Getting started in Cyber Security in 2021- The Complete Guide
This article will be our starting point, I will create tutorial series revolving around this topic and link them in this article in the future, so be sure to bookmark this article and check back regularly. You can see this as a mini-curriculum and reference guide for your own studies.
I am in the position of teaching you solid basics, but I am by no stretch of the word an expert in the field. I know my basics pretty well and I think I know what’s necessary to get up to a level where you can start working in an actual job and start building your career. I show you the way, you need to put in the work.
I want to emphasize that every resource I link in this article is free to use. If I find paid content that is super worthy (like a Udemy course for example), I will list it, but the core is free. I put a high value on free content and free learning, that’s why I create tutorials like those without getting paid.
You will find many parts throughout this article that says “Learn this, Learn that…” on some of them, I will link resources, on others not. This is purpose. I want to encourage you to learn how to find information on your own. It’s all out there. A big part of working in Cyber Security, same as Programming, is using Google or other search engines to find information.
That being said, learn how to Google!
I will also list a couple of books that I personally bought and recommend to anyone, of course, they are not free either and optional if you have the money to buy them. All the books that I list are well researched and all of them are highly recommended by the community.
So if you really like this content, please whitelist me on your Adblocker or on UBlock Origin, or visit my Donations page to see all channels. Thank you!
Enough of the introduction, let’s get started.
Getting Started in Cyber Security
Why getting started in Cyber Security?
Well, that’s a question you have to party solve on your own, but let me tell you my perspective and a few facts.
High Demand for Security Professionals everywhere
It’s a fun field to work in (We get to that later)
You can Hack things and get paid for it! (Without landing in Jail)
You can feed your Technological Curiosity with Bleeding Edge Technology
You can solve Problems!
The satisfaction you get by breaking into a System successfully
Competitive Salary
Those are just a few things that make Cyber Security interesting for myself. Finding a Job even when you just start out but you got a solid foundation is pretty easy. I get an ungodly amount of Job offers every single week.
I was always a big fan of Hacking culture since I was a small Kid and watched movies like Hackers and Wargames. I always wanted to become a “Hacker” but started that journey only much later in my life. The satisfaction you get, at least for me, when breaking into a System is incredible. It gives you a really nice sense of achievement.
The really good salary for Security Professionals is a nice motivation but should be put pretty far on the end of your list. If you are just in for the salary, you are most likely going to fail. You have to be borderline masochistic to learn something like Cyber Security or Hacking in the first place.
Check my YouTube Channel for more Cyber Security Tutorials
When you should not get started in Cyber Security
If you really dislike failing and can’t deal with failure on a daily basis, working in Cyber Security probably isn’t for you. You are going to fail and you are going to be frustrated a lot. On a daily basis. In fact, it will happen so oft that you consider quitting on the regular.
You don’t like failing
You can’t deal with stress
You don’t like learning
You are scared of breaking things
Now you see that I don’t list things like “..You don’t know programming” or, “..You’re not working in the IT field for XX amount of years”. I believe that everyone can learn everything and that there is no “I should have started this when I was 8”. The best day you should have started was yesterday, the second best day is, well, you guess it.
I don’t want to discourage you, but I will tell you that it isn’t going to be a walk in the park either. Every bit of experience you have upfront, even working in a Service Desk will help.
How did I get started in Cyber Security?
I think this information is somewhat relevant so you can understand where I am coming from and what my learning path was. I don’t want to make you read my life story, so we use our good old friends, the Bullet Point list, to give you an overview and I say a few words to it after that.
Started Gaming and fiddling with computers at a young age
Mostly only gaming, built my own computers pretty early, only basic stuff
Apprenticeship as a Computer Science Expert for System Integration // 3 Years
We have a different System here in Germany, it’s somewhat of an equivalent of a Computer Science Bachelor in the US, takes you 3 years. It’s more real-world oriented than an actual degree because you work for a company throughout the whole process.
Working in First Level Support for a huge company // 3 years
This certainly helped to learn how people who have no idea of computers think and get all the basics down.
