Chapter 4 of 12 · Ongoing
A first homelab
- What is a homelab and do I need one?
- Do I need expensive hardware?
- What should I actually do in it?
A homelab is a small environment you control, where you can install systems, attack them, defend them and break them without hurting anyone. It is where reading turns into skill, and it gives you something real to talk about in interviews.
Start small
- An old laptop or your current computer running a few virtual machines is enough to begin.
- Free virtualisation software and free operating systems cover most early projects.
- Browser-based labs need no setup at all and are a good first step.
- Cloud free tiers can work, but set billing alerts before you start.
Rule of thumb:Only attack systems you own or have written permission to test. Scanning or attacking someone else’s systems without permission can be a crime, even when you mean no harm.
Projects that teach a lot
- Set up a small network with two or three virtual machines and get them talking.
- Turn on logging and find your own logins in the logs.
- Run a deliberately vulnerable web application and find a flaw in it.
- Collect logs in one place and write a simple alert for a failed-login burst.
- Attack your own setup, then check whether your logs and alert caught it.
Pick projects that match your direction. For a SOC role, spend more time on logs and alerts. For AppSec, more time on vulnerable apps and code. For cloud, a free-tier account with careful permissions.
The question you might not ask out loud
My lab keeps breaking and I spend more time fixing it than learning. Is that normal?
Yes, and it is part of the learning. Fixing a broken setup teaches networking, permissions and troubleshooting, which every security job needs. Note what broke and how you fixed it. That note is portfolio material.
Write it up
For each project, write a short page: what you set out to do, what you built, what went wrong and what you learned. Include screenshots. These write-ups become the portfolio you will use in the next chapter, and they show employers how you think.
Keep your lab separate from anything you rely on. Use a dedicated virtual network, avoid reusing real passwords and take snapshots before big changes so you can roll back. Treat it the way a careful employer would treat a test environment. That habit will matter in your first job, where test and production must never be confused.