How to Learn Cybersecurity
Cybersecurity is a Journey

Let’s face it, cybersecurity can be really hard to learn. Not only is it broad and deep, but it consists of hundreds of different fields in technology and computing. I get a lot of questions asking: “what is the best course to take for learning cybersecurity?”. That’s a tough one to answer, because the real answer is: there is no course! Cybersecurity is a journey. It’s a field that is constantly changing where you’re always having to learn new technologies, tools, and methods to stay in the game. Everybody you ask is going to give you a different answer. And the reason for that is everyone’s journey in cybersecurity is different. It’s almost like asking a bunch of martial artists on how to fight. They will all give you very different answers and recommendations depending on where they came from and how they were trained. With that in mind, I’m going to show you some approaches you can use to overcome the challenge of learning cybersecurity, as well as the overall mindset you will need to maintain if you want to be successful on your own journey in the field.

Why Cybersecurity is So Hard to Learn

The number one reason why cybersecurity is hard to learn is because it consists of so many different fields each with their own unique stack of skills. Think of it this way: every component within each skill stack could be its own concept, tool, or even an entirely new field. A good example of this is network security. In network security, you may encounter IP tables, which let you set packet filtering roles in Linux, PCAPs, or packet captures, which are used to take static snapshots of data in motion, TCP or transmission control protocol which is used to segment data into conversations between devices, BGP or border gateway protocol which is used to govern the routes between autonomous systems on the internet, or switches which are used to connect physical devices together through cables and relay Ethernet frames between them.

There are so many different components and concepts that fall under network security, and the examples I gave you are only but a few of them. The list goes on and on. Not only that, each of the concepts that I’ve mentioned can themselves be broken down into smaller bundles of knowledge, which can then be broken down into even further bundles of knowledge. You get the idea.

Use Skill Stacks for Your Cyber Training

The idea of skill stacks applies to all the different subfields in cybersecurity. What makes it even more complicated is that all the stacks are interrelated to one another, kind of like a skill matrix. If you want to learn a high-level skill, like penetration testing, you will first have to master many different skill stacks before having a solid enough baseline to really understand penetration testing well. This applies to almost all cyber-specific areas of concentration like privilege escalation, security monitoring, incident response, threat hunting, data protection, insider threat, Open-Source Intelligence (OSINT), malware analysis, and so on.

It’s impossible to know everything about cybersecurity because there are just too many different subfields and concepts to know. It can very well take you 10 to 20 years to master just a few of them, at which point you just don’t have the time or interest to learn any of the other fields. The reality is if you want to be good at cybersecurity, I recommend starting off by focusing on just one or two areas first and expand out from there. There are many different journeys you can take. You can choose to become well-rounded in a few different skill stacks, or you can choose to become an elite master in just one. There is no right or wrong path. Each path offers its own unique challenges and rewards.

Personally, I began my cybersecurity journey in network and system security and then branched out into cybersecurity engineering. This gave me broad exposure to a variety of tools, techniques, and methods for not only securing and defending computer networks and operating systems, but also for building out enterprise-wide security infrastructures. Eventually, I landed in the realm of data protection where I became highly focused and specialize in conducting cyber technical investigations involving insider threat, internal fraud, and data exfiltration for large financial institutions and multinational organizations. As part of this skill stack, I’ve learned how to master querying Splunk to further investigations, how to build my own investigation tools using Python and PowerShell, and how to conduct OSINT (Open-Source Intelligence) operations on targets of interest, to name a few.

As you’re asking yourself the question: “How do I learn cybersecurity?” and wondering where to begin, the very first step I would take is to start discovering all the different topics on cybersecurity and how they connect on a broad level. From there you can begin to narrow down the learning scope to just those topics you might be interested in starting off with. Let’s go over some techniques you can use for learning cybersecurity.