Hoorah to all First Level Supporters who want to change their Career <– You can do it!
Long Break
Traveling the world because f*** First Level Support
Self Study Certificates and getting my game up to speed // 1/2 Year
Microsoft Certified Solutions Associate Server 2016
Microsoft Certified Solutions Expert Server 2016
ITIL Foundation (bleh, you can skip that if you don’t want to move into management)
Starting Ceos3c.com
We get to that later
Starting to work as a “real” System Administrator for an IT Service Provider // ~1 Year
My first real Sysadmin Job. Worked for different companies and learned all about Virtualization, Windows Servers, and Firewalls.
Starting to work as a CTO for a Startup // 3 years
Stuff got serious from this point
Working as the Head of the IT department and as a Cyber Security specialist at the same time
Getting pfSense Certified
Working as a Freelance Cyber Security Specialist on the side
Ok, let me say a few things to that. Everything that happened before the Long Break was kind of “winging it” on my side. I wasn’t really interested in any of the stuff I was working with. That all changed after my Long Break where I decided to make an actual career out of that. That was also the time I got involved in Cyber Security for the first time and immediately caught fire.
I basically started Ceos3c around the time I started my first “Real Sysadmin Job” in 2016. I only ever started it because I wanted to document stuff for myself, because I found that so many tutorials out there were incomplete and I wanted to find the information I needed more than once on my own website, in a complete and working tutorial.
That pretty quickly turned out to be a great way to learn something. Because if you actually write a tutorial for something, you need to understand it yourself. Also, writing really helps to manifest the knowledge in your brain.
That being said, I highly recommend writing your own Blog while you are starting your Cyber Security journey. Even on a free platform like Blogger or WordPress. It’s an incredible tool and maybe in the end, who knows, you will be the one writing tutorials for others and generate a nice stream of side incoming at the same time. Win-win.
Having to build a whole company network basically from scratch in my role as a CTO gave me an incredible boost in knowledge and understanding of how things work together. I knew kind of how things worked before, but this filled the gaps I still had. Around that same time, I really got interested in Security and started to intensively learn Linux and Firewalls.
I also started working as a Freelancer once I got my skills to a level where I could use them for assignments. My freelance work includes everything from Penetration Tests to Cloud Architecture to configuring Servers and consulting companies in Cyber Security questions. This also helped me a lot!
So you can see, I have a quite long journey behind me. How much all those previous experiences weight into my knowledge of today, I can’t tell for sure, but every piece contributed a bit to it.
Now let’s get started with the actual curriculum of this getting started in Cyber Security article.
The Best Hacking Tools in 2019
Curriculum – or – what I recommend to learn
This will be a tough one and it highly depends on your background. If you have worked in IT before, you probably can skip a thing or two.
We try to move through this in the order that I think makes the most sense. You will find “starting to use Kali Linux” pretty late in that list. But that has a good reason. I eventually add things to this list as time passes, so make sure to check back regularly to stay up to date.
To keep those points as short as possible, I will work with Bullet Points that give you a summary of the things and don’t go over everything in great detail. The great detail follows in the specific tutorials that I will link in this article later on, once I produce them.
Getting Started in Cyber Security
1 – Basic Computer Skills
This basically goes without saying. You should have a basic understanding of how computers work.
Learn what parts a computer consists of (RAM, CPU, etc) and how they work together on a Basic Level
Learn what the BIOS is
Learn what UEFI is
Learn how to Create a Bootable USB Drive
Learn how to boot from a USB drive
Learn how to install Windows 10 and be aware of what happens to your old installation if you overwrite it (Hint: Your Data will be gone!)
Just make sure you know how to operate your Windows or Linux machine before you even think of getting started with Cyber Security or Hacking. If you don’t know all of the above, don’t go any further. Open up YouTube and learn the things I listed above before continuing with Step 2.
It seriously is that important. For all of you who are more advanced, this is a no-brainer, but I had so many people comment on my YouTube videos that their “Windows 10 is gone after following my tutorial” because they want to install Kali Linux and have no clue of the consequences.
