Security Study Plan

A Comprehensive Guide to Cybersecurity Career Paths

Master cybersecurity skills across 25 specialized domains including Cloud Security, Application
Security, DevSecOps, Penetration Testing, and more with structured learning paths and curated
resources.

Author

Sanjeev Jaiswal
Edition: December 2025
Table of Contents

Chapter 1: Common Security Skills

Chapter 2: AWS Security
Chapter 3: GCP Security
Chapter 4: Web Penetration Testing
Chapter 5: Application Security
Chapter 6: API Security
Chapter 7: Threat Modeling
Chapter 8: GRC (Governance, Risk & Compliance)
Chapter 9: Azure Security
Chapter 10: DevSecOps
Chapter 11: Docker Security
Chapter 12: Kubernetes Security
Chapter 13: Network Security
Chapter 14: Cryptography
Chapter 15: Software Supply Chain Security
Chapter 16: Secure Code Review
Chapter 17: Secure SDLC
Chapter 18: Security Architecture
Chapter 19: GenAI Security
Chapter 20: Product Security
Chapter 21: IAM Security
Chapter 22: Blue Team, Detection & Response
Chapter 23: Mobile Application Security
Chapter 24: Reverse Engineering & Malware Analysis
Chapter 25: OSINT & Social Engineering
 Chapter 1

Common Security Skills

Whichever domain you choose in the Cybersecurity umbrella like Application Security, Cloud
Security, or DevSecOPs; there are common skills that one must learn to excel in this domain. I
have explained what you need to learn in those common skills here

So, I will explain where to study and how much time you should devote to learning those concepts
in these common skills so that you are job-ready and interview-ready too!

These 5 common skills are:

ToC
1. Linux Basics - 1-2 weeks
2. Networking Fundamentals - 2-4 weeks
3. Programming Fundamentals - 4-8 weeks
4. Cloud Computing Fundamentals - 3-4 weeks
5. Essential git commands - 1 week
6. Networking matters

Linux Basics and Linux Commands

Duration: 1-2 weeks

It should not take more than a week to be comfortable with basic Linux commands to do
day-to-day activities. Once you are comfortable with basic commands, go for networking and
other security-related command in little depth.

Week 1: Basic Commands

Bug bounty hunters, Penetration testers, and almost all tech-focused security professionals use
O.S. like Kali Linux, Parrot OS, or BlackArch Linux which have lots of security tools to play with.
But for that, you would need to know the basic workings of Linux and commands.

Some common (50) commands, I can think of are in alphabetical order: 1. awk, cat, cd,
chmod, chown, cp, curl, dig, du, df 2. echo, export, find, grep, head, history, host, ifconfig, kill, less
3. locate, ls, man, mkdir, more, mount, mv, nslookup, ping, ps 4. pwd, rm and rmdir, scp, sed,
service/systemctl, sort, ssh, sudo, tail, tar 5. top, touch, uname, uniq, wget, whois, whatis, w, wc,
zip
Week 2: Security Focused Commands
Beyond basics commands for security professionals (mainly AppSec and Pentesters) are:
1. netcat, nslookup, host, dig, netstat, traceroute 2. nmap, nikto, fierce, dirb 3.
install/uninstall/update/upgrade 4. find, grep, ifconfig 5. learn the basics of regular expression as
well. 6. start and stop services 7. basic understanding of /opt /tmp and log server locations 8.
comfortable running scripts written in various languages like Python, ruby, go, etc.

Resources
Books 1. Linux Basics for Hackers: Recommended 2. The Linux Command Line 3. How Linux
works

Courses 1. Introduction to Linux Commands and Scripting 2. Linux Fundamentals for Security
Practitioners: Recommended

Videos 1. Linux for Ethical Hackers: Recommended 2. Hacking for beginners: Linux and
Common Commands 3. 50 most popular Linux and Terminal Commands

Networking Fundamentals
Duration: 2-4 weeks

Except for the Audit and Compliance role, I assume almost every security professional needs to
have a basic to intermediate understanding of Computer Networks to excel in its domain.

Week 3-4: Core Concepts

I will brief the common concepts here anyway just for quick reference: 1. IPv4/IPv6, concept
of CIDR, IP addressing and subnetting 2. Public vs Private IPs, TCP/IP Model 3. DMZs, Zero
Trust Networks 4. Common ports and protocols like 22, 25, ssh, https and so on. 5.
Understanding of common cryptographic modules and functions 6. How DNS works, How SSL
works

Week 5-6: Network Security

1. What are the common network threats around these
2. MiTM, Network sniffing
3. Various TCP attacks
4. DoS and DDoS attacks and its preventions
5. Common ideas on firewall or Software-defined networks
6. Basic network troubleshooting like why the internet is slow or down, why wi-fi is not
working, open network issues et al.

Resources
Books 1. See if you know basics as mentioned in this presentation 2. Computer Networking: A
Top-Down Approach by Kurose and Ross: Recommended 3. Networking All-in-One For Dummies

Videos 1. Basics of Computer Networking 2. Computer Networking Full Course: Recommended

Courses 1. Computer Networking by georgia Tech on Udacity: Recommended 2. Bits and Bytes
of Computer Networking by Google on Coursera

Programming Skills
Duration: 4-8 weeks

Recently, it has become a mandatory skill for any tech security job role to have a decent
knowledge of at least one programming language. Common Programming languages that attract
security folks are: Python (recommended), Go (gaining popularity), Ruby.

Week 7-10: Basics & Projects

What you should try when you are learning any of these programming languages: 1. Learn
basic concepts 2. Try a few basic projects like 1. connecting to DB and get some data 2.
extracting data from a webpage 3. display some info from the cloud like AWS Instance details
region-wise 4. automate few security stuff like docker monitor, get public IPs, server details, etc 5.
See if you can find any task related to CSV, JSON 6. Learn the use of crypto modules 7. simulate
a few Linux or other commands to be comfortable with the language like a small nmap simulation

Week 11-14: Security Focus

1. Understand the OOP concept and at least you should understand others' code comfortably
2. Try to review the source code from a security perspective
3. Read Python Security Best Practices

Resources
Books 1. Learn Python 3 the Hard Way - Recommended 2. Violent Python 3. Black Hat Python -
Must Read 4. Full Stack Python Security - Must for AppSec Professionals 5. Masterting Python for
Networking and Security

Videos 1. Python Security Best Practices 2. Security Checks for Python Code 3. Intro to Python
for Security Professionals

Courses 1. Python for Cybersecurity Specialization 2. SEC573: Automating Information Security

with Python 3. Python for Pentesters

Cloud Computing
Duration: 3-4 weeks
Cloud Computing is everywhere these days be it Industrial, Pharma, Finance, IT etc. Sooner or
later, it will be a mandatory skills to have for any cybersecurity job roles.

Week 15-18: Cloud Fundamentals

Learn any of the famous CSPs like AWS, Azure or GCP and 1. try to understand the use of it to
solve various traditional challenges and 2. then try to understand what are the new security
challenges added because of Cloud concepts. 3. Understand various service and deployment
models 4. Shared Security Responsibility 5. Microservices 6. IAM functionalities (Must understand
very well) 7. Data Encryption 8. Cloud Networking concept is very important to succeed in Cloud
Security

For a deeper focus on identity and access, see the Identity and Access Management (IAM)
Security Study Plan.

There are separate plans for Cloud Security Study Plan as listed below: 1. AWS Security Study
Plan 2. Azure Security Study Plan 3. GCP Security Study Plan

Resources
Books 1. Cloud Computing for Dummies 2. AWS in Action

Videos 1. Cloud Computing Playlist by Fkexmind 2. What is Cloud Computing by AWS 3. Inside a
Cloud Data Center

Courses 1. Introduction to Cloud Computing by IBM on Coursera 2. Micro Masters Program in

Cloud Computing

git commands
Duration: 1 week

You must understand any of the Version Control Software and git is one of the famous one at
present. Don't go for gui version like sourcetree rather try to learn and understand common git
commands at terminal level.

Week 19: Git Basics

Most basic git commands to understand are: 1. git clone, git add, git commit, git branch, git
pull 2. git fetch, git merge, git push, git config, git log

There are many job roles/titles which make it as a mandatory skill, such as: Application Security,
Penetration tester, DevSecOps, API Security, Security Engineering.

Resources
Books 1. Pro Git by Appress - Highly recommended 2. Beginning git and github by Apress 3.
github cheatsheet
Videos 1. git and github for beginners - crash course by freecodecamp 2. git fundamentals for
beginners - full course for free by Flexmind

Courses 1. Git Fundamentals for everyone on Udemy 2. Version Control with Git by Atlassian on
Coursera 3. Learn git and github by codecademy

Networking matters
Once you are on track and now understands the heat, it's time to: 1. Make some good LinkedIn
contacts from the application security domain. 2. Find a mentor or follow someone who shares
blogs, tutorials, talks on these topics. 3. Make connections through various security conference
online/offline 4. Publish some good appsec articles, may be basic concepts, but you must publish.
Choose [Link] or something of your choice. 5. Join webinars, conferences, newsletters. 6.
Help someone who is still a beginner or struggling to understand appsec concepts. You will even
learn better while guiding/helping others.

By the time you cover all these checklists, you will be already on a way to have a good start in a
web security job role. All the best!
 Chapter 2

AWS Security

I am making the study plan irrespective of job role under AWS Security category. It can be AWS
Security Analyst, AWS Security Researcher or AWS Security Engineer or Cloud Security
Operations Expert or Cloud Security Manager.

So, check how much you can cover and close the checkbox. The more you close, the better
candidate you are for the job role. Also, I assume you have already checked and comfortable with
Common Security Skills study plan.

ToC
1. AWS Fundamentals - 2-3 weeks
2. AWS Native Security core skills - 4-6 weeks
3. AWS Security Whitepapers - 2 weeks
4. Check your AWS Pentesting Skills - 2-3 weeks
5. Check your Knowledge against common security benchmark and frameworks
6. AWS Security Videos and Courses
7. AWS Security Interview Questions
8. People to follow on twitter

AWS Fundamentals
Duration: 2-3 weeks

I am listing only the topic name. How much you learn and comfortable with the concept or topic is
upon you. And I will share the minimal link to make you up to the mark and you are free to learn
anything more than this for better candidacy and experience.

Week 1: IAM Deep Dive

One of the most important and must have skills for you. Try to understand IAM functionalities as
much as possible. 1. Understand IAM policy in 60 minutes: Youtube 2. Understand IAM
permissions 3. Business Use Cases for IAM 4. Security in IAM and STS 5. IAM Access Analyzer
6. User, Group, Roles and when to use when and don't forget to ask why this, why not that 7.
Custom policy vs AWS Managed Policy 8. Cross-Account IAM policy to different roles, services,
account 9. Understand the IAM policy from security mindset. Why this, why not this? 10. Service
Control Policy 11. Security Best Practices in IAM
Week 2-3: Core Services
For any AWS Service(s), please follow this strategy: 1. What does this service does & what
problem it would solve for business 2. Security Best Practices guide for AWS service. Ex: S3
security best practices, VPC security best practices. 3. What permissions you should provide for
each role to maintain the least privilege principle. 4. How it is being used, can there be some
security misconfiguration if not configured properly. 5. Is multi-tier, multi region required for this
service 6. How data at rest and data in transit can be achieved. 7. Is logging required? If so, how
are you going to log and what data and till what period 8. Are we monitoring it? what's the reason
for Yes or No 9. Any specific security settings for that service like Bucket Policy for S3 bucket

Key Services to Cover: 1. Amazon S3 2. KMS 3. VPC 4. Lambda 5. AWS EKS and ECS 6.
AMAZON RDS

AWS Native Security core skills

Duration: 4-6 weeks

What I mean to say here is: 1. AWS core services related security skills 2. AWS Security services
hands-on knowledge

Week 4-6: Core Services Security

These are the core services: 1. IAM, super important 2. EC2 3. S3 4. VPC, I feel it as the
toughest one so far 5. RDS 6. API Gateway 7. Lambda 8. ECS and EKS

Week 7-9: Security Services Hands-on

Below are AWS Core Security services that you should know and try hands-on as much as
possible: 1. IAM Access Analyzer 2. S3 Bucket Policy 3. Security Group and NACL 4. CloudTrail
5. Config 6. GuardDuty 7. Inspector 8. Macie 9. Security Hub 10. WAF and Shield (Optional, but if
your job needs it; learn it) 11. AWS KMS 12. Secrets Manager 13. Cognito

AWS Security Whitepapers

Duration: 2 weeks

AWS has awesome lists of whitepapers related to AWS Security. We are adding few important
one here. You can anytime check more for updated or new security whitepapers here

Week 10-11: Reading & Analysis

1. AWS Overview - One of the important whitepaper to understand an overview of AWS
2. Introduction to AWS Security Whitepaper
3. AWS Well-Architected Security Pillar
 4. Introduction to Security By Design
5. AWS Well Architected Framework
6. AWS Risk And Compliance Whitepaper
7. AWS Security Checklist
8. AWS HIPAA Compliance Whitepaper
9. AWS Cloud Adoption Framework
10. AWS Auditing Security Checklist
11. AWS CIS Foundation benchmark
12. AWS Security Incident Response
13. Overview of AWS Lambda Security
14. AWS KMS Best Practices
15. Encrypting File Data with Amazon Elastic File System
16. Security of AWS CloudHSM backups
17. Security overview of AWS Lambda
18. NIST Cybersecurity Framework in the AWS cloud
19. NIST 800-144 Security and Privacy in Public Cloud Computing
20. Security at the Edge: Core Principles
21. AWS KMS Best Practices
22. Security Overview of AWS Fargate

Check your AWS Pentesting Skills

Duration: 2-3 weeks

Week 12-14: Practical Labs

1. Did you use pacu? if not, start using it
2. Try out the scenarios in Cloud Goat
3. Try AWS CTF from [Link]. Here is solution on YouTube as well
4. Next level is at [Link]
5. Try Well Architected Framework: Security Labs
6. AWS Security Workshops
7. Check other good tools like Prowler and ScoutSuite as well.

Check your Knowledge against common security

benchmark and frameworks.
1. AWS CIS Benchmark
2. CSA Cloud Matrix and STAR Framework
 3. NIST CSF for AWS
4. ISO 27017

AWS Security Videos and Courses

Check Awesome AWS Security repo for more details on book, videos, courses etc.

AWS Security Interview Questions

I have a separate repo for skills roadmap and interview questions. I will keep it updated time to
time. You can star it or fork it.

People to follow on twitter

1. Abhay Bhargav
2. Scott Piper
3. Anant Srivastava
4. Aakash Mahajan
5. Sanjeev Jaiswal
 Chapter 3

GCP Security

I am making the study plan irrespective of job role under GCP Security category. It can be Cloud
Security Analyst, Cloud Security Researcher or Cloud Security Engineer or Cloud Security
Operations Expert or Cloud Security Manager or Cloud Governance.

So, check how much you can cover and learn practically. The more you are good at these
concepts, the better candidate you are for the job role. Also, I assume you have already checked
and comfortable with Common Security Skills study plan.

GCP Security Skills Learning and Checklist

My only suggestion here is ask below 4 questions while learning each topic/concepts etc. 1. What
is this? (For example: What is instance group, where it is used and why?) 2. Why am I learning
this specific service or concept now? Will it help me for my job role and in future? 3. How can I
implement this? (Practical aspects, hands-on knowledge always have an extra edge) 4. How it will
make secure or how to make it secure depending upon the topic or concept?

GCP Fundamentals (2-3 weeks)

I am listing only the topic name with few lines and possibly some examples. How much you learn
and comfortable with the concept or topic is upon you. And I will share the minimal link to make
you up to the mark and you are free to learn anything more than this for better candidacy and
experience.

