Cybersecurity Roadmap: A Step-by-Step Learning Guide

Introduction

Cybersecurity is a vast and rapidly evolving field. It encompasses computer architecture, networking, operating systems, scripting, security tooling, penetration testing, threat detection, and incident response.

For beginners and transitioning professionals, the sheer amount of information can feel overwhelming. Without a structured roadmap, it is easy to get stuck jumping between unrelated tutorials, downloading random tools, or attempting advanced exploit labs without understanding the underlying protocols.

This roadmap provides a progressive, step-by-step curriculum to build a resilient foundation in cybersecurity. Whether your goal is to become a SOC Analyst, Penetration Tester, Security Engineer, or Bug Bounty Hunter, master these core domains in sequence before specializing.

+-----------------------------------------------------------------------------------+
|                           CYBERSECURITY LEARNING PATH                             |
+-----------------------------------------------------------------------------------+
|  PHASE 1: CORE FOUNDATIONS                                                        |
|  [ Computer Fundamentals ] -> [ Networking ] -> [ Linux ] -> [ Windows ]          |
+-----------------------------------------------------------------------------------+
                                         │
                                         ▼
+-----------------------------------------------------------------------------------+
|  PHASE 2: PROGRAMMING & SECURITY ESSENTIALS                                       |
|  [ Python / Bash / SQL ] -> [ Security Fundamentals ] -> [ Cryptography & Web ]   |
+-----------------------------------------------------------------------------------+
                                         │
                                         ▼
+-----------------------------------------------------------------------------------+
|  PHASE 3: PRACTICAL SECURITY PATHWAYS                                             |
|  ┌───────────────────────────────────┐     ┌───────────────────────────────────┐  |
|  │        OFFENSIVE SECURITY         │     │         DEFENSIVE SECURITY        │  |
|  │  • Web App Pentesting (OWASP)     │     │  • SOC & Threat Monitoring        │  |
|  │  • Network Pentesting             │     │  • SIEM (Splunk, Wazuh, Sentinel) │  |
|  │  • Active Directory Security      │     │  • EDR, Sysmon, Auditd, Suricata  │  |
|  │  • Mobile Security (Android)      │     │  • Alert Triage & Threat Hunting  │  |
|  └───────────────────────────────────┘     └───────────────────────────────────┘  |
+-----------------------------------------------------------------------------------+
                                         │
                                         ▼
+-----------------------------------------------------------------------------------+
|  PHASE 4: FRAMEWORKS, BENCHMARKS & HANDS-ON LABS                                  |
|  [ MITRE ATT&CK / NIST / ISO ] -> [ Practical Labs & Bug Bounty Platforms ]       |
+-----------------------------------------------------------------------------------+

1. Computer Fundamentals

Before attempting to secure or break a system, you must know how hardware and software operate at a low level.

• How computers work: Understand the fetch-decode-execute cycle and how data moves between hardware components.
• CPU, RAM, ROM, and storage: The differences between volatile and non-volatile memory, disk I/O, cache tiers, and persistent storage media.
• Operating systems and applications: How the operating system mediates between hardware and userland processes, manages system resources, and executes code.
• Virtualization and virtual machines: Hypervisors (Type 1 bare-metal vs. Type 2 hosted like VirtualBox, VMware Workstation, and Proxmox). Virtualization is essential for safely building isolated malware analysis and penetration testing labs.
• Basic computer troubleshooting: Diagnosing boot issues, service crashes, hardware bottlenecks, and interpreting OS error codes.

2. Networking

Networking is the backbone of all modern computing and cybersecurity. If you cannot explain how a packet traverses the internet, you will struggle to analyze attacks or secure infrastructure.

