Cyber Security Engineer
Master cyber security — networking, cryptography, web/app security, offensive testing, defense operations, cloud security, and compliance. 18 phases from fundamentals to practitioner skills.
Your Progress
Complete all 18 phases to master this track
Master cyber security — networking, cryptography, web/app security, offensive testing, defense operations, cloud security, and compliance. 18 phases from fundamentals to practitioner skills.
Phase 1: Security Principles and Threat Modeling
Anchor decisions in the CIA triad and threat-model systems before attacks start.
CIA Triad Fundamentals
Balance confidentiality, integrity, and availability across every control decision.
Least Privilege and Defense in Depth
Apply least privilege, separation of duties, and layered controls in practice.
Attack Surfaces and Attack Vectors
Map where an attacker can enter and which path they are likely to take.
Threat Modeling with STRIDE
Enumerate spoofing, tampering, repudiation, and disclosure threats per component.
Risk Assessment Basics
Score likelihood and impact so remediation effort follows actual risk.
Phase 2: Networking for Security
Read packets, protocols, and HTTP traffic well enough to spot malicious behavior.
The TCP/IP Model for Security
Locate common attacks and inspection points across the network layers.
Common Ports and Protocols
Map default ports to services and flag traffic that deviates from norms.
DNS Security Deep Dive
Follow resolution paths and detect poisoning, tunneling, and fast-flux abuse.
HTTP Traffic Forensics
Read methods, headers, and status codes to reconstruct suspicious requests.
Packet Analysis with Wireshark
Capture and dissect packets to confirm what actually crossed the wire.
Phase 3: Operating System Hardening and Permissions
Lock down hosts by shrinking permissions, services, and unpatched exposure.
File Permissions and Ownership
Read and set mode bits so sensitive files are not world-writable.
Users, Groups, and Principals
Manage accounts and group membership so access stays attributable.
Service Reduction and Host Firewalls
Disable unused services and filter inbound traffic on the host itself.
Patching and Vulnerability Management
Inventory assets, prioritize CVEs by exposure, and patch on an SLA.
Hardening with CIS Benchmarks
Apply vendor-hardening baselines and verify them with automated scans.
Phase 4: Linux and Windows Security Administration
Operate firewalls, auditing, and directory services on both major platforms.
SSH Hardening
Restrict remote shells with key auth, disabled root, and rate limits.
Linux Firewalls with nftables
Write default-deny rulesets that permit only sanctioned flows.
Linux Audit Logging
Record privilege use and config changes with auditd rules.
Windows Group Policy Hardening
Enforce password, audit, and endpoint settings centrally via GPO.
Active Directory Fundamentals
Understand domains, trusts, and the attack value of directory services.
Phase 5: Cryptography Foundations
Apply hashing, symmetric and asymmetric crypto, TLS, and PKI correctly.
Hashing and Integrity
Use cryptographic hashes to verify files, passwords, and message integrity.
Symmetric Encryption
Encrypt bulk data with shared keys and safe cipher modes.
Asymmetric Encryption
Use key pairs for key exchange, signatures, and encrypted messages.
PKI and Digital Certificates
Bind public keys to identities through certificate authorities and chains.
The TLS Handshake
Trace version negotiation, key exchange, and session establishment.
Phase 6: Identity, Authentication, and Authorization
Design strong sign-in flows with MFA, sane authorization models, and recovery.
Authentication Factors and MFA
Combine knowledge, possession, and inherence factors to resist credential theft.
Authorization Models: RBAC and ABAC
Grant access by role or by evaluating attributes at request time.
Single Sign-On and Federation
Centralize sign-in with SAML or OIDC across applications and domains.
Account Recovery Workflows
Make password reset flows secure against takeover via recovery channels.
Phase 7: Web Vulnerabilities and the OWASP Top 10
Recognize, test for, and explain the vulnerability classes attackers use on the web.
OWASP Top 10 Overview
Learn the ten vulnerability classes that anchor web security programs.
SQL Injection
Exploit unescaped queries and fix them with parameterized statements.
Cross-Site Scripting Variants
Differentiate stored, reflected, and DOM-based script injection.
CSRF Protection
Stop forged cross-origin requests from riding authenticated sessions.
Broken Access Control and IDOR
Find object-level authorization gaps that expose other users' records.
SSRF and Unsafe Deserialization
Abuse server-side fetches and object loaders to reach internal resources.
Phase 8: Application Security and Secure Coding
Build defenses into code with validation, headers, scanning, and review gates.
Input Validation and Output Encoding
Constrain inputs by allow-list and encode outputs by context.
Error Handling and Information Leakage
Return generic failures to users while logging detail securely.
Security Headers and CSP
Ship browser-enforced policies that blunt XSS and clickjacking.
Dependency and Supply Chain Scanning
Catch vulnerable and malicious packages before they ship.
Secure SDLC and Security Code Review
Insert threat models, reviews, and tests across the delivery lifecycle.
Phase 9: Password Storage and Session Security
Protect credentials at rest and keep authenticated sessions hijack-proof.
Password Hashing with Argon2 and bcrypt
Store passwords with memory-hard or work-factor hashing, never plaintext.
Brute-Force Defenses and Rate Limiting
Slow credential guessing with throttling, lockouts, and backoff.
