Start with the ground rules
Cybersecurity skills are practised on systems you own or have written permission to test. Unauthorised access is an offence under India's Information Technology Act, 2000. Use legal practice platforms and your own home lab, and keep a record of what you are authorised to do.
The six-month plan
| Month | Focus | Output |
|---|---|---|
| 1 | Networking basics (IP, DNS, HTTP, ports), Linux command line, how operating systems work | A notes file and a small home lab on a virtual machine |
| 2 | Security fundamentals: the CIA triad, authentication and access control, basic cryptography, common attack types | A one-page summary of each concept in your own words |
| 3 | Hands-on practice on legal training platforms such as TryHackMe and Hack The Box | Three written walkthroughs of rooms or machines you solved |
| 4 | Tools: Wireshark for traffic, Nmap for scanning in your lab, log reading, the idea of a SIEM | A packet-capture analysis and a log-triage exercise |
| 5 | Choose a track: SOC and blue team, penetration testing, cloud security, or governance and compliance | A short plan for the track you pick |
| 6 | A vendor-neutral certification such as CompTIA Security+, plus a public portfolio | A certification date and a GitHub or blog portfolio |
Free and low-cost resources
- OWASP Top 10: the standard list of web application risks
- MITRE ATT&CK: a knowledge base of attacker tactics and techniques
- CERT-In advisories: India's national agency publishes security advisories worth reading regularly
- Home lab: virtual machines cost nothing and teach more than videos alone
Choosing a track
| Track | Good fit if you enjoy… |
|---|---|
| SOC analyst (blue team) | Investigating alerts and patterns, working in a team |
| Penetration tester | Breaking things methodically and writing clear reports |
| Cloud security | Infrastructure, configuration and automation |
| Governance, risk and compliance | Policy, audits and working with business teams |
Mistakes beginners make
- Collecting certificates before building hands-on skills
- Jumping to advanced hacking without networking basics
- Practising on systems you are not authorised to test
- Never writing anything down — write-ups are your portfolio
Go further: SOC analyst career guide, cloud security courses, zero trust security and cybersecurity pay for freshers.
Planning a cybersecurity career?
Talk to an advisor about cybersecurity programmes for beginners and working professionals.
Frequently Asked Questions
How long does it take to start a cybersecurity career?
With steady practice, many beginners can build entry-level foundations in around six months, but the timeline varies with your background and weekly hours.
Which certification should a beginner take first?
A vendor-neutral foundation such as CompTIA Security+ is a common first choice, after you have built some hands-on skills.
Can I practise hacking legally?
Yes. Use legal training platforms and your own lab. Never test systems without written permission — unauthorised access is an offence.
Do I need a degree in computer science?
Not always. Many entry-level roles value demonstrated skills and certifications, though requirements vary by employer.