Skip to main content

Deep Dive into Cybersecurity: Security+ Level Knowledge Without the Certificate

📚 My Cybersecurity Learning Journey

Key Topics from a 17-Hour Security+ Course

🔹 CIA Triad Explained

Confidentiality: Ensuring that sensitive data is only accessed by authorized users. This is often achieved using encryption and access controls.

Integrity: Ensuring data is accurate and untampered. Techniques like hashing, checksums, and digital signatures help validate that data hasn't been altered.

Availability: Making sure systems and data are accessible when needed. Achieved through backups, redundancy, load balancing, and fault-tolerant design.

🔹 Types of Threats

  • Malware: Includes viruses, ransomware, worms, and trojans that compromise devices or networks.
  • Social Engineering: Manipulating users into giving up confidential info. Example: Phishing emails.
  • Insider Threats: Employees or contractors misusing access, accidentally or intentionally.
  • Advanced Persistent Threats (APTs): Long-term targeted attacks, often by well-funded threat actors.
  • Zero-Day Vulnerabilities: Exploits for unknown software bugs before a fix is available.

🔹 Networking Fundamentals for Security

Studied basic networking concepts: IP addressing (IPv4/IPv6), MAC addresses, ports, and protocols like TCP/UDP. Learned about the OSI model, and how each layer relates to security implementations. Gained insights into VLANs, VPNs, routers, switches, and secure architecture design.

🔹 Security Protocols

  • SSL/TLS: Secures web communication via encryption. TLS is widely used in HTTPS.
  • IPSec: Secures IP traffic, mainly used in VPNs for encrypted tunnels.
  • SSH: Secure Shell protocol for secure remote login and file transfers.
  • SFTP: Secure file transfer protocol using SSH.
  • WPA3: Wi-Fi Protected Access protocol for securing wireless networks.

🔹 Firewalls & Network Security

Understood how stateful firewalls track active connections and how stateless firewalls inspect packets individually. Learned about configuring ACLs, DMZs for isolating public-facing services, and NAT for IP address masking. Also studied IDS/IPS for threat detection and prevention.

🔹 Security Operations Center (SOC)

Learned how a SOC monitors and manages security posture using tools like SIEM (Security Information and Event Management). Understood the use of SOAR for automating incident response, and endpoint security solutions like EDR/XDR for managing threats on devices.

🔹 Threat Hunting & Threat Intelligence

Studied proactive threat hunting strategies — using indicators of compromise (IoCs), behavior analytics, and threat intelligence feeds. Learned how organizations gather and analyze threat data to understand attacker TTPs (Tactics, Techniques, Procedures) and prepare defenses accordingly.

🔹 Host Security

  • Anti-virus and anti-malware solutions
  • Regular patching to fix vulnerabilities
  • Host-based firewalls and secure configurations
  • OS hardening to remove unnecessary services and enforce strict permissions

🔹 Identity and Access Management (IAM)

  • MFA (Multi-Factor Authentication): Adds additional verification steps to improve login security.
  • SSO (Single Sign-On): One login grants access to multiple systems.
  • RBAC: Access based on user roles.
  • ABAC: Access based on attributes like department or or sensitivity of information.
  • LBAC: Access based on location .
  • Emphasized the Principle of Least Privilege and Separation of Duties to reduce risk.

🔹 AAA – Authentication, Authorization, Accounting

  • Authentication: Verifying identity (e.g., username & password, biometrics).
  • Authorization: Granting permissions based on identity (e.g., admin rights).
  • Accounting: Logging actions (e.g., login attempts, file access) for auditing.

🔹 Mobile Device Security

Learned about MDM (Mobile Device Management) tools for enforcing security policies. Topics included encryption, remote wipe, app whitelisting, and handling BYOD (Bring Your Own Device) risks with secure containers and user awareness.

🔹 Incident Response & Digital Forensics

Studied the full Incident Response (IR) lifecycle: Preparation → Detection → Containment → Eradication → Recovery. Learned forensic steps for evidence preservation: identification, collection, analysis, and documentation. Understood the importance of maintaining chain of custody for legal admissibility.

🔹 Cryptography

  • Symmetric Encryption (AES): Uses one shared key for encryption and decryption. Fast and efficient for large data.
  • Asymmetric Encryption (RSA): Uses public and private key pairs. Suitable for secure key exchange and digital signatures.
  • Hashing Algorithms (SHA-2, MD5): Provide data integrity by creating fixed-length representations.
  • Digital Signatures: Ensure data authenticity and integrity. Common in secure emails and documents.
  • PKI (Public Key Infrastructure): Framework for managing digital certificates and public keys.
  • TLS/SSL Handshake: A multi-step negotiation process to establish secure communication between a client and server using certificates and encryption keys.

🔚 Final Thoughts: Was It Worth It?

After completing the full CompTIA Security+ course on LinkedIn Learning (37 hours), I can confidently say it was absolutely worth it for anyone looking to build a solid foundation in cybersecurity.

The course covers a wide spectrum of essential topics—from understanding basic networking and threats to learning real-world concepts like incident response, cryptography, and security operations.