• OSI Model: The 7-layer reference model (Physical, Data Link, Network, Transport, Session, Presentation, Application) and the role of each layer.
• TCP/IP Model: The practical 4-layer model (Network Access, Internet, Transport, Application) used across modern networks.
• TCP vs. UDP: Connection-oriented reliable transmission (3-way handshake: SYN, SYN-ACK, ACK) versus connectionless, low-overhead transmission.
• IP Addresses (IPv4 and IPv6): IPv4 address structure, 32-bit dotted-decimal notation, IPv6 128-bit hexadecimal addressing, and why IPv6 was adopted.
• Private vs. Public IP Addresses: RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) versus globally routable public IPs.
• MAC Addresses: Layer 2 physical hardware identifiers, manufacturer OUIs, and Layer 2 frames.
• Subnetting: CIDR notation (/24, /16), subnet masks, calculating network IDs, broadcast addresses, and usable host counts.
• Default Gateway: The routing hop that forwards traffic outside the local subnet to other networks or the Internet.
• Core Network Protocols:
  • DNS (Domain Name System): Resolves human-readable domain names into IP addresses (A, AAAA, CNAME, MX, TXT records).
  • DHCP (Dynamic Host Configuration Protocol): Automatically leases IP addresses, subnet masks, and DNS servers to endpoints (DORA process).
  • ARP (Address Resolution Protocol): Resolves IP addresses to MAC addresses on local subnets; vulnerable to ARP poisoning.
  • ICMP (Internet Control Message Protocol): Diagnostic messaging protocol used by tools like ping and traceroute.
• HTTP vs. HTTPS: Plaintext web communication over port 80 versus encrypted communication over port 443.
• SSL/TLS: Handshake mechanisms, asymmetric encryption for key exchange, symmetric encryption for session data, and certificate validation.
• Essential Network Protocols: SSH (port 22), FTP/SFTP (ports 20/21/22), SMTP (port 25/587), IMAP/POP3, and Telnet (insecure port 23).
• Ports and Protocols: Memorize common ports and understand how socket pairs (Source IP:Port + Destination IP:Port) maintain stateful connections.
• VLANs and Firewalls: Segmenting networks into broadcast domains and enforcing stateful packet inspection at perimeter and internal boundaries.
• Proxies and Reverse Proxies: Forward proxies protecting internal clients versus reverse proxies fronting web servers for load balancing, caching, and SSL termination.
• VPNs: Virtual Private Networks (IPsec, OpenVPN, WireGuard) creating encrypted tunnels over untrusted networks.
• Wi-Fi Security: WEP (deprecated), WPA2 (AES-CCMP), and modern WPA3 security standards.
• Network Security & Traffic Analysis: Identifying anomalous traffic flows, port scans, data exfiltration, and command-and-control (C2) beacons.
• Packet Capture: Using Wireshark and tcpdump to capture .pcap files, filter traffic using BPF filters, and reconstruct streams.

3. Linux Fundamentals

The majority of servers, cloud environments, containers, and security tools run on Linux. Fluency in the terminal is non-negotiable.

• Linux Architecture: The Linux Kernel, system libraries, system call interface, and user space.
• Linux Distributions: Debian, Ubuntu, Red Hat Enterprise Linux (RHEL), CentOS/Rocky Linux, and dedicated security distributions like Kali Linux and Parrot OS.
• Linux Filesystem Hierarchy (FHS): Understanding the purpose of /, /etc, /var, /home, /root, /bin, /sbin, /usr, /tmp, and pseudo-filesystems /proc and /sys.
• Terminal Navigation & File Management:
  bash content_copy

  # Navigating and inspecting
  ls -la /var/log
  pwd
  cd /etc
  cat /etc/os-release
  find / -type f -perm -04000 2>/dev/null # Find SUID binaries
  
  # Text processing
  grep -rnw '/var/log/' -e 'Failed password'
  awk '{print $1, $9}' /var/log/nginx/access.log
  sed -i 's/PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config

• Users and Groups: Managing accounts via useradd, usermod, passwd, and inspecting /etc/passwd, /etc/shadow, and /etc/group.
• File Permissions: Understanding standard permissions (Read 4, Write 2, Execute 1), chmod, chown, and special permissions (SUID, SGID, and the Sticky Bit).
• System Logs: Reviewing authentication events in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL), syslog, and querying systemd journals with journalctl -xe.
• SSH Configuration: Hardening /etc/ssh/sshd_config, generating SSH key pairs (ssh-keygen), disabling password-based root login, and configuring bastion hosts.
• Network Commands: Checking interfaces, listening sockets, and routes with ip addr, ip route, ss -tulpn, curl -I, dig, and traceroute.

4. Windows Fundamentals

Windows dominates the enterprise desktop and identity management landscape. Understanding Windows internals is critical for detecting endpoint attacks and executing penetration tests.

