Published 8/5/22, 9:00am

So, you want to start a career in cybersecurity?

The good news is that there are so many training resources available to you. The bad news is that means that if you show up to an interview and say you want to get into cybersecurity but have done nothing to show it, it’s a bad sign for hiring managers. If you have a sincere interest in cybersecurity, go out and learn it! You don’t need any special infrastructure, money, or connections to gain critical security skills. You just need a computer and an internet connection. 

I’ve written this blog to help you get started down the right track and to make you aware of available cybersecurity training resources. There are plenty of other resources available for you online beyond what I’ve listed below.

Technology is changing so quickly that it is very difficult to keep training resources and videos up to date. Things hardly ever run perfectly the first time you try. If you run into an error while consulting a resource – work through it! Start by searching for the error message; someone else likely has already encountered this same problem and found a solution. Sites like StackOverflow are good places to ask questions and search for solutions to your problems. Troubleshooting is a large part of any cybersecurity job. If you are unwilling to work through errors as they occur, this may not be the correct career choice for you. 

Skills you should know before trying to get a cybersecurity job include gaining expertise in different operating systems. Start by learning Linux, then continue by learning Windows if you have time. Having the below foundational knowledge allows you to learn new security tools and procedures.

Networking

It is highly encouraged that you begin your journey by learning the fundamentals of computing networking. There are many ways to do this, including free courses online. One great way to learn is to study for either the Certified Cisco Networking Associate (CCNA) or CompTIA’s Network+ certification exam. These certifications teach learners from the absolute beginning, covering many important topics that are necessary to know for security professionals. You may find it worthwhile to spend ~$20 on a Udemy Course to learn the fundamentals of computing networks. The courses can be time-consuming but are a worthwhile investment if you are serious about getting into IT or cybersecurity. For practice, try using the free Cisco tool Packet Tracer to explore networking devices and communication protocols.

Virtual Networking

Once you become familiar with the basics of networking, you can start exploring virtual machines and networks. Virtual machines allow for a more hands-on approach to learning, while also creating a safe place for you to practice with security tools.

• Start Using Virtual Machines: The best way to practice security techniques, or check out a new tool, is to use a Virtual Machine (VM). VMs offer a safe environment for you to run commands and test programs. You can easily create VMs using one of the two popular virtualization tools:
  • Oracle VM VirtualBox 
  • VMware
    

• Create a Home Network: After installing your first VM, create another and get them talking. Experiment with OpenVPN if you want to take it a step further. Once you have multiple VMs communicating, you can start attacking from one machine into the other, or practice using popular security tools.

Linux Operating System 

Linux is widely used for enterprise-level databases and security tools. 

• Linux Terminal: Learn how to use the Linux terminal, which will translate well to Mac OS and AWS commands. One fun way to learn the Linux terminal is to go through Bandit War Games. You should use a Linux VM to go through these levels. 

• Linux Servers and Security: Take a class on Linux Server Management, such as the free Coursera course offered by the University of Colorado.

Windows Operating System 

When we talk about understanding the Windows OS, it does not mean being able to open a game of Solitaire or create a PowerPoint presentation. You must become familiar with the directory structure, command prompt, user accounts, running processes, common vulnerabilities, etc. 

• Windows Servers and Security: Take a class on Windows Server Management, such as the free Coursera course offered by the University of Colorado. 

• Sysinternals: This is slightly more advanced, but something people getting into Incident Response or Digital Forensics should take a look at. There’s a 30-minute overview of Windows Sysinternals on Youtube.

Common Attacks & Threat Intel Resources 

• OWASP Top 10: You should know about the OWASP Top 10. You can also explore some of these vulnerabilities through exercises on Kontra.

• MITRE ATT&CK: This is one of the most common frameworks in cybersecurity. MITRE ATT&CK maintains a list of threat groups and their techniques, tactics, and procedures. It is used regularly by security analysts and cyber threat intelligence analysts. MITRE offers free training on their ATT&CK framework, which can be found here. At the very least, you should review Module 1 of this training.

Programming

Learn a language! Python is a fairly easy language to learn and one of the most popular programming languages in the industry. Additional popular languages include BASH Scripting, C++, and JavaScript. Check out these free resources to get started: 

• FreeCodeCamp.org
• LearnPython.org
• Codecademy.com
• Codewars.com

Cybersecurity Fundamentals 

There are a few different ways to learn the common themes and best practices that show up all the time in our industry: 

• University of Maryland’s Cybersecurity for Everyone
• University of London’s Information Security course 

You can audit these classes – no need to purchase the certificate.

Remember, cybersecurity is a journey with constant opportunities to learn and grow. In the next blog, I’ll tackle Offensive Tools and Techniques, Cloud Security, and additional security tools that provide free training.