditional VPN.
Resources
Intermediate
SSE and SASE
Security Service Edge bundles SWG, CASB and ZTNA in the cloud; SASE adds networking. Learn the model and what it replaces.
Resources
Intermediate
Browser security
The browser is where most work and most attacks happen. Learn browser hardening, extension control and the idea of enterprise and isolated browsers.
Resources
Intermediate
Tuning WAF and DDoS
Out of the box, a WAF blocks real traffic and misses real attacks. Learn to tune rules, handle false positives and set sensible rate limits.
Resources
Advanced Time: 4–6 months
Scaling and defending the edge
Skills
Defend against application-layer DDoS and bots. Use DNS logs for detection. Design resilient edge architecture. Decide where TLS inspection is worth it.
Hands-on projects and labs
Add rate limiting and simple bot detection to a lab app and test them. Analyse DNS logs from a lab for tunnelling you created, and write a detection.
Done when you can…
Show an edge that survives a simulated application-layer attack. Detect command-and-control traffic in DNS logs.
Advanced
Advanced DDoS defence
Layer 7 and application DDoS are harder than volumetric floods. Learn upstream scrubbing, bot management and graceful degradation.
Resources
Advanced
Bot and abuse management
Credential stuffing, scraping and fraud come from bots. Learn detection, rate limiting and challenges, and the trade-off with real users.
Resources
Advanced
DNS as a detection source
DNS logs reveal command and control, tunnelling and newly registered domains. Send them to the SOC and build detections.
Resources
Advanced
Edge architecture at scale
Design resilient edge: multiple providers, failover, anycast and cached origins, so no single failure takes services down.
Resources
Advanced
TLS inspection and privacy
Inspecting encrypted traffic catches hidden threats but breaks some apps and raises privacy issues. Learn where it helps and where to exempt traffic.
Resources
Advanced Optional
Remote browser isolation
Running the browser away from the device and streaming only pixels contains web threats entirely, at the cost of performance and money.
Resources
Expert Time: 6–12 months
Strategy and leadership
Skills
Set edge and secure access strategy. Plan edge resilience and continuity.
Hands-on projects and labs
Write a staged plan to move an organisation from VPN to zero trust access. Design a resilient edge for a service, with failover and DDoS handling.
Done when you can…
Run an edge and access programme with measured maturity. Lead a SASE or zero trust access rollout.
Expert
Edge and access strategy
Plan the move from perimeter to SASE and zero trust, in steps, without breaking access for users mid-journey.
Resources
Expert
Resilience and continuity
The edge must stay up under attack. Plan for provider failure, DDoS and certificate expiry, and test the plans.
Resources
Expert
Measuring edge security
Track attacks blocked, DDoS handled, TLS and DNS coverage, and progress toward zero trust. Report outcomes, not raw blocks.
Resources
The edge is where an organisation touches the internet in both directions: users reaching out to websites and apps, and the world reaching in to published services. It is a favourite target, because one weak point here exposes everyone behind it.
This roadmap covers DNS security, web application firewalls and DDoS protection on the inbound side, and secure web gateways, CASB, browser security and the move to SASE and zero trust network access on the outbound side. It blends network, web and cloud security.
Why it matters
Edge services absorb constant attacks, and the industry is shifting from the old perimeter to cloud-delivered SASE and zero trust. People who understand both the classic controls and the new model are in demand.
Typical job roles
Entry Network or edge administrator Runs DNS, proxies, WAF and DDoS protection day to day. Mid-level Edge security engineer Configures WAF, DNS security, gateways and DDoS protection. Mid-level SASE / network security engineer Builds secure access with SSE, ZTNA and cloud-delivered controls. Senior Edge security architect Designs the edge and secure access architecture. Lead Head of network and edge security Owns edge and access strategy.