• Windows Architecture: User mode versus Kernel mode, the Hardware Abstraction Layer (HAL), and executive system services.
• Windows Filesystem: NTFS features including Master File Table (MFT), Access Control Lists (ACLs), Alternate Data Streams (ADS), and journaling.
• Users and Groups: Local Security Authority Subsystem Service (LSASS), Security Account Manager (SAM) database, and local built-in administrator accounts.
• NTFS Permissions: Discretionary Access Control Lists (DACLs), System Access Control Lists (SACLs), permission inheritance, and explicit permission assignment.
• Task Manager & Process Internals: Investigating parent-child process relationships, PID, thread counts, memory utilization, and detecting unquoted service paths.
• Processes and Services: Managing Windows services via services.msc, sc.exe, and understanding the ubiquitous role of svchost.exe.
• Windows Registry: Structure of hives (HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER), examining common persistence keys (Run, RunOnce, Services), and system configuration.
• Event Viewer: Inspecting core Windows event logs:
  • Security.evtx (Logon events: Event ID 4624 success, 4625 failure)
  • System.evtx (Service installations: Event ID 7045)
  • Application.evtx
• PowerShell: Command-line administration with cmdlets (Get-Process, Get-Service, Get-WinEvent), remote administration (WinRM), Execution Policies, and script-block logging.
• Microsoft Defender: Real-time protection, Cloud-delivered protection, Attack Surface Reduction (ASR) rules, and quarantine logs.
• Windows Defender Firewall: Creating and reviewing inbound and outbound connection rules, port filters, and profile types (Domain, Private, Public).

5. Programming and Scripting

You do not need to be a full-stack software engineer to start in cybersecurity, but scripting is required to automate repetitive tasks, parse logs, interact with APIs, and craft custom exploits.

• Core Programming Concepts:
  • Variables and data types (strings, integers, booleans, lists, dictionaries)
  • Conditional logic (if/else)
  • For loops, while loops, and iterators
  • Functions, arguments, return values, and modular code organization
  • Object-Oriented Programming (classes, objects, inheritance, encapsulation)
• Python for Security:
  • Writing network socket connections and port scanners
  • Interacting with REST APIs and parsing HTTP responses using the requests library
  • Crafting and dissecting network packets with scapy
  • Automating OS tasks and parsing CSV/JSON data structures
• Bash Scripting: Writing automated reconnaissance pipelines, log scraping one-liners, and automated backup scripts.
• SQL Fundamentals: Relational database architecture, queries (SELECT, INSERT, UPDATE, DELETE), table joins, and SQL injection payloads (' OR 1=1 --).
• Data Interchange Formats: Parsing and generating JSON and XML payloads for web applications and log pipelines.
• REST APIs: HTTP verbs, API keys, Bearer tokens, rate limiting, and endpoints.
• Git and GitHub: Version control, cloning repositories, branching, staging, committing, pushing, and maintaining security projects.

6. Cybersecurity Fundamentals

This domain provides the operational doctrine and mental models guiding defensive and offensive decisions.

• What is Cybersecurity: Protecting systems, networks, devices, and data from unauthorized access, modification, destruction, or disruption.
• The CIA Triad:
  • Confidentiality: Ensuring data is accessible only to authorized entities.
  • Integrity: Maintaining the accuracy, consistency, and trustworthiness of data over its lifecycle.
  • Availability: Ensuring authorized users have timely, reliable access to resources.
• Authentication vs. Authorization: Validating identity (Authentication - "Who are you?") versus validating permissions (Authorization - "What are you permitted to do?"). Multi-Factor Authentication (MFA) mechanisms.
• Principle of Least Privilege (PoLP): Granting users, applications, and services only the minimal permissions required to perform their explicit function.
• Threats, Vulnerabilities, and Risks: The foundational relationship for risk assessment:

  Risk = Threat × Vulnerability × Impact

• Security Controls:
  • Preventive (firewalls, MFA, encryption)
  • Detective (SIEM, IDS, audit logs)
  • Corrective (incident response, backups, patches)
• Common Attack Types: Brute-force attacks, credential stuffing, Man-in-the-Middle (MitM), Denial of Service (DoS/DDoS), and ARP/DNS spoofing.
• Malware Taxonomy: Viruses, worms, trojans, ransomware, keyloggers, rootkits, spyware, and backdoors.
• Phishing & Social Engineering: Spear phishing, whaling, vishing, smishing, pretexting, baiting, and credential harvesting landing pages.
• Vulnerability Frameworks & Standards:
  • CVE (Common Vulnerabilities and Exposures): Unique identifiers for disclosed security flaws.
  • CWE (Common Weakness Enumeration): Category taxonomy of software weaknesses.
  • CVSS (Common Vulnerability Scoring System): Standardized severity metric (0.0 to 10.0 scale).
  • OWASP Top 10: The benchmark awareness document for application security risks.
  • MITRE ATT&CK: Globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs).

