CareerOS
Sign inGet started
Learning Paths

Cybersecurity Foundations

How systems are attacked and defended: networks, Linux, web security, cryptography and the frameworks organisations run on, practised legally in labs built for it.

Finish this and you can find and explain the common web vulnerabilities, harden a Linux host, and read a security framework without getting lost.

Starts at
Beginner
Topics
5
Projects
5
Of material
167 h
  • Networking
  • Linux
  • Web security
  • Cryptography
  • Security frameworks
01Beginner

Security basics

The concepts every security role assumes you know: threats, controls, risk and the vocabulary of the field.

Foundation

Project

A risk assessment of a small organisation

Pick a real small business or club you know and assess it.

  1. List its assets and who depends on them.
  2. Identify five threats and rate likelihood and impact.
  3. Map controls to the NIST functions and propose the three cheapest that cut the most risk.
02Beginner

Linux and networks

The command line, permissions, packets and protocols: where most attacks happen and most evidence lives.

Foundation

  • OverTheWire: Bandit

    OverTheWire · interactive · 10 h

    A wargame that teaches the Linux command line one level at a time. Do every level without reading spoilers.

Practitioner

  • Wireshark user's guide

    Wireshark · docs · 4 h

    Capture and read real traffic. Seeing a TLS handshake once teaches more than a diagram.

Project

Harden a Linux server, then prove it

Start from a default cloud or local VM.

  1. Baseline it: open ports, users, services.
  2. Harden it: key-only SSH, firewall, automatic updates, least privilege.
  3. Capture traffic before and after and show what changed.
  4. Write the checklist so someone else could repeat it.
03Intermediate

Web application security

Injection, broken access control, XSS and the rest, learned by exploiting them in labs made for it.

Foundation

  • OWASP Top 10

    OWASP · docs · 1 h 30 min

    The most common web risks and how to prevent each. The shared language of developers and testers.

Practitioner

  • Web Security Academy

    PortSwigger · interactive · 50 h

    Hundreds of free labs, from apprentice to expert. The best hands-on web security training available.

Project

Find, exploit and fix five vulnerabilities

Use a deliberately vulnerable app you run locally, never a real site.

  1. Run OWASP Juice Shop in a container.
  2. Find and exploit five issues from different Top 10 categories.
  3. Write each up as a finding: impact, reproduction steps, fix.
  4. Patch one in the code and show the exploit no longer works.
OWASP Juice Shop
04Intermediate

Cryptography you can use

Hashing, encryption, signatures and TLS: what each guarantees, and how they are misused.

Practitioner

  • Cryptography I

    Coursera · course · 25 h

    Free to audit. The clearest university course on how real cryptographic systems work and fail.

Builder

Project

Store passwords correctly, and explain why

A small sign-up service that would survive a database leak.

  1. Hash passwords with a slow, salted algorithm and justify its parameters.
  2. Add encrypted fields for one piece of personal data, with the key kept outside the database.
  3. Simulate a leak and show what an attacker can and cannot recover.
05Intermediate

Practice: capture the flag

Competitions and challenge sites that build the instincts certifications cannot.

Foundation

  • picoCTF

    Carnegie Mellon University · interactive · 20 h

    A year-round practice gym of beginner-friendly challenges across every category.

Project

Ten write-ups

Solve ten picoCTF challenges across at least four categories and publish write-ups that teach the technique, not just the flag.

Not sure this is your direction?

A three-minute counselling sample is free.

Try counselling