Stage 1 of 8 · 8 lessons · ~6 weeks

Security foundations

The ideas every security role shares: the CIA triad, risk, the networking and Linux you need, authentication, hashing and encryption at a conceptual level, and the law and ethics of authorised testing.

Start: Confidentiality, integrity and availability

Lessons· one lesson for each topic, in this order

Do this

Explain the CIA triad with one example of each from the news.
Draw the path of an HTTPS request from browser to server, including DNS and TLS.
Practise Linux permissions and processes on a safe wargame.
Write down the difference between authentication and authorisation with an example.
Explain hashing, symmetric encryption and asymmetric encryption to a friend in two minutes.
Read the rules page of every practice platform you sign up to.
Pick your first path and write two sentences on why.

Start with· follow one of these

CourseFree
Professor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free video course whose early sections cover general security concepts, threats and cryptography at exactly the right depth
PlatformFree
TryHackMe
TryHackMe · Beginner
The free pre-security and introductory rooms teach networking, Linux and web basics in guided, browser-based labs

Practise

OverTheWire: Bandit
A free wargame that makes you comfortable in the Linux terminal, level by level
CyLab Security Academy (formerly picoCTF)
Carnegie Mellon's free practice challenges for students, formerly picoCTF, now CyLab Security Academy

Keep handy

roadmap.sh: Cyber Security
A one-page map of the field: use it to see where each stage of this roadmap sits
OWASP Cheat Sheet Series
Read the Authentication and Password Storage cheat sheets for the practical side of this stage

Also worth your time

Computer Networking: A Top-Down Approach (Video Lectures)Go deeper
If networking still feels shaky, the application and transport layer lectures fill the gap properly

Before moving on: A one-page notes document in your own words covering the CIA triad, risk, how a web request travels, authentication versus authorisation, hashing versus encryption, and the rules you will follow on written authorisation.

Tauseef's advice

Do not rush this stage to get to the tools. Nearly every weak candidate I meet can name tools but cannot explain what happens when a browser opens a website, or why passwords are hashed. And take the law seriously from day one: practise only on labs, CTFs and programmes that invite you. Curiosity is not permission. If securing LLM apps and agents is what draws you, AI security now has its own roadmap at sefism.com/roadmaps/ai-security/.