Week 1: IAM Deep Dive

It's very important topic for any cloud role. Try to understand it practically as much as your job
demands. 1. Start with GCP IAM official doc 2. Understand IAM roles and permissions is 2nd
important thing to excel in IAM concepts 3. User, Group, Roles and when to use when and don't
forget to ask why this, why not that 4. Custom role vs Google Managed role 5. Cross-Account IAM
policy to different roles, services, account 6. Understand the IAM policy from security mindset.
Why this, why not this? 7. Using IAM Securely

Week 2-3: Core Services

For any GCP Service(s), please follow this strategy: 1. What does this service do? 2. What
problem it would solve for the business? 3. Security Best Practices guide for GCP services. Ex:
GCS security best practices, VPC security best practices. 4. What permissions you should
provide for each role or principal or service account to maintain the least privilege principle. 5.
How it is being used, can there be some security misconfiguration if not configured properly. 6. Is
multi-tier, multi region required for this service? 7. How data at rest and data in transit can be
achieved? 8. Is logging required? If so, how are you going to log and what data and till what
period 9. Are we monitoring it? what's the reason for Yes or No? 10. Any specific security settings
for that service like Bucket Permissions for specific GCS bucket

Key Services to Cover: 1. GCS (Google Cloud Storage) 2. GKE 3. VPC (Virtual Private Cloud) 4.
Firewall Rules and policies 5. Load Balancer 6. Cloud DNS 7. Cloud CDN 8. Google Cloud Armor
9. Google Cloud Logging 10. BigQuery 11. API Gateway 12. Certificate Manager 13. Secrets
Manager 14. Cloud Run 15. Cloud Function

GCP Native Security skills

Duration: 4-6 weeks

What I mean to say here is: 1. GCP core services related to security 2. GCP Security services
hands-on knowledge

Week 4-6: Core Services Security

These are the core services: 1. IAM, super important 2. Compute Instances 3. GCS (Storage
Object) 4. VPC, I feel it as the toughest one so far apart from GKE 5. CloudSQL (RDS) 6. Bigtable
(NoSQL) 7. API Gateway 8. GKE 9. Cloud Run 10. Cloud Function 11. Cloud Composer 12.
BigQuery 13. DataStore 14. DataProc 15. Secret manager 16. Cloud Key Management

Week 7-9: Security Services Hands-on

Below are GCP Core Security services that you should know and try hands-on as much as
possible: 1. IAM Policy Analyzer 2. IAM Organization Policies

GCP Security Whitepapers

Duration: 2 weeks

GCP has awesome lists of whitepapers related to GCP Security. We are adding few important
one here. You can anytime check more for updated or new security whitepapers here

Week 10-11: Reading & Analysis

1. GCP Overview - One of the important whitepapers to understand an overview of GCP
2. Introduction to GCP Security Whitepaper
3. Google Cloud Security Foundation Guide
4. GCP Well-Architected Security Pillar
5. Risk Governance of Digital Transformation
6. GCP Security Checklist
7. Google Infrastructure Security Design Overview
 8. NIST Cybersecurity Framework in the GCP cloud
9. NIST 800-144 Security and Privacy in Public Cloud Computing

Check your GCP Pentesting Skills

Duration: 2-3 weeks

Week 12-14: Practical Labs

1. A Damn Vulnerable GCP Infrastructure GCPGoat
2. Try out the scenarios in Cloud Goat
3. GCP Pentest Labs
4. GCP Pentesting

Check your Knowledge against common security

benchmark and frameworks.
1. CIS Benchmark for Google Cloud. You can download pdf version from here
2. CSA Cloud Matrix and STAR Framework
3. NIST CSF for GCP
4. ISO 27017

GCP Security Videos and Courses

1. GCP Cloud Security Features
2. GCP Full Course from Intellipat
3. Google Cloud Security Fundamentals - Level 1
4. Managing Secuirty in Google Cloud

GCP Security Interview Questions

I have a separate repo for GCP Security interview questions. I will keep it updated time to time.
You can star it or fork it.
 Chapter 4

Web Penetration Testing

This study plan is based on milestones. So, check how much you can cover and close the
checkboxes. The more you close, the better candidate you are for the job role. Also, I assume you
have already checked and are comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be a pentester. It is
altogether different from bug bounty, Red Team etc. but to excel in any of those roles you should
be good at pentesting. It's not necessary that you can be a Red Teamer or Bug bounty hunter if
you know pentesting. But a red teamer is surely very good at pentesting. Also, Vulnerability
assessment is not pentesting, however, VAPT is a common skills required for pentesters job.

In short:

1. Pentesters are offensive security folks who try to find as many security vulnerabilities as
possible, access the risk and exploit as much as possible. They can play as internal or
external attackers for the organization.
2. Red Teamers are least bothered of finding all security gaps, and their ultimate goal is to
find one way in, exploit it and then escalate laterally through your system to access the
juiciest data they can.
3. It's totally upon your preference and timings that you should join bug bounty platform or not.
Read more here about Pentesters vs Red Team

Usually it will take you 6 months to be good at fundamentals to get a job at entry level.

If you are also interested in testing Android or iOS apps, read the Mobile Application Security
Study Plan alongside this one.

ToC:
1. Pentesting Concepts - 6 weeks
2. Tools of Trade - 2 weeks
3. Lab Practices - 8 weeks
4. Books (Read 1-2 books) - 2-3 months
5. Videos
6. Courses - Try to complete at least one course (1-2 months)
7. Certifications - on your bandwidth and wish

Pentesting Concepts
Duration: 6 weeks

Go with your pace, but make sure you understand the basic security concepts very well like HTTP
Security Response headers, Bruteforce, DoS, XSS, CSRF, Injection, IDoR, JWT etc.

Week 1-2: Basics

1. Understanding of various HTTP methods, PUT vs POST, UPDATE vs PATCH, leverage
OPTIONS method
2. Ability to understand response status codes.
3. what if you got 200, when you tried something malicious
4. what can we do if we get 403
5. let's try to get 500 status code, and why so? What will it reveal.
6. Try to understand each status code which as a pentester you would love to see.
7. Understand HTTP headers very well, specially response headers. You would need it more
often while doing pentest.
8. TCP 3 way handshake
9. How SSL works
10. Basics of security terminologies
11. Essentials Security Concepts

Week 3-4: Security Concepts

You can find majority of the security concepts at OWASP Cheatsheet

Understand the fundamental concepts on what it is, how it can be vulnerable and how you can
either exploit it or mitigate it. 1. Understanding how proper implementation of AuthN and AuthZ
contribute to robust security. What can an attacker do to exploit it. 2. How session and cookies
can be vulnerable, bypassed or even exploited 3. In-depth understanding of XSS 4. Some REST
concepts like CRUD. 5. Different types of injections specially SQLi, RFI,LFI 6. Mass Assignment
7. CSP concepts 8. SSRF 9. Automated Bruteforce 10. Credential Stuffing 11. JWT Tokens 12.
Basic of encoding, decoding, hashing 13. Session Fixation, Session Hijacking 14. 3rd Party
Vulnerability checks and exploitations 15. Understand the work defined for black box and white
box testing 16. SAST vs DAST 17. CORS

Week 5-6: Advance Level of security skill sets

1. Very good at OWASP Testing Guide hands-on
2. How to leverage a vulnerability to achieve RCE
3. Learn how to test for OS Command Injection
4. Understand what causes BOLA and BFLA and try to be good at testing these vulnerabilities
5. Various weak cipher suites
6. Advanced SQL Injection
7. XML Injection, JSON Injection
8. Understand SAML and LDAP Injection
 9. NoSQL Injection
10. GraphQL Injection
11. XXE Attacks
12. Template Injection
13. Deserialization

Tools of Trade
Duration: 2 weeks

They say tools are not everything but tools play an important role to make you a better and
efficient penetration tester. But, don't just be tool junkie. Try to understand in-depth of each tool,
its functionalities and when to use with how concept! I am not writing names of many tools for
DAST, SAST etc like acunetix, appscan, checkmarx etc. Kali OS will have almost all the tools that
you would need for pentest, but I would explicitly mention few of them here as well.

Week 7-8: Essential Tools

1. Kali Linux (I am sure majority of us would be using this only)
2. Burp Suite Pro or OWASP ZAP (Really a single tool for bread and butter ;) )
3. Metasploit
4. nmap (you would use it everytime you start with pentest)
5. dirb
6. nikto
7. fierce
8. dnsenum
9. sqlmap
10. Shodan
11. BeeF
12. Arachni
13. wireshark
14. hydra
15. cain and abel
16. w3af

Lab Practices
Duration: 8 weeks

Week 9-16: Hands-on Practice

1. Kontra for OWASP Top 10 for Web
 2. hackthebox
3. tryhackme
4. OWASP WebGoat
5. OWASP JuiceShop
6. PentesterLab
7. AttackDefense Lab - Recommended (you would need paid subscription)
8. DVWA

Books
1. The Web Application Hacker's Handbook (read this book as the first thing or learn from web
security academy)
2. OWASP Top 10 2021 Testing Guide (read this as the 2nd book)
3. The Hacker Playbook 3: Practical Guide To Penetration Testing
4. Real World Bug Hunting
5. Web Hacking 101 by Peter Yaworski - pdf

Videos
1. Penetration Testing for Beginners - Youtube
2. Web Security Course - Playlist

Blogs / Other References

1. exploit-db
2. cve
3. schneier on security
4. KrebsonSecurity

Courses
It's upto you to choose some paid or free courses to speed up what you have learned so far to test
how much you understand under web pentesting category. You should choose lab based courses
though. 1. Cybrary 2. Pentester academy - I liked few of its courses on 1. Python for Pentesters 2.
JavaScript for Pentesters 3. Pentesting with Metasploit 4. WAP Challenges 5. Web Application
Pentesting 3. Introduction to Web Security form Stanford 4. Pentesting for beginners 5. Pentesting
from EdX 6. Web Security Academy (You can ignore reading Web Application Hackers
Handbook, if you are learning from here!) 7. Computer Systems Security form MIT 8. [Link]
Certifications
Certification gives you an entry for HR calls, but remember real hands-on experience can beat
anything. 1. CEH: not highly recommended, but good to start with if you don't know anything
about security. 2. eJPT 3. eWPTXv2 4. OSCP 5. OSWE 6. GPEN 7. GWAPT

List of other famous cybersecurity certifications are mentioned here.

Networking matters
Once you are on track and now understands the heat, it's time to: 1. Make some good LinkedIn
contacts from security domain 2. Find a mentor 3. Make connections through various security
conference online/offline 4. Publish some good hacking articles, may be basic concepts but you
must publish. Choose medium 5. Join webinars, conferences 6. help someone who is still a
beginner

By the time you cover all these checklists, you will be already on a way to have a good start in
web security job role. All the best!

Whom to follow on twitter

Why twitter? Because you will see lots of security professionals very active here and sharing cool
stuffs often. 1. Dave Kennedy 2. Kevin Mitnick 3. The Hacker News(THN) 4. PortSwigger 5. Dark
Reading 6. Defcon 7. Nullcon 8. NahamSec 9. TryHackMe 10. HackerOne 11. BugCrowd 12.
OWASP 13. Troy Hunt 14. Jason Haddix 15. Security Princess - Parisa Tabriz 16. Binni Shah 17.
Random Robbie 18. TomNomNom 19. Aditya Shende 20. Infosec Community 21. Hacking
Articles 22. harsh Bothra

Interview Questions
Possible Web Security interview questions is shared at different github repo to keep it aligned with
career roadmap guide.
 Chapter 5

Application Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job role. Also, I assume you
have already checked and are comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be an Application Security
Engineer. Application Security is different from Web Security or commonly people think it as
offensive security or pentesting. Though it needs some concepts aligned with pentester, it's
altogether a totally different skill set.

It is more towards shift left security including Threat Modeling, Secure Code Review, Secure
Code Design, Training Developers, taking care of overall SDL process, and of course OWASP
Top 10 web and API security. I have another page specifically for "API Security Study Plan"
because that skill also needs good time to learn.

In short:
1. AppSec is not Pentesting (Penetration Testing) or Web Security (people use it generically).
2. Think more of a combination of developer and attacker
3. Talking to developers, giving training to them or going through the code should not scare
you.
4. Tougher than Pentesting (Topic of debate for another day)
5. Can write code for PoC, Exploit or demo with comfort
6. API security should be your area of interest.
7. Good understanding of Identity and Access Management (IAM) will help for auth-related
design and reviews.
Usually it will take you 6-12 months to be good at the Application Security fundamentals to get a
job at entry level.

ToC:
1. Web Application Concepts - 6 weeks
2. Threat Modeling - 2-3 weeks
3. Secure Code Review - 6-8 weeks
4. Cryptography - 3 weeks
5. Security Development Lifecycle (SDL) - 4 weeks
 6. Books
7. Videos
8. Courses - Try to complete at least 1-2 courses (1-2 months)
9. Certifications - on your bandwidth and wish
10. Interview Questions
11. Application Security Tools
12. Whom to follow on Twitter

Web Application Concepts

Duration: 6 weeks

This topic will have an overlap with the concepts required for Pentesting, but you have to now
think more of a defender than offender. Go with your pace, but make sure you understand the
basic web security concepts very well like HTTP Security Response headers, Bruteforce, CSRF,
Injection, JWT, Cryptography, Hashing, Encoding etc.

Week 1-2: Basics

1. Understanding of various HTTP methods, PUT vs POST, UPDATE vs PATCH, leverage
OPTIONS method
2. Ability to understand response status codes.
3. what if you got 200, when you tried something malicious
4. what can we do if we get 403
5. let's try to get 500 status code, and why so? What will it reveal?
6. Try to understand each status code which as a pentester you would love to see.
7. Understand HTTP headers very well, especially response headers. You would need it more
often while doing pentest.
8. TCP 3 way handshake
9. How SSL works
10. Basics of security terminologies
11. Essentials Security Concepts

Week 3-4: Security Concepts

You can find the majority of the security concepts at OWASP Cheatsheet

Understand the fundamental concepts on what it is, how it can be vulnerable and how you can
either exploit it or mitigate it. 1. Understanding how proper implementation of AuthN and AuthZ
contribute to robust security. What can an attacker do to exploit it and how to mitigate/defend it 2.
How session and cookies work and how it can be vulnerable, bypassed or even exploited 3.
Understand how session management can be more secured 4. In-depth understanding of XSS
from both perspective exploit and mitigation 5. REST concepts like CRUD. 6. Different types of
injections specially SQLi, RFI,LFI, RCE 7. Mass Assignment 8. Concepts like rate limit,
bruteforce, replay attack, MITM, session fixation, session hijack, credential stuffing 9. CORS
concepts 10. How can you prevent SSRF attacks 11. JWT Tokens in depth 12. Basic of encoding,
decoding, hashing 13. Good understand of Cryptography and its implementation in application 14.
SAST vs SCA

Week 5-6: Advance Level of application security skill sets

1. Very good at OWASP Top 10 for Web 2021 and OWASP Top 10 for API: 2019
2. Go through OWASP Secure Code Review Guide, understand what to verify and how to use
this guide.
3. Very good at OWASP ASVS (Application Security Verification Standard), it's your job to
make every developer aware about it and must use while development.
4. Go through OWASP Software Assurance maturity Model (OSAMM), if you aim for a
security architect role.
5. Understand what causes BOLA and BFLA and try to be good at testing these
vulnerabilities.
6. Various weak cipher suites, how to test, how to make developers aware about it
7. Authentication and Authorization
8. Advanced SQL Injection
9. XML Injection, JSON Injection
10. Understand SAML and LDAP Injection
11. NoSQL Injection
12. GraphQL Injection
13. XXE Attacks
14. Server-side Template Injection
15. Deserialization
16. CSP: Content Security Policy

Threat Modeling
Read Threat Modeling Study Plan

Secure Code Review

Read Secure Code Review

Cryptography
Read Cryptography
Security Development Lifecycle (SDL)
Read Security Development Lifecycle

Mobile Application Security

If you work with mobile apps (Android/iOS), also check the Mobile Application Security Study
Plan.

Books
1. Agile Application Security
2. Application Security Program Handbook
3. Writing Secure Code
4. The Tangled Web: A Guide to Securing Modern Web Applications
5. Alice and Bob Learn Application Security
6. OWASP Code Review Guide

Videos
1. Introduction to Application Security
2. Scaling your AppSec Program with semgrep
3. Building an AppSec Program from the ground up by Snyk
4. Application Security - Understanding, Exploiting and Defending against Top Web
Vulnerabilities by Cerner
5. Securing Web Application
6. Web Application Security: 10 things developers need to know
7. Application Security from SANS Institute

Courses
1. Software Security on Coursera
2. Cloud Application Security
3. Application Security Guide - Udemy
4. Sec522: Application Security: Securing Web Apps, APIs, and Microservices from SANS
Really nice one but costly.
5. Free OWASP Top 10 practice from Kontra Security
Certifications
1. CSSLP: Certified Secure Software Lifecycle Professional Recommended
2. CASE: Certified Application Security Engineer for Java and .NET professionals
3. GWEB: GIAC Certified Web Application Defender

Interview Questions
Possible Application Security interview questions is shared at different github repo to keep it
aligned with career roadmap guide.

AppSec Tools
1. Checkmarx for SAST or HCL AppSCan (Previously it was IBM AppScan)
2. Snyk Code for SAST and Snyk Open Source for SCA
3. git-secrets or gitleaks or trufflehog to find out secrets
4. Chef Inspec
5. OWASP Dependency Check is for SCA
6. Bandit for python code
7. Sonarqube for SAST with few plugins like findsecbugs
8. RetireJS for JS libraries
9. Contrast for IAST solution
10. Coverity from Snyopsys
11. You must not ignore Burp Suite Pro
12. Veracode
13. InSight from Rapid7

Whom to follow on twitter

Why twitter? Because you will see lots of security professionals very active here and sharing cool
stuff often. 1. Jim Manico 2. Gyan Chawdhary 3. Abhay Bhargav 4. Inon Shkedy 5. Chris Romeo
6. Tanya Janca 7. Anant Shrivastava 8. Sanjeev Jaiswal 9. Defcon 10. Nullcon 11. OWASP
 Chapter 6

API Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the varied job roles which require
good knowledge of API security. Also, I assume you have already checked and comfortable with
Common Security Skills study plan.

It will cover what you need to learn to excel in API security (part of AppSec domain). And, please
keep in mind that it would require knowledge of: 1. How website works 2. How API endpoints are
defined and its request and response 3. You know basics of coding to write your own APIs for
testing 4. OWASP Top 10 for web 5. OWASP Top 10 for API 2023 (Latest version)

I will explain very basic or just the overview so that you can start learning those concepts from
there.