7. Cryptography

Cryptography ensures privacy, verifies identity, and guarantees data integrity.

• Plaintext and Ciphertext: Unencrypted human-readable data versus encrypted mathematical output.
• Encryption and Decryption: Transforming plaintext into ciphertext using an algorithm and key, and reversing the process.
• Symmetric vs. Asymmetric Encryption:
  • Symmetric: Single shared secret key for encryption and decryption (e.g., AES-256, ChaCha20). Fast and optimal for large volumes of data.
  • Asymmetric: Public key for encryption, mathematically linked private key for decryption (e.g., RSA, ECC). Solves the key distribution problem.
• Hashing and Salting:
  • Hashing: One-way irreversible mathematical algorithm that converts arbitrary data into a fixed-length string (e.g., SHA-256).
  • Salting: Appending unique random bytes to passwords before hashing to defeat precomputed Rainbow Table attacks.
• Encryption vs. Hashing: Encryption is two-way (reversible with the key); hashing is one-way (irreversible).
• Public and Private Keys & Digital Signatures: Signing hashes with private keys to provide non-repudiation and integrity verification.
• TLS Certificates & PKI: Public Key Infrastructure (PKI), Certificate Authorities (CAs), root stores, intermediate certificates, and trust chains.
• Password Hashing Algorithms: Why fast algorithms like MD5/SHA-256 should never be used for passwords; standardizing on slow, memory-hard algorithms (bcrypt, Argon2, PBKDF2).

8. Web Technologies

Web applications represent one of the largest attack surfaces in modern technology. Understanding the client-server architecture is critical before hunting for web bugs.

• How Websites Work: DNS resolution → TCP 3-way handshake → TLS negotiation → HTTP GET request → Server processing → Response rendering in browser.
• Frontend vs. Backend: HTML/CSS/JavaScript running in the client context versus PHP/Python/Node.js/Go running on web application servers connected to databases.
• HTTP Requests and Responses: Headers, body, status lines, user-agents, and content-types.
• HTTP Status Codes:
  • 2xx Success (200 OK, 201 Created)
  • 3xx Redirection (301 Moved Permanently, 302 Found)
  • 4xx Client Errors (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found)
  • 5xx Server Errors (500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable)
• HTTP Methods: GET (retrieve), POST (submit data), PUT / PATCH (update), DELETE (remove), OPTIONS (CORS preflight).
• HTTP Headers & Cookies: Set-Cookie, flags (HttpOnly, Secure, SameSite), Authorization, Content-Security-Policy (CSP), and Strict-Transport-Security (HSTS).
• Sessions & Authentication: State-based session cookies versus stateless tokens (JWT - JSON Web Tokens).
• Same-Origin Policy (SOP) & CORS: How browsers prevent scripts from one origin accessing data from another origin, and how Cross-Origin Resource Sharing headers define access.
• Web Servers & Reverse Proxies: Deploying, configuring, and inspecting Apache, Nginx, and Microsoft IIS.

9. Common Vulnerabilities

Security researchers classify vulnerabilities using structured benchmarks. Focus your study on the following three OWASP vulnerability indexes:

• OWASP Top 10 for Web Applications (2025):
  • A01: Broken Access Control (IDOR, privilege escalation, unauthorized API access, SSRF)
  • A02: Security Misconfiguration (default credentials, verbose error disclosures, unhardened permissions)
  • A03: Software Supply Chain Failures (compromised third-party packages, vulnerable dependencies, CI/CD risks)
  • A04: Cryptographic Failures (weak encryption algorithms, hardcoded keys, transmission of sensitive plaintext data)
  • A05: Injection (SQL injection, Command injection, Cross-Site Scripting [XSS], LDAP injection)
  • A06: Insecure Design (threat modeling gaps, insecure architecture, flawed business logic)
  • A07: Authentication Failures (credential stuffing, session fixation, broken MFA, brute-force vulnerabilities)
  • A08: Software or Data Integrity Failures (insecure deserialization, unverified updates, critical data tampering)
  • A09: Security Logging and Alerting Failures (missing audit logs, undetected intrusions, lack of active alerting)
• OWASP Top 10 for Mobile Applications (Active Baseline):
  • M1: Improper Credential Usage (hardcoded API keys, exposed tokens, insecure credential transmission)
  • M2: Inadequate Supply Chain Security (compromised third-party SDKs, unverified app libraries, malicious dependencies)
  • M3: Insecure Authentication/Authorization (missing backend authorization, biometric bypasses, client-side auth checks)
  • M4: Insufficient Input/Output Validation (unvalidated IPC, deep link injection, SQL injection, buffer overflows)
  • M5: Insecure Communication (missing TLS, unvalidated certificates, lack of SSL certificate pinning, cleartext data in transit)
  • M6: Inadequate Privacy Controls (excessive app permissions, PII leakage into device logs, tracking without consent)
  • M7: Insufficient Binary Protections (absence of code obfuscation, lack of anti-tampering, missing root/jailbreak detection)
  • M8: Security Misconfiguration (debugging enabled in production, exported Android activities/services, misconfigured permissions)
  • M9: Insecure Data Storage (sensitive data stored in SQLite, SharedPreferences, or external storage unencrypted)
  • M10: Insufficient Cryptography (deprecated cryptographic algorithms like MD5/DES, weak keys, predictable IVs)
• OWASP Top 10 for APIs (Active Standard):
  • API1: Broken Object Level Authorization (BOLA) (manipulating object IDs in API endpoints to access unauthorized records)
  • API2: Broken Authentication (weak token generation, credential stuffing, missing rate limits on auth endpoints)
  • API3: Broken Object Property Level Authorization (unauthorized access to sensitive object properties, mass assignment, excessive data exposure)
  • API4: Unrestricted Resource Consumption (lack of rate limiting, excessive payload execution, request floods, DoS)
  • API5: Broken Function Level Authorization (regular users invoking administrative API endpoints by altering HTTP methods or URIs)
  • API6: Unrestricted Access to Sensitive Business Flows (automated abuse of critical business logic like purchasing goods or bulk scraping)
  • API7: Server-Side Request Forgery (SSRF) (forcing the API backend to make unintended outbound network requests)
  • API8: Security Misconfiguration (unpatched API gateways, verbose error stack traces, unhardened CORS headers)
  • API9: Improper Inventory Management (untracked shadow APIs, exposed deprecated versions like /v1/, lack of API documentation)
  • API10: Unsafe Consumption of APIs (blindly trusting third-party API payloads without validation or sanitization)

10. Essential Security Tools

Familiarity with industry-standard security tools helps bridge the gap between theory and execution:

Note: The cybersecurity ecosystem contains hundreds of specialized utilities, but mastering these core eleven provides an immediate operational foundation.

11. Web Application Penetration Testing

Web application testing involves systematically identifying security flaws in web servers, APIs, and business logic.

• Penetration Testing Methodologies: Structured frameworks like PTES (Penetration Testing Execution Standard) and OWASP WSTG (Web Security Testing Guide).
• Information Gathering: Discovering underlying tech stacks, framework versions, endpoints, and server infrastructure.
• Passive vs. Active Reconnaissance:
  • Passive: Querying public databases, OSINT, search engine dorks, Certificate Transparency logs without directly probing the target server.
  • Active: Port scanning, web directory fuzzing, and crawling that touches the target system.
• Authentication & Authorization Testing: Testing for username enumeration, weak password policies, JWT manipulation, horizontal and vertical privilege escalation, and Insecure Direct Object References (IDOR).
• Testing against the OWASP Top 10: Manually verifying SQL injection, Cross-Site Scripting (Reflected, Stored, DOM XSS), Cross-Site Request Forgery (CSRF), and Server-Side Request Forgery (SSRF).
• API Testing: Intercepting REST/GraphQL endpoints, parameter tampering, and testing for excessive data exposure.
• Risk Rating: Calculating business impact and technical likelihood using CVSS metrics.
• Reporting & Remediation: Translating technical findings into remediation advice for developers and executive summaries for leadership.

Practice Resource: For structured, hands-on practice, work through the free labs at PortSwigger Web Security Academy while keeping the OWASP Web Security Testing Guide open as a reference.

12. Network Penetration Testing

Network penetration testing focuses on identifying exposed network services, misconfigurations, and vulnerable systems across internal or external corporate subnets.

• Port Scanning: Using Nmap for TCP SYN scans (-sS), UDP scans (-sU), and service detection (-sV).
• Service Scanning & Version Detection: Identifying the exact banner and daemon running on open ports (e.g., OpenSSH 7.2p2, Apache 2.4.41).
• Vulnerability Scanning: Probing detected services against known CVE databases using Nmap NSE scripts (--script vuln) or Nessus.
• Exploitation: Leveraging verified public exploits or custom scripts to obtain an initial foothold on the target machine.
• Privilege Escalation: Escalating from an unprivileged user shell to root (Linux) or SYSTEM (Windows) using misconfigurations, SUID binaries, kernel exploits, or vulnerable service permissions.
• Lateral Movement: Pivoting through the internal network using credentials, SSH keys, or tools like chisel and SSH port forwarding.
• Reporting: Documenting the compromise chain, evidence of access, network diagrams, and patching recommendations.

