Seema Gupta

If you are thinking about getting into cybersecurity but have no idea where to start, this is for you.

I've received quite a few messages after sharing my journey in cybersecurity. A lot of people have asked me questions like:

"What should I learn first?"

"Which cybersecurity field should I choose?"

"Which certifications should I get?"

"How do I get experience?"

I completely understand these questions because I had the same ones when I started.

And honestly, I wish someone had explained this to me in a much simpler way.

So here is what I learned.

First: You Don't Need to Know Your Cybersecurity Niche Right Away

When I first started talking to people in cybersecurity, I was often told:

"Pick a niche."

That sounds like good advice.

But there was one problem.

How do you pick a niche when you don't even know what the different niches are?

When you're completely new, terms like SOC, GRC, IAM, penetration testing, cloud security, application security, and threat intelligence can all sound like completely different languages.

So don't pressure yourself to pick one immediately.

Take some time to explore.

Cybersecurity has many different areas, and they can look very different from one another.

Some of the areas you can explore are:

SOC / Security Operations

This is about monitoring systems and looking for suspicious activity.

You might work with security alerts, logs, SIEM tools, endpoint security, and incident response.

If you like investigating problems and asking "What happened here?", you might enjoy this.

Penetration Testing

This is the ethical hacking side of cybersecurity.

You learn how attackers find weaknesses in systems, networks, and applications with permission, of course.

If you enjoy trying to figure out how something can be broken, this might be interesting to you.

Cloud Security

This focuses on securing cloud environments such as AWS, Azure, and Google Cloud.

You may work with things like access, cloud configurations, networks, containers, and monitoring.

Identity & Access Management (IAM)

IAM is basically about managing who gets access to what.

You'll come across things like authentication, authorization, SSO, MFA, and access management.

Application Security

This focuses on making software more secure.

You'll learn about vulnerabilities in applications, secure development, code security, testing, and DevSecOps.

If you come from a software development background, this can be a really interesting area.

GRC

GRC stands for Governance, Risk, and Compliance.

This side of cybersecurity is more focused on things like security policies, risk, audits, controls, and compliance.

Not every cybersecurity job involves penetration testing or sitting in a SOC.

Digital Forensics & Incident Response

This is more investigative.

When a security incident happens, you may need to figure out what happened, how it happened, and what was affected.

Threat Intelligence

This involves researching threats, attackers, malware, vulnerabilities, and how attacks are carried out.

And these are only some of the areas.

That's exactly why I don't think you need to choose your niche on day one.

Explore first.

Then decide what you enjoy.

Start With IT Fundamentals

This is probably the most important advice I can give someone starting from zero.

Don't jump straight into advanced cybersecurity tools.

First, understand the technology you're actually trying to protect.

Start with basic IT concepts.

Learn:

• How computers work
• How operating systems work
• What servers are
• What databases are
• How users and permissions work
• What virtualization is
• Basic cloud concepts
• Windows basics
• Linux basics

You don't need to become an IT expert.

You just need enough knowledge to understand what's happening around you.

Learn Networking

If you are serious about cybersecurity, learn networking.

You don't have to become a network engineer, but you should understand how devices communicate.

Start with things like:

• IP addresses
• TCP and UDP
• Ports
• DNS
• DHCP
• HTTP and HTTPS
• Routers
• Switches
• Firewalls
• VPNs
• Basic routing

For example, if someone tells you:

"We saw suspicious traffic coming from this IP address over port 443."

You should have some idea of what that means.

The fundamentals make everything else easier to understand later.

Learn Linux and Windows

You don't need to know everything about either operating system.

But get comfortable using them.

For Linux, learn basic commands, files, permissions, processes, users, and networking.

For Windows, understand users, services, processes, permissions, and basic administration.

The more comfortable you become with operating systems, the easier cybersecurity concepts become.

Don't Just Watch Videos

This is something I learned along the way.

You can watch hundreds of cybersecurity videos and still feel like you don't know anything.

At some point, you have to actually do things.

If you're learning Linux, use Linux.

If you're learning networking, work with a network.

If you're learning Wireshark, capture some traffic and look at it.

If you're learning security monitoring, work with logs.

If you're learning Python, write a small script.

If you're learning web security, use legal practice environments designed for learning.

You don't need an expensive setup.

You can start with virtual machines on your own computer and build a small lab where you can safely experiment.

And don't be afraid of breaking things.

Sometimes fixing something you broke teaches you more than watching another tutorial.

Learn the Tools. But Understand What They're Doing.

Cybersecurity has a lot of tools.

You will hear names like:

• Wireshark
• Splunk
• Burp Suite
• Nmap
• Kali Linux
• CrowdStrike
• Microsoft Sentinel
• Nessus
• Metasploit

You don't need to learn all of them at once.