Note: Usually it will take you 3-6 months to be good at the API Security fundamentals to get a job
at entry level.

Study Plan ToC:

1. API Fundamentals - 2 weeks
2. API Security Understandings - 2 weeks
3. API Security Labs and Practices - 2 weeks
4. API Security Tools
5. Books
6. Videos
7. Courses
8. Certifications
9. Interview Questions

API Fundamentals
Duration: 2 weeks

Week 1: Basics of API & Endpoints

1. API endpoints

Let's try to understand API endpoints in layman terms.

Imagine you're ordering food from a restaurant using a food delivery app. You open the app and
select the items you want to order. When you're done, you click the "Place Order" button. Behind
the scenes, the app needs to communicate with the restaurant's system to process your order.
This is where API endpoints come into play.

API endpoints are like specific doors or entrances at the restaurant that allow the app and the
restaurant's system to exchange information. Each endpoint serves a particular purpose or action.
For example, there might be an endpoint for submitting an order, another one for retrieving the
menu, and yet another one for tracking the status of your order.

When you click "Place Order" in the app, it sends a request to a specific API endpoint designated
for order submission. This request contains all the necessary information, such as the items you
ordered, your delivery address, and any special instructions. The endpoint receives this request
and processes it. It may check if the items are available, calculate the total cost, and initiate the
delivery process.

Similarly, if you want to check the status of your order later, the app sends a request to a different
API endpoint dedicated to order tracking. This endpoint retrieves the relevant information about
your order, such as whether it's being prepared, out for delivery, or already delivered. The
endpoint then sends this information back to the app, which displays it to you.

In summary, API endpoints act as communication channels between different systems, allowing
them to exchange information and perform specific actions. They serve as designated entry points
that receive requests from one system and provide the necessary responses based on the
requested action.

2. Types of microservices

Try to understand what types of microservices exist from application architectural view. Then it will
be easy for you to understand microservices patter. Once you know these concepts, it will actually
help you to the API security assessment accurately.

Microservices are an architectural approach to building software applications by breaking them

down into small, loosely coupled, and independently deployable services. Each microservice
focuses on a specific business capability or function. Here are some common types of
microservices:

1. User Service: This microservice is responsible for managing user-related functionalities

such as user registration, authentication, profile management, and access control. It handles
tasks like user creation, login, password management, and user-specific settings.
2. Product Service: The product service handles tasks related to managing products or items
in an application. It includes functions like product catalog management, inventory
management, pricing, and product search. This microservice allows the application to
efficiently handle product-related operations.
3. Order Service: This microservice deals with order processing and management. It handles
tasks such as creating new orders, updating order status, handling payments, and generating
invoices. The order service enables seamless management of the entire order lifecycle.
4. Payment Service: This microservice focuses on payment processing. It integrates with
payment gateways and handles tasks like accepting and verifying payment information,
processing transactions, and ensuring secure payment processing.
 5. Notification Service: The notification service is responsible for sending out various types of
notifications, such as email notifications, SMS alerts, or push notifications. It enables the
application to communicate important information to users or other systems in a reliable and
timely manner.
6. Analytics Service: This microservice deals with collecting, processing, and analyzing data
to provide insights and metrics about the application and its usage. It helps in monitoring
system performance, identifying patterns, and making data-driven decisions.
7. Integration Service: The integration service facilitates communication and integration
between different systems or external services. It enables the microservices-based
application to interact with external APIs, third-party services, or legacy systems by providing
adapters, connectors, or translation layers.
8. Image/Video Processing Service: This microservice focuses on image or video processing
capabilities. It may handle tasks such as resizing images, generating thumbnails, applying
filters, or encoding/decoding videos. This service is especially useful in applications that
involve multimedia content.
These are just a few examples of the types of microservices that can exist in an application. The
specific types and number of microservices can vary depending on the requirements of the
application and the domain it serves. The goal is to decompose the application into small,
manageable services, each responsible for a specific business capability, allowing for scalability,
agility, and independent development and deployment.

Week 2: Microservices & Cloud Native APIs

3. Try to understand Microservices from API Security perspective

When it comes to API security in the context of microservices, there are a few important types of
microservices that developers and security professionals should be aware of. Let's explore them:

1. Authentication Service: This microservice handles user authentication and identity

management. It verifies the identity of users, usually through username/password
combinations, tokens, or other authentication mechanisms. It ensures that only authorized
users can access protected resources and performs actions like user registration, login, and
logout.
2. Authorization Service: This microservice is responsible for controlling access to various
resources within the system. It determines what actions a user or system can perform based
on their identity and assigned permissions. The authorization service enforces access control
policies and ensures that users can only access the resources they are authorized to access.
3. API Gateway: The API gateway acts as the entry point for external requests and provides a
single point of contact for clients. It handles tasks like request routing, load balancing,
caching, and protocol translation. From a security perspective, it can also enforce security
policies, such as rate limiting, authentication, and encryption.
4. Logging and Monitoring Service: This microservice collects and analyzes logs and metrics
from various components of the system. It helps detect anomalies, track system behavior,
and identify security events. It plays a crucial role in identifying potential security breaches or
attacks by monitoring and analyzing the API traffic and system logs.
5. Encryption Service: This microservice focuses on data protection by providing encryption
and decryption capabilities. It ensures that sensitive information, such as user credentials or
 personal data, is securely transmitted and stored. The encryption service may handle tasks
like generating and managing encryption keys, encrypting data at rest or in transit, and
decrypting data when necessary.
6. Threat Intelligence Service: This microservice gathers information about known threats and
vulnerabilities from various sources. It helps detect and mitigate potential security risks by
analyzing incoming requests and comparing them against known threat patterns. The threat
intelligence service can provide real-time threat alerts, block suspicious activities, or trigger
additional security measures.
Understanding these types of microservices from an API security perspective allows developers
and security professionals to design, implement, and maintain secure microservice architectures.
It helps them identify the specific security concerns associated with each microservice and apply
appropriate security measures to protect the system and its APIs from potential threats and
attacks.

4. Cloud native API

You can't deny the fact that Cloud is everywhere and understanding how API is being used in
cloud would be an aded advantage for you. A cloud-native API refers to an API that is designed,
developed, and deployed with a cloud-native approach, taking full advantage of cloud computing
capabilities and principles. Cloud-native APIs are specifically tailored for cloud environments,
enabling scalability, resilience, and flexibility. Here are a few examples of cloud-native APIs:

1. RESTful API: Representational State Transfer (REST) is a widely used architectural style
for building APIs. RESTful APIs are designed to be stateless and use standard HTTP
methods such as GET, POST, PUT, and DELETE to interact with resources. They are
well-suited for cloud-native environments as they leverage the HTTP protocol and can be
easily consumed by different clients, including web browsers, mobile apps, and other
services.
2. Event-Driven APIs: Event-driven APIs enable asynchronous communication and are often
used in cloud-native architectures. They allow services to exchange information and trigger
actions based on events. For example, when a new user registers on a platform, an
event-driven API can publish an event that triggers other services to send welcome emails,
update user profiles, or perform other related actions. Cloud-native event-driven APIs often
utilize message queues, event brokers, or streaming platforms to facilitate event processing.
3. GraphQL API: GraphQL is a query language and runtime for APIs that allows clients to
request specific data in a flexible and efficient manner. It enables clients to retrieve only the
data they need, reducing the amount of network traffic and improving performance. GraphQL
APIs are popular in cloud-native environments where microservices often need to interact
with multiple data sources. They provide a single entry point for clients to fetch data from
various services and aggregate responses.
4. Serverless APIs: Serverless computing allows developers to build and deploy applications
without managing the underlying infrastructure. Serverless APIs, often implemented using
serverless computing platforms like AWS Lambda or Azure Functions, enable developers to
focus solely on writing the API logic while leaving the infrastructure management to the cloud
provider. Serverless APIs scale automatically based on demand, and developers only pay for
the actual execution time of the API functions.
 5. OpenAPI (formerly Swagger): OpenAPI is a specification that defines and documents
RESTful APIs. It provides a machine-readable format for describing the API's endpoints,
request/response payloads, and authentication mechanisms. OpenAPI allows developers to
generate code stubs, automatically generate API documentation, and even test and mock
APIs. It promotes collaboration and interoperability between different teams and tools in a
cloud-native development ecosystem.
These examples illustrate different types of cloud-native APIs that leverage cloud infrastructure
and principles to deliver scalable, resilient, and flexible solutions. Cloud-native APIs enable
organizations to take full advantage of cloud computing benefits, such as elasticity, cost
efficiency, and rapid deployment, while building robust and modern applications.

API Security Understandings

Duration: 2 weeks

Now, as you understand basic blocks of API, types of API, microservices, cloud-native APIs etc.
Let's understand few basic concepts while dealing with API Security like AuthN, AuthZ, OAuth,
API Gateway, why API security is different from web security and so on.

Week 3: Core Security Concepts

1. API Security is not web security!
When I talk about API Security and say that web security is different. Many either get confused or
don't agree. But, ideally API security and web application security are two different concepts,
although they are related. Web application security refers to the measures taken to protect web
applications, including the servers, databases, and user interfaces that are involved in delivering
web content. API security, on the other hand, is about protecting the API itself and the data that it
transmits.

Here are some of the key differences between API security and web application security: 1.
Focus: Web application security focuses on securing the user interface, server, and database
parts of a web application. API security, however, concentrates on securing the API and the data
it transmits. 2. Attack Vectors: Web applications are often targeted by attacks such as SQL
injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and file inclusion. API
security, on the other hand, is typically targeted by attacks such as API spoofing, parameter
manipulation, and man-in-the-middle (MitM) attacks. 3. Authentication and Authorization: Web
application security often relies on username and password authentication, session management,
and access control to protect web applications. API security, on the other hand, typically uses
OAuth, API keys, or JSON Web Tokens (JWTs) for authentication and authorization. 4. Usage:
Web applications typically provide a user interface to interact with, whereas APIs are back-end
components that allow different systems to communicate. As a result, API security focuses on
securing APIs that expose application functionality to other systems.

Overall, API security and web application security are equally important and require different
measures to ensure they remain safe and secure. While web application security focuses on the
user interface, server, and database, API security focuses on the API itself, the data it transmits,
and the ways in which different systems interact with it.

2. What is API Security

API security refers to the measures taken to protect an Application Programming Interface (API)
from unauthorized access, modification, and exploitation. APIs are a set of rules and protocols
that allow various software applications to interact with each other. Therefore, they need to be
secure to ensure that only authorized parties have access to them.

API security can be ensured through the following measures:

1. Encryption: This involves the use of encryption techniques to protect the data being
transmitted between API endpoints. For example, HTTPS (HyperText Transfer Protocol
Secure) is commonly used for secure data transmission.
2. Authentication: This involves verifying the identity of the user or application accessing the
API. Authentication can be achieved through the use of usernames and passwords or the use
of tokens that expire after a certain period.
3. Authorization: This involves determining what actions a user or application can perform
after they have been authenticated. For example, some users may have access to read data,
while others may have access to modify data.
4. Rate Limiting: This involves limiting the number of requests that a user or application can
make to the API. This helps to prevent Denial of Service attacks by limiting the amount of
resources that can be consumed by a user.
Practical Examples:

• Google Maps API: Google Maps API requires an API key for authentication. This key is
specific to the developer's account and is used to restrict access to the API to authorized
users. It also uses HTTPS to encrypt the data being transmitted between the API endpoints.
• Stripe API: The Stripe API uses authentication and API keys to restrict access to authorized
users. It also uses rate limiting to prevent excessive API usage and offers real-time fraud
detection to prevent fraudulent transactions.
• Twilio API: The Twilio API uses authentication and authorization to restrict access to
authorized users. It also uses HTTPS to encrypt data and provides rate throttling to prevent
excessive API usage. Additionally, it offers access control features to restrict API access to
specific IP addresses or domains.
3. Why API Security

API security is crucial for several reasons:

1. Data Protection: APIs often handle sensitive data, such as user credentials, personal
information, financial data, or business secrets. Securing APIs ensures that this data remains
confidential and is not compromised or accessed by unauthorized entities.
2. Authorization and Access Control: APIs provide access to various resources and
functionalities. Implementing proper security measures ensures that only authenticated and
authorized users or systems can access and perform actions on those resources. It helps
prevent unauthorized access, data breaches, and misuse of the API.
3. Trust and Reputation: Security breaches or vulnerabilities in APIs can damage the trust and
reputation of an organization. Users and clients expect their data to be handled securely.
 Demonstrating a commitment to API security enhances trust, improves customer satisfaction,
and helps maintain a positive reputation.
4. Compliance with Regulations: Many industries are subject to regulatory requirements
regarding data protection and privacy, such as GDPR (General Data Protection Regulation)
or HIPAA (Health Insurance Portability and Accountability Act). Ensuring API security helps
organizations comply with these regulations and avoid legal consequences or penalties.
5. Prevention of Attacks: APIs can be targeted by various types of attacks, including injection
attacks, cross-site scripting (XSS), cross-site request forgery (CSRF), or denial-of-service
(DoS) attacks. Implementing security measures mitigates the risk of these attacks and
protects the API and underlying systems from being compromised.
6. Secure Integration: APIs are often used to integrate different systems, services, or
third-party applications. Proper security measures ensure that these integrations are
performed securely, protecting both the API provider and the entities consuming the API from
potential vulnerabilities or data leaks.
7. Monitoring and Auditing: API security enables organizations to monitor and audit API
activities, such as tracking API usage, detecting abnormal behavior, or identifying potential
security incidents. This visibility allows for timely response and remediation, reducing the
impact of security breaches.
In summary, API security is essential to protect sensitive data, ensure authorized access,
maintain trust and reputation, comply with regulations, prevent attacks, secure integrations, and
enable monitoring and auditing. It is a fundamental aspect of building robust and secure
applications and systems in today's interconnected digital landscape.

Week 4: Advanced Concepts (AuthN, AuthZ, Rate Limiting)

4. AuthN and AuthZ

Authentication (AuthN) and authorization (AuthZ) are two essential concepts in API security. Let's
explore each of them with practical examples:

Authentication (AuthN): Authentication is the process of verifying the identity of a user or

system. It ensures that the entity trying to access a resource or perform an action is who they
claim to be. Here are a few practical examples of authentication:

1. Username/Password Authentication: When you log into an application or website using a

username and password, the system checks whether the entered credentials match the
stored values associated with that user. If the credentials are valid, you are authenticated and
granted access to the protected resources.
2. Token-Based Authentication: Many APIs use tokens for authentication. For instance, when
you log into a mobile app using your social media account, the app receives an access token.
The app includes this token with subsequent API requests to prove your identity and access
protected resources. The API server verifies the token's validity before allowing access.
3. Two-Factor Authentication (2FA): 2FA adds an extra layer of security to authentication. In
addition to a username and password, you may be required to provide a second factor, such
as a unique code generated by an authentication app or received via SMS. This method
ensures that even if someone obtains your password, they still cannot access the protected
resource without the second factor.
Authorization (AuthZ): Authorization is the process of granting or denying access to specific
resources or actions based on the authenticated user's privileges or permissions. Here are some
practical examples of authorization:

1. Role-Based Access Control (RBAC): In RBAC, permissions are assigned based on roles.
For example, in a content management system, an administrator role may have access to
create, edit, and delete content, while a regular user role may have read-only access. When a
user is authenticated, their role determines the actions they can perform.
2. Attribute-Based Access Control (ABAC): ABAC grants access based on various attributes
associated with the user or the resource. For instance, in a healthcare system, a doctor may
have access to medical records of their assigned patients based on their role as a doctor and
the specific patient's attribute.
3. Scope-Based Access Control: APIs often implement scope-based access control, where
each authenticated user is granted specific scopes or permissions. For example, in an email
API, a user with "read" scope can only retrieve emails, while a user with "read" and "send"
scopes can both read and send emails.
4. Fine-Grained Access Control: Fine-grained access control allows for precise control over
individual resources. For instance, in a file-sharing application, you can define permissions at
the file or folder level, specifying which users or groups can read, write, or delete specific files.
In summary, authentication (AuthN) is the process of verifying a user's identity, while authorization
(AuthZ) determines the permissions and access rights granted to an authenticated user. These
two concepts work together to ensure that only authenticated users with appropriate privileges
can access the desired resources or perform specific actions.

5. Rate limit

Rate limiting is a strategy for limiting network traffic. It puts a cap on how often someone can
repeat an action within a certain timeframe - for instance, trying to log in to an account. Rate
limiting can help stop certain kinds of malicious bot activity. It can also reduce strain on web
servers.

Why is it important? 1. Preventing DoS/DDoS: Stops attackers from flooding your API with
requests to crash it. 2. Brute Force Protection: Limits the speed at which an attacker can guess
passwords or tokens. 3. Resource Management: Ensures fair usage of your API resources
among all users.

Common Algorithms: - Token Bucket: Tokens are added to a bucket at a fixed rate. Each
request consumes a token. If empty, request is denied. - Leaky Bucket: Requests are processed
at a fixed rate, smoothing out bursts. - Fixed Window: Counts requests in a fixed time window
(e.g., 100 req/min). Can be bypassed at window edges. - Sliding Window: A more accurate
version of fixed window that smooths out the edges.

