Where Should You Start with Cybersecurity? — A Learning Path for Beginners
When you want to learn cybersecurity, it is easy to feel unsure where to begin. Networking, cryptography, Linux, Web and malware are only some of the many possible topics. This article introduces a Learning Path that helps beginners move gradually from the fundamentals towards practical learning.
Do not start by learning only “security technologies”
When beginning cybersecurity, there is no need to start immediately with attack techniques or security tools.
A better starting point is to understand the basic question:
“What are we protecting, what are we protecting it from, and why?”
Cybersecurity does not apply only to computers.
It also covers information systems, networks, software, data and services, together with the people and organisations that use and operate them.
Even when protecting a single Web service, for example, several different objectives may be involved:
- preventing unauthorised people from seeing data
- preventing data from being altered without permission
- ensuring the service remains available when it is needed
- allowing only legitimate users to access it
- making it possible to investigate the cause when something goes wrong
For this reason, “learning how attacks work” is not the same as “learning cybersecurity”.
The foundation is understanding how systems work, where risk exists and how those systems can be protected.
Step 1 — Understand the fundamentals of computers and networks
The first foundation for cybersecurity learning is understanding how computers and networks work.
Even something as simple as opening a website involves many different mechanisms, including:
- IP addresses
- DNS
- TCP/IP
- HTTP / HTTPS
- clients and servers
- operating systems
- file systems
- users and permissions
- processes
Security problems often occur when these normal mechanisms are abused, misconfigured or used in ways that were not intended.
It is therefore important to:
understand the normal state before learning about attacks.
For example, before learning port scanning, it helps to understand:
“What is a port?”
“What is a TCP connection?”
“Why does a server listen on a particular port?”
With this foundation, the result of a scan becomes something you can interpret rather than simply the output of a command.
At the beginner stage, you do not need to understand every topic in depth.
A useful initial goal is to be able to explain the basic relationship:
Computer → OS → Network → Web
Step 2 — Understand the basic concepts of security
Next, learn the concepts that are specific to cybersecurity.
For example:
- Confidentiality
- Integrity
- Availability
- Threat
- Vulnerability
- Risk
- Authentication
- Authorisation
The important point is not simply to memorise the terminology.
For example, a “vulnerability” and a “risk” are not the same thing.
Even if a system has a weakness, the priority for dealing with it will depend on which threats could exploit it and how much impact that exploitation could cause.
Nor does stronger security automatically mean that every possible security measure should be introduced.
Usability, operations, cost and business requirements also have to be balanced.
Once you understand this, cybersecurity begins to look less like a simple contest between “attack and defence” and more like a field concerned with systems and risk.
Step 3 — Use CyBOK to understand where you are in your learning
Once you have the fundamentals, use CyBOK to organise the scope of what you are learning.
CyBOK Version 1.1 organises cybersecurity knowledge into 21 Knowledge Areas.
However, beginners do not need to read all 21 Knowledge Areas in order from the beginning.
Start by identifying where the topic you are studying sits within the wider body of knowledge.
If you are studying networking, for example:
Network Security
is directly relevant.
As you progress, however, you may also begin to see connections with:
- Authentication, Authorisation & Accountability
- Cryptography
- Operating Systems & Virtualisation Security
- Security Operations & Incident Management
For Web security, you might begin with:
Web & Mobile Security
and then extend your knowledge into:
- Software Security
- Authentication, Authorisation & Accountability
- Network Security
CyBOK Knowledge Areas are not completely independent of one another. They are interconnected.
That means the most useful approach is not necessarily:
“Finish this entire subject, then move on to the next one.”
Instead, it is often better to:
expand from what you are learning now into the related knowledge around it.
Cyber Hiroshima uses this idea as a foundation for Learning Paths.
Step 4 — Put your knowledge into practice
There is also no need to spend a long time studying theory before trying anything practical.
Once you understand a topic to some extent, start working with it directly at an early stage.