Even though it doesn’t offer a certification like the official CompTIA Security+ exam, the knowledge and clarity I gained were invaluable. The content was well-structured, beginner-friendly, and practical enough to help me grasp the real-world applications of cybersecurity concepts.

If you're someone looking to start your journey in cybersecurity, I highly recommend this course. It's an excellent way to get exposure to key domains and terminology used in the industry—before diving into more advanced certifications or practical labs.

Bottom Line: Great investment of time for beginners. Solid theoretical grounding, clear explanations

Labels:

Comments

Post a Comment

Please do not enter any spam link here.

Popular posts from this blog

How to Pass CompTIA Security+ SY0-701 in 2 Months (839 Score Breakdown + Resources)

How I Scored 839/900 on CompTIA Security+ SY0-701 — 2-Month Prep Strategy That Actually Worked Score: 839/900  |  Exam: CompTIA Security+ SY0-701  |  Prep Time: 2 Months  |  Total Questions: 76 (including 3 PBQs) I'm not going to sugarcoat it — CompTIA Security+ is not easy, but it is very passable with the right strategy. I cleared it with an 839 out of 900, and in this post I'll share exactly how I did it, domain by domain, so you can replicate the approach without wasting time. My 2-Month Study Plan Month 1 — Domain-by-domain study: Read, take notes, and build comparison tables and mnemonics for tricky concepts. Month 2 — Heavy practice testing: Full focus on practice tests and PBQ simulations. Time management drills every session. The biggest mistake people make is spending 90% of their time reading and only 10% practicing. I flipped that in month 2 — and it made all the difference. Domain 1 — General Security Concepts What to focu...
Post a Comment
Read more

Splunk in Plain English — A Practical SOC Guide

Imagine you are a detective, and every device on your network — servers, laptops, firewalls, cloud systems — is leaving footprints everywhere. The problem is there are millions of footprints every single day, scattered across thousands of different files. Your job is to find the one set of footprints that does not belong. That is exactly the problem Splunk solves. It is the platform that collects every footprint from every device, puts them in one place, and gives you the tools to find the suspicious ones — fast. In this blog, I will take you through Splunk from absolute scratch — what it is, how it works under the hood, how to write SPL queries like a pro, how to build dashboards and alerts, how to set up a SOC lab, and most importantly, the interview questions you will definitely face if you are going for a SOC analyst role. I have completed the TryHackMe Advanced Splunk rooms including SPL exploration, SOC lab setup, dashboards and reports, data manipula...
Post a Comment
Read more

Every SOC Analyst Must Know These Windows Event IDs — Here's Why

Imagine you are the security guard of a massive office building. Every time someone enters, leaves, opens a cabinet, or tries to break in — it gets recorded in a logbook. Now imagine if that logbook could automatically tell you when something suspicious happened. That is exactly what Windows Event Logs are — the logbook of your Windows system, and for a SOC analyst, it is the single most important source of truth. In this blog, we will break down Windows Event Logs from scratch — what they are, how to read them, how to query them like a pro using PowerShell, and most importantly, which Event IDs you must memorize for your SOC analyst interview. Let's dive in. 1. What Are Windows Event Logs? Windows Event Logs are records that Windows automatically creates whenever something significant happens on the system — a user logs in, a service crashes, a file is accessed, an audit policy changes, a script runs. Think...
Post a Comment
Read more

Beware of Instagram Shopping Scams: Tips to Stay Safe

Beware of Instagram Shopping Scams: Tips to Stay Safe In recent years, Instagram has evolved into a popular marketplace, allowing users to discover and purchase products directly through the platform. While this has made shopping more convenient, it has also opened the door to a rise in scams and fraudulent activities. Here’s what you need to know about Instagram shopping scams and how to protect yourself. What Are Instagram Shopping Scams? Instagram shopping scams typically involve fake accounts or websites that mimic legitimate brands. Scammers often create attractive posts featuring trendy products at unbeatable prices, luring unsuspecting shoppers into making purchases. Once you’ve placed an order, you might receive subpar merchandise, or worse, nothing at all. I'm receiving a lot of calls nowadays about scams, and people are asking how they can get a refund and whether there is any chance of getting their money back. Common Types of Scams are Fake Accounts, Phishing Links and ...
Post a Comment
Read more

Customer Care number frauds : Be careful regarding your google search

Awareness is necessity ALERT !! "Careful during searching on google for customer care number regarding online shopping, bank loan or online job search." The number you find on Google need not be real all the time. It can be a fake number. When you are looking for a customer care number, go to that particular site and search for their help centre section or contact us section. Don't search for such help centre numbers on other sites, as it can be fake. Here, I am sharing the latest case study of September 2020 regarding customer care fraud !! A person from Gujarat wanted to buy a mobile and he searched on an online website. Now he wanted to buy a mobile on the EMI installment, but he didn't know what was the procedure for EMI installment. He randomly searched on google for the customer care number of that online website and found a mobile number from some random website. He called that number, and the person on the other s...
Post a Comment
Read more