Implementation: - Rate limits are often implemented at the API Gateway or Load Balancer level.
- Use HTTP headers to communicate limits to clients: - X-RateLimit-Limit: The maximum number
of requests allowed in a window. - X-RateLimit-Remaining: The number of requests remaining in
the current window. - X-RateLimit-Reset: The time at which the current window resets. - Return
429 Too Many Requests status code when the limit is exceeded.

6. API Gateway
An API Gateway is an API management tool that sits between a client and a collection of backend
services. It acts as a reverse proxy to accept all application programming interface (API) calls,
aggregate the various services required to fulfill them, and return the appropriate result.

Key Security Functions: 1. Authentication & Authorization: Offload AuthN/AuthZ from

individual microservices. The gateway verifies tokens (e.g., JWT) and passes user context
downstream. 2. Rate Limiting & Throttling: Enforce limits to protect backend services from
overload and abuse. 3. Input Validation: Sanitize incoming requests to prevent injections (SQLi,
XSS) before they reach the backend. 4. IP Whitelisting/Blacklisting: Allow or deny traffic based
on IP source. 5. SSL/TLS Termination: Handle encryption/decryption at the gateway to reduce
overhead on backend services. 6. Logging & Monitoring: Centralized point for logging all API
traffic for auditing and analytics.

Popular API Gateways: - Kong: Open-source, highly extensible. - Apigee (Google Cloud):
Enterprise-grade full lifecycle API management. - AWS API Gateway: Fully managed service for
AWS environments. - Azure API Management: Managed service for Azure. - Tyk: Open-source
API gateway and management platform.

API Security Labs and Practices

1. OWASP crAPI: Completely Ridiculous API (crAPI) can help teams understand the ten most
important security aspects of an API within a mock environment. crAPI has implemented
almost every security loophole that APIs should not have-this offers a good model that
showcases how not to secure APIs.
crAPI uses a microservices architecture and is composed of several services which are
developed using the following: - Identity: user and authentication endpoints - Web: main Ingress
service - Community: community blogs and comments endpoints - Mailhog: mail service -
Workshop-vehicle workshop endpoints - Postgres-SQL Database - Mongo-NoSQL Database
1. vAPI: vAPI is Vulnerable Adversarial Programmable Interface, which is an open-source
PHP-based API that mimics OWASP API Top 10 scenarios through exercises.
2. VAmPI: Vulnerable API made with Python/Flask.

API Security Tools

1. Dastardly form Burp suite (free): Use it in CI/CD pipeline
2. API Security Audit from 42 crunch for bitbucket pipeline:
3. Wallarm Advanced API Security Platform
4. Google Apigee Sense
5. Traceable: Intelligent API Security at Enterprise Scale
6. Levo: Continous API Security Assurance
7. Beagle Security
8. Salt Security
 9. Cequence
10. Neosec: now part of Akamai

Books
1. API Security in Action
2. Hacking APIs: Breaking Web Application Programming Interfaces
3. Web Application Security
4. Advanced API Security

Videos
1. API Security: Everythign you need to know to protect your APIs
2. The 2022Guide to API Security
3. Analysing the OWASP API Security Top 10 for Pen Testers

Courses
1. API Security Fundamentals form APISec University (free)
2. API Penetration Testing Course from APISec University (free)
3. API Security on Google Cloud's Apigee API Platform
4. API Fundamentals from Qualys for (free)
5. Introduction to the OWASP API Security Top 10 - Cybrary (free)

Certifications
1. CSSLP
2. API Security Architect Certification
3. Certified API Security Professional

Interview Questions
Possible API Security interview questions is shared at different github repo to keep it aligned with
career roadmap guide.
 Chapter 7

Threat Modeling

Threat Modelling
"[!IMPORTANT] If you are into Product security or application security or security engineering, you
would need this study plan more than any other security professionals. However, it is advised for
every security professional to have a fair understanding of Threat Modeling fundamentals."

"[!Note] It should take 1-2 months for good understanding of Threat Modeling with some hands-on
experiences."

What is Threat Modeling

Threat modelling is a structured approach for analysing the security of an application and enables
to identify, quantify, and address the security risks associated with an application. From details
about threats and likely attacks against each application, the organization operates more
effectively through better decisions about prioritization of initiatives for security. Additionally,
decisions for risk acceptance are more informed, therefore better aligned to the business.

"[!TIP] You must go through OWASP Threat Modeling Cheat Sheet for basic understanding."

In short, - Threat modeling is the process of identifying, analyzing, and mitigating potential
security threats to a system or organization. - It involves identifying the assets that need to be
protected, analyzing the potential threats to those assets, and developing strategies to mitigate or
eliminate those threats. - The early you perform Threat Modeling the better result you would get.

The objective to conduct threat modelling is to investigate following:

1. The trust boundaries to and within the application
2. The actors that interact within and outside of the trust boundaries
3. Information flows within and to and from the trust boundaries
4. Information persistence within and out of trust boundaries
5. Threats to transgression of trust boundaries by actors and for information flow and
persistence
6. Vulnerabilities at trust boundaries as accessed by actors and for information flow and
persistence
7. Threat agents that can exploit the vulnerabilities
8. Impact of exploitation of vulnerability by a threat agent
9. Decision tree to treat the risk
ToC
1. Threat Modeling Fundamentals - 2 weeks
2. Methodologies - 2 weeks
3. Process and Tools - 2 weeks
4. Advanced Topics and Practice - 2 weeks
5. Resources

Threat Modeling Fundamentals

Duration: 2 weeks

Understand the "Why" and "What" of Threat Modeling.

Week 1-2: Core Concepts

• Definition: Identifying, analyzing, and mitigating potential security threats.
• Why it matters: Proactive identification, cost efficiency, prioritization.
• Key Elements:
• Assets: What are we protecting?
• Threats: What can go wrong?
• Vulnerabilities: Where are we weak?
• Mitigations: What are we going to do about it?
• The 4 Questions:
• What are we building?
• What can go wrong?
• What are we going to do about it?
• Did we do a good job?

Methodologies
Duration: 2 weeks

Learn the structured approaches to finding threats.

Week 3-4: Frameworks

1. STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service,
Elevation of Privilege. (Focus heavily on this).
2. PASTA: Process for Attack Simulation and Threat Analysis (Risk-centric).
3. Attack Trees: Visualizing attack paths.
4. Other models: CVSS (scoring), DREAD (scoring), LINDUNN (privacy).
Process and Tools
Duration: 2 weeks

How to actually do it in a real project.

Week 5-6: Execution

1. Data Flow Diagrams (DFDs):
• Trust boundaries.
• Processes, Data Stores, Data Flows, External Entities.
2. The Process:
• Define Scope -> Decompose Application -> Identify Threats -> Mitigate -> Validate.
3. Tools:
• OWASP Threat Dragon: Open source, web/desktop based.
• Microsoft Threat Modeling Tool: The classic standard.
• Threagile: Agile, code-driven threat modeling.

Advanced Topics and Practice

Duration: 2 weeks

Scaling and integrating into SDLC.

Week 7-8: Scaling & Integration

1. Integration: How to fit TM into Agile/DevOps (Rapid Threat Modeling).
2. Validation: Verifying mitigations through testing (pentesting, unit tests).
3. Practice:
• Model a simple web app.
• Model a cloud infrastructure (e.g., S3 bucket setup).
• Model a CI/CD pipeline.

Threat Modeling tools to explore

1. OWASP Threat Dragon
2. Microsoft Threat Modeling Tool
3. STRIDE GPT
4. Threagile - run agile threat modeling
5. PyTM - a Pythonic Framework for Threat Modeling
6. [Link] is also a good tool to draw threat model diagram

Resources to learn and practice

1. [Link]
2. [Link]
 3. [Link]
4. [Link]
5. [Link]
6. [Link]
7. Mindmap of a threat model used by Red Team
8. Cyber Threat Modeling by MITRE
9. [Link]
10. [Link]
11. [Link]
12. Clone this repo for more resources: Awesome Threat Modeling by @secfigo
13. Threat Modeling Podcast by Chris Romeo
14. Threat Modeling learning resources: Linkedin Post
15. Certified Threat Modeling Professional by Practical DevSecOps
16. Kubernetes Threat Modeling
17. AWS S3 Threat Modeling - One you think you are ready for real time projects

Video Resources :bulb:

1. [Link]
2. [Link]
3. [Link]
4. [Link]
5. [Link]
6. [Link]
7. Paid Course on Udemy: Threat Modeling using STRIDE by Taimur

Books :books:
1. Threat Modeling: Design for Security by Adam Shostack
2. Threat Modeling by Izar Tarandach
After learning Threat Modeling, you can connect it with monitoring and incident response by
exploring the Blue Team, Detection & Response Study Plan.
 Chapter 8

GRC (Governance, Risk &

Compliance)

Here’s a detailed study plan for GRC (Governance, Risk, and Compliance) professionals and
beginners:

Introduction into GRC

GRC is an initialism that denotes Governance, Risk, and Compliance, but the reality is much
more. GRC is the integrated collection of capabilities that enable an organization to reliably
achieve objectives, address uncertainty, and act with integrity.

GRC Overview
• Governance: The framework and processes that ensure an organization’s strategies,
objectives, and risks are managed and aligned with its goals. It includes policies, procedures,
and decision-making structures.
• Risk Management: Identifying, assessing, and mitigating risks that could impact the
organization’s ability to achieve its objectives. This involves risk assessment, risk control, and
risk monitoring.
• Compliance: Ensuring that the organization adheres to laws, regulations, standards, and
internal policies. It involves compliance audits, monitoring, and reporting.

Key Components:
• Governance Frameworks: COSO, COBIT
• Risk Management Frameworks: ISO 31000, NIST SP 800-30, NIST RMF
• Compliance Frameworks: GDPR, HIPAA, SOX, ISO27K1, SOC

Why GRC
• Governance & Oversight provides methods to guide, constrain and conscribe the
organization to achieve its purpose, mission, vision, and values.
• Strategy & Performance provides methods to guide, arrange and operate resources to
achieve objectives and monitor performance.
• Risk & Decision-Support provides methods to identify and address the e■ect of uncertainty
on objectives, including ways to support decisions under uncertainty.
• Compliance & Ethics provides methods to identify and address mandatory and voluntary
obligations and the underlying ethical principles and values.
 • Security & Continuity provides methods to identify and address threats to critical physical
and digital assets and infrastructure.
• Audit & Assurance provides methods to enhance confidence that the organization is reliably
achieving objectives, addressing uncertainty, and acting with integrity.
But for the scope of this study plan we will focus on the following elements: - Governance &
Oversight - Risk & Decision-Support - Security & Continuity - Audit & Assurance

ToC
1. GRC Fundamentals - 2 weeks
2. Governance and Policy - 2 weeks
3. Risk Management Deep Dive - 2 weeks
4. Compliance and Auditing - 2 weeks
5. Tools, Metrics and Operations - 2 weeks
6. Resources

GRC Fundamentals
Duration: 2 weeks

Understand the core concepts of Governance, Risk, and Compliance and how they integrate.

Week 1-2: Core Concepts

• Governance: The framework and processes that ensure an organization’s strategies,
objectives, and risks are managed and aligned with its goals.
• Risk Management: Identifying, assessing, and mitigating risks that could impact the
organization’s ability to achieve its objectives.
• Compliance: Ensuring that the organization adheres to laws, regulations, standards, and
internal policies.
• Key Frameworks Overview:
• Governance: COSO, COBIT
• Risk: ISO 31000, NIST RMF
• Compliance: GDPR, HIPAA, SOX, ISO 27001

Governance and Policy

Duration: 2 weeks

Focus on the "G" in GRC - setting the direction and rules.

Week 3-4: Establishing Governance

 • Strategic Planning: Understanding organizational goals and aligning GRC efforts.
• Policy Development: Crafting policies that support governance and compliance.
• Internal Controls: Designing and implementing controls to mitigate risks.
• Roles & Responsibilities: Board, Management, Audit, Risk Owners.

Risk Management Deep Dive

Duration: 2 weeks

Focus on the "R" in GRC - managing uncertainty.

Week 5-6: Risk Lifecycle

• Risk Assessment: Techniques for identifying and evaluating risks (Qualitative vs
Quantitative).
• Risk Mitigation: Strategies for controlling and reducing risk impact (Avoid, Accept, Transfer,
Mitigate).
• Incident Management: Processes for handling and recovering from risk events.
• Third-Party Risk Management (TPRM): Managing risks from vendors and suppliers.

Compliance and Auditing

Duration: 2 weeks

Focus on the "C" in GRC - adhering to rules and proving it.

Week 7-8: Regulatory Landscape

• Regulatory Knowledge: Deep dive into relevant regulations (GDPR, HIPAA, PCI-DSS).
• Compliance Auditing: Techniques for auditing and ensuring compliance.
• Reporting and Documentation: Skills for documenting and reporting compliance status.

Integration and Technology

• GRC Software: Familiarity with GRC tools and software (e.g., RSA Archer, MetricStream).
• Data Analytics: Using data to support risk assessments and compliance reporting.

Soft Skills
• Communication: Effectively communicating GRC issues and strategies to stakeholders.
• Problem-Solving: Addressing complex GRC challenges with creative solutions.

GRC Roles & / Jobs

"[!NOTE] Career Path Progression: Many professionals in GRC start in entry-level roles, such as
GRC analysts or compliance officers, and then progress to more senior positions like GRC
program managers, IT risk and compliance managers, or chief risk officers as they gain
experience and certifications. Senior-level roles often require deep expertise in both the business
and regulatory landscapes, as well as leadership and strategic planning abilities."

In the field of Governance, Risk, and Compliance (GRC), there are a variety of roles that span
different responsibilities and levels of expertise. These roles focus on ensuring that organizations
adhere to regulatory standards, effectively manage risks, and maintain strong governance
practices. Below is a breakdown of the different jobs and roles in GRC:

1. GRC Analyst
2. Responsibilities:
3. Conduct risk assessments and analyze data to identify risks and compliance gaps.
4. Monitor and report on governance, risk, and compliance activities.
5. Assist in implementing GRC tools and technologies.
6. Draft and update policies and procedures to ensure regulatory compliance.
7. Skills Required:
8. Strong analytical and communication skills.
9. Knowledge of risk management frameworks (ISO 31000, NIST).
10. Understanding of relevant regulations (GDPR, HIPAA, SOX).
11. Typical Employers: Banks, financial institutions, large enterprises, IT firms.
12. Risk Management Specialist
13. Responsibilities:
14. Identify, assess, and monitor risks across different areas of the organization.
15. Develop and implement risk mitigation strategies.
16. Conduct regular risk assessments and create risk reports for senior management.
17. Work with business units to integrate risk management into operations.
18. Skills Required:
19. Proficiency in risk management frameworks (COSO, ISO 31000).
20. Strong problem-solving and analytical abilities.
21. Risk modeling and analysis experience.
22. Typical Employers: Insurance companies, financial institutions, consulting firms.
23. Compliance Officer
24. Responsibilities:
25. Ensure the organization adheres to relevant laws, regulations, and internal policies.
26. Conduct compliance audits and report on compliance risks.
27. Stay updated on changes in regulatory requirements and ensure the organization adjusts
accordingly.
28. Train employees on compliance policies and procedures.
29. Skills Required:
30. Knowledge of industry-specific regulations (e.g., HIPAA, SOX, GDPR).
31. Strong attention to detail and analytical skills.
32. Audit and regulatory experience.
33. Typical Employers: Healthcare, banking, tech firms, regulated industries.
34. GRC Consultant
35. Responsibilities:
36. Provide advisory services to clients on GRC frameworks, policies, and procedures.
37. Conduct audits and assessments for governance, risk, and compliance.
38. Design and implement GRC programs and tools for clients.
39. Train and educate client teams on GRC best practices.
40. Skills Required:
41. In-depth knowledge of multiple GRC frameworks and standards.
42. Strong communication and client management skills.
43. Ability to tailor GRC solutions to specific industries.
44. Typical Employers: Consulting firms (Big Four: Deloitte, PwC, EY, KPMG).
45. Internal Auditor
46. Responsibilities:
47. Conduct internal audits to ensure compliance with policies, regulations, and internal
controls.
48. Evaluate the effectiveness of risk management and governance processes.
49. Report audit findings to management and suggest improvements.
50. Monitor remediation efforts and follow up on recommendations.
51. Skills Required:
52. Experience with auditing standards (IIA, ISO 19011).
53. Detail-oriented with strong analytical skills.
54. Knowledge of risk management and internal control frameworks.
55. Typical Employers: Large corporations, government organizations, public institutions.
56. GRC Program Manager
57. Responsibilities:
58. Oversee the design and implementation of the GRC program across the organization.
59. Ensure integration of GRC activities with overall business strategies.
60. Lead cross-functional teams in managing governance, risk, and compliance initiatives.
61. Track GRC program performance metrics and report to senior leadership.
62. Skills Required:
63. Project management experience (PMP, PRINCE2).
64. Deep understanding of GRC processes and tools.
65. Strong leadership and communication skills.
66. Typical Employers: Large enterprises, multinational corporations, consulting firms.
67. IT Risk and Compliance Manager
68. Responsibilities:
69. Manage IT-related risks and ensure compliance with information security standards.
70. Oversee IT audits and risk assessments.
71. Ensure compliance with IT-specific regulations like GDPR, PCI DSS, and SOX.
72. Implement and monitor IT governance frameworks such as COBIT and NIST.
73. Skills Required:
74. Strong knowledge of information security, IT governance, and regulatory requirements.
75. Certifications such as CISM, CRISC, or CISSP.
76. Experience with IT risk assessment and mitigation.
77. Typical Employers: Technology companies, financial institutions, healthcare providers.
78. Chief Risk Officer (CRO)
79. Responsibilities:
80. Develop and lead the organization’s risk management strategy and framework.
81. Oversee enterprise risk management, internal audits, and compliance activities.
82. Report to the board of directors on risk exposure and mitigation efforts.
83. Drive risk culture and awareness throughout the organization.
84. Skills Required:
85. Strong leadership and strategic planning abilities.
86. Advanced knowledge of risk management and governance frameworks.
87. Experience working at the executive level.
88. Typical Employers: Large enterprises, multinational corporations, regulated industries.
89. Chief Compliance Officer (CCO)
90. Responsibilities:
91. Develop and oversee the organization’s compliance program.
92. Ensure that the organization complies with all external regulations and internal policies.
93. Lead compliance audits and investigations.
94. Serve as the key point of contact for regulatory agencies.
95. Skills Required:
96. Deep understanding of regulatory requirements in the organization’s industry.
97. Strong communication and decision-making abilities.
98. Experience with legal and compliance frameworks.
99. Typical Employers: Banks, healthcare organizations, multinational companies.
100. Enterprise Risk Manager
101. Responsibilities:
102. Manage enterprise-wide risk, ensuring a unified approach to risk across all business
units.
103. Implement risk management strategies at the organizational level.
104. Ensure compliance with risk management standards like ISO 31000.
105. Present risk reports and mitigation strategies to senior leadership.
106. Skills Required:
107. Proficiency in enterprise risk management frameworks (ERM).
108. Ability to work with cross-functional teams and lead risk management initiatives.
 109. Excellent analytical and problem-solving skills.
110. Typical Employers: Large corporations, public sector, consulting firms.
111. GRC Software Specialist/Administrator
112. Responsibilities:
113. Manage the organization’s GRC software platform (e.g., RSA Archer, MetricStream).
114. Configure and customize GRC tools to support governance, risk, and compliance
activities.
115. Train staff on the use of GRC technology.
116. Ensure data integrity and proper reporting from the GRC platform.
117. Skills Required:
118. Technical expertise in GRC software.
119. Familiarity with governance, risk, and compliance processes.
120. Strong project management and troubleshooting skills.
121. Typical Employers: Large corporations, IT service providers, financial institutions.

