Cyber Security: from zero to SOC analyst

What cyber security protects and why: the CIA triad, threats, vulnerabilities and risk, strong passwords and MFA, phishing and social engineering, and the law in India. After this module you can explain any security problem in plain words, protect your own accounts, spot a phishing message and say what is legal to practise.

1. What cyber security protects: the CIA triadCyber security is the work of keeping information and computer systems safe from harm. Almost every security problem damages one of three things: confidentiality (only the right people can see data), integrity (data is correct and not secretly changed) and availability (systems work when people need them). Together they are called the CIA triad.25 min
2. Threats, vulnerabilities and riskA vulnerability is a weakness. A threat is someone or something that could use that weakness to cause harm. Risk is how likely that harm is, multiplied by how bad it would be. Security work is mostly about reducing risk, not removing it completely.30 min
3. Passwords and multi-factor authenticationA password proves who you are only if nobody else knows or can guess it. Long, unique passwords kept in a password manager beat short "complex" ones. Multi-factor authentication (MFA) adds a second proof, like an app code or a security key, so a stolen password alone is not enough.30 min
4. Phishing and social engineeringSocial engineering means tricking people instead of breaking technology. Phishing is the most common kind: a fake message that tries to make you click a link, open a file, share an OTP or send money. The signs are urgency, a request for secrets or money, and a sender or link that does not match the real organisation.30 min
5. Ethics and the law: permission firstIn security, the same action can be a job or a crime. The difference is permission. In India the IT Act 2000 makes unauthorised access to a computer a civil wrong (Section 43) and, when done dishonestly or fraudulently, a crime (Section 66). Practise only on your own lab machines, legal training platforms, or with written permission.25 min

How data moves: the TCP/IP layers, IP addresses and subnets, ports and protocols, DNS, and HTTP, HTTPS and TLS, always seen through a defender's eyes. After this module you can read an IP address, a port number, a DNS record and an HTTP header in a log and say what is normal and what is suspicious.

1. TCP/IP and the network layersNetworks are built in layers, and each layer does one job: carrying signals, moving frames between nearby devices, routing packets across the internet, delivering data to the right program, and finally the app itself. Knowing the layers tells you where an attack happens and which tool can see it.30 min
2. IP addresses, subnets and CIDRAn IP address identifies a device on a network, like 192.168.1.10. A subnet is a group of addresses written in CIDR form, like 192.168.1.0/24, where /24 says how many bits are fixed. Defenders use this every day: to tell private from public addresses, to write firewall rules and to check whether an address is inside a range.30 min
3. Ports and protocolsA port is a number from 0 to 65535 that tells a computer which program should receive network data. Well-known services use fixed ports, like 443 for HTTPS and 22 for SSH. Knowing the common ports lets you spot risky open services and odd traffic in logs.30 min
4. DNS: the internet's phone bookDNS (Domain Name System) turns names like example.com into IP addresses. Nearly every connection starts with a DNS lookup, so DNS logs show where every device is trying to go. Attackers abuse DNS with look-alike domains, hijacked records and hidden data, and email security checks (SPF, DKIM, DMARC) live in DNS too.30 min
5. HTTP, HTTPS and TLSHTTP is the language browsers and web servers use: requests with methods like GET and POST, and responses with status codes like 200 and 404. HTTPS is HTTP inside TLS, which encrypts the traffic, protects it from changes and proves the server's identity with a certificate. Security headers and cookie flags add more protection.30 min

The machines you defend and the maths that protects them: Linux and Windows security basics, hashing, symmetric and asymmetric encryption, and certificates and PKI. After this module you can check users and permissions on both systems, verify a file with its hash, explain how HTTPS keeps data secret, and read a certificate.

