So You Want to Learn Cybersecurity? Here's What You Actually Need to Know
Where Do You Even Start?
This is a question I see constantly. Someone gets excited about cybersecurity, maybe they watched a documentary, maybe they got hacked, maybe they just think it looks cool. Then they go online and get hit with a wall of terms: penetration testing, SOC analyst, malware reverse engineering, cloud security, DevSecOps, red team, blue team, purple team. It is a lot.
Here’s the honest truth: cybersecurity is a massive field. No one person knows all of it. The best professionals are usually very deep in one or two areas and have a reasonable awareness of the rest. The goal early on is not to learn everything. It is to see what the field actually looks like, find what pulls you in, and go deep there.
The Mentality That Actually Matters
Before any of the technical stuff, there is a mindset piece that gets skipped constantly. Tools and certifications are the easy part. The mentality is what actually determines whether you last in this field.
Security rewards people who are comfortable not knowing something yet. You will hit a wall constantly: a log that does not make sense, a tool that behaves differently than the documentation says, a system that breaks in a way nobody predicted. The people who do well here are not the ones who already know the answer. They are the ones willing to sit with the problem, test a theory, watch it fail, and try again, without needing someone to hand them the solution.
It also means being genuinely curious rather than just credentialed. Anyone can memorize the OWASP Top 10 for an exam. What separates a good analyst from someone just holding the job title is whether they actually want to know why an attack works, not just that it works. That curiosity is what turns a routine alert into a real investigation.
Last thing: expect to be wrong a lot, and get comfortable with that. You will misdiagnose an incident. You will miss something in a pentest. You will write a detection rule that either fires on everything or nothing. That is normal. The mentality that gets people through it is treating every mistake as information, not a verdict on whether you belong here.
Let me break down the major domains and what they actually mean in practice.
The Foundation That Every Domain Shares
Before we even get to the domains, there is a bedrock of knowledge that everything else sits on top of. If you skip this, you will always feel like you are fighting the field instead of flowing with it.
Networking
You need to understand how computers talk to each other. TCP/IP, the OSI model (or at least a working mental model of it), DNS (covered in my other post), HTTP/S, routing, subnetting, firewalls, VPNs. Most attacks happen over a network. Most defenses are built around networks. If you cannot read a packet capture in Wireshark and understand what is happening, that is a gap worth closing.
Operating Systems
Windows and Linux, both of them. Windows because it runs most of the enterprise world. Linux because most security tools run on it, most servers run it, and understanding it deeply gives you leverage everywhere. Learn how processes work, how file permissions work, how the registry works (Windows), how systemd works (Linux), how users and privileges work.
Programming and Scripting
You do not need to be a software engineer. But you do need to be able to write a script to automate something, read code to understand what it does, and modify existing tools. Python is the go-to language in security. PowerShell is essential for Windows work. Bash for Linux. If you can read and write basic code in those three, you are in a strong position.
Basic Cryptography
Hashing, encryption, digital signatures, PKI, TLS. You do not need to derive the math. But you need to understand what AES-256 means, why MD5 is broken for password storage, what a certificate chain is, and why HTTPS matters.
Now let’s get into the actual domains.
Domain 1: Network Security
This is the original cybersecurity. Protecting the network perimeter, detecting threats as they move through infrastructure, stopping attacks before they reach endpoints.
What people actually do here:
- Configure and monitor firewalls (think Palo Alto, Fortinet, pfSense)
- Analyze network traffic for anomalies using tools like Wireshark, Zeek, Suricata
- Deploy and manage Intrusion Detection/Prevention Systems (IDS/IPS)
- Set up VPNs and network segmentation
- Hunt for lateral movement in packet captures
Key concepts to know:
- Firewalls: stateful vs stateless, rules, zones
- Network segmentation and VLANs
- IDS vs IPS and the difference between signature-based and anomaly-based detection
- Common attack patterns at the network layer: port scanning (Nmap), ARP poisoning, MITM attacks, DDoS
Where to practice: Build a home lab with a pfSense firewall. Set up Suricata or Snort and throw some Nmap scans at it. Watch the alerts fire. That is hands-on network security.
Domain 2: Application Security (AppSec)
This is security at the software level. Web applications, APIs, mobile apps, desktop software. The question this domain asks is: is this code secure? Can an attacker manipulate it to do something it was not designed to do?
What people actually do here:
- Perform web application penetration tests (finding SQL injection, XSS, IDOR, SSRF, etc.)
- Do code reviews to find security bugs before they ship
- Work with development teams to build security into the development lifecycle (DevSecOps)
- Set up and tune Web Application Firewalls (WAFs)
- Bug bounty hunting
Key concepts to know:
- The OWASP Top 10 (this is the baseline reading for anyone in AppSec)
- How web applications work: HTTP, cookies, sessions, authentication
- SQL Injection: how it works, how to prevent it
- Cross-Site Scripting (XSS): stored, reflected, DOM-based
- Broken Access Control: IDOR, privilege escalation
- Authentication attacks: credential stuffing, brute force, token weaknesses
- API security: REST, GraphQL, common API vulnerabilities
Where to practice: OWASP WebGoat, DVWA (Damn Vulnerable Web Application), PortSwigger Web Security Academy (this one is genuinely excellent and free). These give you intentionally vulnerable apps to test against without any legal concerns.