The 101 on "GRC"

"The easy way of understanding GRC:"

#### G = People - People are the ones who commit misconduct and make
mistakes and miscalculations. #### R = Wicked Problems; Complex Adaptive
Sytem of Systems - Wicked Problems - describe a complex, dynamic, and
multifaceted problem that is difficult or even impossible to solve
completely. - Complex adaptive system of systems - is a type of system that
is made up of many interacting subsystems, each with its own behavior,
rules, and feedback loops. #### C = Fractality - Fractality refers to the
property of self-similarity or the repetition of patterns at different
scales in a system or structure.

GRC Model
A GRC model refers to the structured approach an organization adopts to integrate governance,
risk management, and compliance into its operations. The goal of the model is to ensure all three
elements (Governance, Risk, and Compliance) work together efficiently and align with the
organization’s overall strategy and objectives. There are several well-established
models/frameworks used in GRC:

The Three Lines of Defense Model:

• First Line: Operational management owns and manages risks. They are responsible for
identifying, assessing, and controlling risks in day-to-day operations.
• Second Line: Risk management and compliance functions provide oversight. They develop
policies and monitor their application.
• Third Line: Internal audit provides independent assurance by reviewing the effectiveness of
the governance and risk management framework.
COSO (Committee of Sponsoring Organizations) Framework:
 • Focuses on internal controls, risk management, and corporate governance.
• It outlines five key components:
• Control Environment,
• Risk Assessment,
• Control Activities,
• Information and Communication, and
• Monitoring.
COBIT (Control Objectives for Information and Related Technologies):

A framework for the governance and management of IT enterprise systems. Helps ensure
alignment between IT and business goals, manage risk, and ensure compliance. Unified GRC
Model:

This model integrates GRC activities across the organization into a cohesive framework, where
governance, risk management, and compliance are addressed in a unified manner. It avoids silos
by aligning risk management, compliance functions, and governance under a single operational
structure, often supported by technology platforms for GRC automation.

Key Aspects of a GRC Model:

• Integration: GRC activities (governance, risk, and compliance) should be integrated across
departments and not handled in isolation.
• Accountability: Clear roles and responsibilities should be defined for those managing
governance, risk, and compliance.
• Process Alignment: Risk management and compliance activities should align with
organizational governance processes and strategic objectives.
• Technology Enablement: Use of GRC tools to manage policies, track risks, and ensure
compliance can significantly enhance efficiency.

Measuring GRC
Measuring the effectiveness of a GRC program involves establishing metrics that assess how well
the governance, risk, and compliance functions are performing. These measurements provide
insight into whether the GRC model is helping the organization achieve its goals while managing
risks and adhering to regulatory requirements.

Key Metrics for Measuring GRC:

Governance Metrics: * Policy Adherence Rate: Measures how well employees and processes
comply with internal policies. * Decision-Making Efficiency: Evaluates the effectiveness and
timeliness of decisions made based on governance frameworks. * Stakeholder Engagement:
Surveys and feedback from stakeholders to measure their involvement in governance.

Risk Management Metrics: * Risk Identification Rate: Measures how frequently new risks are
identified, indicating proactive risk management. * Risk Mitigation Success: Assesses how
effective the organization is in addressing identified risks (i.e., reduction in the number of
incidents). * Risk Appetite Adherence: Evaluates how well the organization operates within its
defined risk appetite or tolerance.
Compliance Metrics: * Compliance Breach Rate: The number of compliance violations or
regulatory breaches. * Audit Findings: The number and severity of issues identified during audits,
particularly regarding compliance with internal or external regulations. * Compliance Training
Completion Rate: The percentage of employees who have completed required compliance
training.

Incident Response and Recovery Metrics: * Mean Time to Detect (MTTD): Measures the
average time it takes to detect a security or compliance incident. * Mean Time to Respond
(MTTR): Tracks how quickly an organization can respond to and mitigate an incident. * Incident
Recurrence Rate: Measures whether the same or similar incidents are occurring repeatedly,
indicating the effectiveness of risk controls.

GRC Program Efficiency: * Cost of Compliance vs. Non-Compliance: Compares the cost of
implementing and maintaining compliance with the financial impact of non-compliance (penalties,
fines, etc.). * GRC Integration Efficiency: Evaluates how well governance, risk management, and
compliance processes are integrated into business operations. * Technology Utilization:
Measures the degree to which GRC technologies are used effectively to automate processes,
streamline reporting, and reduce manual effort.

Overall Performance Metrics: * ROI on GRC Investments: This metric evaluates the return on
investment (ROI) for GRC initiatives, comparing costs against measurable benefits, such as
reduced incidents, improved compliance, and more effective risk management. * Risk Exposure
Reduction: Measures the overall reduction in risk exposure across different categories
(operational, financial, legal) as a result of GRC activities. * Audit Results: Successful internal or
external audit outcomes indicate strong GRC processes.

Certification
For Beginners: - Certified in Risk and Information Systems Control (CRISC): Focuses on risk
management. - Certified Information Systems Auditor (CISA): Covers auditing, control, and
assurance.

For Intermediate/Advanced Professionals: - Certified Information Systems Security

Professional (CISSP): Provides a broad understanding of security principles, including
governance and risk management. - Certified in Governance, Risk, and Compliance (CGRC):
Specialized certification for GRC professionals.

For Expert Level: - Certified in Risk Management Assurance (CRMA): Focuses on risk
management and assurance. - Certified Information Security Manager (CISM): Focuses on
information security management, including governance and risk management.

Resources
Books
• “Governance, Risk, and Compliance Handbook for Financial Services” by J. J. Stone
• “Managing Risk in Information Systems” by D. G. Peltier
 • “The Complete Guide to Cybersecurity Risks and Controls” by Anne Kohnke, et al.

Videos/Tutorials
• YouTube Channels: GRC-related content can be found on channels like “InfoSec Institute,”
“Cybrary,” and “SANS Institute.”
• Practical GRC Series: Part 1 by Prabh Nair
• Practical GRC Series: Part 2 by Prabh Nair

Online Platforms
• LinkedIn Learning: Offers courses on risk management, governance, and compliance.
• Pluralsight: Provides courses on GRC concepts and frameworks.
• Coursera/Udemy/Udacity/EdX: Look for courses on GRC fundamentals, risk management,
and compliance.

Communities
• ISACA: Offers resources, forums, and events for GRC professionals.
• GRC Summit: An annual event where professionals can network and learn about the latest
in GRC.
• ISC2 Community: An active group where professionals help each other through various
ways including meetup, training, guidance, job referrals etc.

Useful Links
• You will get what you need for ISO 27001 here
• NIST RMF
 Chapter 9

Azure Security

This study plan is designed to help you master Azure Security, from foundational concepts to
advanced security engineering and operations. It aligns with Microsoft certifications like AZ-500
and SC series.

ToC
1. Azure Fundamentals - 2 weeks
2. Identity and Access Management - 2 weeks
3. Platform Protection - 2 weeks
4. Security Operations - 2 weeks
5. Resources

Azure Fundamentals
Duration: 2 weeks

Start here if you are new to Azure.

Week 1-2: Cloud Basics (AZ-900 level)

1. Core Concepts:
2. Regions, Availability Zones, Subscriptions, Resource Groups.
3. IaaS, PaaS, SaaS in Azure context.
4. Core Services:
5. Compute (VMs, App Service, AKS).
6. Networking (VNet, NSG, Load Balancers).
7. Storage (Blob, File, Disk).
8. Basic Security:
9. Shared Responsibility Model.
10. Azure Policy & Blueprints basics.
11. Microsoft Defender for Cloud (Free tier).

Identity and Access Management

Duration: 2 weeks

Identity is the new perimeter.

Week 3-4: Microsoft Entra ID (formerly Azure AD)

1. Core Identity:
2. Users, Groups, Service Principals, Managed Identities.
3. Hybrid Identity (Azure AD Connect).
4. Access Control:
5. RBAC: Built-in roles, Custom roles, Scope (Mgmt Group > Sub > RG > Resource).
6. Conditional Access: Policies based on location, device state, risk.
7. Identity Protection:
8. PIM (Privileged Identity Management).
9. MFA and Passwordless auth.
10. Identity Protection (Risk detection).

Platform Protection
Duration: 2 weeks

Securing the infrastructure and data.

Week 5-6: Network & Compute

1. Network Security:
2. NSGs vs ASGs.
3. Azure Firewall & Azure Firewall Manager.
4. DDoS Protection (Basic vs Standard).
5. Private Link & Service Endpoints.
6. Compute & Container Security:
7. VM security (Bastion, JIT access, Disk Encryption).
8. AKS Security (Network policies, private clusters).
9. Data Security:
10. Key Vault (Secrets, Keys, Certs).
11. Storage Security (SAS tokens, Access Keys, Encryption).
12. SQL Database Security (TDE, Firewall, Auditing).

Security Operations
Duration: 2 weeks

Monitoring and responding to threats.

Week 7-8: Defender & Sentinel
1. Microsoft Defender for Cloud:
2. CSPM (Cloud Security Posture Management) - Secure Score.
3. CWP (Cloud Workload Protection) - Alerts for VMs, Storage, SQL, Containers.
4. Microsoft Sentinel (SIEM/SOAR):
5. Connecting data sources.
6. KQL (Kusto Query Language) basics for hunting.
7. Creating Analytics Rules and Incidents.
8. Automation with Playbooks (Logic Apps).

Resources
Certifications
• AZ-500: Azure Security Technologies (Core certification).
• SC-900: Security, Compliance, and Identity Fundamentals.
• SC-200: Security Operations Analyst (Sentinel/Defender focus).
• SC-300: Identity and Access Administrator (Entra ID focus).

Learning Paths
• Microsoft Learn: Azure Security Engineer
• Microsoft Learn: SC-200

Labs & Practice

• Azure Citadel
• Microsoft GitHub Labs (Search for AZ-500)
 Chapter 10

DevSecOps

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job roles which require good
knowledge of DevSecOps. Also, I assume you have already checked and are comfortable with
Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be a DevSecOps
Engineer / DevSecOps-focused security engineer. DevSecOps is not just "adding security tools to
CI/CD". It is about building security into how software is planned, built, tested, delivered, and
operated - with as much automation and feedback as possible.

It is more towards: - working closely with developers, SRE/DevOps, and AppSec, - integrating
security checks into pipelines and platforms, - defining secure defaults and guardrails, - enabling
teams to ship fast and safely.

Usually it will take you 6-12 months to be good at the DevSecOps fundamentals to get a job at
entry level or move laterally from AppSec/DevOps into a DevSecOps role.

In short
1. DevSecOps is not a separate silo - it is how development, security, and operations work
together.
2. Think more of a combination of developer, DevOps/SRE, and security engineer.
3. You should be comfortable with CI/CD systems, containers, and basic cloud concepts.
4. You should know enough Application Security to choose and tune the right checks.
5. Automation, feedback loops, and culture change are as important as tools.

ToC
1. DevSecOps Fundamentals - 3-4 weeks
2. CI/CD and Automation Basics - 3-4 weeks
3. Security Testing in the Pipeline - 4-6 weeks
4. Cloud, Containers and IaC Security - 4-6 weeks
5. Platform Guardrails and Governance - 3-4 weeks
6. Metrics, Feedback and Culture - 2-3 weeks
7. Books
8. Videos
 9. Courses
10. Certifications
11. Interview Questions

DevSecOps Fundamentals
Duration: 3-4 weeks

Goal here is to understand what DevSecOps is and what problems it tries to solve.

Week 1-2: Evolution & Goals

1. Understand the evolution:
2. Dev → DevOps → DevSecOps.
3. Why traditional "security at the end" does not work.
4. Read or refresh related study plans:
5. Application Security Study Plan
6. Security Development Lifecycle (SDL) Study Plan
7. Relevant cloud security study plan(s) (AWS/Azure/GCP) if you know your focus.

Week 3-4: Responsibilities & Shift Left

1. Understand the main DevSecOps goals:
2. Shift security left (earlier in SDLC) and right (monitoring in production).
3. Make security part of the delivery pipeline, not a blocking afterthought.
4. Provide self-service security capabilities for product teams.
5. Know typical DevSecOps responsibilities:
6. Designing and maintaining security checks in CI/CD.
7. Working with platform/DevOps teams to define secure defaults.
8. Helping AppSec/Product Security scale via automation.

CI/CD and Automation Basics

Duration: 3-4 weeks

You cannot do DevSecOps effectively without basic CI/CD understanding.

Week 5-6: Platforms & Stages

1. Learn one or two CI/CD platforms in depth (e.g., GitHub Actions, GitLab CI, Jenkins, Azure
DevOps, CircleCI - depending on your environment).
2. Understand common pipeline stages:
3. Build
 4. Unit/Integration tests
5. Security tests
6. Packaging and artifact management
7. Deployment

Week 7-8: Infrastructure & Practice

1. Learn infrastructure around pipelines:
2. Repositories and branching strategies.
3. Environments (dev, test, stage, prod).
4. Secrets management for pipelines.
5. Practice:
6. Create a simple app and add a basic CI pipeline (build + tests).
7. Then plan where security checks will be plugged in (SAST, SCA, etc.).

Security Testing in the Pipeline

Duration: 4-6 weeks

Here you focus on what kinds of security checks you can automate and where.

Week 9-11: SAST, SCA & Secrets

1. Static Application Security Testing (SAST)
2. What it is good at and its limitations (false positives, language support).
3. Where to run it in the pipeline (typically on pull request/merge).
4. How to configure basic rules and quality gates.
5. Software Composition Analysis (SCA) / Dependency Scanning
6. Why vulnerable dependencies are a big risk.
7. License risks and SBOM basics.
8. Automating dependency checks and upgrade workflows.
9. Secrets Detection
10. Preventing API keys and passwords from being committed.
11. Pre-commit hooks vs pipeline checks.

Week 12-14: DAST & Container Scanning

1. Dynamic Application Security Testing (DAST) and API testing
2. Basic idea of black-box testing against running apps/APIs.
3. Where in the delivery process to run it (e.g., pre-prod env).
4. Container and Image Scanning
5. Base image vulnerabilities.
6. Application packages inside containers.
 7. Integrating scanning into image build process.
You do not need to be an expert in every tool, but you should understand which type of test fits
which risk and where in the pipeline it makes sense.

Cloud, Containers and IaC Security

Duration: 4-6 weeks

Most DevSecOps work today happens around cloud-native stacks.

Week 15-17: Containers & Orchestration

1. Containers and orchestration:
2. Basics of Docker (images, containers, Dockerfile).
3. Basics of Kubernetes or your orchestration platform (pods, services, deployments,
namespaces).
4. Common container security risks (running as root, capabilities, image provenance).

