How to learn cybersecurity

Build the base layer. Work with Linux and Windows command lines, file systems, users, permissions, processes, and logging. This is first because every later network and security tool assumes you can navigate a host and read system state. You cannot assess what you cannot operate.

• Linux file permissions and ownership
• Windows NTFS permissions and registry hives
• systemd units and Windows services
• process inspection with ps, top, tasklist
• local user and group management
• log locations in /var/log and Event Viewer
• SSH and PowerShell remoting
• shell scripting basics (bash, PowerShell)

You can now: Given a running Linux or Windows VM, you can inspect running processes, find a suspicious binary's file path and owner, and check the relevant logs without a guide.

Security events are network events first. Learn how packets move, how addressing and routing work, and how to read traffic in Wireshark. This sits here because every later stage—scanning, defence, detection—assumes you can interpret a packet capture and understand what a tool is actually sending.

• TCP/IP and the OSI model
• IPv4 addressing, subnetting, CIDR
• TCP handshake and state flags
• UDP and common port protocols
• DNS resolution and records
• HTTP request/response and TLS handshake
• Wireshark display filters and tcpdump
• NAT, firewalls and routing tables

You can now: Given a packet capture of a simple HTTP request, you can isolate the TCP stream, identify client and server ports, and explain each step of the handshake.

Learn what controls exist and how they fail. Cover authentication, access control, encryption, and the defensive tools you will operate: firewalls, IDS/IPS, antivirus, vulnerability scanners. This follows networking because controls are configured on network boundaries and hosts, and you need to see how they interact.

• Authentication factors and password hashing (bcrypt, Argon2)
• Access control models (DAC, MAC, RBAC)
• Symmetric vs asymmetric encryption and TLS certificates
• Firewall rules and stateful inspection
• IDS/IPS signatures and Suricata
• Endpoint protection and Sysmon
• Vulnerability scanning with Nessus/OpenVAS
• CVSS scoring and remediation prioritisation

You can now: Given a small lab network, you can run a vulnerability scan, interpret a CVSS score, and write a firewall rule that blocks an identified service while allowing required traffic.

To detect attacks you must know what they look like. Study reconnaissance, initial access, privilege escalation, persistence, and lateral movement in a controlled lab. This is deliberately after defensive basics so you analyse attacks as a defender, not imitate a checklist of commands.

• Reconnaissance with Nmap and passive DNS
• Password attacks: brute force, spraying, credential stuffing
• Exploitation basics: Metasploit and manual payloads
• Windows privilege escalation and UAC bypass
• Linux privilege escalation via SUID and cron
• Persistence mechanisms: services, scheduled tasks, registry Run keys
• Lateral movement: SMB, PsExec, WinRM
• Command and control channels and beaconing

You can now: In an isolated lab, you can use publicly known techniques to gain a foothold on a deliberately vulnerable Windows host and then document the artefacts you would look for as a defender.

The job of a security analyst is to find attacks early and respond without making things worse. Work with SIEM queries, endpoint telemetry, memory and disk forensics, and incident handling. This comes after offensive techniques because you now know which artefacts matter and where to look.

• Security information and event management (SIEM) query languages
• Windows event logs and Sysmon telemetry
• Network detection with Zeek and Suricata alerts
• Memory analysis with Volatility
• Disk forensic timelines with plaso
• Incident response phases (NIST 800-61)
• Threat intelligence feeds and indicators of compromise
• Containment and eradication planning

You can now: Given a pre-recorded compromise scenario, you can write SIEM queries to locate the initial access, trace lateral movement, and produce a one-page timeline with containment steps.

Combine skills into usable judgement. Harden a small network, segment systems, configure logging, then run a detection exercise against a red-team script. This is last because it forces you to think in systems, not certificates. You must make choices and justify them.

• Network segmentation and VLANs
• Host hardening benchmarks (CIS)
• Centralised logging with Syslog/Elastic
• Active Directory security and group policy
• Patch management and vulnerability tracking
• Cloud security basics: IAM, VPC, storage permissions
• Capstone: build, attack, detect, respond lab
• Writing an incident report and remediation plan

You can now: You can stand up a three-host network from scratch, harden it against a known attack set, and detect the attack using your own logs and alerts.