13. Active Directory Security

Active Directory (AD) is the primary identity and access management infrastructure used by 90%+ of Fortune 500 enterprises. Enterprise penetration testing and SOC monitoring require in-depth AD knowledge.

• Windows Domains & Forests: Hierarchical domain structures, trusts, and identity boundaries.
• Domain Controllers (DC): The centralized servers hosting AD DS and processing enterprise authentication.
• Active Directory Users and Computers (ADUC): Managing user accounts, service accounts, and security groups.
• Organizational Units (OUs): Logical containers used to organize objects and link Group Policies.
• Group Policy Objects (GPO): Centralized configuration management used to push registry settings, security scripts, and firewall policies across all domain-joined endpoints.
• Kerberos Authentication: The ticket-based authentication protocol:
  • AS-REQ & AS-REP (Ticket Granting Ticket - TGT)
  • TGS-REQ & TGS-REP (Service Ticket)
  • AP-REQ (Application access)
• NTLM Authentication: Challenge-response authentication fallback, vulnerable to relay and brute-force attacks.
• LDAP & LDAPS: Querying directory information over ports 389 / 636.
• Service Principal Names (SPN): Identifiers linking service instances to logon accounts, the target of Kerberoasting attacks.
• Active Directory Security Tooling:
  • BloodHound: Graph theory tool to visualize attack paths, excessive privileges, and lateral movement routes in AD.
  • Impacket: Collection of Python classes for working with network protocols (includes psexec.py, secretsdump.py, GetUserSPNs.py).
  • Kerbrute: Fast Kerberos pre-authentication brute-forcing and username enumeration.
• Common AD Attack Techniques:
  • Pass-the-Hash (PtH): Authenticating using an NTLM hash without knowing the plaintext password.
  • Kerberoasting: Requesting service tickets for SPN accounts and cracking the ticket offline to recover service account passwords.
  • AS-REP Roasting: Exploiting user accounts that do not require Kerberos pre-authentication.
  • Golden Ticket & Silver Ticket Attacks: Forging Ticket Granting Tickets using compromised KRBTGT keys.

14. SOC & Blue Team Operations

The defensive side of cybersecurity revolves around the Security Operations Center (SOC). Analysts detect, analyze, triage, and respond to threats in real time.

• The Security Operations Center (SOC): Team structure, roles (Tier 1 Triage, Tier 2 Incident Responder, Tier 3 Threat Hunter), and service-level agreements (SLAs).
• SIEM (Security Information and Event Management): Centralized log aggregation, correlation engines, and alerting dashboards.
• Security Logs: Ingesting firewall logs, web access logs, authentication events, DNS queries, and endpoint telemetry.
• Alert Triage: Rapidly assessing whether an alert is a True Positive (actual attack), False Positive (benign activity flagged erroneously), or benign background noise.
• Threat Monitoring & Threat Hunting: Continuous monitoring versus proactive hypothesis-driven searches for undetected adversaries in the network.
• Incident Response (IR): The 6-phase NIST incident response lifecycle:
  1. Preparation
  2. Detection & Analysis
  3. Containment
  4. Eradication
  5. Recovery
  6. Post-Incident Activity (Lessons Learned)
• IDS / IPS: Snort, Suricata, and Zeek monitoring network packets for signature-based and behavioral anomalies.
• EDR & NDR: Endpoint Detection and Response agents (CrowdStrike, Defender for Endpoint) and Network Detection and Response platforms.
• Alert Investigation Workflow: Extracting Indicators of Compromise (IOCs: hashes, IPs, domains), checking threat intelligence, mapping to MITRE ATT&CK, and documenting incident timelines.