Session Cookie Attributes
Configure Secure, HttpOnly, SameSite, and expiration correctly.
Session Fixation and Hijacking
Rotate session IDs and bind them to reduce theft impact.
Credential Stuffing Defenses
Block reused-breach logins with MFA, breach checks, and bot control.
Phase 10: Web Testing with Burp Suite
Intercept, replay, and automate web requests to find vulnerabilities methodically.
Burp Suite Proxy Basics
Route browser traffic through an intercepting proxy you fully control.
Repeater and Intruder Workflows
Hand-craft single requests and automate parameter attacks at scale.
Target Site Map and Passive Scanning
Map the application surface and collect passive scanner findings.
Testing Authenticated Flows
Carry sessions through testing and probe authorization boundaries.
Burp Extensions and Automation
Extend Burp with extensions and schedule repeatable scan runs.
Phase 11: Reconnaissance and Enumeration
Gather external intelligence and enumerate services before touching exploits.
Passive Recon and OSINT
Collect public intelligence without ever touching the target infrastructure.
Subdomain Enumeration
Discover hosts beyond the primary domain through multiple data sources.
Port Scanning with Nmap
Identify open ports, services, and operating system fingerprints.
Service Fingerprinting
Match banners and behaviors to exact product versions for CVE lookup.
Web Content Discovery
Find hidden paths, backup files, and administrative panels by enumeration.
Phase 12: Exploitation Fundamentals and Metasploit
Turn verified findings into controlled exploits within defined authorization.
Exploitation Ethics and Scoping
Confirm written authorization, scope, and rules before any exploit runs.
From Vulnerability to Exploit
Verify findings safely and judge exploitability in your environment.
Metasploit Framework Basics
Navigate modules, targets, and options to run controlled exploits.
Payloads, Sessions, and Handlers
Choose staged or stageless payloads and manage returned sessions.
Privilege Escalation Basics
Escalate from low-privilege access using misconfigurations and weak files.
Phase 13: Network Attacks and Defense
Counter interception, spoofing, and flood attacks with segmented defenses.
Sniffing and Spoofing
Understand passive capture and identity forgery on local networks.
Man-in-the-Middle Attacks
Intercept and alter communications between two trusting parties.
DoS and DDoS Defense
Absorb volumetric, protocol, and application-layer flood attacks.
Network Segmentation and Firewall Architecture
Zone networks so a breach in one area cannot roam freely.
IDS and IPS with Signatures
Detect and block attack patterns with tuned signature-based sensors.
Phase 14: SOC Operations and SIEM Platforms
Run day-to-day defense with log pipelines, SIEM queries, and triage discipline.
SOC Roles and Workflows
Understand analyst tiers, shift routines, and escalation paths.
Log Collection and Parsing
Ship, normalize, and enrich logs so fields are queryable consistently.
Splunk SPL Fundamentals
Write searches that aggregate, correlate, and visualize security events.
Elastic SIEM and Dashboards
Build detection rules and dashboards on the Elastic stack.
Alert Triage and Escalation
Judge severity quickly and move real incidents up the chain correctly.
Phase 15: Detection Engineering and Incident Response
Write durable detections and run incidents from triage through lessons learned.
Incident Response Lifecycle
Move through preparation, detection, containment, eradication, and recovery.
Detection Engineering Lifecycle
Turn attacker techniques into tested, versioned detection content.
Forensic Artifact Collection
Acquire memory and disk evidence with documented chain of custody.
Containment Playbooks
Pre-stage isolation steps so containment does not destroy evidence.
Post-Incident Review
Run blameless retrospectives that convert incidents into durable fixes.
Phase 16: Cloud Security Foundations
Secure cloud accounts through shared responsibility, IAM, and network controls.
Shared Responsibility Model
Know exactly which controls your provider owns and which remain yours.
Cloud IAM, Roles, and Policies
Grant least-privilege access with roles, policies, and short-lived credentials.
VPC and Security Groups
Design private subnets and stateful firewall rules for cloud workloads.
Preventing Cloud Storage Exposure
Stop public buckets, open blobs, and world-readable snapshots.
Cloud Security Posture Management
Continuously benchmark configurations against security baselines.
Phase 17: Container and Kubernetes Security
Secure images, runtimes, and cluster control planes across the container lifecycle.
Container Image Security
Build minimal images, scan layers, and verify what actually ships.
Container Runtime Hardening
Restrict syscalls, capabilities, and filesystem access for running containers.
Kubernetes RBAC
Scope what users and service accounts can do inside the cluster.
Network Policies and Secrets
Default-deny pod traffic and protect sensitive values in the cluster.
Image Signing and Admission Control
Enforce that only signed, trusted images ever start in the cluster.
Phase 18: Governance, Risk, Compliance, and Capstone
Run audits and controls and deliver a complete security assessment report.
Risk Registers and Treatment Plans
Track identified risks with owners, treatment options, and residual scores.
GRC Frameworks: SOC 2 and ISO 27001
Map controls to common audit frameworks your organization must satisfy.
Controls and Audit Evidence
Design effective controls and collect proof auditors can actually verify.
Security Policies and Awareness
Write enforceable policies and pair them with training people remember.
Capstone: Security Assessment Report
Produce a findings report with risk ratings that leadership can act on.