Cybersecurity roadmap

Learn IP addresses, ports, the TCP/IP model, DNS (which turns names into IP addresses), DHCP and HTTP. Understand what a router, switch and firewall do. Cisco's free Skills for All courses are a good place to start.

Wireshark records the data moving through your network card and shows each packet. Capture your own traffic while you open a website and find the DNS question and the HTTP request. Only capture on networks you own or have permission to watch.

Learn to move around, read and search files, manage users and permissions, and see running processes. Practise commands like grep, find, ps and chmod daily. The OverTheWire Bandit game teaches this in a fun way.

Learn users and groups, the registry, services, PowerShell and the Event Viewer, where Windows writes its logs. Understand what Active Directory is: the system companies use to manage logins and computers. Many real attacks target Active Directory.

Install VirtualBox or VMware and create a few virtual machines, for example one Linux and one Windows. Keep the lab on a private virtual network. Take snapshots so you can undo mistakes quickly.

Learn basic bash and Python: loops, reading files, simple text searching. Start by writing a script that counts failed login lines in a log file. You do not need to be a full developer, but reading and writing small scripts is a must.

Confidentiality means only the right people can see data. Integrity means data is not changed without permission. Availability means systems work when people need them; every attack harms at least one of these three.

A vulnerability is a weakness, like an old unpatched app. A threat is someone or something that could use it. Risk combines how likely an attack is and how much damage it would do.

Learn the difference between authentication (who you are) and authorisation (what you can do). Learn why long passphrases, password managers and multi-factor login matter. Also learn how websites should store passwords: hashed, never as plain text.

Learn the difference between hashing, symmetric encryption and public-key encryption. Understand how HTTPS uses certificates so your browser knows it is talking to the real site. You do not need to do the maths, but you must know which tool fits which job.

Phishing tricks people into clicking bad links or sharing passwords, often by SMS, WhatsApp or email in India. Malware is harmful software, and ransomware locks files and demands money. Learn the warning signs and how backups and training reduce the damage.

Only test systems you own or have clear written permission to test, and stay inside the agreed scope. In India, the Information Technology Act, 2000 makes unauthorised access, data damage and similar acts offences that can bring fines or jail. Report security problems you find by chance through the organisation's official disclosure route, and you can also report incidents to CERT-In.

The NIST Cybersecurity Framework groups work into steps like identify, protect, detect, respond and recover. ISO 27001 is a common standard companies get certified in. Knowing the names and main ideas helps you understand job descriptions and audits.

OWASP is a non-profit group that publishes free security guides. Its Top 10 covers problems like broken access control, injection and security misconfiguration. Learn what each one means, how it is attacked and how developers prevent it.

PortSwigger Web Security Academy has free labs for SQL injection, cross-site scripting (XSS), access control bugs and more. Each lab is a legal target built for practice. Use Burp Suite Community Edition to look at and change web requests.

Learn to read web server logs, Linux auth logs and Windows security events, such as event ID 4625 for a failed login. Look for patterns like many failed logins from one IP address. Good analysts know what "normal" looks like, so odd things stand out.

A SIEM (security information and event management) tool collects logs from many systems in one place and raises alerts. Common ones are Splunk, Microsoft Sentinel, Elastic and the free, open-source Wazuh. Learn to search logs and build a simple alert rule in at least one.

Triage means deciding quickly if an alert is real, harmless or needs more digging. Check the user, the device, the time and what happened just before and after. Write clear notes so the next person understands your decision.

MITRE ATT&CK is a free list of the tactics and techniques real attackers use, such as phishing for first access or stealing passwords. SOC teams map alerts to it to see what stage an attack is in. Learn to look up a technique and find how to detect it.

The usual steps are prepare, detect, contain, remove the threat, recover and learn. Containing might mean isolating one laptop from the network. Always keep evidence safe and follow your company's process.

A penetration test is an approved, planned attack on a system to find and report weaknesses. It always starts with a written agreement saying what can be tested and when. Without that permission, the same actions are illegal.

Reconnaissance means collecting information, like which hosts and services exist. Nmap scans a machine to find open ports and the services behind them. Only scan your own lab machines or targets you are allowed to test.

An exploit is a way to use a vulnerability, such as an old service with a known bug. Tools like Metasploit contain many of these, but you should also understand what each one does. Practise only on intentionally vulnerable machines in labs.

Privilege escalation means going from a normal user to an admin or root user. It often uses weak permissions, saved passwords or old software. Learning it also shows you what to fix on real systems.

Learn how attackers steal and reuse passwords and tickets inside a Windows domain. Learn the defences too: strong passwords, limited admin accounts and good monitoring. Build a small AD lab with free evaluation versions of Windows Server.

A good report explains each finding, how serious it is, how you found it and exactly how to fix it. Write a short summary for managers and details for technical teams. Clear writing often matters more than clever hacking.

Some companies publish rules that let anyone test certain systems and report bugs, sometimes for a reward. Read the scope and rules fully and follow them exactly. Most beginners earn little at first, so treat it as practice, not a salary.

In the cloud, the provider secures the hardware, but you must secure your settings, users and data (the shared responsibility model). Many cloud breaches come from simple mistakes like a public storage bucket. Learn IAM, logging and network rules in one cloud well.

Turn on audit logs such as AWS CloudTrail or Azure Activity Logs. Use the cloud's security tools to find risky settings automatically. Send cloud logs into your SIEM so the SOC can watch them.

Threat hunting means searching logs for signs of attack based on an idea, for example "has anyone used PowerShell to download files?". It needs strong log skills and knowledge of MITRE ATT&CK. Good hunts often become new alert rules.

Forensics means collecting and studying evidence from disks, memory and logs without changing it. Learn about timelines, keeping a record of who handled the evidence, and common tools. In legal cases, careful handling decides whether evidence can be used.

GRC work covers policies, risk registers, audits and standards like ISO 27001. In India, also learn the main ideas of the Digital Personal Data Protection (DPDP) Act and CERT-In's rules on reporting incidents. GRC is a good path for people who like writing and organising.

Common paths are SOC and incident response, penetration testing, cloud security, application security and GRC. Pick one based on what you enjoyed most in your labs. Go deep there while keeping your basics fresh.

Entry certificates like CompTIA Security+ or ISC2 Certified in Cybersecurity (CC) are widely known; ISC2 has at times offered its CC training and exam free, so check its site. Advanced ones like OSCP or cloud security certs cost a lot and are hard. Check current fees and rules on the official sites, and never pay for "guaranteed pass" or leaked-answer offers.