15. SOC & Defensive Security Tools

Defensive engineers utilize specialized tools for logging, correlation, host analysis, and signature detection:

• Wazuh: Open-source SIEM and XDR platform providing real-time File Integrity Monitoring (FIM), vulnerability detection, log analysis, and active response.
• Splunk: Enterprise data analytics and SIEM platform utilizing Splunk Processing Language (SPL) for fast log queries, dashboards, and security alerts.
• Microsoft Sentinel: Cloud-native SIEM and SOAR solution integrated with Microsoft 365 and Azure environments.
• Sysmon (System Monitor): Free Windows system service and device driver that monitors and logs detailed endpoint activity (Process creation Event ID 1, Network connections Event ID 3, Driver loads Event ID 6) to Windows Event Logs.
• Windows Event Viewer: Native Windows tool for parsing event log files (.evtx).
• Auditd: The Linux audit framework that tracks system calls, file access, and process execution at the kernel level.
• Suricata: High-performance network threat detection and Intrusion Prevention System engine.
• Wireshark: Invaluable for analyzing captured pcap files during incident investigations.
• YARA: The pattern-matching Swiss Army knife used to classify and identify malware samples based on text and binary signatures.
• Sigma Rules: Generic open signature format for SIEM systems, allowing analysts to write detection rules once and convert them into Splunk, Elasticsearch, or Sentinel queries.

16. Mobile Application Security

Mobile devices process vast amounts of sensitive personal and corporate data, presenting unique operating system architectures and attack vectors.

• Android Architecture: Linux kernel, Hardware Abstraction Layer, Android Runtime and application framework.
• Android Application Concepts: Activities, Services, Broadcast Receivers, Content Providers, and the AndroidManifest.xml file.
• Android Permissions: Normal vs. Dangerous permissions, runtime permission requests, and privilege escalation bugs.
• OWASP Top 10 for Mobile Applications: Examining local data storage leakage, insecure communication, and poor cryptography.
• Reverse Engineering: Decompiling APKs into Java/Smali source code to inspect hardcoded secrets, backend API endpoints, and logic flaws.
• Static vs. Dynamic Analysis:
  • Static Analysis: Inspecting decompiled code, manifest configurations, and dependencies without running the app.
  • Dynamic Analysis: Executing the application in a rooted emulator/device to inspect runtime network traffic, memory modifications, and method calls.
• Mobile Security Tools:
  • MobSF (Mobile Security Framework): Automated static and dynamic mobile security testing suite.
  • JADX / JADX-GUI: Decompiler from DEX to Java source code.
  • ADB (Android Debug Bridge): Command-line tool to communicate with emulators or physical Android devices.
  • Frida: Dynamic instrumentation toolkit for injecting custom JavaScript into native app processes.
  • Objection: Runtime mobile exploration toolkit powered by Frida.
  • Drozer: Comprehensive security audit and attack framework for Android.
  • Bypassing SSL Pinning: Overriding client-side certificate pinning checks using Frida scripts to intercept HTTPS traffic in Burp Suite.

17. Security Standards and Frameworks

Industry frameworks standardize how organizations evaluate risk, map adversarial activity, and communicate defensive maturity.

• OWASP Top 10: Standard reference list of critical web, mobile, and API security risks.
• MITRE ATT&CK: Matrix mapping real-world adversary behavior across tactics (Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact).
• CWE, CVE, and CVSS: The universal language for defining weaknesses, specific vulnerabilities, and their objective severity ratings.
• NIST Cybersecurity Framework (CSF): Five core functions: Identify, Protect, Detect, Respond, and Recover.
• NIST SP 800-53: Comprehensive catalog of security and privacy controls for federal and enterprise systems.
• ISO/IEC 27001: Global standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
• OSINT Framework: Curated repository of open-source intelligence tools and sources (osintframework.com).

18. Practical Labs & Learning Platforms

Cybersecurity cannot be mastered through passive reading alone. You must get your hands dirty in real lab environments, practice breaking machines, analyze live logs, and participate in ethical bug disclosure.

Hands-on Cybersecurity Labs

• TryHackMe: Beginner-friendly, browser-based hands-on rooms and guided learning paths covering offensive and defensive fundamentals.
• Hack The Box: Challenging realistic target machines and CTF-style challenges for intermediate to advanced penetration testing.
• PortSwigger Web Security Academy: The definitive, 100% free resource for mastering web application vulnerabilities and Burp Suite.
• OverTheWire: Gamified command-line challenges (start with the Bandit wargame to master Linux commands).
• OWASP Juice Shop: Intentionally vulnerable modern JavaScript web application ideal for OWASP Top 10 testing.
• DVWA (Damn Vulnerable Web Application): Classic PHP/MySQL vulnerable web app with configurable security levels.
• Metasploitable: Intentionally vulnerable Linux virtual machine designed for network scanning and exploitation practice.
• VulnHub: Downloadable custom vulnerable VM images for offline penetration testing practice.
• PicoCTF: Accessible gamified CTF platform run by Carnegie Mellon University covering reverse engineering, forensics, cryptography, and binary exploitation.

