Chapter 1 of 12 · Before you start
I don’t know anything
- Everyone else seems to know so much more. Am I too far behind?
- Where do I even start?
- Do I need to be good at maths or coding?
Security is a big field with its own language. When you first look at it, it can seem like everyone else speaks it fluently. They do not. Most people know their own corner well and the rest only roughly. The feeling of being behind is common, including among people who have worked in security for years.
The fix is not to learn everything. It is to learn the foundations in a sensible order, then go deeper in one area.
Foundations, in order
- How computers and operating systems work: files, processes, users and permissions.
- How networks work: addresses, ports, DNS, how a web page loads.
- How the web works: requests, responses, cookies, logins.
- Basic security ideas: confidentiality, integrity, availability, least privilege, authentication.
- How attacks happen in practice: phishing, stolen passwords, unpatched software, misconfiguration.
You do not need to master each before moving to the next. Get a working feel for each, then circle back.
The question you might not ask out loud
Do I need to be good at maths or a strong programmer?
For most entry-level roles, no. Basic scripting helps a lot and is worth learning, because it saves you hours of manual work. Deep maths matters in a few areas, such as cryptography research, but most security jobs never touch it.
Learn by doing
Reading and videos give you words. Practice gives you understanding. After you learn a concept, find a way to see it: look at a real log, inspect a web request in your browser, break something in a safe lab. You will remember what you did far better than what you read.
- Keep a simple notes file of what you learned each week, in your own words.
- When you get stuck, write down the exact question. Precise questions get answers.
- Pick a regular time to study. Short and regular beats long and rare.
Rule of thumb:Compare yourself with where you were a month ago, not with someone online who has worked in security for ten years.
Within a few weeks of steady work, the jargon starts to make sense. That is the moment people often mistake for the start. It is actually the first sign of progress.