Week 18-20: IaC & Baselines

1. Infrastructure as Code (IaC):
2. Terraform, CloudFormation, ARM/Bicep, etc.
3. Why IaC is powerful for repeatable, auditable infrastructure.
4. Typical misconfigurations (open security groups, public buckets, missing encryption).
5. Cloud security baselines:
6. Align with your cloud study plan(s) for core cloud security concepts.
7. Understand provider-native security services (e.g., security center, config, guardrails).
8. DevSecOps role here:
9. Integrate image and IaC scanning into pipelines.
10. Enforce baseline policies via policy-as-code (e.g., OPA/Conftest, admission controllers).

Platform Guardrails and Governance

Duration: 3-4 weeks

DevSecOps is also about secure platforms, not only individual pipelines.

Week 21-24: Guardrails & Governance

1. Understand platform engineering concepts:
2. Internal developer platforms.
3. Golden paths and templates.
4. Typical security guardrails:
 5. Standardized service templates with logging, monitoring, and security defaults.
6. Centralized identity and access patterns.
7. Network policies and ingress/egress controls.
8. Governance and approvals:
9. When approval workflows are necessary.
10. Automating checks so humans mainly handle exceptions.
11. Work with Product Security / AppSec / Cloud Security to define:
12. Minimal controls all services must have.
13. Exception handling and risk acceptance process.

Metrics, Feedback and Culture

Duration: 2-3 weeks

DevSecOps is as much about people and feedback as it is about tools.

Week 25-27: Metrics & Culture

1. Metrics you might track:
2. Security findings per pipeline or service (and trends).
3. MTTR for security issues.
4. Adoption of security checks (percentage of services with SAST/SCA/etc.).
5. Feedback loops:
6. Making scanner results visible and understandable to developers.
7. Fast feedback on pull requests.
8. Security office hours or help channels.
9. Culture and enablement:
10. Security champions in teams.
11. Training developers on interpreting and fixing findings.
12. Keeping friction low - avoid turning tools into constant blockers.

Books
1. Any solid DevOps/Continuous Delivery book to understand the base culture and practices.
2. Books on building Application Security programs (see Application Security plan) - useful for
understanding what you are automating.
3. Books on cloud-native security and container security that include CI/CD viewpoints.

Videos
 1. Conference talks on DevSecOps (OWASP, DevOpsDays, KubeCon, etc.).
2. Videos showing real-world CI/CD security implementations.
3. Talks on security automation, policy-as-code, and platform engineering.

Courses
1. DevSecOps-focused courses that cover CI/CD, automation, and security tooling.
2. Cloud-native security courses that include pipeline and platform topics.
3. Container and Kubernetes security courses that show how to integrate checks into
pipelines.

Certifications
1. Cloud security certifications related to your main cloud provider (AWS/Azure/GCP).
2. DevOps/Cloud-native certifications that cover CI/CD and containers.
3. Application Security or Secure SDLC certifications if you want to emphasize the security
side.

Interview Questions
You can reuse many questions from the Application Security interview questions and from any
cloud/security interviews, but focus on how you would automate and integrate security into
pipelines and platforms.

Additional DevSecOps-focused questions could be:

1. How would you add security checks into an existing CI/CD pipeline without slowing teams
down too much?
2. How do you decide which security tools to run on pull requests vs in nightly builds?
3. How would you integrate container and IaC scanning into the delivery process?
4. How would you measure the success of a DevSecOps initiative over 6-12 months?
 Chapter 11

Docker Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job roles which require good
knowledge of Docker and container security. Also, I assume you have already checked and are
comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be good at
Docker/container security. Docker Security is a focused subset of cloud-native security and
DevSecOps. You need to understand how images and containers work, what can go wrong, and
how to build and run them securely across the SDLC.

It is more towards: - building minimal and secure container images, - understanding runtime
hardening and isolation, - integrating image scanning into CI/CD, - and working with DevSecOps /
Platform teams on secure base images.

Usually it will take you 4-8 weeks to be comfortable with Docker Security fundamentals, assuming
you already know basic Docker usage.

In short
1. Docker Security is not just running a scanner on images.
2. Think more of image hygiene + least privilege + secure defaults.
3. You should be comfortable writing and reviewing Dockerfiles.
4. You must understand how containers differ from VMs and what isolation they provide (and
don’t).
5. You should know where Docker Security fits into DevSecOps and cloud security.

ToC
1. Docker and Container Fundamentals - 1-2 weeks
2. Image Build and Supply Chain Security - 1-2 weeks
3. Runtime Hardening and Host Security - 1-2 weeks
4. Scanning, Policies and CI/CD Integration - 1-2 weeks
5. Books
6. Videos
7. Courses
8. Certifications
 9. Interview Questions

Docker and Container Fundamentals

Duration: 1-2 weeks

Goal here is to be very comfortable with how Docker works before going deep into security.

Week 1-2: Core Concepts

1. Revisit basic Docker concepts:
2. Images, layers, containers.
3. Dockerfile instructions (FROM, RUN, COPY, CMD, ENTRYPOINT, EXPOSE, USER, etc.).
4. Volumes and networking basics.
5. Understand containers vs VMs:
6. Namespaces and cgroups at high level.
7. Shared kernel model and what isolation it gives.
8. Practice:
9. Build simple images from base images (alpine, debian, etc.).
10. Run containers, inspect them, and play with basic commands.

Image Build and Supply Chain Security

Duration: 1-2 weeks

Here you focus on building secure images and understanding supply chain risk.

Week 3-4: Secure Images

1. Secure Dockerfile practices:
2. Use minimal base images.
3. Avoid unnecessary packages and tools.
4. Do not run as root - use USER properly.
5. Separate build and runtime stages (multi-stage builds).
6. Keep secrets out of images.
7. Dependency and base image risk:
8. Understand how vulnerabilities in base images affect you.
9. Learn to track and update base images regularly.
10. Basic supply chain concepts:
11. Image registries and access controls.
12. Image signing and provenance (high level).
13. Practice:
 14. Take an existing Dockerfile and harden it step by step.
15. Compare image sizes and contents before vs after.

Runtime Hardening and Host Security

Duration: 1-2 weeks

Even with secure images, runtime and host configuration matter a lot.

Week 5-6: Runtime Security

1. Container runtime security basics:
2. Dropping capabilities.
3. Read-only filesystems where possible.
4. Limiting resources (CPU/memory) via cgroups.
5. Networking and exposure:
6. Avoid unnecessary open ports.
7. Use networks to separate services.
8. Host hardening:
9. Keep Docker engine and OS patched.
10. Limit who can run Docker (docker group is effectively root).
11. Logging and monitoring of Docker daemon and containers.
12. Integration with orchestration:
13. How these concepts later map into Kubernetes or other orchestrators (see Kubernetes
Security Study Plan).

Scanning, Policies and CI/CD Integration

Duration: 1-2 weeks

This is where Docker Security meets DevSecOps.

Week 7-8: Automation & Policies

1. Image scanning:
2. Understand what image scanners usually check (OS packages, app libs).
3. Severity, fix availability, and risk-based triage.
4. Where to scan: in CI, in registry, and/or in runtime.
5. Policies and baselines:
6. Define basic rules (no latest tags, specific allowed registries, minimal base images, no root
user by default).
7. Enforce through CI checks and registry policies.
 8. CI/CD integration:
9. Cross-link with DevSecOps Study Plan.
10. Add image build and scan stages into pipelines.
11. Decide when to block vs warn.

Books
1. Any good Docker/Container fundamentals book - focus on sections about security and best
practices.
2. Books on container security or cloud-native security that include Docker as a base.

Videos
1. Docker security talks from major conferences (DockerCon, KubeCon, OWASP).
2. Short tutorials on writing secure Dockerfiles and hardening images.
3. Videos on container runtime hardening and host security.

Courses
1. Docker/Container security courses that cover image hardening and runtime security.
2. DevSecOps courses that include container image scanning and CI/CD integration.

Certifications
1. Container or cloud-native security certifications where Docker is a key part of the
curriculum.
2. General cloud security certifications (AWS/Azure/GCP) if you deploy Docker workloads to
cloud.

Interview Questions
You can reuse some questions from Application Security and DevSecOps, but focus on
containers:

1. How would you harden a Dockerfile for a typical web application?

2. What are common security risks in container images and how do you detect them?
3. How would you integrate image scanning into a CI/CD pipeline?
4. What are the implications of giving developers access to the docker group on a host?
 Chapter 12

Kubernetes Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job roles which require good
knowledge of Kubernetes and container orchestration security. Also, I assume you have already
checked and are comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be good at Kubernetes
Security. Kubernetes Security builds on Docker/container security and cloud security. You need to
understand how Kubernetes works, how workloads are deployed and exposed, and what controls
exist at cluster, namespace, and workload levels.

It is more towards: - securing clusters and control plane access, - defining secure defaults for
workloads (namespaces, RBAC, network policies), - integrating Kubernetes security checks into
DevSecOps pipelines, - and working with platform/SRE teams to keep clusters hardened.

Usually it will take you 6-10 weeks to be comfortable with Kubernetes Security fundamentals,
assuming you already know basic Docker and some Kubernetes usage.

In short
1. Kubernetes Security is not just enabling a few network policies.
2. Think more of multi-layer defense: cluster, namespace, workload, network, and supply
chain.
3. You should be comfortable with basic Kubernetes concepts (pods, deployments, services,
ingress, configmaps, secrets).
4. You should understand how containers and images are built and scanned (see Docker
Security Study Plan).
5. You should know how Kubernetes fits into DevSecOps and cloud-native security.

ToC
1. Kubernetes Fundamentals for Security - 1-2 weeks
2. Cluster and Control Plane Security - 1-2 weeks
3. Workload and Identity Security - 2-3 weeks
4. Network, Policies and Multi-tenancy - 1-2 weeks
5. Supply Chain and Runtime Security - 1-2 weeks
6. Books
7. Videos
 8. Courses
9. Certifications
10. Interview Questions

Kubernetes Fundamentals for Security

Goal here is to be very comfortable with how Kubernetes works, specifically from a security point
of view.

1. Revisit basic Kubernetes concepts:

2. Cluster components (api-server, controller-manager, scheduler, etcd, kubelet).
3. Pods, deployments, replica sets.
4. Services, ingress, configmaps, secrets.
5. Understand basic deployment flows:
6. How manifests define workloads (YAML).
7. How services expose pods.
8. How ingress or load balancers expose services externally.
9. Map where security decisions are made:
10. Who can talk to the API server (authentication and RBAC).
11. Which nodes run which workloads.
12. How traffic flows inside and outside the cluster.

Kubernetes Fundamentals and Cluster Setup

Duration: 1-2 weeks

Before securing it, you must understand how it works.

Week 1-2: Core Concepts

1. Architecture: Control Plane (API Server, etcd, Scheduler, Controller Manager) vs Worker
Nodes (Kubelet, Kube-proxy, Container Runtime).
2. Objects: Pods, Deployments, Services, ConfigMaps, Secrets, Namespaces.
3. Networking: CNI basics, Pod-to-Pod communication, Service discovery.
4. Practice: Set up a cluster using kind or minikube and deploy a simple app.

Cluster Hardening
Duration: 1-2 weeks

Securing the infrastructure itself.

Week 3-4: Hardening the Cluster
1. CIS Benchmarks: Understand and apply CIS Kubernetes Benchmark.
2. API Server Security:
3. Disable anonymous access.
4. Enable audit logging.
5. Restrict access to etcd.
6. RBAC (Role-Based Access Control):
7. Roles vs ClusterRoles.
8. Bindings.
9. Principle of Least Privilege.
10. Node Security:
11. OS hardening.
12. Kubelet security configuration.

Workload Security
Duration: 1-2 weeks

Securing what runs inside the cluster.

Week 5-6: Securing Pods & Deployments

1. Pod Security Standards (PSS): Privileged, Baseline, Restricted profiles.
2. Security Context:
3. runAsUser, runAsGroup.
4. readOnlyRootFilesystem.
5. allowPrivilegeEscalation: false.
6. Network Policies:
7. Default deny all.
8. Allow specific traffic (ingress/egress).
9. Secrets Management:
10. Kubernetes Secrets (encryption at rest).
11. External Secret Stores (Vault, AWS Secrets Manager).

Supply Chain and Runtime Security

Duration: 1-2 weeks

Ensuring integrity and monitoring behavior.

Week 7-8: Advanced Topics

 1. Admission Controllers:
2. Validating and Mutating webhooks.
3. Policy engines: OPA Gatekeeper or Kyverno.
4. Supply Chain:
5. Image signing (Cosign).
6. Image scanning in CI/CD.
7. Runtime Security:
8. Detecting anomalies (Falco).
9. Sandboxed containers (gVisor, Kata Containers). if needed.

Network, Policies and Multi-tenancy

Kubernetes networking is a big part of securing workloads.

1. Basic network model:

2. Pod-to-pod and pod-to-service communication.
3. Ingress controllers and load balancers.
4. Network Policies:
5. Deny-by-default vs allow-by-default.
6. Writing simple network policies to restrict traffic.
7. Multi-tenancy considerations:
8. Combining namespaces, network policies, and RBAC for isolation.
9. Basic ideas of multi-tenant cluster vs dedicated clusters.

Supply Chain and Runtime Security

Here you connect Kubernetes Security with Docker Security and DevSecOps.

1. Supply chain:
2. Image registries and allowed registries.
3. Image scanning before deployment.
4. Admission controllers or policy engines (at a high level) to enforce constraints.
5. Runtime security:
6. Monitoring workloads for suspicious behavior.
7. Basic idea of using runtime security tools to detect attacks.
8. Cross-link to other plans:
9. Docker Security Study Plan.
10. DevSecOps Study Plan.
11. Relevant cloud security study plans if running managed Kubernetes.
Books
1. Kubernetes fundamentals books - focus on the chapters about security.
2. Dedicated Kubernetes security or cloud-native security books that cover RBAC, network
policies, and admission control.

Videos
1. Kubernetes security talks from KubeCon, CNCF events, and OWASP.
2. Tutorials on securing RBAC, network policies, and pod security.
3. Videos on managed Kubernetes security (EKS, AKS, GKE) from cloud providers.

Courses
1. Kubernetes security-focused courses (often part of cloud-native security tracks).
2. Hands-on labs for Kubernetes RBAC, network policies, and workload hardening.
3. DevSecOps courses which include Kubernetes integration.

Certifications
1. Kubernetes-related certifications that cover security (CKA/CKS and similar) if they align
with your goals.
2. Cloud security or cloud-native certifications where Kubernetes is a major component.

Interview Questions
You can reuse questions from Docker Security, DevSecOps, and cloud security but focus on
Kubernetes specifics:

1. How would you secure access to a Kubernetes cluster for multiple teams?
2. How would you restrict which services/pods can talk to each other?
3. What are the risks of running privileged containers and how do you prevent it?
4. How would you ensure only trusted images are deployed in a cluster?
 Chapter 13

Network Security

In this plan, let's assume that you already have some computer science skills (linux basics,
common windows or mac os use, search on the internet, edit a file...).
But first, what is network security ? Network security includes all methods, both defensive and
offensive, to protect and maintain functional a network.

This plan has several objectives, in short : - Understand networks and how it works - Common
vulnerabilities and how to detect them - How to remedy these vulnerabilities and secure your
network

ToC
1. Network Fundamentals - 2 weeks
2. Network Defense - 2 weeks
3. Network Attacks and Analysis - 2 weeks
4. Wireless and Advanced Topics - 2 weeks
5. Resources

Network Fundamentals
Duration: 2 weeks

In this first part you will focus on learning the basics concepts of networks (architectures,
protocols, OSI model).

Week 1-2: Core Concepts

1. OSI & TCP/IP Models: Understand layers and encapsulation.
2. Protocols: IP, TCP, UDP, ICMP, DNS, DHCP, HTTP/HTTPS, SSH.
3. Addressing: IPv4, IPv6, Subnetting, MAC addresses.
4. Routing & Switching: Basics of how data moves.
Resources: - Networking for Ethical Hackers from The Cyber Mentor - You Suck at Subnetting
from NetworkChuck - TryHackMe Pre-Security Path

Network Defense
Duration: 2 weeks

Learn how to protect and maintain a functional network.

Week 3-4: Defensive Technologies

1. Firewalls: Stateful vs Stateless, WAFs.
2. IDS/IPS: Snort, Suricata basics.
3. VPNs: Tunneling, IPsec, SSL VPNs.
4. Hardening: Port security, disabling unused services, segmentation (VLANs).
Resources: - Blue Teaming and Network Defense Series from LoiLiangYang - TryHackMe
Network Security Module

Network Attacks and Analysis

Duration: 2 weeks

Understand common vulnerabilities and how to detect them.

Week 5-6: Offensive Concepts & Analysis

1. Scanning: Nmap, Masscan (Host discovery, port scanning).
2. Sniffing: Wireshark, tcpdump (Packet analysis).
3. Attacks: MITM, ARP Spoofing, DoS/DDoS, DNS Poisoning.
4. Tools: Netcat, Metasploit (basics).
Resources: - TryHackMe Wireshark - HakTip: Netcat

Wireless and Advanced Topics

Duration: 2 weeks

Expanding into wireless and more complex scenarios.

