Cybersecurity

Steps

Security and network basics

1. 1 Thinking like a defenderLearn the core ideas of confidentiality, integrity, availability and risk, and see how real attacks and breaches unfold.

   • Professor Messer professormesser.comfree

     Free video training courses, study groups, and resources covering CompTIA Security+ and cybersecurity fundamentals.

   • Schneier on Security schneier.comfree

     A widely read security blog and essay archive by Bruce Schneier covering cryptography, privacy, and security technology policy.

   • Krebs on Security krebsonsecurity.comfree

     An investigative journalism blog by Brian Krebs dedicated to in-depth reporting on cybercrime, data breaches, and security vulnerabilities.

   I finished this step
2. 2 How networks workUnderstand IP, TCP, ports and DNS, because most attacks and defenses happen on traffic moving across a network.

   • Computer Networking: A Top-Down Approach (Online Resources) gaia.cs.umass.edufree

     Companion interactive problems, Wireshark lab assignments, and lecture slides for the Kurose and Ross networking textbook.

   • DNS Record Types Explained nslookup.iofree

     Reference guide describing each DNS record type, such as A, MX, TXT and CNAME, with links to detailed explanations for network and system administrators.

   • IANA Protocol and Port Number Registries iana.orgfree

     The authoritative registries of standardized port numbers and transport protocol assignments for internet communications.

   I finished this step
3. 3 Watching network trafficCapture and read packets yourself to recognise normal traffic and spot what looks suspicious.

   • Wireshark wireshark.orgfree

     A widely used open-source network protocol analyzer for network troubleshooting, analysis, and protocol communication review.

   • Wireshark University wireshark.orgfree

     Official user guides, protocol reference documentation, and practical packet analysis instructional material.

   • tcpdump tcpdump.orgfree

     A powerful command-line packet analyzer and libpcap portable capture library.

   I finished this step

Cryptography and secure communication

1. 4 Encryption and keysLearn symmetric and public-key encryption, signatures and secure tunnels, the tools that protect data in transit and at rest.

   • Encryption with GPG Tutorial hashrocket.comfree

     Narrative tutorial explaining public key encryption with GnuPG, from generating keys to encrypting, signing and exchanging files, for newcomers to secure communication.

   • SSH Tunneling Guide ssh.comfree

     Tutorial on SSH port forwarding that shows local, remote and dynamic tunnel commands and the matching server configuration for system administrators.

   • NIST Computer Security Resource Center csrc.nist.govfree

     Official repository of cryptographic standards, guidelines, and Special Publications (SP 800-series) from NIST.

   I finished this step
2. 5 Email authentication (optional)See how SPF, DKIM and DMARC let receivers reject forged senders, a common entry point for phishing.

   • RFC 7208: Sender Policy Framework (SPF) datatracker.ietf.orgfree

     IETF standard defining the Sender Policy Framework, which lets domain owners publish which mail servers may send email on their behalf.

   • RFC 6376: DomainKeys Identified Mail (DKIM) Signatures datatracker.ietf.orgfree

     IETF standard specifying DKIM, a method for signing email messages cryptographically so receivers can verify the sending domain and detect tampering.

   • Postmark DMARC Monitoring dmarc.postmarkapp.comfree

     Free service that collects DMARC aggregate reports and sends weekly digests, helping domain owners check email authentication and detect spoofing of their domain.

   I finished this step

Web application security

1. 6 The most common web flawsStudy injection, broken access control and the other recurring weaknesses so you can recognise them in your own code.

   • OWASP Community owasp.orgfree

     A global non-profit community and website offering open-source application security standards, tools, and local chapters.

   • CWE (Common Weakness Enumeration) cwe.mitre.orgfree

     A community-developed taxonomy and dictionary of common software security architecture and implementation weaknesses.

   I finished this step
2. 7 Hands-on web labsExploit deliberately vulnerable applications in guided labs, the fastest way to understand why each flaw matters.

   • PortSwigger Web Security Academy portswigger.netfree

     Free interactive online training and vulnerability labs covering web application security and penetration testing concepts.

   I finished this step
3. 8 Browser defensesLearn how cookie attributes and browser policies block cross-site attacks, and when they fail to.

   • SameSite Cookies Explained web.devfree

     Article explaining how the SameSite cookie attribute separates first-party and third-party use and how Strict and Lax values reduce cross-site request risks.

   I finished this step
4. 9 Web testing toolsUse an intercepting proxy and an automated injection scanner to test applications you are authorised to assess.

   • OWASP ZAP zaproxy.orgfree

     World's most widely used open-source web application security scanner for finding vulnerabilities during development.

   • sqlmap sqlmap.orgfree

     Open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws.

   I finished this step

Vulnerabilities, threats and defense

1. 10 Tracking vulnerabilitiesRead CVE entries and severity scores, and learn which flaws are being exploited right now so you can patch first.

   • CVE Program cve.orgfree

     An international catalog of publicly known cybersecurity vulnerabilities and exposures identified by standardized CVE identifiers.

   • National Vulnerability Database (NVD) nvd.nist.govfree

     The U.S. government repository of standards-based vulnerability management data to secure enterprise information systems.

   • CISA Known Exploited Vulnerabilities Catalog cisa.govfree

     An authoritative list of vulnerabilities confirmed by CISA to have been actively exploited by threat actors in the wild.

   I finished this step
2. 11 How attackers operateMap attacker tactics and techniques to the detections and controls that stop them.

   • MITRE ATT&CK attack.mitre.orgfree

     A globally accessible knowledge base of adversary tactics and techniques based on real-world cybersecurity observations.

   I finished this step
3. 12 Hardening and scanning your systemsApply secure configuration baselines and scan your own hosts to find exposed services before someone else does.

   • Center for Internet Security (CIS) Benchmarks cisecurity.orgfree

     Consensus-developed, secure configuration guidelines and hardening benchmarks for operating systems, clouds, and databases.

   • Nmap nmap.orgfree

     A free and open-source network scanner for vulnerability assessment and network discovery.

   I finished this step
4. 13 Staying current (optional)Follow daily threat reports and official advisories to keep up with new campaigns and emergency patches.

   • SANS Internet Storm Center isc.sans.edufree

     A community monitoring network providing daily security podcasts, threat diary updates, and analysis of active internet attack trends.

   • CISA Cybersecurity Advisories cisa.govfree

     Official timely alerts and threat analyses published by CISA regarding current security issues and active cyber threats.

   I finished this step
5. 14 Security of AI applications (optional)Explore how prompt injection and adversarial inputs attack systems built on large language models.

   • Compromising LLM-Integrated Applications with Indirect Prompt Injection arxiv.orgfree

     Research paper showing how instructions hidden in retrieved web content can hijack applications built on language models, and classifying the resulting threats.

   • Universal and Transferable Attacks on Aligned Language Models llm-attacks.orgfree

     Project site for research demonstrating automatically generated adversarial suffixes that bypass safety training across many language models, with paper and code.

   I finished this step