A comprehensive learning path covering cybersecurity from foundational concepts to advanced offensive and defensive techniques. Designed for software engineers, cloud practitioners, and anyone building or defending systems.

Prerequisites#

• Basic networking knowledge (TCP/IP, DNS, HTTP)
• Familiarity with Linux command line
• Understanding of web applications and APIs
• Basic programming ability (Python recommended)

Learning Path#

1. Threat Landscape & Attacker Mindset#

Understanding who attacks systems, why, and how is the foundation of all security work. Defenders must think like attackers to build effective controls.

Threat Actors#

Cyber Kill Chain (Lockheed Martin)#

flowchart LR
    R["1: Reconnaissance"] --> W["2: Weaponization"]
    W --> D["3: Delivery"]
    D --> E["4: Exploitation"]
    E --> I["5: Installation"]
    I --> C["6: Command & Control"]
    C --> A["7: Actions on Objectives"]

Each phase is a detection opportunity — the earlier you break the chain, the less damage occurs.

MITRE ATT&CK Framework#

A knowledge base of adversary tactics and techniques based on real-world observations:

Attack Surface#

Everything exposed to potential attackers:

• External: Public IPs, domains, APIs, web apps, email
• Internal: Employee workstations, internal services, databases
• Human: Phishing susceptibility, social engineering
• Supply chain: Third-party libraries, SaaS providers, contractors

2. Cryptography#

Cryptography provides confidentiality, integrity, and authentication — the mathematical foundation of all security.

Symmetric Encryption#

Same key encrypts and decrypts. Fast, used for bulk data.

Asymmetric Encryption#

Key pair: public key encrypts, private key decrypts. Slow, used for key exchange and signatures.

Hashing#

One-way function — cannot be reversed. Used for integrity and password storage.

How TLS Uses All Three#

sequenceDiagram
    participant C as Client
    participant S as Server
    
    Note over C,S: Asymmetric (key exchange)
    C->>S: ClientHello + supported ciphers
    S->>C: ServerHello + certificate (public key)
    C->>S: Pre-master secret (encrypted with server's public key)
    Note over C,S: Both derive symmetric session key
    
    Note over C,S: Symmetric (bulk data)
    C->>S: Application data (AES-encrypted)
    S->>C: Response (AES-encrypted)
    
    Note over C,S: Hashing (integrity)
    Note over C: HMAC on every message ensures no tampering

Public Key Infrastructure (PKI)#

Chain of trust for certificates:

Root CA (self-signed, offline)
  └── Intermediate CA (signs server certs)
        └── Server Certificate (your-domain.com)

3. Network Security#

Protecting data in transit and controlling what can communicate with what.

Defense in Depth#

flowchart TD
    Internet["Internet"] --> FW["Firewall / WAF"]
    FW --> DMZ["DMZ (public-facing)"]
    DMZ --> IFW["Internal Firewall"]
    IFW --> App["Application Tier"]
    App --> DB["Database Tier"]
    
    style Internet fill:#ff6b6b
    style DB fill:#51cf66

Firewalls#

Network Segmentation#

Divide the network into zones to limit blast radius:

Zero Trust Architecture#

“Never trust, always verify” — no implicit trust based on network location.

IDS/IPS#

Detection methods: signature-based (known patterns), anomaly-based (deviations from baseline), behavior-based (suspicious sequences).

4. Web Application Security#

Web apps are the most common attack surface. The OWASP Top 10 defines the most critical risks.

OWASP Top 10 (2021)#

SQL Injection#

User input:  ' OR 1=1 --
Query becomes: SELECT * FROM users WHERE name='' OR 1=1 --'
Result: Returns ALL users

Prevention: Parameterized queries (prepared statements), never string concatenation.

Cross-Site Scripting (XSS)#

Prevention: Output encoding, Content Security Policy (CSP), input validation.

Cross-Site Request Forgery (CSRF)#

Tricks authenticated user into making unintended requests:

sequenceDiagram
    participant V as Victim (logged in)
    participant E as Evil Site
    participant B as Bank
    
    V->>E: Visits evil site
    E->>V: Hidden form auto-submits
    V->>B: POST /transfer (with victim's cookies)
    B->>B: Transfers money (request looks legitimate)

Prevention: CSRF tokens, SameSite cookies, checking Origin/Referer headers.

Server-Side Request Forgery (SSRF)#

Attacker makes the server fetch internal resources:

Input: url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
Result: Server fetches AWS credentials from metadata service

Prevention: Allowlist URLs, block internal IP ranges, use IMDSv2 (requires token).

5. Identity & Access Management#

Controlling who can access what, and proving they are who they claim to be.

Authentication Protocols#

OAuth 2.0 Flows#

Privileged Access Management (PAM)#

Controls for high-privilege accounts:

• Just-in-time access — elevate only when needed, auto-revoke
• Session recording — audit trail of admin actions
• Credential vaulting — secrets stored centrally, rotated automatically
• Break-glass procedures — emergency access with full audit

Federation#

Trust relationships between identity providers:

flowchart LR
    User["User"] --> IdP["Identity Provider<br/>(Okta, Azure AD)"]
    IdP --> SP1["Service Provider 1"]
    IdP --> SP2["Service Provider 2"]
    IdP --> SP3["Service Provider 3"]

One login, access to many services — reduces password fatigue and attack surface.

