David Pouliot

Getting Started in Cybersecurity

What the work looks like, how to build a safe place to practice, and where to play.

Cybersecurity is one of the few fields where you can build real, demonstrable skill on your own, for free, before anyone hires you or admits you to a program. The catch is that it is easy to collect a hundred bookmarks and never start.

This page is meant to be read in order. Each section assumes the one before it.

On this page

What security work actually looks like

“Cybersecurity” covers several fairly different jobs. It helps to know which one you are drawn to, because the skills only partly overlap.

Defensive security, often called blue team, is the largest share of the field. Monitoring systems, hunting for intrusions, responding to incidents, hardening configurations, and building the tooling that makes all of that possible. If you like puzzles made of logs and network traffic, this is your side.

Offensive security, often called red team or penetration testing, means finding the vulnerabilities before someone else does, then writing up what you found and how to fix it. It is the most visible side of the field and the most romanticized. It is also a smaller job market than most beginners expect, and the good practitioners are excellent writers as well as excellent hackers.

Digital forensics and incident response is what happens after something goes wrong: recovering evidence from disks, memory, and network captures, and reconstructing what an attacker actually did. It carries into law enforcement and legal work, where your analysis has to hold up under scrutiny by people who are paid to attack it.

The capture-the-flag games below lean offensive, because that is what gamifies best. Do not read that as a claim about where the jobs are.

Ground rules

Read this before you start Practice offensive security techniques only in designated playgrounds: the CTF sites and intentionally vulnerable virtual machines listed on this page. There are serious consequences, including fines and jail time, for attacking a real website or resource that you do not own and do not have written permission to test.

“I was only learning” is not a defense. The good news is that the legal playgrounds are excellent and there is more free practice material than you can finish.

Start here: Bandit

If you are new, do not start with a vulnerability scanner. Start by getting comfortable in a Linux shell, because everything else assumes it.

Bandit at OverTheWire is a wargame that teaches the shell one level at a time. Each level hides a password that gets you into the next one. It is the most reliable first step I know of, and it costs nothing but your evenings.

Walkthrough and setup instructions are on the tools page: Practice: Bandit on OverTheWire.

Build somewhere safe to practice

Some of the best practice material comes as intentionally vulnerable virtual machines that you download and attack offline. For that you need a lab: a virtual network holding the vulnerable machine and an attacking machine, usually Kali Linux, isolated from your real network.

Start with Containers & Virtual Machines for hypervisors, VM sizing, and snapshots. Then these guides cover the network side specifically:

For a broader tour of what a home lab can be and how people actually build one, watch Jeff McJunkin’s SANS webcast Building Your Own Super Duper Home Lab. It covers the hardware and software choices at several budget levels, so it is useful whether you are working with a spare laptop or a rack in the garage.

Keep the lab off your real network Intentionally vulnerable machines are, by design, trivially exploitable by anyone who can reach them. Put them on a host-only or internal virtual network, not a bridged one, so nothing outside your lab can talk to them.

What is a CTF?

CTF stands for capture the flag. These are computer security challenges and competitions. The general idea is to exploit a security vulnerability in some system, which will let you recover a flag. The flag is generally text, like a password.

Some CTFs are designed with levels, so that you need the flag from the previous level in order to access the next level. Some of the competitions have a Jeopardy-style board, where you get points for each flag that you capture.

Practice sites

I put this list together to help people who want to get started with offensive security. I have personal experience with most of these.

Still in high school? picoCTF and CyberPatriot are built specifically for students at your level, and CyberPatriot in particular runs as a team competition through schools.

Vulnerable virtual machines

Most of these sites have intentionally vulnerable virtual machines that you can download and play with offline.

Competitions

Once you have some practice behind you, these run events where you compete against other individuals and teams.

Tools

Common tools that might be useful in a CTF:

Debuggers

Reverse engineering tools

Try it Pick one thing and finish it before collecting more links. A reasonable first month: get through Bandit level 15, then work the PortSwigger Web Security Academy labs, which are free, well built, and explain the theory as they go.