SOC & Blue Team Practice

• Blue Team Labs Online (BTLO): Hands-on defensive security labs focusing on incident response, digital forensics, SIEM analysis, and threat hunting.
• LetsDefend: Realistic SOC analyst simulation platform where you investigate tickets, review SIEM logs, analyze alerts, and make containment decisions.
• TryHackMe (Defensive Pathways): Pre-Security, SOC Level 1, and Cyber Defense paths.

Linux & Security Reference Guides

• Linux Journey: Clean, structured interactive tutorial for learning the Linux command line.
• Pentestmonkey: Classic reference cheat sheets for reverse shells and database injection syntax.
• GTFOBins: Curated list of Linux binaries that can be exploited to bypass local security restrictions and escalate privileges.
• Wappalyzer: Fast web browser extension to uncover the technology stacks behind websites.
• Cisco Networking Academy: Comprehensive courses on networking fundamentals and routing protocols.

Vulnerability Disclosure & Bug Bounty Platforms

• HackerOne: The world's largest bug bounty and vulnerability coordination platform.
• Bugcrowd: Enterprise crowdsourced bug bounty programs and managed vulnerability disclosure.
• Intigriti: Leading European bug bounty platform with active security research programs.
• YesWeHack: Global bug bounty and vulnerability disclosure platform.
• Bugbase: Fast-growing consolidated vulnerability management and bug bounty platform.

Final Roadmap Checklist

Use this checklist to track your progression across all major milestones:

1. Computer Fundamentals: Architecture, CPU/RAM/Storage, Operating Systems, Hypervisors/VMs, Troubleshooting.
2. Networking: OSI & TCP/IP models, IP addressing, Subnetting, Core protocols (DNS/DHCP/ARP/HTTP), Wireshark packet captures.
3. Linux Fundamentals: Filesystem hierarchy, Permissions (SUID/SGID), User management, System logs, Command line proficiency.
4. Windows Fundamentals: Architecture, NTFS permissions, Registry, Event Viewer logs, PowerShell basics, Defender.
5. Programming & Scripting: Python automation, Bash scripting, SQL queries, REST APIs, Git/GitHub.
6. Cybersecurity Fundamentals: CIA Triad, Principle of Least Privilege, Threat vs. Vulnerability vs. Risk, Attack types, CVE/CVSS.
7. Cryptography: Symmetric vs. Asymmetric, Hashing and Salting, PKI & TLS certificates, Secure password storage.
8. Web Technologies: Client-server flow, HTTP methods and status codes, Cookies & Sessions, Same-Origin Policy.
9. Common Vulnerabilities: OWASP Top 10 for Web, Mobile, and APIs.
10. Essential Security Tools: Nmap, Burp Suite, Wireshark, Metasploit, SQLmap, Gobuster, Hydra, Nessus.
11. Web Application Penetration Testing: Methodologies, Reconnaissance, Authentication testing, Vulnerability exploitation, Reporting.
12. Network Penetration Testing: Port scanning, Service fingerprinting, Exploitation, Privilege escalation, Lateral movement.
13. Active Directory Security: Domains, Domain Controllers, GPOs, Kerberos vs. NTLM, BloodHound, Kerberoasting, Pass-the-Hash.
14. SOC & Blue Team Operations: SIEM operations, Alert triage, Threat hunting, NIST incident response cycle.
15. SOC & Defensive Tools: Wazuh, Splunk, Sentinel, Sysmon, Auditd, Suricata, YARA, Sigma rules.
16. Mobile Application Security: Android architecture, Static and dynamic analysis, Frida, MobSF, SSL pinning bypass.
17. Security Standards & Frameworks: MITRE ATT&CK, NIST CSF, ISO/IEC 27001, OSINT framework.
18. Practical Labs & Platforms: Active practice on TryHackMe, Hack The Box, PortSwigger, BTLO, and Bug Bounty platforms.

Connect & Contact

If you have any questions, want advice on building home labs, or would like to discuss security research, feel free to reach out across any of these channels:

• Buy Me a Coffee: buymeacoffee.com/jaseervk
• GitHub: github.com/jaseervk
• Portfolio: www.jaseervk.com
• Blog: blog.jaseervk.com
• LinkedIn: linkedin.com/in/jaseer-vk-
• Medium: medium.com/@jaseervk321