Cybersecurity Fundamentals

This is the starting point for anyone new to cybersecurity. It explains how attacks happen, how organizations defend themselves, and which career paths exist. No prior security knowledge is needed — just curiosity and basic computer skills.

• Understand what cybersecurity covers
• Set aside regular study time
• Keep notes of new terms

• CyberA4U Academy — courses

Confidentiality, integrity and availability are the three goals of information security. Every control protects one or more of them, and every incident harms at least one.

• Define confidentiality, integrity and availability
• Classify incidents by which goal they harmed
• Recognize trade-offs between the three

Tools & tech: Security basics

Learn it on CyberA4U:Module 1: Foundations of Cybersecurity and Ethical Hacking

• NIST SP 800-12 Rev. 1 — An Introduction to Information Security

Attackers range from opportunistic criminals to organized ransomware groups, insiders and nation-states. Their motives — money, espionage, disruption, ideology — shape what they target.

• Describe the main types of threat actors
• Link motives to typical targets
• Use MITRE ATT&CK Groups to read about real actors

Tools & tech: Security basics

Learn it on CyberA4U:Module 1: Foundations of Cybersecurity and Ethical Hacking

• MITRE ATT&CK — Groups

The attack surface is every way an attacker could interact with your systems: internet-facing services, user accounts, devices, third parties and people. Reducing it is one of the cheapest defenses.

• List the parts of an organization's attack surface
• Distinguish external and internal exposure
• Identify quick ways to reduce it

Tools & tech: Security basics

• CISA — Cyber Hygiene Services

Authentication proves who you are; authorization decides what you may do. Mixing them up is a common source of security bugs.

• Explain authentication factors
• Explain authorization models such as roles
• Recognize broken authorization in examples

Tools & tech: Security basics

• OWASP Authentication Cheat Sheet
• OWASP Authorization Cheat Sheet

You don't need to be a cryptographer, but you should know what hashing, encryption and signatures do, and why HTTPS and password hashing matter.

• Distinguish hashing, encryption and signatures
• Explain what HTTPS protects
• Know why passwords must be hashed, not encrypted

Tools & tech: Security basics

Learn it on CyberA4U:Module 22: Applied Cryptography and Attacks

• Cloudflare Learning — What is encryption?

Network security controls — firewalls, segmentation, VPNs, secure Wi-Fi and monitoring — limit who can reach what and help detect suspicious traffic.

• Explain what firewalls and segmentation do
• Understand VPNs and secure Wi-Fi at a high level
• Know why network monitoring matters

Tools & tech: Security basics

• NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy

Laptops, servers and phones are where users work and where malware runs. Updates, hardening, endpoint protection and least privilege keep them safe.

• Explain the role of patching and hardening
• Know what antivirus/EDR does
• Understand why users shouldn't be local admins

Tools & tech: Security basics

Learn it on CyberA4U:Module 9: Malicious Software Concepts

• CIS Benchmarks

Accounts are the new perimeter. Strong authentication, MFA and least privilege stop most account takeovers.

• Explain MFA and why it works
• Apply least privilege
• Understand account lifecycle (joiners, movers, leavers)

Tools & tech: Security basics

• NIST SP 800-63-4 — Digital Identity Guidelines

Logs record what happened on systems. Collecting and watching them is how organizations detect attacks and investigate incidents.

• Explain why logs matter
• Name key log sources
• Understand what a SIEM does

Tools & tech: Security basics

• NIST SP 800-92 — Guide to Computer Security Log Management

Software has flaws; vulnerability management finds, prioritizes and fixes them before attackers use them.

• Explain what a CVE is
• Understand CVSS severity
• Know why known-exploited vulnerabilities come first

Tools & tech: Security basics

• CISA — Known Exploited Vulnerabilities Catalog

Incident response is the organized way to handle a security incident: prepare, detect, contain, eradicate, recover and learn.

• Name the phases of incident response
• Know who is involved
• Understand why preparation matters most

Tools & tech: Security basics

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Security is about managing risk: how likely something is and how bad it would be. Controls reduce risk; not every risk is worth eliminating.

• Define risk, threat and vulnerability
• Classify controls as preventive, detective or corrective
• Explain accept, mitigate, transfer and avoid

Tools & tech: Security basics

Learn it on CyberA4U:Module 1: Foundations of Cybersecurity and Ethical Hacking

• NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments

Laws and standards such as ISO/IEC 27001, PCI DSS and data-protection regulations set minimum security requirements. Compliance is a floor, not a guarantee of security.

• Recognize major standards and regulations
• Understand certification vs compliance
• See how compliance drives security programs

Tools & tech: Security basics

• ISO/IEC 27001 — Information security management systems

Cybersecurity has many paths — SOC analyst, penetration tester, cloud security engineer, GRC analyst and more. The NICE Framework describes these roles and their skills.

• Describe common entry-level roles
• Map roles to skills
• Choose a first direction

Tools & tech: Security basics

• NIST — NICE Framework Resource Center

Security skills must be used legally and ethically: only test systems you own or have written permission to test, respect privacy, and report vulnerabilities responsibly.

• Understand authorization and scope
• Know the basics of responsible disclosure
• Recognize legal risks of unauthorized testing

Tools & tech: Security basics

Learn it on CyberA4U:Module 1: Foundations of Cybersecurity and Ethical Hacking

• CISA — Coordinated Vulnerability Disclosure process

A home lab is a safe place to practice — a few virtual machines on your own computer are enough to start.

• Choose a hypervisor
• Build isolated virtual networks
• Keep the lab separate from real systems

Tools & tech: Security basics

• Oracle VirtualBox documentation

Check that you can explain the core concepts of cybersecurity in your own words and apply basic protections.

• Explain the CIA triad, risk and common threats
• Describe key defensive controls
• Choose your next learning path

• CyberA4U CTF Arena — practice challenges

You've completed the fundamentals. Choose a path: Blue Team Fundamentals or SOC Analyst for defense, Network Administrator or Linux Administrator for IT foundations, or Web Application Pentesting for offense.

• Pick your next roadmap
• Keep your home lab
• Keep learning daily

• CyberA4U CTF Arena — practice challenges