NEXELENCE

Learning

Cyber Security: Background, Full Roadmap, Syllabus and Future

What cyber security is, how it developed, and a complete eight-stage roadmap with syllabus covering networks, cryptography, web application security, security operations and cloud, plus laws, certifications, projects and outlook.

24 Oct 2026 · 11 min read

Cyber security protects systems, networks and data from attack, misuse and failure. As more of daily life and business moves online, security stops being a specialist concern and becomes everyone's responsibility. It is also a career field with real hands-on depth, from defending networks to testing applications and managing risk. This guide explains how the field developed, the core concepts, a stage-by-stage roadmap with syllabus, the laws and ethics you must respect, and an honest outlook. Sources are linked at the end, and anything that is our own estimate or opinion is labelled.

What is cyber security?

At its core, security aims to protect three properties of information, often called the CIA triad: confidentiality (only authorised people can see it; NIST's definition speaks of preserving authorised restrictions on information access and disclosure), integrity (it is accurate and unaltered) and availability (it can be used when needed).

A few ideas shape how professionals think:

  • Defence in depth: several layers of protection, so that one failure does not mean total compromise.
  • Least privilege: give people and systems only the access they need.
  • Zero trust: NIST's SP 800-207 describes zero trust as an evolving set of paradigms that moves defence from network perimeters to users, assets and resources, instead of trusting anything just because it is "inside" the network.
  • Risk thinking: you cannot remove all risk, so you identify what matters most, estimate likelihood and impact, and decide what to do.

The NIST Cybersecurity Framework 2.0, released in February 2024, organises security outcomes around six functions: Govern (new in version 2.0), Identify, Protect, Detect, Respond and Recover. It is a useful mental map of the whole field.

A short history

WhenMilestone
1971 to 1972Creeper, an experimental self-moving program, travels across ARPANET computers, and a program called Reaper is created to remove it, often described as the first antivirus.
November 1988The Morris worm spreads across the early internet. It prompts the creation of the CERT Coordination Center at Carnegie Mellon University.
May 2000The ILOVEYOU email worm spreads on 4 May 2000 through attachments sent to address-book contacts, with later estimates putting damage in the billions of US dollars.
June 2000 and October 2000India's Information Technology Act, 2000 is passed (assent on 9 June 2000) and comes into force on 17 October 2000.
January 2004India's national incident response team, CERT-In, becomes operational.
October 2005ISO/IEC 27001, the international information security management standard, is first published, evolving from the British standard BS 7799.
June 2010Stuxnet is discovered, a sophisticated worm that targeted industrial control systems.
May 2017WannaCry ransomware spreads to more than 150 countries using a flaw in Windows file sharing for which Microsoft had released a patch in March 2017.
December 2021The Log4Shell vulnerability (CVE-2021-44228) in the widely used Log4j library triggers urgent patching worldwide, including a US emergency directive.
February 2024NIST releases Cybersecurity Framework 2.0, adding the Govern function.

A pattern runs through this history: many large incidents exploited known weaknesses that had fixes available. Patching, configuration and basic hygiene are not glamorous, but they matter.

Careers: the NICE Framework

The NICE Workforce Framework for Cybersecurity, maintained by NIST and CISA, groups work into five categories: Oversight and Governance, Design and Development, Implementation and Operation, Protection and Defense, and Investigation. Use it to find a direction: for example, a security operations centre (SOC) analyst sits mostly in Protection and Defense, a penetration tester spans testing and investigation, and a risk analyst sits in governance.

The learning roadmap: eight stages

The plan assumes about ten hours a week. The durations are our own planning estimates, not guarantees. For reference, Google's Cybersecurity Certificate on Coursera lists nine courses and says about six months at seven hours a week.

StageFocusEstimated time
0IT fundamentals: computers, networks and Linux6 to 8 weeks
1Security principles, risk and frameworks3 to 4 weeks
2Cryptography and identity and access management4 to 5 weeks
3Network and system security5 to 6 weeks
4Web application security4 to 5 weeks
5Security operations, detection and incident response6 to 8 weeks
6Cloud security, governance and compliance4 to 5 weeks
7Capstone, labs and job preparation4 to 6 weeks

That is roughly eight to twelve months at a steady pace.

