✳ Learning path / 10 lessons
Cybersecurity foundations
Ten core lessons and seven deep-dive electives build your first-principles engineering model across assets and the CIA triad, threat-vulnerability-risk math, DNS/TCP/TLS/HTTP protocol layers, identity and origin-bound authentication, evidence-grade logging, defense-in-depth segmentation, application trust boundaries, data resilience, cloud shared responsibility, and outcome-driven control design.
Work through the lessons in order to build a complete engineering mental model, or jump straight to the topic you are designing or reviewing today. Electives sit beside the core lesson they extend and are not required to complete the path.
01Assets and the CIA triad: what we protect and how it fails
Security engineering begins by naming the asset, its mission value, and how confidentiality, integrity, and availability fail in distinct operational ways.
Threat, vulnerability, and risk: the core equation
Separating threats, vulnerabilities, and business impact prevents security teams from treating every scanner finding or headline as an equal emergency.
Networks in one request: DNS, TCP, TLS, and HTTP
Every web or API call crosses four distinct protocol layers. Tracing DNS resolution, TCP connection setup, TLS cryptographic negotiation, and HTTP application semantics isolates where failures and controls live.
Three packets to open a road: TCP SYN, SYN-ACK, and ACK
Deep dive into the TCP three-way handshake (SYN, SYN-ACK, ACK), SYN_RCVD state, and SYN cookies. Why does TCP require three packets before entering ESTABLISHED? Trace sequence number synchronization, half-open SYN_RCVD state, and SYN flood defenses.
Two sides derive one secret: TLS 1.3 key exchange and name binding
Deep dive into TLS 1.3 ephemeral Diffie-Hellman key derivation, forward secrecy, and X.509 name binding. How do two endpoints agree on an encryption key over an untrusted network without sending the secret on the wire? Trace ephemeral Diffie-Hellman, X.509 name binding, and what TLS leaves to the application.
Identity, authentication, authorization, and recovery
A login flow actually performs four distinct security jobs. Separating directory identity, authentication proof, authorization policy, and account recovery prevents catastrophic bypasses.
Phishing and social engineering: how attackers exploit workflow urgency
How social engineering and AitM reverse proxies exploit human workflows - and how FIDO2/WebAuthn and out-of-band verification defeat them. Social engineering attacks target human workflows, authority gradients, and time pressure. Defending against them requires pairing user awareness with phishing-resistant technical gates.
Email authentication: what SPF, DKIM, and DMARC prove (and what they do not)
Protocol mechanics of SPF, DKIM, and DMARC identifier alignment - and why passing authentication never proves an email is safe. SPF, DKIM, and DMARC verify three specific domain claims on an incoming email message. Learn how each check works in DNS and why a DMARC pass never guarantees that an email is safe or written by a trusted human.
DMARC rollout: monitor with p=none, fix legitimate senders, then enforce
Operational rollout playbook for domain owners moving from DMARC p=none telemetry to p=quarantine and p=reject. Jumping straight to DMARC p=reject breaks legitimate business mail. Learn how domain operators use DMARC aggregate reports (rua) to inventory third-party senders, fix alignment, and safely ratchet to enforcement.
Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
A log is an immutable record of an event, an alert is a rule or model notification that warrants review, and evidence is correlated, time-synchronized proof that supports an investigative conclusion.
Least privilege, defense in depth, and Zero Trust boundaries
Flat networks and standing admin credentials turn a single compromised endpoint into a total breach. Combine least-privilege permissions with independent identity and network trust boundaries.
Application trust boundaries: why the client UI is never a security gate
A Trust Boundary marks where execution crosses from untrusted caller input into privileged server state. Learn why hiding a button or validating in JavaScript fails and how server-side API gates enforce integrity.
Data protection and resilience: why encryption is not a backup plan
Protecting data requires pairing confidentiality controls (encryption at rest and in transit) with availability and integrity resilience (immutable offline backups and tested restores).
Cloud shared responsibility: what you rent vs what you still own
Moving to IaaS, PaaS, or SaaS shifts infrastructure maintenance to the provider, but the customer always retains ownership of data classification, identity governance, and configuration.
Privacy vs security: why an encrypted database can still violate privacy
Why authorized collection, purpose limitation, and data minimization sit beside confidentiality, integrity, and availability. Security controls protect data from unauthorized outsiders, while privacy governance regulates whether the organization itself is collecting, using, and retaining personal data lawfully and Minimally.
Outcomes before controls: using NIST CSF, CIS, ISO 27001, and ATT&CK together
Frameworks are not competing checklists. Learn how security architects start from a measurable risk outcome and map across NIST CSF 2.0, ISO/IEC 27001, NIST SP 800-53, CIS Controls, OWASP, and MITRE ATT&CK.
Security product categories are capabilities, not outcomes
Translating vendor product acronyms (EDR, SIEM, CSPM, ZTNA, WAF) back into concrete NIST CSF capabilities. Buying a SIEM, EDR, WAF, or CSPM does not mark a security function "done." Learn how to map vendor product acronyms to concrete technical capabilities, telemetry inputs, and operational owners.
Test your engineering judgment
Every lesson closes with a 4-choice scenario check modeled on real architectural trade-offs. Ready for full hands-on simulations or certification drills?
Open the practice labs ↗ · Launch the CISSP practice simulator ↗