Week 7-8: Wireless & Beyond

1. Wireless Security: WEP, WPA2/WPA3, Handshakes, Aircrack-ng.
2. Network Architecture: DMZ, Bastion Hosts, Zero Trust basics.
3. Traffic Analysis: Identifying anomalies and malware traffic.
Resources: - RootMe Network Challenges

To finish with this plan, as I said above, you should at least create free-accounts on platforms
such as tryhackme or rootme. This is useful to learn cybersecurity and developp skills and
knowledge.
You should create a github account too, to post code and projects about cybersecurity or
whatever you want (if you don't code yet, please consider this other tryhackme module. After
that, you will certainly find content on youtube to go further in programming, which is more
than useful for cybersecurity.

A X(twitter) account can be useful too to keep informed of cybersecurity news and to build a
reputation into the domain.

If you want to go deeper into monitoring, detection and incident response after Network Security,
read the Blue Team, Detection & Response Study Plan.
 Chapter 14

Cryptography

In this plan, let's assume that you already have some computer science skills (linux basics,
common windows or mac os use, search on the internet, edit a file...).
But first, what is cryptography ? cryptography is the practice and study of techniques for
secure communication in the presence of adversarial behavior.

This plan has several objectives, in short : - learn about cryptography theoric concepts - become
familiar with useful cryptography tools - how to apply all this acknoledgment in the context of
cybersecurity

ToC
1. Theoretical Concepts - 2 weeks
2. Applied Cryptography - 2 weeks
3. Cryptography Tools - 2 weeks
4. Cryptanalysis & Challenges - 2 weeks
5. Resources

Theoretical Concepts
Duration: 2 weeks

In this first part you will focus on learning the basics concepts of cryptography (algorithms,
keys, PKI, hashing).

Week 1-2: Core Concepts

1. Symmetric vs Asymmetric Encryption: DES, AES, RSA, ECC.
2. Hashing Algorithms: MD5, SHA-1, SHA-256, SHA-3.
3. Public Key Infrastructure (PKI): Certificates, CAs, Chain of Trust.
4. Digital Signatures: How they work and why they are important.
Resources: - Basic Cryptography from Sunny Classroom - Cryptography Module on TryHackMe

Applied Cryptography
Duration: 2 weeks
How to apply this knowledge in the context of cybersecurity and secure communications.

Week 3-4: Protocols & Implementation

1. SSL/TLS: Handshake process, versions, and security.
2. SSH: Secure remote access, key management.
3. Email Security: PGP, GPG, S/MIME.
4. Data at Rest vs Data in Transit.
Resources: - Hak5: SSH Inside and Out - Real-world Cryptography (Book)

Cryptography Tools
Duration: 2 weeks

Become familiar with useful cryptography tools for analysis and implementation.

Week 5-6: Hands-on Tools

1. OpenSSL: Generating keys, CSRs, and testing connections.
2. GPG: Encrypting and signing files.
3. John the Ripper / Hashcat: Password cracking basics (understanding strength).
4. CyberChef: The "Swiss Army Knife" for encryption/decoding.
Resources: - TryHackMe Practice - CyberChef

Cryptanalysis & Challenges

Duration: 2 weeks

Time to challenge yourself with CTFs and cryptanalysis puzzles.

Week 7-8: Breaking Codes

1. Classical Ciphers: Caesar, Vigenère (for historical context).
2. Modern Attacks: Padding Oracle, POODLE, Heartbleed (understanding the flaws).
3. CTF Challenges: Solve crypto challenges on platforms.
Resources: - RootMe Cryptanalysis Challenges - Cryptopals Crypto Challenges

Resources
Platforms
 • [Link]
• TryHackMe
• RootMe

Books
• Serious Cryptography by Jean-Philippe Aumasson
• Real-World Cryptography by David Wong
 Chapter 15

Software Supply Chain Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job roles which require good
knowledge of software supply chain security. Also, I assume you have already checked and are
comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be good at Software
Supply Chain Security. Software supply chain security is about securing all the components, tools,
and services that go into building, packaging, and delivering software: source code,
dependencies, build systems, CI/CD pipelines, artifacts, and runtime environments.

It is more towards: - understanding how code and dependencies flow from dev laptops to
production, - securing dependencies and third-party components, - hardening build and CI/CD
systems, - ensuring integrity of artifacts and deployments, - and responding to supply chain
incidents quickly.

Usually it will take you 8-16 weeks to be comfortable with software supply chain security
fundamentals, depending on your background in AppSec, DevSecOps, and cloud.

In short
1. Software supply chain security is not just dependency scanning.
2. Think more of end-to-end integrity: from source to production.
3. You should be comfortable with version control, CI/CD, and package managers.
4. You should know the basics of DevSecOps, Docker/Kubernetes, and cloud.
5. You must understand how real-world incidents happened to avoid repeating them.

ToC
1. Supply Chain Fundamentals - 2-3 weeks
2. Dependencies and Package Ecosystems - 2-3 weeks
3. Build Systems and CI/CD Security - 2-3 weeks
4. Artifact Integrity, Signing and SBOM - 2-3 weeks
5. Historical Supply Chain Incidents - 1-2 weeks
6. Detection, Response and Governance - 2-3 weeks
7. Books
8. Videos
 9. Courses
10. Certifications
11. Interview Questions

Supply Chain Fundamentals

Duration: 2-3 weeks

Goal here is to understand what “software supply chain” actually means.

Week 1-3: The Chain

1. Understand the basic stages:
2. Developer workstation and source control.
3. Dependencies and package managers.
4. Build systems and CI/CD pipelines.
5. Artifact repositories and container registries.
6. Deployment and runtime environments.
7. Read or refresh related study plans:
8. Application Security Study Plan
9. DevSecOps Study Plan
10. Docker Security Study Plan
11. Kubernetes Security Study Plan
12. Map risks at each stage:
13. Source code tampering, credential theft.
14. Malicious or vulnerable dependencies.
15. Compromised build agents or pipelines.
16. Poisoned images or artifacts.
17. Misconfigurations in deployment.

Dependencies and Package Ecosystems

Duration: 2-3 weeks

Dependencies are one of the largest attack surfaces.

Week 4-6: Dependencies

1. Understand different ecosystems:
2. npm/yarn/pnpm for JavaScript/TypeScript.
3. PyPI for Python, Maven/Gradle for Java, NuGet for .NET, etc.
4. Common risks:
 5. Dependency confusion and typosquatting.
6. Malicious maintainers or compromised accounts.
7. Abandoned or unmaintained packages.
8. Basic protections:
9. Lockfiles and deterministic builds.
10. Private registries or proxies.
11. Using allowlists/blocklists for dependencies.
12. Dependency scanning:
13. Understanding SCA (Software Composition Analysis).
14. Severity, exploitability, and prioritization of dependency vulns.

Build Systems and CI/CD Security

Duration: 2-3 weeks

Here you focus on securing the build and delivery machinery.

Week 7-9: Pipeline Security

1. Understand key components:
2. CI servers/agents.
3. Build scripts and configuration.
4. Secrets used in pipelines (cloud creds, signing keys, etc.).
5. Common risks:
6. Attackers gaining access to CI agents or configuration.
7. Insecure storage or handling of secrets.
8. Unreviewed changes to build scripts.
9. Basic hardening:
10. Least privilege for CI service accounts.
11. Separate build agents for different trust levels.
12. Code review and change control for build configs.
13. Cross-link with DevSecOps Study Plan for CI/CD details.

Artifact Integrity, Signing and SBOM

Duration: 2-3 weeks

This is about making sure what you build is exactly what gets deployed.

Week 10-12: Integrity

1. Artifact repositories and registries:
 2. Access control and separation of environments.
3. Immutable artifacts where possible.
4. Signing and verification (high level):
5. Code signing concepts.
6. Image signing and verification.
7. SBOM (Software Bill of Materials):
8. What an SBOM is and why it matters.
9. How SBOMs help in incident response and compliance.
10. Simple practices:
11. Track which artifact versions are deployed where.
12. Ensure builds are reproducible and traceable.

Historical Supply Chain Incidents

Duration: 1-2 weeks

You will learn a lot by understanding how major incidents happened.

Week 13-14: Case Studies

1. npm ecosystem attacks (examples at a high level):
2. Malicious packages published to npm to steal credentials, exfiltrate data, or run
cryptominers.
3. Typosquatting attacks where packages with names similar to popular libraries are
published.
4. Incidents where maintainers’ accounts were compromised and releases were backdoored.
5. SHA-1 related attacks (e.g., SHA-1 collision attacks):
6. Collision attacks against SHA-1 showed that older hash algorithms may no longer be safe
for integrity.
7. Understand why moving away from weak hashes (like SHA-1) matters in signing and
integrity checks.
8. SolarWinds-style attacks:
9. Attackers compromised the vendor’s build system.
10. Malicious code was inserted into legitimate updates.
11. Customers trusted signed updates, so the backdoor spread widely.
12. For each incident type, focus on:
13. Where in the supply chain the attacker gained control.
14. What controls were missing or weak.
15. What changes were made after the incident (e.g., more signing, better monitoring, stricter
access control).
Detection, Response and Governance
Duration: 2-3 weeks

Finally, focus on how to detect and respond to supply chain issues and how to govern the
program.

Week 15-17: Operations

1. Detection:
2. Monitoring dependency changes and vulnerability feeds.
3. Alerting on unusual build or deployment behavior.
4. Logging around CI/CD and registries.
5. Response:
6. Having an inventory of where components are used.
7. Rapid patching or rollback strategies.
8. Communication with stakeholders and customers.
9. Governance:
10. Policies for dependency management and updates.
11. Standards for CI/CD and artifact handling.
12. Regular reviews and tabletop exercises based on real incidents.

Books
1. Any good book on software supply chain or modern software security that includes supply
chain chapters.
2. Books on DevSecOps and cloud-native security that cover CI/CD and dependencies.

Videos
1. Conference talks on software supply chain attacks and defenses.
2. Deep dives on major incidents (e.g., large vendor compromises, dependency attacks).
3. Talks on SBOMs, signing, and secure build pipelines.

Courses
1. Courses specifically focused on software supply chain security, if available.
2. DevSecOps courses with strong coverage of CI/CD and dependency scanning.
3. Cloud-native security courses that include supply chain topics.
Certifications
1. General cloud security and DevSecOps certifications that include supply chain security.
2. Any vendor-neutral or vendor-specific certifications that emphasize secure SDLC and
CI/CD.

Interview Questions
You can reuse questions from Application Security, DevSecOps, and cloud security, but add
supply chain focus:

1. How would you reduce the risk of malicious dependencies in a large organization?
2. What controls would you put around CI/CD systems to protect against supply chain
attacks?
3. How would you respond if a widely used third-party library in your product was suddenly
found to be compromised?
4. How would you explain the importance of SBOMs and artifact signing to engineering
leadership?
 Chapter 16

Secure Code Review

This study plan is designed to help you master the art of Secure Code Review. It covers
methodologies, common vulnerabilities, tools, and best practices for identifying security flaws in
source code.

ToC
1. Code Review Fundamentals - 2 weeks
2. Common Vulnerabilities in Code - 2 weeks
3. Process and Checklists - 2 weeks
4. Tools and Automation - 2 weeks
5. Resources

Code Review Fundamentals

Duration: 2 weeks

Understand the basics of code review and why it's critical.

Week 1-2: The Basics

1. What is Secure Code Review?
2. Difference between functional review and security review.
3. Manual vs Automated review.
4. Code Review Strategies:
5. Top-down: Start from high-level logic/entry points.
6. Bottom-up: Start from sensitive functions (sinks).
7. Secure Coding Principles:
8. Input Validation.
9. Output Encoding.
10. Least Privilege.
11. Defense in Depth.

Common Vulnerabilities in Code

Duration: 2 weeks

Learn what to look for.

Week 3-4: Spotting Bugs

1. OWASP Top 10 (Code Perspective):
2. Injection: SQLi, Command Injection (look for unparameterized queries, eval(), exec()).
3. Broken Auth: Hardcoded credentials, weak session management.
4. XSS: Lack of context-aware encoding.
5. Insecure Deserialization: Unsafe handling of serialized objects.
6. Language-Specific Issues:
7. Java: Deserialization, XXE.
8. Python: Pickle, eval(), Jinja2 SSTI.
9. JavaScript/[Link]: Prototype pollution, eval().

Process and Checklists

Duration: 2 weeks

Structuring your review.

Week 5-6: Systematic Review

1. OWASP Secure Code Review Guide:
2. Read the guide to understand the methodology.
3. Checklists:
4. Authentication & Authorization.
5. Data Validation.
6. Error Handling & Logging.
7. Cryptography (weak algos, hardcoded keys).
8. Reviewing Business Logic:
9. Race conditions.
10. Order of operations flaws.
11. Price manipulation.

Tools and Automation

Duration: 2 weeks

Enhancing manual review with tools.

Week 7-8: SAST & IDE Plugins

 1. Static Application Security Testing (SAST):
2. SonarQube: Setup and rule configuration.
3. Semgrep: Writing custom rules (highly recommended).
4. CodeQL: Querying code as data.
5. IDE Plugins:
6. Snyk, SonarLint.
7. Limitations of Tools:
8. Understanding false positives and false negatives.
9. Why manual review is still needed for logic bugs.

Resources
Guides
• OWASP Secure Code Review Guide
• OWASP Top 10
• CWE Top 25

Tools
• Semgrep
• SonarQube
• CodeQL

Practice
• Secure Code Warrior (Free trial/community)
• SonarQube Rules Explorer (Learn by seeing bad vs good code)
 Chapter 17

Secure SDLC

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for roles which require good
understanding of secure SDLC / SDL. Also, I assume you have already checked and are
comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be good at Security
Development Lifecycle. SDL is about building security into each phase of software delivery - from
requirements and design to coding, testing, release, and maintenance - instead of treating
security as a separate step at the end.

It is more towards: - defining security activities and checkpoints in the SDLC, - aligning
developers, product, and security teams on expectations, - integrating
AppSec/DevSecOps/Product Security work into a repeatable process, - and giving organizations
a structured way to measure and improve security maturity.

Usually it will take you 6-12 weeks to be comfortable with SDL fundamentals and how to apply
them in real projects.

In short
1. SDL is not just a document - it is how security is embedded into the way software is built.
2. Think more of a framework that connects Application Security, DevSecOps, Product
Security, and Architecture.
3. You should be comfortable talking about phases of SDLC and which security activities
belong where.
4. You should know how to keep SDL practical for agile and cloud-native teams.
5. You must understand how to start small and evolve the SDL over time.

ToC
1. SDL Fundamentals - 1-2 weeks
2. Security in Requirements and Design - 2-3 weeks
3. Security in Implementation and Code Review - 2-3 weeks
4. Security Testing and Verification - 2-3 weeks
5. Release, Operations and Feedback - 1-2 weeks
6. Frameworks and Maturity Models - 1-2 weeks
7. Books
 8. Videos
9. Courses
10. Certifications
11. Interview Questions

SDL Fundamentals
Duration: 1-2 weeks

Goal here is to understand what SDL is trying to achieve.

Week 1-2: The Big Picture

1. Review basic SDLC models:
2. Waterfall vs iterative vs agile.
3. How modern teams actually deliver (Scrum/Kanban, CI/CD).
4. Understand SDL goals:
5. Reduce vulnerabilities introduced during development.
6. Catch issues earlier when they are cheaper to fix.
7. Provide traceability for security activities.
8. Read or refresh related plans:
9. Application Security Study Plan
10. DevSecOps Study Plan
11. Product Security Study Plan
12. Security Architecture Study Plan

Security in Requirements and Design

Duration: 2-3 weeks

Security must start before code is written.

Week 3-5: Shift Left

1. Requirements phase:
2. Define security and privacy requirements along with functional ones.
3. Examples: authN/authZ, logging, encryption, data retention, compliance.
4. Work with Product Security and GRC (if present) to capture constraints.
5. Design phase:
6. Perform high-level architecture reviews.
7. Do threat modeling for new features or major changes (see Threat Modeling Study Plan).
8. Choose appropriate security patterns (e.g., gateway, zero trust, secure data flow).
 9. Deliverables at this stage might include:
10. Documented security requirements.
11. Threat models and risk assessments.
12. Architecture diagrams with security controls marked.

Security in Implementation and Code Review

Duration: 2-3 weeks

Here you focus on day-to-day development activities.

Week 6-8: Secure Build

1. Secure coding practices:
2. Follow language-specific secure coding guidelines.
3. Use frameworks and libraries securely.
4. Code review:
5. Integrate basic security checks into regular code reviews.
6. Use checklists for common security issues.
7. Automation:
8. Introduce SAST and SCA as part of the build (see Application Security and DevSecOps
plans).
9. Ensure findings are triaged and assigned, not ignored.
10. Link to Secure Code Review Study Plan for deeper code review skills.

Security Testing and Verification

Duration: 2-3 weeks

Testing must verify that controls are correctly implemented.

Week 9-11: Verification

1. Unit and integration tests with security in mind where possible.
2. DAST / API testing for running apps and services.
3. Additional testing methods where relevant:
4. IAST, fuzzing, penetration testing.
5. Non-functional aspects:
6. Performance and reliability under attack conditions (e.g., rate limiting).
7. Ensure test results feed back into backlog and SDL metrics.
Release, Operations and Feedback
Duration: 1-2 weeks

Security does not end at release.

