Cybersecurity Guide: The Order to Learn It In

Confidentiality, integrity and availability are the three properties of data that almost every security control exists to protect. Confidentiality means only the right people can read the data. Integrity means it cannot change without permission and without leaving a trace. Availability means the service is there when someone needs it. Learners often memorise the three as a definition and move on, yet the triad earns its keep as a question to ask: when you read about an incident, which property was hit?

A useful exercise is to take a news story about a data leak or an outage and map it. Ransomware that locks files attacks availability, and often confidentiality too if the data was copied out first. Defacing a website attacks integrity. Mapping stories this way shows why encryption guards confidentiality, why hash functions check integrity, and why keeping three backup copies on two kinds of media protects availability. The everyday habits from the beginner article fit the same frame: a password manager and two-factor authentication keep accounts confidential, while automatic updates close holes that threaten all three properties at once.

Picture two-factor authentication on an email account: a learner who has absorbed this stage can say at once which property of the triad it guards and which attack it blocks, such as a stolen password reused from a leak. Without this compass, the later stages feel like a pile of unrelated tools.

Most servers and security tools run on Linux, and a surprising number of incidents begin with a file permission set wrongly. So learners need a real grip on the three permission layers, owner, group and everyone else, and the three rights within each: read, write and execute. Notation like rwxr-x--- or the number 750 should become as quick to read as a clock face.

Practice happens inside an Ubuntu virtual machine so that mistakes stay away from the main computer. Create two users and a group, hand out files with different permissions, then try opening each file from each account. Change permissions with chmod, change ownership with chown, and notice exactly when sudo is needed. These small experiments make the principle of least privilege concrete: every account gets only the access it needs.

A common stumbling block at this stage is the temptation to reach for ready-made tools before understanding the system underneath. The roadmap article warns that skipping Linux leaves learners pressing buttons without knowing what happens behind them. Linux comfort shows up in a simple test: list a directory, spot the file with permissions that are too loose, and explain what an attacker could do with it.

The core security concepts stage asks learners to understand cryptography well enough to use and judge it, without deriving the mathematics. Three ideas carry most of the weight. Symmetric encryption uses a single shared key to lock and unlock, which is fast and suits large amounts of data. Asymmetric encryption uses a public and private key pair, so two parties who have never met can still exchange a secret. A hash function turns data into a short fingerprint that changes completely if even one character changes.

HTTPS is the best example of all three working together. A digital certificate proves the server's identity, asymmetric cryptography is used to agree on a session key, and a symmetric key then encrypts the conversation itself. Learners can inspect a site's certificate chain straight from the browser and match it with the TLS negotiation they saw in Wireshark in the previous topic.

A simple exercise that makes hashing click is to compute the checksum of a Kali Linux image after downloading it and compare it with the value published on the official site. The habit also follows the lab article's advice to download images only from official sources. Understanding is in place when a learner can explain why passwords are stored as hashes, and why a long passphrase is harder to guess than a short word dressed up with symbols.

Once the lab is standing, blue team work begins by installing a SIEM. A SIEM collects logs from many machines in one place, normalises them and raises an alert when a particular pattern appears. Wazuh and Security Onion can both run in a home lab, though each asks for about 8 GB of RAM on its own, so a computer with 16 GB feels far more comfortable.

The practice moves in steps. First, send the authentication log from the target machine to the SIEM and confirm the lines actually arrive. Second, get to know the built-in alert that fires after several failed logins in a row. Third, write a simple rule of your own, for example an alert when an account signs in successfully outside its usual hours. Every rule is tested by deliberately creating the activity that should trigger it.

The problem nearly everyone meets is a flood of false alarms. Learning to tune thresholds, add exceptions with a stated reason and record why each change was made is a real part of this skill. A learner is ready when they can trigger one activity in the lab, find its alert in the SIEM and trace it back to the original log line.

The last two stages of the roadmap turn months of practice into evidence other people can read. The writeup matters most. The lab article recommends four parts: goal, steps, findings and fix. Write it straight after finishing a challenge, while the details are fresh, in an educational tone that explains your thinking and steers clear of showing off how to break things.

Certification gives the learning a clear structure. CompTIA Security+ is a widely recognised starting point because it covers security concepts, networking and risk governance together. Network+ helps if networking foundations still feel shaky. The suggested way to study is to pair each chapter of the official syllabus with one exercise in the lab, so exam material and hands-on skill reinforce each other.

Scripts, lab configurations and writeups go on GitHub, neatly organised, so progress can be traced. The checklist in the roadmap article works as a mirror: you understand how packets travel and can use Wireshark, you are fluent in the Linux terminal, you have an isolated lab with a SIEM, you hold or are ready to sit a foundation certificate, and you have written at least one in-depth writeup. With all five in hand, a learner has concrete material that shows how they work.