6. Operating System Security#

The OS is the foundation — if compromised, everything above it is compromised.

Hardening Principles#

Linux Security Mechanisms#

Endpoint Detection and Response (EDR)#

Modern endpoint protection beyond traditional antivirus:

Patch Management Lifecycle#

flowchart LR
    Discover["Discover<br/>Vulnerability"] --> Assess["Assess<br/>Risk"]
    Assess --> Test["Test<br/>Patch"]
    Test --> Deploy["Deploy<br/>(staged)"]
    Deploy --> Verify["Verify<br/>& Monitor"]

7. Cloud Security#

Cloud introduces new attack vectors and a fundamentally different security model.

Shared Responsibility Model#

Common Cloud Misconfigurations#

Cloud Security Posture Management (CSPM)#

Automated tools that continuously scan cloud environments for misconfigurations:

• AWS: Security Hub, Config Rules, Access Analyzer
• Multi-cloud: Prisma Cloud, Wiz, Orca, Lacework
• IaC scanning: Checkov, tfsec, KICS (shift-left)

Container Security#

8. Vulnerability Management#

The systematic process of finding, assessing, and fixing security weaknesses.

CVE and CVSS#

CVSS Severity Ratings#

Vulnerability Lifecycle#

flowchart LR
    Discover["Discover"] --> Assess["Assess<br/>(CVSS + context)"]
    Assess --> Prioritize["Prioritize<br/>(exploitability, exposure)"]
    Prioritize --> Remediate["Remediate<br/>(patch, mitigate, accept)"]
    Remediate --> Verify["Verify<br/>(rescan)"]
    Verify --> Report["Report<br/>(metrics, trends)"]

Scanning Types#

9. Security Operations & Incident Response#

Detecting, responding to, and recovering from security incidents.

Security Operations Center (SOC)#

SIEM (Security Information and Event Management)#

Aggregates logs from all sources, correlates events, triggers alerts:

flowchart LR
    FW["Firewall Logs"] --> SIEM["SIEM"]
    EP["Endpoint Logs"] --> SIEM
    Cloud["Cloud Logs"] --> SIEM
    App["Application Logs"] --> SIEM
    SIEM --> Alert["Alerts"]
    SIEM --> Dash["Dashboards"]
    SIEM --> Hunt["Threat Hunting"]

Incident Response Lifecycle (NIST SP 800-61)#

Incident Severity#

10. Secure Software Development#

Building security into the development process rather than bolting it on after.

Secure SDLC#

flowchart LR
    Req["Requirements<br/>· Threat Model"] --> Design["Secure Design<br/>· Architecture Review"]
    Design --> Code["Secure Coding<br/>· SAST"]
    Code --> Test["Security Testing<br/>· DAST/Pentest"]
    Test --> Deploy["Secure Deploy<br/>· Config Review"]
    Deploy --> Operate["Monitor<br/>· Respond"]

Threat Modeling (STRIDE)#

Supply Chain Security#

Security Testing in CI/CD#

Commit → SAST (code) → SCA (dependencies) → Build → DAST (running app) → Deploy
         ↓                ↓                           ↓
    Block on critical   Alert on high          Block on critical

11. Compliance & Governance#

Frameworks and processes that ensure security is managed systematically.

Major Frameworks#

Risk Management#

flowchart LR
    Identify["Identify<br/>Risks"] --> Assess["Assess<br/>(likelihood × impact)"]
    Assess --> Treat["Treat<br/>(mitigate, accept, transfer, avoid)"]
    Treat --> Monitor["Monitor<br/>& Review"]
    Monitor --> Identify

Risk Treatment Options#

Security Controls#

12. Offensive Security#

Understanding attacks to build better defenses. Ethical hacking with authorization.

Penetration Testing Methodology#

flowchart LR
    Scope["1: Scope &<br/>Rules of Engagement"] --> Recon["2: Reconnaissance"]
    Recon --> Enum["3: Enumeration"]
    Enum --> Exploit["4: Exploitation"]
    Exploit --> Post["5: Post-Exploitation"]
    Post --> Report["6: Reporting"]

Testing Types#

Red Team vs Penetration Test#

Common Tools#

Responsible Disclosure#

Key Takeaways#

1. Defense in depth — no single control is sufficient; layer multiple defenses
2. Think like an attacker — understand the kill chain to break it early
3. Shift left — integrate security into development, not after deployment
4. Least privilege everywhere — users, services, network, cloud
5. Assume breach — design systems that limit damage when (not if) compromised
6. Automate — manual security doesn’t scale; use SAST, DAST, CSPM, SIEM
7. Compliance ≠ security — frameworks provide structure, but real security requires continuous effort
8. People are the weakest link — training, awareness, and culture matter as much as technology