Complete Cybersecurity Study Guide

flowchart TD
    A[Hub] --> B[Key Concepts]
    A --> C[Core Principles]
    A --> D[Practical Applications]
    B --> E[Fundamental definitions]
    C --> F[Design patterns]
    D --> G[Real-world usage]

Cybersecurity is the practice of protecting systems, networks, and data from digital attacks. As our world becomes increasingly connected, the demand for cybersecurity professionals continues to grow. But cybersecurity is not just a career — it is a mindset. Every developer, every system administrator, and every user benefits from understanding how systems can be attacked and how to defend them.

This hub page maps every resource on this site. The learning path takes you from security fundamentals through cryptography, authentication, web security, network security, incident response, cloud security, OS security, malware analysis, and penetration testing. Each section includes practical examples, attack scenarios, and defensive strategies.

• Security Fundamentals
• Cryptography
• Authentication
• Web Security
• Network Security
• Incident Response
• Cloud Security
• OS Security
• Malware Analysis
• Penetration Testing
• Learning Path
• Cross-Site Resources
• FAQ

Security fundamentals establish the principles and concepts that underpin all cybersecurity practice. Understanding these foundations is essential before studying specific attack and defence techniques.

• Security Fundamentals Overview — core principles, threat models, and risk management
• Security Fundamentals — CIA triad, least privilege, defence in depth, and threat modelling

The CIA triad defines the three pillars of information security:

• Confidentiality: only authorised parties can access data
• Integrity: data is accurate and has not been tampered with
• Availability: systems and data are accessible when needed

Least privilege dictates that users and systems should have only the minimum permissions necessary to perform their function. This limits the blast radius of compromised accounts or systems.

Defence in depth means layering multiple security controls so that if one fails, others still protect the asset. A firewall alone is insufficient — combine it with authentication, encryption, monitoring, and access controls.

Threat modelling identifies what you are protecting, who might attack it, and how. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is a systematic threat classification framework.

Cryptography is the science of securing communication through encoding messages so that only authorised parties can read them. It is the foundation of confidentiality and integrity in digital systems.

• Cryptography Overview — symmetric and asymmetric encryption, hash functions, and digital signatures
• Cryptography — AES, RSA, ECC, SHA, and key exchange
• TLS in Practice — how cryptography is applied in real-world protocols

Symmetric encryption (AES, ChaCha20) uses the same key for encryption and decryption. It is fast and suitable for bulk data. The challenge is key distribution — how do you securely share the key?

Asymmetric encryption (RSA, ECDSA, Ed25519) uses a public-private key pair. The public key encrypts; the private key decrypts. It solves the key distribution problem but is much slower than symmetric encryption.

Hash functions (SHA-256, SHA-3, BLAKE3) produce a fixed-size digest from arbitrary input. They are one-way — you cannot reverse a hash to obtain the original data. They are used for password storage, data integrity verification, and digital signatures.

Digital signatures combine hashing and asymmetric encryption. The signer hashes the message and encrypts the hash with their private key. Anyone with the public key can verify the signature by comparing hashes.

Key exchange (Diffie-Hellman, ECDH) allows two parties to establish a shared secret over an insecure channel. Neither party ever sends the key directly — they each contribute to the shared secret mathematically.

Authentication verifies the identity of users, devices, and systems. It is the gatekeeper of access control — if authentication fails, all other security controls are irrelevant.

• Authentication Overview — authentication factors, protocols, and best practices
• Authentication — passwords, MFA, biometrics, and token-based auth
• OAuth Deep Dive — OAuth 2.0, OpenID Connect, and token flows

Multi-factor authentication (MFA) requires two or more independent factors: something you know (password), something you have (phone or hardware key), and something you are (biometrics). MFA dramatically reduces the risk of account compromise.

Password security starts with hashing. Never store passwords in plaintext — hash them with a slow, salted algorithm like bcrypt, scrypt, or Argon2. Fast hashes (SHA-256) are unsuitable for passwords because they enable brute-force attacks.

OAuth 2.0 is the standard for delegated authorisation. It allows a user to grant a third-party application limited access to their resources without sharing their credentials. OpenID Connect adds an identity layer on top of OAuth.