Syllabus: what to study at each stage

Stage 0: IT fundamentals

  • How computers work: operating systems, processes, file systems
  • Networking: the OSI and TCP/IP models, IP addressing, DNS, HTTP and HTTPS, ports and protocols, routing and switching basics
  • Linux command line and administration; Windows basics and Active Directory concepts
  • Scripting with Bash or Python for automation
  • Virtual machines and building a safe home lab

Stage 1: Security principles, risk and frameworks

  • The CIA triad, threats, vulnerabilities, risk and controls
  • Defence in depth, least privilege and zero trust
  • The NIST Cybersecurity Framework 2.0 and its six functions
  • Security standards such as ISO/IEC 27001, and policies and procedures
  • MITRE ATT&CK, a knowledge base of adversary behaviour and tactics, which analysts use to describe and detect attacks
  • Security awareness and social engineering, including phishing

Stage 2: Cryptography and identity and access management

  • Symmetric and asymmetric encryption, hashing, digital signatures and certificates
  • TLS and public key infrastructure
  • Authentication, multi-factor authentication, passwords and passkeys
  • Authorisation, role-based access control, single sign-on and identity federation
  • Secrets and key management

Stage 3: Network and system security

  • Firewalls, intrusion detection and prevention, VPNs, segmentation and secure network design
  • Hardening operating systems and servers; patch and configuration management
  • Endpoint protection and mobile device security
  • Vulnerability scanning and management, and prioritising what to fix first
  • Wireless security and common network attacks and defences

Stage 4: Web application security

  • The OWASP Top 10 (2025 edition): broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions
  • Understanding each risk, how it appears in code and how to prevent it
  • Secure development practices, code review and dependency management
  • Testing web applications with proper tools in legal, authorised environments
  • API security basics

Stage 5: Security operations, detection and incident response

  • Logging and monitoring; security information and event management (SIEM) concepts
  • Detection engineering and using ATT&CK to map detections
  • Incident response lifecycle: preparation, detection, containment, eradication, recovery and lessons learned
  • Digital forensics basics and evidence handling
  • Threat intelligence and playbooks
  • Writing clear incident reports

Stage 6: Cloud security, governance and compliance

  • The shared responsibility model and securing identities, storage, networks and workloads in the cloud
  • Governance, risk and compliance (GRC): risk registers, audits, policies and evidence
  • Business continuity and disaster recovery
  • Legal and regulatory landscape, covered in the next section

Stage 7: Capstone, labs and job preparation

  • Build a secured home lab, document what you defended and what you found
  • Complete practical challenges on legal training platforms
  • Write a sample incident report and a short risk assessment
  • Interview preparation: networking questions, scenario-based incident response and communication practice

Law and ethics: know the rules

  • Only test what you are authorised to test. Our guidance: get written permission before testing any system you do not own, stay within the agreed scope, and report what you find responsibly. Unauthorised access is a crime, whatever your intentions.
  • India's Information Technology Act, 2000 covers computer-related offences. Section 66 deals with dishonestly or fraudulently doing the acts listed in Section 43, such as unauthorised access, and carries imprisonment of up to three years, a fine of up to five lakh rupees, or both, as commonly summarised. Read the current text with legal advice for details.
  • CERT-In directions of 28 April 2022 require covered entities to report specified cyber incidents to CERT-In within six hours of noticing them or being notified, and to keep logs of ICT systems for a rolling period of 180 days within Indian jurisdiction.
  • Digital Personal Data Protection Act, 2023: received assent on 11 August 2023, with provisions coming into force in phases from November 2025. It includes duties around reporting personal data breaches. Check the official text for current dates.
  • Professionalism: protect the confidentiality of anything you see during testing, and disclose vulnerabilities through proper channels.

Certifications worth knowing

Certifications are optional but give a structured syllabus. Check each official page for current objectives, since versions change.