2 – Virtualization
I put this in second place because most of you probably won’t have the capacity to build a physical Homelab. Gladly, most of our modern computers are so capable that you can run at least 1 Virtual Machine on them. A Virtual Machine is a, as the name suggests, Virtual Computer that is running on top of your own computer, utilizing its spare resources.
To simplify this very much, think you have 8GB of RAM and 4 CPU Cores in your computer. Your Windows 10 only uses up 4GB of RAM and 2 Cores. Hence, you have 4GB of RAM and 2 Cores spare. That would even allow you to run multiple Virtual Machines at the same time.
Read up on Virtualization and understand it’s core principal. You will need Virtualization if you want to work in the Cyber Security industry.
There are several providers of Virtualization Software, the most popular being: VMWare, Xen, KVM, and VirtualBox. We are going to be using VirtualBox in all of my tutorials.
Learn about VirtualBox
Learn how to install Linux on VirtualBox
Learn what Snapshots are and how to use them
3 – Linux
Every single Cyber Security or Hacking distribution is based on Linux. You won’t be working in Cyber Security on Windows. You have to learn Linux. There is no way around it. If you have followed the previous step, you can simply run Linux on VirtualBox, I even recommend doing this because you will mess things up so many times that you are happy to have a Snapshot of your still working system.
There are endless resources to learn Linux Basics. You can follow my Instagram Account (scroll all the way to the bottom in my feed and start from there), Linux Academy is a great resource to learn the basics, although not free. There are several YouTube Channels that teach Linux Basics very well for free.
Now there is a gazillion of Linux Distributions out there. You can get lost very quickly. Choose a beginner Distro if you haven’t used Linux before! I recommend Ubuntu or Linux Mint for beginners as they are the closest to Windows.
Learn what Linux is
Learn how to install Linux on VirtualBox if you haven’t already in Step 2
Learn Basic Linux Syntax
Use either Ubuntu or Linux Mint to start playing with Linux (try both and see what you prefer!)
Learn how to find out your IP Address
Learn about the Linux Filesystem
Learn how to create a User Account
Learn about Root
Learn about Sudo
Learn about the Apt Package Manager
Book Recommendations:
The Linux Command Line: A Complete Introduction* by William E. Schotts Jr.
UNIX and Linux System Administration Handbook* by Evi Nemeth, Garth Snyder, Trent R. Hein, Ben Whaley, and Dan Mackin
Probably the only Linux Book you’ll ever need
How Linux Works* by Brian Ward
4 – Networking
Knowing how networks work is an essential skill in Cyber Security. You have to know all the different protocols and what they do. A lot of exploits use certain protocols like SSH. The more you know about networking, the better.
Personally, I learned most of my networking skills with the “learning by doing” approach, which means simply mess around with stuff. Having worked as a System Administrator certainly helped me to harden my skills in this area.
Now I don’t know what happened to Eli The Computer Guy, he seems to only do Vlogging today, but he had some high-quality content on all kinds of System Administration stuff on his YouTube Channel. I learned a great deal from him.
I highly recommend you check out his Networking Playlist and just watch every single video of it. I couldn’t grasp subnetting for a long time, watching one video from him explaining it in great detail made me get it. I sometimes still dream of Subnets. Not a nice dream.
That being said, make sure you understand the following:
Learn about the most used Network Protocols
Learn about the OSI Model
Learn what a Switch is
Learn what a Router is
Learn what a Firewall is
Learn about TCP and UDP
Learn about VLAN’s
Learn about IP Addresses
Learn Subnetting
5 – Firewalls
Knowing how a firewall works is extremely important and beneficial if you are serious about getting started with Cyber Security. A few years back I decided to exchange my standard ISP Router with a pfSense firewall. To this day this was one of the most important steps I took.