The Top-Down Approach to Learning Cybersecurity

Top-down is probably the most common approach where you pick a subject to tackle and go after the resources specifically tailored towards learning that topic. A good example of this in cybersecurity might be pursuing a specific certification such as “ethical hacking”. Unfortunately, there’s a misconception by newcomers to the field that “ethical hacking” is as simple as loading up Kali Linux and running all its variety of security tools on targets. Others think they just need to grab some courses and books on a subject, and then “brain dump” everything just to pass the certification exam. Once you got your certification, you walk around thinking that you’re a Jedi master, but the reality is that your baseline fundamentals are still very weak, and your true abilities aren’t good enough to operate in most real-world scenarios. I’m not saying certifications are bad. Far from it. I think they a play a useful role to help develop your skills and baseline fundamentals, and show you’ve already attained some level of knowledge about the subject. Especially if you actually take the time to really learn the subject matter, rather than just “brain dump” to pass the certification exam.

I like to refer to people at this stage in their journeys as “skiddies”, which stands for “script kiddies”. Basically, skiddies are young, aspiring beginners that only know how to run tools written by other people, but do not understand the principles behind why or how those tools work. In my opinion, the best way to acquire deep-level cybersecurity skills using the top-down learning method is through an apprenticeship.

If you look back in history before education was institutionalized through schools, the only real way to learn a specific craft or skill was via an apprenticeship under a master — someone with a few decades of experience under their belt. In the old days, the knowledge transfer process was rigorous and methodical. This was necessary to ensure the apprentice was actually teachable and would be useful in adding value to the craft.

The primary advantage of an apprenticeship is that masters can point you to the skill stacks that are relevant to the field you are learning while filtering out the ones that aren’t. Not to mention you have somebody who is available to answer all your questions and guide you on your journey to make sure you stay the course. Another benefit of being an apprentice is that it saves you a huge amount of time in the learning process, which in my experience can reduce what would take years to learn on your own into a matter of months.

Top-down learning through an apprenticeship can be great but finding someone who can teach you is not always an easy task. Many journeyman-level and master-level practitioners are either way to busy or not interested in coaching you if you don’t already have a solid baseline to begin with. This is especially true in cybersecurity. It’s a huge time investment on their part to teach students, since it takes them away from actual work and carries a high risk of failure. Nobody wants to teach someone who doesn’t have much grit or the drive to succeed in their chosen profession. If a senior practitioner doesn’t see much potential in you, they’ll probably just walk on by.

If you work for a large corporation, chances are you’ll receive on-the-job training. On-the-job training for cybersecurity professionals is extremely helpful because you’re surrounded by co-workers you can learn from, most of whom are likely better than you in one or more areas. If you’re lucky to find yourself in this situation, then try to identify the most technical people on your team and spend time learning as much as you can from them. Once you’ve developed a decent relationship with them, find out which experts they personally look up to. Then reach out to those guys. If you’re not able to get mentorship through professional circles, you might consider building a solid baseline knowledge through the bottom-up approach.

The Bottom-Up Approach to Learning Cybersecurity

The bottom-up learning approach is where you pick a subject to tackle and decompose it into its most basic principles, definitions, methods, and tools. You learn each of those components first before you dive into the actual target subject.

Take UFC fighters for example. They go through countless amounts of conditioning and training combined with simple exercises that build muscle memory and situational agility. Each of these exercises indirectly improves their fighting abilities over time. Even though the bottom-up approach takes a lot longer to do, you build a very solid foundation that becomes useful when you make the switch to more skill-oriented training.

In the case of cybersecurity where you literally become a mental athlete, bottom-up learning translates into tons of reading. And by tons of reading, I mean you start out by finding all the books you can that are related to computer and network security and just marathon away. What’s good about traditional book learning is that you tend to get much higher quality content than the average Internet post and you get to learn about each author’s style and approach to cybersecurity, most of whom are active practitioners themselves. Many authors also maintain blogs or tweet links to resources that you can follow. When you’re reading, remember to jot down all the different vocabulary and concepts you’re learning. You can create a mind map or use spaced repetition software like Anki.

