Get Started in Cybersecurity
Find the right resources, understand the landscape, and build a plan that works for you.
What is Cybersecurity?
"Cybersecurity is the art of protecting networks, devices, and data from unauthorized access through the practice of confidentiality, integrity, and availability of information."
The 3 Key Elements in Cybersecurity
Confidentiality
Ensuring only authorized users have access to read information.
Integrity
Allow authorized users to modify information.
Availability
Authorized users are able to access information on an as-needed basis.
Ensuring the confidentiality, integrity, and availability of a network, different devices, and data is the core to cybersecurity. All three conditions make up what we know as cybersecurity. One condition is not necessarily better than the other. Ensuring confidentiality, integrity, and availability is often referred to as the CIA Triangle or Triad. In addition to the CIA Triad, other conditions such as non-repudiation and authorization are equally important to maintain an effective cybersecurity posture.
Cybersecurity isn't all about "hacking"
Although cybersecurity often involves what we like to depict as "hacking", there is much more involvement than simply hacking into computers, networks, and companies.
Cybersecurity considers specific risks posed to an organization
Performing accurate risk assessments is an important element to cybersecurity. Identifying, evaluating, and mitigating specific risks posed to an organization is one key element in cybersecurity. Risks can include both physical and digital elements.
Cybersecurity Careers
Cybersecurity can be divided into several types of paths, specialties, and responsibilities. Each trait making up its own career title. Here are the most popular entry-level positions in cybersecurity.
Cybersecurity Analyst
Detects and prevents cyber threats for a company.
Incident Responder
A cyber firefighter who addresses security incidents and threats.
Penetration Tester
Probes for and exploits security vulnerabilities to identify weaknesses in networks / systems.
Security Auditor
Probes for the safety, effectiveness, and security compliance of a company.
Security Specialist
Responsible for designing, testing, implementing, and monitoring the overall security posture of a company.
Vulnerability Assessor
Scans applications and systems to identify any current vulnerabilities.
Cybersecurity Domains
"Cybersecurity" represents a complete list of responsibilities, roles, and topics. Often referred to as the domains of cybersecurity, each element includes very specific goals and responsibilities to be accomplished. Within every domain are sub-domains. The responsibilities and tasks associated with each sub-domain contribute to the larger goal of the top domain and ultimately the goal of cybersecurity.
Security & Risk Management
Governance, compliance, risk assessment, legal regulations, and security policies.
Asset Security
Protecting and managing organizational assets, data classification, and ownership.
Security Architecture
Designing secure systems, networks, and infrastructure.
Network Security
Securing network components, connections, and communications.
Identity & Access Management
Controlling who has access to what resources and under what conditions.
Security Assessment & Testing
Auditing, testing, and validating security controls.
Security Operations
Monitoring, detecting, and responding to security incidents.
Software Development Security
Integrating security into the software development lifecycle.
Cloud Security
Securing cloud infrastructure, services, and data.
The above is a simplified overview of the major cybersecurity domains. Each one contains numerous sub-domains and specializations. You don't need to master all of them, pick a direction that interests you and go deep.
Let's Make a Four-Step Plan
You now have some resources to choose from. Let's go ahead and make a plan.
Take out a piece of paper. Pick one of the above mentioned resources from each category. Write down your four resources on this piece of paper.
Next to the listed resources you have written down, allocate a specific amount of dedicated time you will spend each day or week on learning from that resource.
Title this paper, "My plan to learn more about cybersecurity" and place this paper in a place where you will be able to see it every day.
Time to start learning! You have a plan set into place now. Getting started in cybersecurity does not have a very sophisticated, well-orchestrated plan. Approach your plan with simplicity.
Explore Before You Invest
Starting out in cybersecurity can be confusing and overwhelming. Hundreds of resources, platforms, certifications, and degree programs all competing for your attention and you haven't even figured out which career path to pursue yet. Here's what matters: make a plan. Your plan will look different from everyone else's. What's important is that it's catered to your learning style and lets you start now.
Before making a major investment into a university program or certification training, spend a few months simply learning more about the industry. It doesn't matter if you're in high school, already at university, or mid-career in something else entirely, the setting you're in right now doesn't matter. Free, paid, online, or a book, it doesn't matter. What does matter is that you learn more about the industry before you spend serious money trying to get into it.
Browse free resourcesCommon Questions
Here are some of the most common questions I receive from individuals who are considering the idea of getting started in cybersecurity.