CareerOS
Sign inStart for free
Learning Paths

Cybersecurity Foundations

How systems are attacked and defended: networks, Linux, web security, cryptography and the frameworks organisations run on, practised legally in labs built for it.

Finish this and you can find and explain the common web vulnerabilities, harden a Linux host, and read a security framework without getting lost.

Starts at
Beginner
Topics
5
Projects
5
Of material
167 h
  • Networking
  • Linux
  • Web security
  • Cryptography
  • Security frameworks
Level
Format
  1. 01

    Security basics

    Beginner

    The concepts every security role assumes you know: threats, controls, risk and the vocabulary of the field.

    Build this

    A risk assessment of a small organisation

    Pick a real small business or club you know and assess it.

    1. List its assets and who depends on them.
    2. Identify five threats and rate likelihood and impact.
    3. Map controls to the NIST functions and propose the three cheapest that cut the most risk.

    Done when: A two-page assessment written for a non-technical owner.

  2. 02

    Linux and networks

    Beginner

    The command line, permissions, packets and protocols: where most attacks happen and most evidence lives.

    Build this

    Harden a Linux server, then prove it

    Start from a default cloud or local VM.

    1. Baseline it: open ports, users, services.
    2. Harden it: key-only SSH, firewall, automatic updates, least privilege.
    3. Capture traffic before and after and show what changed.
    4. Write the checklist so someone else could repeat it.

    Done when: The hardening checklist with before-and-after evidence.

  3. 03

    Web application security

    Intermediate

    Injection, broken access control, XSS and the rest, learned by exploiting them in labs made for it.

    Build this

    Find, exploit and fix five vulnerabilities

    Use a deliberately vulnerable app you run locally, never a real site.

    1. Run OWASP Juice Shop in a container.
    2. Find and exploit five issues from different Top 10 categories.
    3. Write each up as a finding: impact, reproduction steps, fix.
    4. Patch one in the code and show the exploit no longer works.

    Done when: A findings report in the format a security team would accept.

    OWASP Juice Shop
  4. 04

    Cryptography you can use

    Intermediate

    Hashing, encryption, signatures and TLS: what each guarantees, and how they are misused.

    Build this

    Store passwords correctly, and explain why

    A small sign-up service that would survive a database leak.

    1. Hash passwords with a slow, salted algorithm and justify its parameters.
    2. Add encrypted fields for one piece of personal data, with the key kept outside the database.
    3. Simulate a leak and show what an attacker can and cannot recover.

    Done when: The service and a one-page threat analysis.

  5. 05

    Practice: capture the flag

    Intermediate

    Competitions and challenge sites that build the instincts certifications cannot.

    Build this

    Ten write-ups

    Solve ten picoCTF challenges across at least four categories and publish write-ups that teach the technique, not just the flag.

    Done when: A blog or repository with ten write-ups.

Not sure this is your direction?

A three-minute counselling sample is free.

Try counselling
Cybersecurity Foundations · Learning Paths · CareerOS