Learn cybersecurity in this order: networks and Linux, Python and Bash, web application security, legal practice labs, detection and incident response, then cloud, identity and governance. Practise only on systems you own or platforms built for it.
Only test systems you own or have written permission to test. Unauthorised access can be an offence under India's Information Technology Act, 2000.
- 1Networks and LinuxTCP/IP, shell
- 2Python and Bashautomation
- 3Web securityOWASP Top 10
- 4Practice labsJuice Shop, DVWA
- 5DetectionSIEM, ATT&CK
- 6Cloud and GRCidentity, DPDP
Learning path: free resources in order
| Stage | Free resource | Industry tool you will meet |
|---|---|---|
| 1. Networks and Linux | Wireshark documentation | Wireshark, Linux shell, tcpdump |
| 2. Python and Bash | Python tutorial | Python, Bash |
| 3. Web security | OWASP Top 10 · PortSwigger Web Security Academy | Burp Suite, OWASP ZAP |
| 4. Practice targets | OWASP Juice Shop · DVWA · TryHackMe · Hack The Box | Nmap, intentionally vulnerable labs |
| 5. Attacker techniques and defence | MITRE ATT&CK | SIEM tools, EDR, ATT&CK Navigator |
| 6. Governance and India | CERT-In · NIST Cybersecurity Framework | Risk registers, audit frameworks |
A realistic 12 to 24 week plan
| Weeks | Focus | Output you can show |
|---|---|---|
| Weeks 1 to 4 | Networks and Linux | Annotated packet captures and a lab network diagram |
| Weeks 5 to 7 | Scripting | A Python log analyser with tests |
| Weeks 8 to 12 | Web security | A Juice Shop findings report mapped to OWASP Top 10:2025 |
| Weeks 13 to 16 | Detection | A Wazuh lab with a detection-gap report |
Roles in the industry
| Role | What the work looks like | Core tools |
|---|---|---|
| SOC analyst | Monitor alerts, triage and escalate incidents | SIEM, EDR, ATT&CK |
| Penetration tester | Authorised attack simulation and reporting | Burp Suite, Nmap, scripting |
| Incident responder | Contain and investigate breaches | Logs, forensics tools |
| Cloud security engineer | Secure cloud accounts, identity and configuration | Cloud consoles, IaC scanners |
| GRC analyst | Risk, policy and compliance | Frameworks, audits |
Reference frameworks to know
- OWASP Top 10:2025 is the current web-application risk list (A01 Broken Access Control through A10 Mishandling of Exceptional Conditions). Older tutorials teach the 2021 list; check the edition.
- MITRE ATT&CK is the knowledge base of attacker tactics and techniques; use the live matrix, not screenshots from old courses.
- NIST Cybersecurity Framework 2.0 organises security into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- India: CERT-In handles national incident response and reporting directions; the Digital Personal Data Protection Act, 2023 and its 2025 Rules phase in obligations for organisations. Read the official texts.
Mistakes to avoid
- Running tools on systems you do not own or have written permission to test.
- Learning tool names without learning the network and operating-system basics underneath them.
- Reporting a finding without evidence and a fix.
- Treating compliance checklists as a substitute for detection and response.
Build as you learn
Cybersecurity projects
Home-lab projects from Wireshark to a Wazuh SIEM.
Agentic AI projects
MCP servers, text-to-SQL and agentic RAG, each with an eval set.
Free tools for this field
Free coding tools for students
A zero-cost stack to write, host and deploy code.
Free AI tools for builders
Run, build and test AI projects without paying.
Frequently asked questions
How do I start learning cybersecurity?
Networks and Linux first, then Python, then web security on a lab you run yourself. Tools make sense only after the basics.
Is learning ethical hacking legal in India?
Yes, when you practise on systems you own or platforms designed for it, with permission. See ethical hacking vs cybersecurity.
Which free labs are good for beginners?
OWASP Juice Shop, DVWA, PortSwigger Web Security Academy, TryHackMe and Hack The Box.
Which cybersecurity role is easiest to enter?
SOC analyst and GRC analyst roles have the most entry points. Penetration testing usually needs a portfolio of reports first.
Learn this with mentors
Cybersecurity programmes with admissions open: live classes, mentors and project work.