1. Linux security basicsMost servers, cloud machines and security tools run Linux. Its security rests on users and groups, file permissions (read, write, execute for owner, group and others), the all-powerful root account used carefully through sudo, regular updates, and logs in /var/log.35 min
2. Windows security basicsMost office laptops run Windows, and most companies manage them with Active Directory. Key defences are separate admin and normal accounts, User Account Control, Microsoft Defender, updates, BitLocker disk encryption, and the Security event log, which records logons and changes.35 min
3. Hashing: fingerprints for dataA hash function turns any data into a short, fixed-length fingerprint. The same input always gives the same hash, a tiny change gives a completely different hash, and you cannot turn the hash back into the data. Defenders use hashes to check files have not changed, to identify known malware, and to store passwords safely (with a salt and a slow algorithm).30 min
4. Symmetric and asymmetric encryptionEncryption scrambles data so only someone with the right key can read it. Symmetric encryption (like AES) uses one shared key and is fast. Asymmetric encryption (like RSA or elliptic curves) uses a public key and a private key, which solves the problem of sharing keys and makes digital signatures possible. Real systems such as HTTPS use both together.35 min
5. Certificates and PKIA digital certificate is an ID card for a website, person or device: it ties a name to a public key and is signed by a certificate authority (CA). PKI (public key infrastructure) is the whole system of CAs, certificates and checks that lets your browser trust a site it has never seen. Browsers check the name, the dates and the chain of signatures.30 min

Control who can do what, and what can talk to what: identity and access management with least privilege and RBAC, firewalls, intrusion detection and prevention, and network segmentation and VPNs. After this module you can review access rights, read and write simple firewall rules, explain an IDS alert, and design a basic segmented network.

1. Identity and access management, least privilege and RBACIdentity and access management (IAM) decides who someone is and what they may do. The key rule is least privilege: give each person only the access their job needs, for only as long as they need it. Role-based access control (RBAC) makes this manageable by giving permissions to roles, and roles to people.35 min
2. FirewallsA firewall decides which network traffic is allowed, using an ordered list of rules. The safest setup is default deny: block everything, then allow only what is needed. Firewalls come as network appliances, cloud security groups, host firewalls on each machine, and web application firewalls (WAF) that understand HTTP.30 min
3. Intrusion detection and prevention (IDS/IPS)An intrusion detection system (IDS) watches traffic or a host and raises an alert when it sees something that looks like an attack. An intrusion prevention system (IPS) sits in the path and can also block it. They detect with signatures (known patterns) or anomalies (unusual behaviour), and every alert must be checked, because some are false positives.30 min
4. Network segmentation, zero trust and VPNsSegmentation splits a network into zones, so an attacker who gets into one part cannot reach everything. A DMZ holds internet-facing servers, VLANs separate groups of devices, and zero trust checks every request instead of trusting the network. VPNs create encrypted tunnels for remote staff and between offices, and must themselves be patched and protected with MFA.30 min

The heart of a SOC analyst's job: reading logs (Linux auth logs, Windows Event IDs like 4624 and 4625, firewall, web and DNS logs), using a SIEM to search and triage alerts, handling incidents with the NIST SP 800-61 lifecycle, and working through playbooks on a real shift. After this module you can triage a login alert, write a timeline and follow a phishing playbook.

1. Logs and log sourcesA log is a time-stamped record of something that happened: a login, a blocked connection, a DNS lookup, a file change. Defenders collect logs from many sources (servers, laptops, firewalls, cloud, apps) because they are the main evidence of what an attacker did. You must know the key sources, the key Windows Event IDs, and why correct time matters.40 min
2. SIEM and alert triageA SIEM (security information and event management) system collects logs from everywhere, puts them in one searchable place, links related events together and raises alerts. Triage is the analyst's first look at an alert: is it real, how bad is it, and what happens next? A good triage is quick, written down and based on evidence.40 min
3. The incident response lifecycle (NIST SP 800-61)Incident response is the planned way a team handles a security incident. NIST SP 800-61 Rev. 2 describes four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity (lessons learned). Rev. 3 (2025) places the same work inside the NIST Cybersecurity Framework 2.0. Following a plan keeps people calm, protects evidence and speeds recovery.40 min
4. A SOC analyst's day and playbooksA security operations centre (SOC) is the team that watches an organisation's security around the clock. L1 analysts triage alerts, L2 analysts investigate deeper, and L3 or specialists hunt threats and handle major incidents. Playbooks are step-by-step guides for common alerts, like a reported phishing email, so every analyst responds the same, correct way.35 min

What malicious software is and how defenders catch it, then the web: the OWASP Top 10 risks with their fixes, and secure coding habits that stop the most common bugs. After this module you can name malware types from their behaviour, match files against known-bad hashes, explain each OWASP risk with a fix, and write code that uses parameterised queries and output encoding.

