A cybersecurity roadmap for beginners: Linux, networks, then the web

Search for "how to learn cybersecurity" and you will find long lists of tools, certificates and hacking videos. The problem is that tools make sense only once you understand what they are acting on: an operating system, a network, a web application. This roadmap puts those foundations first. It is the same order we teach in our cybersecurity fundamentals course, and you can follow it on your own.

Step 0: the rules, before anything else

Testing a system you do not own, without written permission, is illegal in most countries, whatever your intentions. In Pakistan, unauthorised access to an information system is an offence under the Prevention of Electronic Crimes Act 2016; the UK, the UAE, Saudi Arabia and most other countries have similar laws. "I was only learning" is not a defence.

Professionals work this way too: penetration testers sign a contract that defines exactly what they may test before they start. Learning to work inside rules is part of the skill.

Step 1: Linux and the command line

Most servers run Linux, and most security tools are built for it. Install a Linux distribution such as Ubuntu in a virtual machine (VirtualBox is free), so you can experiment without risking your main computer. Then learn to move around and read what you see:

$ pwd                     # where am I?
$ ls -l /etc/passwd       # who may read and change this file?
-rw-r--r-- 1 root root 2847 Oct 18 09:12 /etc/passwd
$ whoami                  # which user am I running as?
$ ps aux | head           # which programs are running?
$ sudo tail /var/log/auth.log   # recent logins and sudo use

Aim to understand users, groups and file permissions (what -rw-r--r-- means), processes and services, and logs. Then write a few short shell scripts, for example one that lists the files in your home folder that anyone can write to. Permissions and logs come up again in every later step.

Step 2: how networks actually work

Almost every attack crosses a network, so you need a working picture of what happens when you open a website. Learn, in this order:

1. IP addresses and ports: which machine, and which program on it.
2. TCP and UDP: reliable connections versus fast, connectionless messages.
3. DNS: how mysubjecthub.com becomes an IP address. Try dig or nslookup on a few domains.
4. HTTP and HTTPS: requests, responses, status codes, headers and cookies, and what TLS encryption protects.
5. Packet capture: open Wireshark on your own network, load a web page and find the DNS lookup and the TLS handshake.
6. Firewalls: what it means to allow or block a port, and why most ports on a server should be closed.

A good test of this step: explain, out loud and in order, everything that happens between typing a web address and seeing the page.

Step 3: web application security

Websites and apps are where most beginners first find real vulnerabilities, and where developers most need security knowledge. Start with the OWASP Top 10, a free, widely used list of the most serious web application risks, and learn each one from both sides: how it is exploited and how it is fixed.

SQL injection is the classic example. It happens when user input is pasted straight into a database query:

# Vulnerable: the input becomes part of the SQL itself.
# A username of  ' OR '1'='1  changes what the query means.
query = f"SELECT * FROM users WHERE name = '{username}'"
cursor.execute(query)

# Fixed: a parameterised query. The database treats the input
# as data only, never as SQL.
cursor.execute("SELECT * FROM users WHERE name = ?", (username,))

Practise on applications built to be attacked, running on your own machine: OWASP Juice Shop and DVWA (Damn Vulnerable Web Application) are free and made for exactly this. Then move on to cross-site scripting, broken authentication and session handling.

Programming: the skill that multiplies the others

You can start cybersecurity without programming, but you will progress faster with it. Python is the most useful first choice: it is used to automate tasks, parse logs and write small tools. Basic Bash scripting, and enough JavaScript to read a web page's code, come next. If you are new to programming, see which programming language to learn first.

Where to practise legally

• Your own lab: two or three virtual machines on a private network inside VirtualBox.
• Deliberately vulnerable apps: OWASP Juice Shop, DVWA, and similar projects you run yourself.
• Online training platforms with legal practice labs, such as TryHackMe and Hack The Box. Read each platform's rules.
• Capture the Flag (CTF) competitions: timed challenges, often run by universities and security communities, and a good way to meet other learners.

What about certificates?

Certificates can help with job applications later, but none is needed to start, and none replaces the foundations above. Build the skills first; when you choose a certificate, pick it for the job you want, and check what employers in your country actually ask for.

Learning with a tutor

The hardest part of starting is knowing what to learn next and whether you have understood it. Our cybersecurity fundamentals course follows this roadmap one-to-one, from the Linux command line to web application security, with ethics built into every lesson. No experience is needed, and the first class is free.