Domain 3: Offensive Security (Penetration Testing / Red Teaming)
This is the one everyone has heard of. Ethical hacking. You are paid to try to break into systems, find the vulnerabilities before the real attackers do, and report them so they can be fixed.
There is an important distinction though:
- Penetration Testing: Scoped, time-limited engagement. Test these specific systems, find what you can, write a report.
- Red Teaming: More like a simulation of a real threat actor. Full attack chain, from initial access to domain compromise, often testing whether the security team even detects you.
What people actually do here:
- Reconnaissance: OSINT, subdomain enumeration, service fingerprinting
- Exploitation: using tools like Metasploit, writing custom exploits
- Post-exploitation: privilege escalation, lateral movement, persistence
- Active Directory attacks: Kerberoasting, AS-REP Roasting, Pass-the-Hash, BloodHound
- Social engineering: phishing campaigns, pretexting
Key concepts to know:
- Metasploit Framework
- Nmap and Nessus for scanning
- Burp Suite for web testing
- BloodHound for Active Directory mapping
- The kill chain and MITRE ATT&CK framework
- Report writing (often underrated, but this is how you get paid)
Certifications to aim for: eJPT (good starter), OSCP (the gold standard for pentesting).
Domain 4: Defensive Security / Blue Team
If red team is the attack, blue team is the defense. This is where most security jobs actually live. SOC analysts, incident responders, threat hunters, SIEM engineers. The people watching the dashboards and investigating the alerts at 2 AM.
What people actually do here:
- Monitor SIEM dashboards and triage alerts (Splunk, Microsoft Sentinel, Elastic)
- Investigate security incidents: what happened, how did they get in, what did they touch?
- Hunt for threats that bypassed automated detection
- Write detection rules and use cases
- Conduct digital forensics: disk imaging, log analysis, memory forensics
Key concepts to know:
- Log analysis: Windows Event Logs, Syslog, authentication logs
- SIEM query languages: SPL (Splunk), KQL (Microsoft)
- Incident Response lifecycle (NIST/SANS frameworks)
- Indicators of Compromise (IOCs) and Indicators of Attack (IOAs)
- MITRE ATT&CK: mapping adversary behaviors to known TTPs
- EDR tools: CrowdStrike, SentinelOne, Microsoft Defender
Where to practice: TryHackMe’s SOC Level 1 and Blue Team paths are solid. LetsDefend.io is specifically built for defensive scenarios.
Domain 5: Cloud Security
This is not optional anymore. The enterprise has moved to the cloud. AWS, Azure, GCP. If you do not understand cloud security, you are leaving a massive part of the attack surface unaddressed.
What people actually do here:
- Secure cloud infrastructure (IAM policies, S3 bucket permissions, network security groups)
- Cloud penetration testing
- Detect and respond to cloud-specific attacks
- Implement Cloud Security Posture Management (CSPM)
Key concepts to know:
- IAM (Identity and Access Management): roles, policies, least privilege
- Cloud-specific attacks: S3 bucket misconfigurations, SSRF to steal metadata credentials, privilege escalation via misconfigured roles
- Shared responsibility model: what the cloud provider secures vs what you secure
- Tools: Pacu (AWS exploitation), ScoutSuite (cloud auditing), CloudTrail (AWS logging)
Domain 6: Identity and Access Management (IAM)
Identity is the new perimeter. With remote work and cloud services, there is no longer a clear network boundary. Everything hinges on: who are you, and should you have access to this?
Key concepts to know:
- Active Directory: the backbone of enterprise identity in Windows environments
- Single Sign-On (SSO) and federation
- Multi-Factor Authentication (MFA) and why it matters
- Privileged Access Management (PAM)
- OAuth, SAML, OpenID Connect: the protocols that power modern identity
Identity attacks are some of the most impactful. Compromising one privileged identity account in an organization can be game over.
Domain 7: Governance, Risk, and Compliance (GRC)
Less technical, but absolutely critical in the real world. Every organization has to comply with some set of regulations and standards. GDPR, HIPAA, PCI-DSS, ISO 27001, NIST. Someone has to understand these frameworks and make sure the organization is actually following them.
This is where cybersecurity meets business and law. If you like the conceptual and strategic side more than the technical side, GRC might actually be the best fit for you.
How These Domains Connect
Here is the thing that took me a while to understand: these domains do not operate in isolation. An attacker who finds a vulnerability in a web application (AppSec) might use it to gain access to the internal network (Network Security) and then move laterally through Active Directory (Identity) before exfiltrating data to a cloud storage bucket (Cloud). A blue teamer defending against this has to understand all of it.
The best security professionals have a home base in one domain, but they understand the adjacent domains well enough to collaborate and follow the attack chain wherever it goes.
What Should You Actually Do First?
- Learn networking. Seriously. Do not skip it. Professor Messer’s CompTIA Network+ material is free online and solid.
- Get comfortable on Linux. Use it daily. Break things. Fix them.
- Start with TryHackMe. Their learning paths are structured and beginner-friendly. Pre-Security path first, then pick a direction.
- Pick a lane. Do you like building and breaking things? Go offensive. Do you like investigating and detecting? Go defensive. Both are valid and both pay well.
- Get a certification to validate your fundamentals. CompTIA Security+ is the most recognized entry-level cert and opens doors.
- Build in public. Write about what you learn. It forces you to actually understand it and builds a portfolio. Which is exactly what this site is.
The field rewards curiosity. Stay curious.