1. Malware types and how they get inMalware is any software made to harm or misuse a computer, its data or its user. Types are named by behaviour: viruses attach to files, worms spread by themselves, trojans pretend to be useful, ransomware locks files for money, and spyware and infostealers steal data. Most malware still gets in through a person: an attachment, a fake app or a cracked download.35 min
2. How defenders detect malwareDefenders find malware in layers: matching known file hashes and patterns (signatures, YARA rules), looking at suspicious behaviour (an Office document starting PowerShell), running unknown files in a sandbox, and watching for persistence like new services and startup entries. No single method catches everything.35 min
3. The OWASP Top 10 with fixesThe OWASP Top 10 is a free, widely used list of the most serious risks in web applications, such as broken access control and injection. Security teams, developers and auditors use it as a shared checklist. For each risk there is a clear fix, like checking permissions on the server and using parameterised queries.40 min
4. Secure coding basicsSecure coding means writing software that stays safe when people send it unexpected or hostile input. The core habits are: validate input against what you expect, encode output for where it goes, use parameterised queries, keep secrets out of code, handle errors without leaking details, mask personal data in logs, and keep dependencies updated.35 min

Security when your servers belong to Amazon, Microsoft or Google: the shared responsibility model, cloud identity and access management, the misconfigurations behind most cloud breaches (like public storage buckets), and cloud logging and monitoring. After this module you can say who is responsible for what, spot an over-powerful IAM policy or a public bucket, and know which cloud logs to check in an investigation.

1. The shared responsibility modelIn the cloud, security is split between the provider and the customer. The provider secures the cloud itself: buildings, hardware and the core platform. The customer secures what they put in the cloud: their data, user accounts, access settings and, for virtual machines, the operating system and apps. Most cloud breaches happen on the customer's side.30 min
2. Cloud identity and access managementIn the cloud, identity is the main control: whoever holds an admin login or access key controls the whole account. Protect the root or owner account with MFA and never use it daily, give people and programs roles with least privilege, prefer short-lived role credentials over long-lived access keys, and review permissions regularly.35 min
3. Common cloud misconfigurationsMost cloud breaches come from settings, not clever hacking: storage open to the public, management ports open to the whole internet, unencrypted disks and snapshots, logging turned off, and secrets left in places anyone can read. Cloud security posture management (CSPM) tools scan accounts for these mistakes automatically.35 min
4. Logging and monitoring in the cloudCloud providers record who did what in your account: AWS CloudTrail, Azure Activity Log and Microsoft Entra sign-in logs, and Google Cloud Audit Logs. Threat detection services such as Amazon GuardDuty and Microsoft Defender for Cloud watch these and alert on suspicious behaviour. Analysts look for root logins, logins without MFA, new access keys, changes to logging, and public exposure.30 min

The business side of security: governance, risk management and frameworks; ISO/IEC 27001:2022; India's Digital Personal Data Protection Act 2023 and the CERT-In 6-hour incident reporting directions of 2022; and an overview of the EU GDPR. After this module you can keep a risk register, explain what an ISO 27001 audit checks, and say what an Indian company must do when it has a cyber incident or a personal data breach.