Operating a firewall in your own home forces you to learn how it works. On top of it, it helps you to secure your home network. If you are a complete beginner, pfSense is a great choice. It is easier than you might think. If you want a comprehensive guide on how to get started, you can go to Amazon and grab my pfSense Starter Guide for a few dollars, or read it for free if you have Kindle Unlimited. I go through each step on how to set up pfSense with all the basic functionality, up until you can establish an Internet connection.
You can also check out my pfSense Playlist on YouTube, there are a lot of beginner-friendly pfSense tutorials, including “How to install pfSense on VirtualBox” videos.
That being said, those are a few examples of what you will learn when using a firewall, amongst many others:
Firewall Rules
Routing
Blocking and Allowing Traffic
VLAN’s
How to control Data in your own Network
How to Block certain Devices from going out to the Internet
Intrusion Detection
Proxy Servers
Network Interfaces
Book Recommendations:
pfSense 2.4 Starter Guide, by Myself
I haven’t read any books on pfSense, so this is the only one I can come up with. I am pfSense Certified (which requires you to attend a pricey 3-day on location seminar), so I got most of my knowledge from there and from YouTube.
6 – Windows Server & Domains
Alright, this is the last step before we get into actual Cyber Security stuff, I promise.
It is important that you know what Windows Servers are and what Domains are. Each and every company will run some kind of Active Directory or other authentication, Windows still being the most dominant. You have to have at least a basic understanding of how Domain Authentication works and how user accounts and computers are connected with a Domain Controller.
Again, I point you in the direction of our old friend Eli. Watch both his Windows Server 2012 (a bit dated but still relevant) and his Servers playlist.
Most of you who are looking into this topic most likely have previous System Administration experience anyway, so just make sure you got your basics straight.
Make sure you know at least:
What a Domain is
How Domain Authentication works
What a Domain Controller is
What LDAP is
What the Linux equivalent to a Microsoft Windows Domain is
Different Windows Account Roles (Like Administrator, Domain Administrator, etc)
What a Forest is
How Windows Domains are structured
Windows Server Best Practices
Book Recommendations:
The Practice of System and Network Administration by Thomas A. Limoncelli, Christine Hogan & Strata Chalup
Very detailed and good book was recommended through Reddit many, many times.
Top Things to do after installing Kali Linux / Parrot Security OS
7 – Installing your first Security Linux Distribution
Now we are getting to the part you probably have been waiting for: Choosing your first Security Linux Distribution. Many people recommend starting out with something like Ubuntu or Linux Mint because those distros are more beginner friendly. But let’s be honest. Nobody is going to follow this advice, everyone just wants to install Kali Linux right away.
Kali Linux is by far the most popular Pentesting / Cyber Security / Hacking distribution out there, you even see Kali Linux being used in Movies and TV Shows. Kali Linux isn’t the only choice. There are quite a lot of Security Distributions out there, the most popular ones are:
Kali Linux
ParrotSec OS
BlackArch
The choice here really is yours, but my recommendation, especially if you are a beginner is the Parrot Security OS. Why Parrot Security OS over Kali you ask? Because it’s set up a little bit more securely out of the box. In Kali Linux, you get a root user account when you install it and that’s it. To look at the reality, as a beginner, you are just going to use the root account because you don’t know any better. That’s a bad idea. Every Professional will be creating a new non-root user account as a first thing after logging in to Kali.
ParrotSec OS, on the other hand, creates a low privileged user account for you right from the start.
Ultimately, the choice is yours. I have instructions on how to install either of the operating systems on VirtualBox:
How to install Kali Linux on VirtualBox
How to install ParrotSec OS on VirtualBox
Right after installing either one of them, follow this article and watch the video linked in it. It is essential that you understand what the first steps are after installing a Linux Security Distribution.
Get familiar with your distro. Start using the terminal. From now on, you will use your Linux VM for all the following steps. Learn how to connect to a server via SSH using the terminal.
8 – Over The Wire
Overthewire is the place where you will practice and ramp up your basic Linux skills using your Linux VM for the first time. Overthewire.org is a great place to start your journey into Cyber Security because you need the commands used there on a daily basis.