I highly recommend Anki for studying new cybersecurity concepts. It’s a free and open-source tool that lets you build flashcards to learn just about any concept you happen to be interested in. Unlike normal flashcards, Anki utilizes a scheduling algorithm that decides when to show you concepts based on how well you already know them. This is great for active recall, where you’re asked questions and forced to remember the answers. Research shows that using active recall is a much more effective learning method than passive study for building a strong memory. When you take this process and distribute it consistently over increasing periods of time, it further cements your knowledge by forcing your brain to retrieve it with even deeper levels of recall.

Using the bottom-up approach for cybersecurity sets you up for success and makes learning new concepts much easier. One of the cool things about cybersecurity is that many of the concepts you learn will keep showing up repeatedly, since almost everything in cybersecurity is interconnected one way or another. One downside to bottom-up learning, however, is that it can get monotonous at times, since doing any activity for its own sake without a clear goal or purpose can certainly get boring.

The Project-based Approach to Learning Cybersecurity

One of my favorite approaches to learning cybersecurity is through projects. Project-based learning is a bit of a hybrid approach between the top-down and bottom-up learning methods and gives you more flexibility using both. Unlike the bottom-up approach where you don’t really have any specific objectives that need to be achieved, with a project you define what the technical outcome will be from the get-go, which allows you to gather the resources you need to work toward meeting your project goal.

Speaking of goals, it’s always good to set smart goals when working on projects. Smart goals are defined as specific, measurable, achievable, relevant, and time bound. Saying something like “I want to hack” wouldn’t qualify as a smart goal. You need to get more specific like “I want to learn how to crack WEP encryption on my home wireless network by the end of the month”. It may take you longer than a month and that’s okay. The main thing is you have a clear objective in mind and the process will expose you to all sorts of different skill stacks, from air crack, layer 2 networking, the 802.11 protocol and much more.

Project ideas often fall in one of four categories: making things, breaking things, fixing things, and knowing things. For instance, if you wanted to learn different forensic methods for detecting and eradicating malware, you could have a project where you build your own virtual machine and then intentionally install publicly available malware on it to hone your skills. Always make sure to document your entire process and workflow, as this can help solidify the entire learning experience and be used later to analyze areas for improvement.

You Need to be in it for the Long Haul

A final thought I’d like to leave you with that will help you get better at cybersecurity is you need to go in it with the right mind set and time horizon for picking it up. The reality is that some areas of cybersecurity can take a long time to master, much like becoming a doctor or a lawyer. In the United States it takes four years of medical school followed by three to seven years of residency to become a doctor.

What’s interesting is medical residencies are basically apprenticeships that involve working 60+ hours a week. Many doctors I know work 80 or more hours a week and only sleep five or six hours each night. Depending on your residency of choice, this is anywhere from 10,000 to 20,000 hours of training. Assuming you’re only working 40 hours a week, it would take you at least 10 to 20 years on the job in a cybersecurity role to attain the absolute number of equivalent hours as a doctor.

In his book, Mastery, the author Matthew Green describes mastery of any skill as a function of time and intense focus applied to a particular field of knowledge. In our age of two second attention spans and instant gratification, most people lack discipline to dedicate the time necessary to truly master a specific skill. It’s much easier to take a simple crash course or quick tutorial to teach you everything you want to know.

However, just seeking out a surface level education will keep you at an unconsciously incompetent level of learning where you feel super confident that you know everything there is to know, but you’re not actually skilled in the subject matter. As your cyber skills are put to the test under real-world scenarios, you soon come to the realization that you actually suck at what you thought you knew and eventually reach a point as to whether or not you want to continue on the path.

If you do take the time to push through it though, you will begin to feel more comfortable and accepting of the concepts you know and the ones you don’t know. Over time, you will reach the most mature stage of unconscious competence, where now you’ve become a true Jedi master and can execute on a skill without even thinking about it.

In a field like cybersecurity where there’s no clear institutionalized path to becoming a professional, you really got to self-educate using a combination of the different learning approaches available and be in it for the long haul. Taking shortcuts won’t “cut it” if you truly want to become a master practitioner in your specialized area of interest. Remember, cybersecurity is not a course — it’s a journey that can be very rewarding for those dedicated to its path.

Good hunting!
['Michael Atkins']
['Cybersecurity', 'Technology', 'Education', 'Learning', 'Hacking']