Cybersecurity Tutorial: Learn Security from Scratch (2026)
After a decade in incident response, I have learned that security is not a product — it is a practice. The most expensive breaches I have investigated started not with zero-day exploits, but with unpatched servers, weak credentials, and misconfigured S3 buckets. This tutorial focuses on the fundamentals that actually matter.
You will learn to think like an attacker, understand the cryptographic primitives that underpin modern defense, and build a threat model for your own systems. The goal is not to eliminate all risk — that is impossible — but to make your cost of compromise higher than your neighbor's.
The Threat Modeling Mindset
Threat modeling is asking 'what could go wrong?' before it does. The STRIDE framework (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) gives a structured way to enumerate threats per component. For each asset, you identify threats, rank them by likelihood and impact, and decide on mitigations.
A practical approach: draw a data-flow diagram of your system, mark trust boundaries, and ask what an attacker could do at each boundary. The most common failure is forgetting that internal actors can be adversaries too — insider threats account for a significant percentage of real breaches.
threats = [
{'component': 'Login form', 'threat': 'Brute force', 'sev': 'High', 'mitigation': 'Rate limiting + MFA'},
{'component': 'Database', 'threat': 'SQL injection', 'sev': 'Critical', 'mitigation': 'Parameterized queries'},
{'component': 'S3 bucket', 'threat': 'Public read', 'sev': 'High', 'mitigation': 'Bucket policy + ACL audit'},
{'component': 'API keys', 'threat': 'Leak in logs', 'sev': 'Medium', 'mitigation': 'Secrets scanner in CI/CD'},
]Symmetric and Asymmetric Cryptography in Practice
Symmetric encryption (AES-256-GCM) is fast and suitable for data at rest. The same key encrypts and decrypts, so key management is the hard part. Asymmetric encryption (RSA-4096 or ECDH) solves key distribution but is orders of magnitude slower. Real systems use hybrid encryption: asymmetric key exchange to establish a shared secret, then symmetric encryption for the actual data.
Never roll your own crypto. Use well-vetted libraries like libsodium or the built-in crypto modules in your language. The mistakes are subtle: using ECB mode (leaks patterns), nonce reuse in GCM (total cipher compromise), or failing to authenticate ciphertexts (padding oracle attacks).
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os
key = AESGCM.generate_key(bit_length=256)
aesgcm = AESGCM(key)
nonce = os.urandom(12)
def encrypt_data(plaintext: bytes, aad: bytes = b'') -> bytes:
return aesgcm.encrypt(nonce, plaintext, aad)
def decrypt_data(ciphertext: bytes, aad: bytes = b'') -> bytes:
return aesgcm.decrypt(nonce, ciphertext, aad)Web Application Defense in Depth
A single security control will fail eventually. Defense in depth layers multiple independent controls so that a failure in one does not expose the system. For a web app, the layers include: WAF at the perimeter, input validation at the controller, parameterized queries at the data layer, CSP headers in responses, and runtime application self-protection (RASP) for advanced threats.
The OWASP Top 10 is your minimum checklist. Injection, broken authentication, and XSS still dominate the list year after year. A Content Security Policy alone blocks most XSS payloads even if an attacker finds a script injection point.
from flask import Flask, Response
from flask_limiter import Limiter
app = Flask(__name__)
Limiter(app, key_func=lambda: request.remote_addr)
def add_security_headers(response: Response):
response.headers['Content-Security-Policy'] = "default-src 'self'"
response.headers['X-Content-Type-Options'] = 'nosniff'
response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
return response
app.after_request(add_security_headers)Network Segmentation and Zero Trust
The old model — hard perimeter, soft interior — is dead. Once an attacker breaches one machine, lateral movement within a flat network is trivial. Zero Trust says: verify every request as though it originates from an open network. No implicit trust based on network location.
Microsegmentation is the technical implementation: each workload has firewall rules allowing only the specific ports and protocols it needs. Kubernetes NetworkPolicies, AWS Security Groups (applied per-ENI), and host-based firewalls all enable this. Combine with mutual TLS (mTLS) for service-to-service authentication.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-allow-internal
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080Incident Response Lifecycle
When a breach happens, panic is your enemy. The SANS PICERL model (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) gives a playbook. Preparation: have an on-call rotation, a communication plan, and a documented runbook. Identification: use SIEM alerts, endpoint detection (EDR), and user reports to detect the breach early — the average dwell time is still over 200 days.
Containment is the priority. Disconnect affected systems, revoke compromised credentials, and block C2 domains. Then eradicate the root cause (patch, rebuild), recover from clean backups, and conduct a postmortem.
incident_steps = [
'1. IDENTIFY: Alert triggered by SIEM rule 42',
'2. CONTAIN: Revoke IAM keys, isolate EC2 instance',
'3. ERADICATE: Take forensic snapshot, terminate instance',
'4. RECOVER: Deploy fresh AMI, restore from last clean backup',
'5. LEARN: Root cause was unpatched Log4j - add CVE scan to CI/CD'
]Supply Chain Security and SBOMs
Modern applications pull in hundreds of dependencies. Any one of them can be compromised — as with the SolarWinds and log4j incidents. A Software Bill of Materials (SBOM) is a machine-readable inventory of every component in your application. Tools like Syft generate SBOMs from container images, and Grype scans them for known vulnerabilities.
Pin your dependency versions, use lockfiles, and run automated dependency audits in CI. Consider a private package registry to vet packages before they reach your developers.
# Generate SBOM and scan for vulnerabilities
# syft alpine:latest -o json > sbom.json
# grype sbom.spdx.json --fail-on highFrequently Asked Questions
What is the most common way attackers breach a system?
Phishing remains the number one vector — a convincing email tricks someone into entering credentials on a fake page. Second is unpatched software (especially public-facing VPNs and web servers). Both are preventable with MFA and a patch management policy.
Do I need a SIEM for a small company?
Not necessarily. For a small team, centralized logging with alert rules in a cloud-native tool is sufficient. SIEMs add value at scale (1000+ hosts) where correlation across sources becomes manual otherwise.
How often should I run penetration tests?
Pen tests are point-in-time snapshots. Run a full external test annually and after every major infrastructure change. Combine with continuous vulnerability scanning (weekly) and bug bounty programs for ongoing coverage.
Is antivirus software still relevant?
Traditional signature-based AV catches commodity malware but misses most targeted attacks. Modern endpoint detection and response (EDR) uses behavioral analysis and machine learning to detect novel threats. Replace legacy AV with an EDR agent.
Originally published on Ayodhyyya. Last updated June 1, 2026.