You start here. You start with Bandit Level 0 and you will work your way all the way through until you reach Level 34. I highly recommend you don’t look up the straight solutions. Use your Google-Fu and start researching.
An example search would be: “How to find files on Linux”, or, “How to find certain lines of text on Linux”.
If you really get stuck and your brain is fried, in case you REALLY get stuck, I covered Level 0 – 15 on ceos3c with hidden spoilers. There are other websites out there that cover the whole thing. But again, I encourage you to try it on your own first!
Once you finish Bandit, you can go ahead and continue with the other challenges, they are all great. Just see how far you come.
9 – Your own Laboratory
While it’s not necessary anymore nowadays, thanks to sites like Hackthebox and a ton of Hackme sites out there, I still recommend running at least a small Homelab. You can run it locally on your computer using only VirtualBox if your computer has the capacity.
The advantage is that you can download vulnerable VM’s and run them inside of your own local network, using your Kali or Parrot to penetrate them.
Two great vulnerable VM’s (Vulnerable Virtual Machines) to start with are:
Metasploitable2
Damn Vulnerable Web Applications (DVWA)
I created a separate tutorial solely dedicated to creating your own free homelab. You find it here.
I do this all the time. Which brings us to the next point: CTF’s.
The Best Wireless Network Adapter for WiFi Hacking in 2019
10 – Capture the Flags or short: CTF’s
Capture the Flag is an essential part of learning Cyber Security, at least for me. There is no better way to practice your skills than with a CTF or a Vulnerable Machine.
What are CTF’s?
If you have been playing computer games, you probably came across this phrase before. There are two teams competing against each other, both of them trying to capture a flag and bringing it back to the safety of their own base.
CTF’s in hacking are essentially the same. There are people who create a Virtual Machine that you can download to your own computer. This Virtual Machine is vulnerable by design, meaning, the creator placed certain vulnerabilities in it on purpose.
Flags are usually placed on some locations on the system as flag.txt. It is your job to find them. This mostly requires you to gain elevated privileges on the machine to be able to get access to the flag.
This is so much fun once you get the hang of it that you might really start enjoying it. There are even competitions with huge price money and spectators in CTF’s, where the best Hacking Teams compete with each other.
Most of the Vulnerable Machines are categorized as Easy, Intermediate or Hard.
The ones categorized as easy mostly have well-known vulnerabilities, where intermediate ones force you to think out of the box and hard ones mostly have really exotic vulnerabilities that can only be found by experts.
Now if this is confusing for you and you have no clue where to start, start with this:
Basic Pentesting 1
Basic Pentesting 2
Those are awesome an well known vulnerable machines with easy to solve vulnerabilities. That being said, learn how to import an appliance to VirtualBox first.
The same that goes for OverTheWire also goes for CTF’s. Try yourself the best you can before looking up any solution.
However, if you do get stuck, I have a Basic Pensting 1 Walkthrough and a Basic Pentesting 2 Walkthrough, again with hidden spoilers.
There is another thing that is very similar to CTF’s, those are called “Boot to Root“. It’s basically the same, the only difference is that you are not looking for a flag but your only goal is to get root privileges on the machine. They are fun too!
I recommend permanently working on a CTF. You got an hour of free time and don’t know what to do? CTF. Commuting to College or Work? CTF. Girlfriend telling you to do laundry? Do the damn laundry but while the washing machine is running: CTF!
You get the idea.
Great CTF resources I personally use all the time:
Vulnhub
Hackthebox
Plenty more
There are so many resources out there that you will never run out of work.
11 – Essential Tools
You will learn a ton of skills just doing CTF’s. Below is a list of tools that I think are important to know when using a Security Distribution and which tools I use regularly, sorted by category. I recommend just going through each tool and learn it’s purpose. If I have a tutorial on a certain tool, you will find the link to it in there. This is going to be long’ish list. You can also check out a list of the most popular Hacking Tools as of 2021, right here.
Frameworks
Metasploit – Huge Penetration testing Framework. Essential for pentesting.