Session management determines how authenticated sessions are tracked. Tokens (JWT), server-side sessions, and cookies each have trade-offs. The key principles are: expire sessions, rotate tokens, and invalidate on logout.

Web security protects web applications from attacks that exploit vulnerabilities in code, configuration, or architecture. Web applications are the most commonly attacked surface in modern systems.

• Web Security Overview — common vulnerabilities and defence strategies
• OWASP Top 10 — the most critical web application security risks
• Web Security — injection, XSS, CSRF, and security headers
• API Security — authentication, authorisation, and rate limiting for APIs

Injection attacks occur when untrusted data is sent to an interpreter as part of a command. SQL injection, NoSQL injection, and command injection are common variants. The defence is input validation and parameterised queries.

Cross-Site Scripting (XSS) occurs when an attacker injects malicious scripts into web pages viewed by other users. Stored XSS, reflected XSS, and DOM-based XSS are the three types. The defence is output encoding and Content Security Policy (CSP) headers.

Cross-Site Request Forgery (CSRF) tricks a user’s browser into making unwanted requests to a site where they are authenticated. The defence is anti-CSRF tokens and SameSite cookies.

The OWASP Top 10 lists the most critical web application security risks: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, Software and Data Integrity Failures, Logging and Monitoring Failures, and Server-Side Request Forgery.

Network security protects data in transit and the infrastructure that carries it. It encompasses firewalls, intrusion detection, VPNs, and network monitoring.

• Network Security Overview — perimeter defence, monitoring, and access control
• Network Security — firewalls, IDS/IPS, and network segmentation
• VPN and Tunneling — IPsec, WireGuard, and encrypted tunnels

Firewalls filter network traffic based on rules. Packet-filtering firewalls inspect headers; stateful firewalls track connection state; application-layer firewalls inspect payload. Modern next-generation firewalls combine all three.

Network segmentation divides a network into isolated zones. If one segment is compromised, the attacker cannot move laterally to other segments. Use VLANs, subnets, and firewall rules to enforce segmentation.

VPNs create encrypted tunnels over public networks. IPsec operates at the network layer; WireGuard is a modern, high-performance VPN protocol. VPNs protect data in transit but do not protect endpoints.

Incident response is the process of detecting, containing, eradicating, and recovering from security incidents. A well-practised incident response plan limits damage and reduces recovery time.

• Incident Response Overview — preparation, detection, containment, and recovery
• Incident Response — the incident response lifecycle and playbooks
• Forensics — digital forensics, evidence collection, and chain of custody

The incident response lifecycle has four phases: Preparation (plan and train), Detection and Analysis (identify the incident), Containment, Eradication, and Recovery (stop and fix it), and Post-Incident Activity (learn and improve).

Containment stops the incident from spreading. Short-term containment isolates affected systems; long-term containment applies patches and hardening while maintaining business operations.

Digital forensics preserves and analyses evidence. The chain of custody documents who handled evidence and when. Forensic images capture the exact state of a system without altering it.

Cloud security protects data, applications, and infrastructure in cloud environments. The shared responsibility model defines what the cloud provider secures versus what the customer secures.

• Cloud Security Overview — shared responsibility, identity, and data protection
• Cloud Security — IAM, encryption, and configuration management

The shared responsibility model divides security duties. The cloud provider secures the infrastructure (physical data centres, network, hypervisor). The customer secures what they put in the cloud (data, identity, application configuration, OS patching).

Identity and Access Management (IAM) is the primary security control in the cloud. Follow least privilege — grant only the permissions needed. Use roles instead of long-lived access keys. Enable MFA everywhere.

Cloud configuration errors are the leading cause of cloud security incidents. Public S3 buckets, overly permissive security groups, and unencrypted storage are common mistakes. Use infrastructure-as-code scanning and continuous compliance monitoring.

Operating system security protects the system from unauthorised access, malware, and configuration weaknesses. Hardening an OS reduces its attack surface.

• OS Security Overview — hardening, access control, and monitoring
• OS Security — Linux and Windows security configuration and best practices

Hardening reduces the attack surface by disabling unnecessary services, removing unused software, applying patches, and configuring access controls. A hardened system has fewer avenues for attack.

File permissions control who can read, write, and execute files. Linux uses Unix permissions (owner, group, others) and ACLs. Windows uses NTFS permissions. Follow least privilege — grant write access only when necessary.