  • CompTIA Security+ (SY0-701): five domains, namely general security concepts (12 percent), threats, vulnerabilities and mitigations (22 percent), security architecture (18 percent), security operations (28 percent) and security program management and oversight (20 percent). Up to 90 questions in 90 minutes. CompTIA says a new version is expected around November 2026.
  • ISC2 Certified in Cybersecurity (CC): entry-level, covering security principles, governance, access control concepts, network and cloud security concepts, and security operations and incident response.
  • CISSP: a senior-level certification across eight domains, from security and risk management to software development security. A new exam outline takes effect on 15 April 2027.
  • EC-Council CEH: a 20-module ethical hacking programme, from footprinting and scanning to web application hacking, SQL injection, cloud and cryptography.
  • Google Cybersecurity Certificate: a beginner programme with nine courses covering risk, networks, Linux and SQL, assets and threats, detection and response, Python automation and job preparation.

Free, credible resources and safe labs

Portfolio projects

  • Home lab: build a small network of virtual machines, harden them and document each step and the threats you considered.
  • Log analysis: analyse sample web server logs to find suspicious activity and write up your method.
  • Vulnerability report: scan an intentionally vulnerable practice application in your own lab and write a professional report with severity and fixes.
  • Incident tabletop: write a ransomware response plan for a small business, with roles, steps and communications.
  • Risk assessment: assess a fictional company against the NIST Cybersecurity Framework and produce a prioritised action list.
  • Secure a web app: fix issues from the OWASP Top 10 in a small app you wrote, and show before-and-after tests.

Common mistakes

  • Jumping into hacking tools before understanding networking and operating systems
  • Practising on systems you do not have permission to test
  • Collecting certificates without hands-on practice
  • Ignoring the basics, such as patching, backups, multi-factor authentication and least privilege
  • Treating security as a one-off project instead of an ongoing process
  • Writing reports that no non-technical manager can act on

Careers and outlook

  • United States: the Bureau of Labor Statistics reports a 2025 median pay of $129,180 a year for information security analysts and projects employment to grow 21 percent from 2025 to 2035, with about 192,900 jobs in 2025. These are US figures, not Indian salaries.
  • Workforce gap: the ISC2 2024 Cybersecurity Workforce Study estimated a global workforce of about 5.47 million and a workforce gap of about 4.76 million, up 19.1 percent from 2023, while noting that China and India were excluded for lack of reliable data and that the gap is not an estimate of current job openings.
  • Cost of breaches: IBM's Cost of a Data Breach Report landing page for 2026 reports a global average of 4.99 million US dollars per breach, described as a record high.
  • Global trend: the World Economic Forum's Future of Jobs Report 2025, as reported in coverage of it, lists networks and cybersecurity among the fastest-growing skills. We could not verify specific figures from the report itself.

Pay and demand vary widely by location, employer and experience. No course, including ours, can promise a job or a salary.

Where the field is heading: our view

These are opinions, not forecasts.

  • AI helps both attackers and defenders. Expect more convincing phishing and faster vulnerability discovery on one side, and better detection and triage on the other. Fundamentals and judgement stay critical.
  • Identity is the new perimeter. Strong authentication, least privilege and zero trust thinking keep growing in importance.
  • Supply chain security rises. The inclusion of software supply chain failures in the OWASP Top 10 reflects this.
  • Regulation and reporting duties tighten. Incident reporting windows and data protection laws turn security into a board-level topic.
  • Cloud and automation dominate. Security engineers who can code, automate and work with cloud platforms are in demand.
  • People remain central. Most incidents involve human factors, so awareness, culture and clear communication matter as much as tools.

Start this week

  1. Turn on multi-factor authentication for your email and main accounts, and use a password manager.
  2. Set up a virtual machine with Linux and learn ten basic commands.
  3. Read the NIST Cybersecurity Framework summary and name which of the six functions each of your habits supports.
  4. Try a beginner room on a safe, legal practice platform.
  5. Follow a structured path with labs and feedback so you build skills in the right order.

If you would like guided, project-based learning, see the courses at Nexelence Academy or talk to us about where to begin.

Sources

Keep reading