1. GRC and risk managementGRC stands for governance, risk and compliance. Governance sets direction and responsibility through policies; risk management finds, scores and treats risks in a risk register; compliance proves that the company follows laws, standards and contracts. Frameworks like the NIST Cybersecurity Framework 2.0 and ISO 27001 give a shared structure.35 min
2. ISO/IEC 27001:2022ISO/IEC 27001 is the international standard for an information security management system (ISMS): a managed, repeating way of handling security risks. The 2022 version has mandatory clauses 4 to 10 and an Annex A list of 93 controls in four themes. Companies choose controls through risk assessment, record them in a Statement of Applicability, and can be certified by an accredited auditor.35 min
3. India: the DPDP Act 2023 and CERT-In directionsIndia's Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for anyone processing digital personal data: clear notice and consent, reasonable security safeguards, breach notification, and rights for individuals, with penalties up to ₹250 crore. Separately, CERT-In's directions of April 2022 require organisations to report listed cyber incidents within 6 hours, keep logs for 180 days in India and sync clocks to official time servers.40 min
4. GDPR overviewThe EU General Data Protection Regulation (GDPR) has applied since 25 May 2018 and protects personal data of people in the EU. It can apply to Indian companies that offer goods or services to people in the EU or monitor their behaviour. Key ideas: seven principles, six lawful bases, strong individual rights, breach notification to the authority within 72 hours, and fines up to €20 million or 4% of worldwide annual turnover.30 min

Think like a defender who knows the enemy: threat intelligence and indicators of compromise (IOCs), MITRE ATT&CK tactics and techniques, the Lockheed Martin Cyber Kill Chain, and how SOCs use these frameworks to plan, measure and improve detection. After this module you can match IOCs in logs, map an incident to ATT&CK, explain where in the kill chain an attack was stopped, and measure detection coverage.

1. Threat intelligence and indicators of compromiseThreat intelligence is information about attackers, collected and analysed so defenders can make better decisions. It comes at different levels, from board-level trends to technical indicators of compromise (IOCs) such as malicious IP addresses, domains and file hashes. IOCs are easy to use but easy for attackers to change, so behaviour-based intelligence lasts longer.35 min
2. MITRE ATT&CK: tactics and techniquesMITRE ATT&CK is a free, public knowledge base of how real attackers behave, built from observed incidents. Tactics are the attacker's goals (like initial access or persistence), techniques are how they reach them (like phishing or scheduled tasks), and each has an ID such as T1566. Defenders use it as a common language to describe attacks and plan detections.40 min
3. The Lockheed Martin Cyber Kill ChainThe Cyber Kill Chain, published by Lockheed Martin in 2011, splits an intrusion into seven phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The key idea for defenders: break any link in the chain and the attack fails, and the earlier you break it, the less it costs.30 min
4. Using frameworks in detection and threat huntingFrameworks become useful when they drive daily work. SOCs tag every detection rule with ATT&CK techniques, measure which priority techniques they can detect (coverage), write portable rules in formats like Sigma, and run hypothesis-based threat hunts for attackers that no rule has caught yet. With permission, purple-team exercises test whether detections really fire.35 min

Turn your learning into a job: the main security career paths, which certifications help at which stage (CC, Security+ SY0-701, CySA+, CISSP later), building a home lab and a portfolio, and preparing for interviews with honest Indian salary expectations. After this module you have a 6-month plan, a lab you can show, and answers ready for the common SOC analyst interview questions.

1. Career paths in cyber securityCyber security has many paths, not just "hacker". Most people start in a SOC as an L1 analyst, or in IT support or networking, and later move to incident response, threat hunting, detection engineering, cloud security, application security, GRC or penetration testing. Pick a direction, but expect your first job to be a broad one.30 min
2. Certifications: what, when and whyCertifications help you get past CV filters, but skills get you the job. A sensible path for a SOC career is an entry certificate such as ISC2 CC or CompTIA Security+ (SY0-701), then an analyst certificate such as CompTIA CySA+, and much later CISSP, which needs five years of relevant work experience. Always check the current exam code, price and rules on the official site.30 min
3. Building a home lab and a portfolioA home lab is a small, isolated set of virtual machines on your own computer where you can safely generate logs, practise investigations and test detections. A portfolio is public proof of that work: write-ups, scripts and detection rules on GitHub or a blog. Together they let you show, not just say, that you can do the job.35 min
4. Interviews, CVs and honest salary expectationsSOC interviews test fundamentals (networking, ports, Windows Event IDs, the CIA triad, hashing versus encryption, incident response phases), a practical scenario like a phishing email or a brute-force alert, and how clearly you explain your own lab work. In India, freshers in SOC roles typically earn roughly ₹3–8 LPA, depending a lot on city, company and skills.35 min