Audit logging records who did what and when. Enable logging for authentication, privilege escalation, file access, and system changes. Forward logs to a centralised system that an attacker cannot tamper with.

Malware analysis examines malicious software to understand its behaviour, capabilities, and indicators of compromise. It is essential for incident response and threat intelligence.

• Malware Analysis Overview — types of malware, analysis techniques, and tools
• Malware Analysis — static analysis, dynamic analysis, and reverse engineering

Static analysis examines malware without running it — analysing file headers, strings, imports, and disassembly. It reveals the malware’s capabilities without risk of infection.

Dynamic analysis runs malware in a controlled environment (sandbox) and observes its behaviour — file system changes, network connections, registry modifications, and process creation.

Indicators of Compromise (IOCs) are artefacts that indicate a breach: file hashes, IP addresses, domain names, registry keys, and file paths. Share IOCs with threat intelligence communities to help others detect the same malware.

Penetration testing simulates real-world attacks to identify vulnerabilities before adversaries do. It is a structured, authorised process of ethical hacking.

• Penetration Testing Overview — methodology, tools, and reporting
• Penetration Testing — reconnaissance, scanning, exploitation, and post-exploitation

The penetration testing methodology follows a structured process:

1. Reconnaissance — gather information about the target (OSINT, DNS enumeration, social engineering)
2. Scanning — identify live hosts, open ports, and running services
3. Exploitation — use identified vulnerabilities to gain access
4. Post-exploitation — escalate privileges, move laterally, and establish persistence
5. Reporting — document findings, evidence, and remediation recommendations

Common tools include Nmap (network scanning), Burp Suite (web application testing), Metasploit (exploitation), Wireshark (packet analysis), and John the Ripper (password cracking).

Cybersecurity is vast. Follow this progression to build competence.

• Study security fundamentals — CIA triad, threat modelling, and risk management
• Learn cryptography — symmetric and asymmetric encryption, hashing, and digital signatures
• Understand authentication — MFA, password security, and OAuth

• Study web security — OWASP Top 10, injection, XSS, and CSRF
• Learn network security — firewalls, IDS/IPS, and VPNs
• Understand incident response — detection, containment, and recovery

• Study cloud security — IAM, shared responsibility, and configuration management
• Learn OS security — hardening, permissions, and audit logging
• Understand malware analysis — static and dynamic analysis

• Study penetration testing — methodology, tools, and reporting
• Choose a specialisation — application security, network forensics, or threat intelligence
• Build a home lab and practise on vulnerable systems (DVWA, HackTheBox, TryHackMe)

Wyatt’s Notes is a network of interconnected study sites. The security content connects to related material:

• Networking Guide — the network protocols that security controls protect
• C++ Programming Guide — if you are building security-critical applications
• Python Programming Guide — Python is widely used for security tooling and scripting
• Database Design Guide — database security, encryption, and access control
• Computer Science Guide — algorithms and theory that underpin cryptography

Start with security fundamentals — understand the CIA triad, least privilege, and defence in depth. Then learn cryptography — it is the foundation of all security controls. Build a home lab and practise on intentionally vulnerable systems.

Yes, at least at a basic level. Python is the most commonly used language for security tooling. Understanding how code works helps you find vulnerabilities and understand exploits. You do not need to be a developer, but you should be able to read and write scripts.

For beginners, CompTIA Security+ provides a solid foundation. For intermediate professionals, CEH (Certified Ethical Hacker) or OSCP (Offensive Security Certified Professional) are valuable. For advanced specialisation, CISSP or GPEN demonstrate expertise.

Build a home lab with virtual machines. Use intentionally vulnerable systems like DVWA, Metasploitable, or HackTheBox. Never practise on systems you do not own or have explicit permission to test.

Vulnerability scanning automatically identifies potential weaknesses using tools. Penetration testing manually exploits those weaknesses to demonstrate real-world impact. Scanning is broad and fast; testing is deep and slow.

Yes. Demand for cybersecurity professionals far exceeds supply. The field offers strong salaries, job security, and meaningful work. It requires continuous learning — threats evolve constantly — but that is part of what makes it interesting.

Last updated: 24 July 2026

Written by Wyatt. For questions or feedback, visit wyattau.com.