The Complete Metasploit Beginner Guide
More Metasploit Tutorials on Ceos3c
Metasploit Video Tutorials on YouTube
AutoSploit – Automated Mass Exploiter.
Network Vulnerability Scanner
OpenVAS – Open Source Vulnerability Scanner. Highly recommended to check it out.
OpenVAS Tutorials on Ceos3c
OpenVAS Tutorials on YouTube
Web Vulnerability Scanner
Nikto – Noisy Web Application Vulnerability Scanner.
WPScan – WordPress Vulnerability Scanner.
Tutorials
Network Tools
Sparta – Network Infrastructure Scanning & Enumeration Tools with Graphical GUI.
Printer Exploit Toolkit (PRET) – Toolkit for Printer Security Testing.
Routersploit – Very useful Open Source Exploitation Framework similar to Metasploit but for Routers / Embedded Devices.
THC Hydra – Popular Online Password Cracking Tool. Supports a lot of different protocols like HTTP, SMB, FTP and many more.
Network Reconnaissance Tools
Nmap – The most popular Network Scanner.
Part 1: Nmap BasicsPart 2: Nmap Host Discovery
Part 3: Advanced Nmap Commands
Part 4: Nmap NSE Scripts
Part 5: Nmap on Windows 10
Zenmap – Nmap with GUI.
DNSMap – A passive DNS Network Mapper.
Linux Tools
Unix-Privesc-Check – Checks for privilege escalation possibilities on UNIX. Very useful.
OSINT Tools
Maltego – Open Source Intelligence & Forensics.
Shodan – Search Engine for IOT devices.
Tutorial
Recon-NG – Web Reconnaissance Framework.
Tools to stay Anonymous
Tor – The Onion Network.
VPN – Always use a VPN.
Tutorial
Protocol Analyzer & Sniffer
Wireshark – Popular Network Protocol Analyzer.
Tutorial
Wireless Network Tools
Aircrack-ng – Popular Wireless Auditing Tool.
Reaver – Brute Forcing Tool for WiFi Networks.
Wifite – Automated Wireless Attacks.
Fluxion – Automated Wireless Auditing Tool.
Airgeddon – Automated Wireless Auditing Tool.
Bully – WPS Brute Force Attacks.
Web Exploitation
OWASP ZAP – HTTP Interception Proxy & Fuzzer for Web Application Testing.
Burp Suite – Web Application Security Testing Platform.
How to hack web login passwords with Burp Suite
Burp Suite Starter Guide
BeEF – Web Browser Exploitation.
Hash Cracking
John the Ripper – A fast password cracker.
Hashcat – Fast Hash Cracking Tool.
CeWL – Wordlist Generator.
This should keep you busy for a good while.
Book Recommendations
For the best Cyber Security Books, I recommend you check out my Best Hacking Books in 2021 Article. I put together a detailed list on which books I recommend sorted by difficulty level.
You can also just check out my Amazon Affiliate Store, here you will find all books that I have personally read and recommend.
This should set you up for more than enough hours to learn, read and practice.
Conclusion
This is the initial article that I am writing right now. As I mentioned somewhere in the introduction above, this article will get updated on the regular and new content will be added as I craft new tutorials on video & in written form.
This getting started in Cyber Security article should give you a good idea of where to start and which direction you should (or can) go.
It’s really not easy to get started in Cyber Security if you don’t have any prior knowledge in the field, but it is possible. I don’t want to discourage you in any way, but this journey is a tough one and you really have to enjoy doing it, otherwise, there is almost no way to succeed.
I want to encourage you again to subscribe to my YouTube Channel and please whitelist me on your Adblocker or on UBlock Origin, as this is my online income stream, I have to be able to rely on it.
I also highly appreciated everyone supporting me over at Patreon of flipping a coin my direction via Paypal. Donation pitch over.
Disclaimer: Links marked with a * are affiliate links and help me out with a small commission with zero extra cost on your end. Please hit those links if you order something, it would be greatly appreciated and helps me keep the servers paid!