For example:
- work with files and permissions in Linux
- inspect network traffic
- observe Web requests
- investigate logs
- try attack and defence techniques in a vulnerable environment
- attempt simple CTF challenges
The important point is not to make “solving the exercise” the only objective.
Suppose you cannot complete an exercise.
Instead of checking only:
“What was the correct command?”
and stopping there, ask:
“What knowledge was I missing?”
Was it networking?
Linux permissions?
Authentication?
The structure of a Web application?
Then return to the map provided by CyBOK.
This repetition creates the cycle:
Knowledge → Practice → Review
Cyber Hiroshima aims to build this learning cycle by combining structured knowledge from CyBOK with practical experience in Cyber Ranges such as SudoRange.
Step 5 — Develop different Learning Paths for different objectives
Once you have the fundamentals, not everyone needs to study the same material.
Your Learning Path can begin to branch according to your interests and objectives.
If you want to understand attack and defence
For example:
Adversarial Behaviours
→ Malware & Attack Technologies
→ Network Security
→ Security Operations & Incident Management
These are important areas to connect.
If you want to protect Web applications and software
For example:
Web & Mobile Security
→ Software Security
→ Authentication, Authorisation & Accountability
→ Cryptography
These areas can form one possible route.
If you want to learn incident response and investigation
For example:
Security Operations & Incident Management
→ Forensics
→ Network Security
→ Malware & Attack Technologies
Understanding the relationship between these areas can make the subject easier to organise.
If you want to think about organisational security
For example:
Risk Management & Governance
→ Human Factors
→ Law & Regulation
→ Privacy & Online Rights
These are important areas to consider.
These examples are not an official curriculum that must be followed in a fixed order.
They are examples of how a Learning Path can be designed according to a particular objective.
What matters is not studying your specialist area in isolation, but understanding how it connects with the surrounding Knowledge Areas.
A recommended first Learning Loop for beginners
To make the process as simple as possible for beginners, Cyber Hiroshima recommends the following flow.
1. Learn the fundamentals
Understand the basics of computers, operating systems, networks and the Web.
↓
2. Learn the basic concepts of security
Understand confidentiality, integrity, availability, threats, vulnerabilities, risk, authentication and related concepts.
↓
3. Use CyBOK to understand where you are
Identify where the topic you are learning sits within the 21 Knowledge Areas.
↓
4. Try it in practice
Use a Cyber Range, CTF or other practical environment to apply your knowledge through operation and problem solving.
↓
5. Identify what you did not understand
Use the results of the exercise to find the knowledge you are missing.
↓
6. Return to CyBOK
Review the relevant Knowledge Area and deepen your understanding.
↓
7. Try again
Repeat the cycle.
The objective is not:
“learn everything before starting practical work”
but:
“move back and forth between learning and practice.”
Build your own Learning Path
Cybersecurity is an extremely broad field.
It is therefore natural to feel:
“I do not know where to start.”
The important thing is not to try to understand everything from the beginning.
Start by understanding the basic mechanisms of computers and networks, and learn the fundamental concepts of security.
Then use CyBOK to identify where your current learning sits.
Put that knowledge into practice, and use what you did not understand to identify your next learning topic.
Learn → Practice → Review → Learn Again
By creating this cycle, you can move from “I do not know what I should study” towards being able to choose the next step in your own learning.
Cyber Hiroshima aims to connect the Knowledge, Practice, AI, Challenge and Community needed to create an environment in which people can continue learning.
5. Read Next
How to Learn Cybersecurity Systematically — Using CyBOK as a “Map”
An introduction to using CyBOK to see the wider structure of cybersecurity knowledge.
Turning Knowledge into Practice — What Can You Learn with a Cyber Range and SudoRange?
The next step explores how a Cyber Range can turn knowledge into practical understanding.
6. References
- The Cyber Security Body of Knowledge (CyBOK), Version 1.1
- CyBOK Knowledgebase v1.1
CyBOK Attribution
CyBOK Version 1.1.0 © Crown Copyright, The National Cyber Security Centre 2021, licensed under the Open Government Licence v3.0.