Week 12-13: Post-Release

1. Pre-release:
2. Security sign-off criteria for high-risk features.
3. Checklist to verify critical controls (auth, logging, encryption, etc.).
4. Operations:
5. Secure configuration management.
6. Monitoring and alerting for security-relevant events.
7. Patch and vulnerability management (apps and infrastructure).
8. Feedback loop:
9. Use incidents and pen test findings to improve earlier SDL phases.
10. Regular retrospectives on security issues.

Frameworks and Maturity Models

Duration: 1-2 weeks

Finally, understand how SDL ties into broader frameworks.

Week 14-15: Maturity

1. OWASP SAMM (Software Assurance Maturity Model):
2. High-level understanding of practice areas and maturity levels.
3. Microsoft SDL concepts (at a summary level).
4. How SDL relates to standards like ISO 27001, NIST, etc.
5. Use maturity models to:
6. Assess current state.
7. Plan incremental improvements.

Books
1. Books on building Application Security or Product Security programs - for seeing how SDL
is implemented in practice.
2. Any secure software development or secure coding books that tie into SDLC.
Videos
1. Developing Secure Software (LFD121) by The Linux Foundation (free).
2. Conference talks on SDL / secure SDLC and how organizations implemented it in
agile/DevOps environments.
3. Talks on OWASP SAMM and real-world program maturity journeys.

Courses
1. Courses focused on secure software development or secure SDLC.
2. DevSecOps and Application Security courses that show how to integrate security into
pipelines and processes.

Certifications
1. CSSLP: Certified Secure Software Lifecycle Professional.
2. Other secure software development or AppSec/DevSecOps certifications depending on
your focus.

Interview Questions
You can reuse many questions from the Application Security and Product Security interview sets,
but think of them through the SDL lens:

1. How would you introduce security into an existing agile SDLC with minimal disruption?
2. Which security activities would you recommend at each phase of the SDLC and why?
3. How would you measure whether your SDL is working and improving over time?
 Chapter 18

Security Architecture

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job roles which require good
knowledge of security architecture. Also, I assume you have already checked and are comfortable
with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be a Security Architect /
Security Architecture-focused engineer. Security Architecture is different from just "doing AppSec"
or "doing pentesting". You need to understand how to design secure systems end-to-end across
applications, infrastructure, cloud, data, and identities.

It is more towards: - defining guardrails and reference architectures, - driving secure design
decisions early, - aligning with frameworks and standards, - and working closely with AppSec,
Cloud, Infrastructure and GRC teams.

Usually it will take you 6-12 months to be good at the Security Architecture fundamentals to get a
job at entry level or move laterally into an architect-type role.

In short:
1. Security Architecture is not only pentesting or only AppSec.
2. Think more of a combination of engineer, designer, and risk manager.
3. Talking to engineering leaders, architects, product owners, and GRC teams should not
scare you.
4. You must be comfortable with diagrams, data flows, and threat modeling.
5. You should understand both on■prem and cloud architectures (at least one major CSP).
6. You should be able to review designs and propose secure patterns with confidence.

ToC:
1. Security Architecture Fundamentals - 4-6 weeks
2. Frameworks, Standards and Models - 3-4 weeks
3. Designing Secure Architectures - 4-6 weeks
4. Threat Modeling and Risk Management - 3-4 weeks
5. Secure SDLC and Architecture Governance - 3-4 weeks
6. Reference Architectures and Patterns - 3-4 weeks
7. Books
 8. Videos
9. Courses
10. Certifications
11. Interview Questions

Security Architecture Fundamentals

Duration: 4-6 weeks

Goal here is to understand what security architecture means and where it fits in the overall
security program.

Week 1-6: Core Architecture

1. Understand the role of a Security Architect vs AppSec Engineer vs Cloud Security Engineer
vs GRC.
2. Understand high-level components of modern systems:
3. Applications / microservices
4. APIs and integration layers
5. Databases and data stores
6. Identity and access management
7. Network and perimeter controls
8. Observability and logging
9. Learn to read and create architecture diagrams (C4 model basics,
context/container/component diagrams).
10. Understand core security goals (CIA, authenticity, non-repudiation, privacy by design,
least privilege, defense in depth).
11. Map typical attack surfaces on these diagrams.
You will use these fundamentals in almost every other section.

Frameworks, Standards and Models

Duration: 3-4 weeks

You don't need to memorize everything, but you should know what exists, when to use it, and
where to look.

Week 7-10: Frameworks

1. High-level security architecture frameworks
2. SABSA (Sherwood Applied Business Security Architecture) - concept of business-driven
security architecture
3. TOGAF and how security fits into enterprise architecture
 4. NIST Cybersecurity Framework (CSF) at a high level
5. Technical standards and guidelines that influence architecture
6. NIST 800-53 / NIST 800-171 basics
7. ISO 27001 controls at a high level
8. CIS Controls v8 (mapped to architecture capabilities)
9. Application- and cloud-focused standards
10. OWASP ASVS
11. OWASP SAMM
12. CSP-specific well-architected frameworks (AWS, Azure, GCP)
Try to understand how these frameworks translate into concrete architecture requirements
(e.g. logging, segmentation, encryption, IAM, backups, resilience).

Designing Secure Architectures

Duration: 4-6 weeks

Focus on how you design secure solutions from the start.

Week 11-16: Design Patterns

1. Network and segmentation concepts
2. DMZs, zero trust network concepts, micro■segmentation
3. North-south vs east-west traffic
4. Identity and access architecture
5. Central IdP, SSO, SAML/OIDC, MFA
6. RBAC/ABAC, least privilege, just■in■time access
7. Data security architecture
8. Data classification
9. Encryption in transit and at rest, key management (KMS/HSM basics)
10. Tokenization, masking, and pseudonymization
11. Application and API architecture
12. High-level overview of secure web and API architectures
13. (Deep API details are covered in API Security Study Plan)
14. Resilience and availability
15. Redundancy, failover, backups and restore
16. Designing for DDoS and capacity
Try to pick one or two small systems (side project, home lab, or existing app at work) and draw
the "as■is" and "to■be" secure architecture.
Threat Modeling and Risk Management
Duration: 3-4 weeks

Here, you combine architecture diagrams with attacker thinking.

Week 17-20: Threat Modeling

1. Read Threat Modeling Study Plan.
2. Learn at least one methodology:
3. STRIDE
4. Attack trees or kill chain style
5. Learn how to:
6. Identify assets, trust boundaries, and entry points
7. Identify threats and abuses for each component
8. Prioritize using simple risk scoring (likelihood x impact)
9. Propose architectural mitigations and compensating controls
Repeat this for at least 3-4 different architectures: - Simple 3■tier web app - Public APIs with
mobile/SPA client - Internal line-of-business application

Secure SDLC and Architecture Governance

Duration: 3-4 weeks

Security architecture is effective only if it is built into the way software is delivered.

Week 21-24: Governance

1. Revisit Security Development Lifecycle (SDL) Study Plan.
2. Understand where security architects engage in SDLC:
3. Requirement and design reviews
4. Architecture review boards / design review checklists
5. Threat modeling as part of design
6. Sign-off criteria and security non-functional requirements
7. Learn common architecture governance practices:
8. Reference architectures and reusable patterns
9. Exception management and technical debt tracking
10. Security standards, baselines, and guardrails

Reference Architectures and Patterns

Duration: 3-4 weeks
Look for and collect reference architectures for typical environments:

Week 25-28: Reference Architectures

1. On■prem or hybrid architectures
2. DMZ, VPN, identity, central logging, SIEM, bastion hosts
3. Cloud architectures
4. Secure VPC/VNet design
5. Internet■facing vs private services
6. Centralized logging, monitoring, and alerting
7. Common patterns
8. Zero Trust style access to internal apps
9. Secure API gateway pattern
10. Secure data pipeline / analytics architecture
Try to map each reference diagram to: - which controls are enforced where, and - how attacks
would flow through the system.

Books
1. Enterprise Security Architecture: A Business-Driven Approach
2. Agile Application Security - good for seeing how architecture and AppSec work together
3. Security Engineering by Ross Anderson - classic reference on designing secure systems
4. The Tangled Web: A Guide to Securing Modern Web Applications

Videos
1. Search for "Security Architecture" talks from OWASP, Black Hat, or RSA on YouTube.
2. Talks on threat modeling and secure design (many are linked from the Threat Modeling
Study Plan).
3. Cloud provider "Well■Architected" security deep■dives (AWS, Azure, GCP official
channels).

Courses
1. Any good "Enterprise Security Architecture" or "Security Architecture and Design" course
from trusted platforms.
2. Cloud security architecture courses from your preferred CSP (AWS, Azure, or GCP) - align
with your cloud security plan.
3. Threat modeling and secure design courses (see Threat Modeling study plan for specific
links).
Certifications
1. CSSLP: Certified Secure Software Lifecycle Professional
2. CCSP: Certified Cloud Security Professional
3. Vendor-specific cloud security or architecture certifications (AWS, Azure, GCP) depending
on your focus.

Interview Questions
You can use the Application Security interview questions and think how you would answer them
from an architecture perspective (design choices, trade■offs, and patterns), and extend with:

1. How would you design a secure architecture for a public web application with APIs and
mobile clients?
2. How would you design logging and monitoring for a critical payments system?
3. How would you approach threat modeling for a new microservices-based product?
 Chapter 19

GenAI Security

This study plan covers all the topics, concepts, blogs, videos, books, videos, newsletters etc. by
keeping GenAI security in mind.

It should take 6-9 months to be good at GenAI security so that you can do one or more of the
below listed things: 1. LLM pentesting 2. GenAI security assessment 3. Design and implement
secure GenAI/LLM architectures for organizations. 4. Understanding of GenAI from GRC
perspective 5. Knowledge of different GenAI security frameworks 6. AI enabled Threat Modeling
or Threat Modeling of AI systems 7. Good grip on LLM safety, LLM Guardrails, Responsible AI, AI
ethic etc.

It would help you in your current work as well as finding a new work using GenAI security skills.

Note: I am not writing anything that would require core AI/ML skills. It's all are done after keeping
security focus in mind.

"[!IMPORTANT] This field is still evolving, so our repo would too! Stay tuned!"

Organizational Capabilities that you can be job ready

after going through mentioned study plan
Security Assessments & Audits
• Conduct comprehensive GenAI security assessments using OWASP LLM Top 10
framework
• Perform LLM application penetration testing and vulnerability assessments
• Audit RAG (Retrieval Augmented Generation) implementations for security risks
• Evaluate prompt injection and jailbreaking vulnerabilities
• Assess model security, including adversarial attacks and data poisoning risks
• Review AI/ML supply chain security (model provenance, dependencies, third-party APIs)

Governance, Risk & Compliance (GRC)

• Develop GenAI security policies and procedures aligned with NIST AI RMF
• Create AI governance frameworks and risk management strategies
• Implement compliance controls for AI regulations (EU AI Act, etc.)
• Establish AI ethics and responsible AI practices
• Design AI security awareness training programs for employees
• Create incident response plans specifically for AI/ML security incidents
Architecture & Implementation
• Design secure AI/ML pipelines and infrastructure
• Implement secure GenAI architectures (secure RAG, fine-tuning, inference)
• Deploy AI security tools (LLM Guard, model scanning, prompt filtering)
• Establish secure model deployment and MLOps practices
• Design data privacy controls for AI training and inference data
• Implement monitoring and logging for AI systems

Risk Management & Threat Modeling

• Conduct AI/ML specific threat modeling exercises
• Assess business risks associated with GenAI implementations
• Develop risk mitigation strategies for AI adoption
• Create AI security metrics and KPIs for organizational reporting
• Establish AI risk registers and continuous monitoring processes

Security Engineering & DevSecOps

• Integrate AI security into CI/CD pipelines
• Implement security testing for AI/ML models and applications
• Design secure model training environments and data handling processes
• Establish model version control and security scanning practices
• Create automated security testing for prompt injection and other LLM vulnerabilities

Incident Response & Forensics

• Investigate AI/ML security incidents and breaches
• Develop playbooks for AI-specific security incidents
• Perform forensic analysis on compromised AI systems
• Create incident classification systems for AI/ML security events

Consulting & Advisory Services

• Provide GenAI security consulting to organizations
• Conduct security reviews of vendor AI solutions
• Advise on secure AI procurement and third-party risk management
• Lead AI security transformation initiatives
• Mentor and train internal security teams on AI security
"[!NOTE] ToC will highlight GenAI based concepts and learning reqources as and when we come
across some awesome learning materials."

Study Plan ToC:

 1. GenAI/LLM Fundamental Concepts - 4 weeks
2. Prompt Engineering - 1 week
3. RAG (Retrieval Augmented Generation) - 1-2 weeks
4. Fine Tuning - 2 weeks
5. AI Agents - 1 week
6. Agentic AI - 1 week
7. MCP (Model Context Protocol) - 1 week
8. Certifications - on your bandwidth and wish
9. GenAI Interview Questions
10. GenAI Security Tools

GenAI Fundamental Concepts

Duration: 4 weeks

Week 1: AI/ML Foundations & LLM Basics

■ Understanding AI vs ML vs Deep Learning vs GenAI
• What are Foundation Models
• Introduction to Large Language Models
• Transformer Architecture Explained
• [ ] LLM Architecture & Components
• Attention mechanisms and self-attention
• Encoder-decoder architecture
• Pre-training vs fine-tuning concepts
• Token embeddings and positional encoding
• [ ] Popular LLM Models
• GPT family (GPT-3.5, GPT-4, GPT-4o)
• Claude (Anthropic)
• Llama 2/3 (Meta)
• Gemini (Google)
• Open-source vs proprietary models

Week 2: LLM Security Fundamentals

■ OWASP LLM Top 10
• OWASP Top 10 for LLM Applications
• LLM01: Prompt Injection
• LLM02: Insecure Output Handling
• LLM03: Training Data Poisoning
• LLM04: Model Denial of Service
 • LLM05: Supply Chain Vulnerabilities
• LLM06: Sensitive Information Disclosure
• LLM07: Insecure Plugin Design
• LLM08: Excessive Agency
• LLM09: Overreliance
• LLM10: Model Theft
• [ ] Common Attack Vectors
• Prompt Injection and Jailbreaking
• Data poisoning attacks
• Model extraction and theft
• Adversarial examples
• Membership inference attacks

Week 3: AI Governance & Compliance

■ Regulatory Frameworks
• NIST AI Risk Management Framework
• EU AI Act
• NIST AI RMF Playbook
• ISO/IEC 23053:2022 (AI risk management)
• [ ] AI Ethics & Responsible AI
• Bias and fairness in AI systems
• Transparency and explainability
• Privacy and data protection
• Accountability and human oversight

Week 4: Threat Modeling & Risk Assessment

■ AI-Specific Threat Modeling
• Microsoft's AI/ML Threat Modeling
• AI Threat Modeling by Matillion
• Quick AI Threat Model Check
• [ ] Risk Assessment Frameworks
• Adversarial Machine Learning (NIST)
• Failure Modes in Machine Learning
• Business impact assessment for AI systems
Hands-on Practice: - [ ] Complete Gandalf LLM Security Challenge - [ ] Try Prompt Airlines CTF -
[ ] Practice with LLM Security Portal

Prompt Engineering
Duration: 1 week

Understanding Prompt Engineering

■ Prompt Engineering Fundamentals
• What is prompt engineering and why it matters for security
• Types of prompts: zero-shot, few-shot, chain-of-thought
• Prompt structure and best practices
• Context window limitations and management
• [ ] Security-Focused Prompt Engineering
• Defensive prompt engineering techniques
• Input validation through prompts
• Output sanitization strategies
• Prompt injection prevention techniques

Advanced Prompt Techniques

■ Prompt Injection Attacks
• Direct prompt injection
• Indirect prompt injection
• Jailbreaking techniques
• Prompt leaking attacks
• [ ] Defensive Strategies
• Prompt templates and parameterization
• Input filtering and validation
• Output monitoring and filtering
• Role-based prompt design
Hands-on Practice: - [ ] Practice prompt injection techniques on safe platforms - [ ] Design
secure prompt templates - [ ] Test prompt robustness against various attack vectors

RAG (Retrieval Augmented Generation)

Duration: 1-2 weeks

Week 1: RAG Fundamentals

■ Understanding RAG Architecture
• RAG: The Essential Guide
• Why RAG is Revolutionising GenAI
• Components: Retrieval system, knowledge base, generation model
• Vector databases and embeddings
• Chunking strategies and document processing
 • [ ] RAG Implementation Patterns
• Simple RAG vs Advanced RAG
• Multi-step reasoning with RAG
• Hybrid search approaches
• RAG with fine-tuned models

Week 2: RAG Security (Optional - for deeper understanding)

■ RAG-Specific Security Risks
• Riding the RAG Trail: Access, Permissions and Context
• Security Risks with RAG Architectures
• Mitigating Security Risks in RAG Applications
• [ ] RAG Security Best Practices
• Access control for knowledge bases
• Data privacy in retrieval systems
• Context injection attacks
• Information leakage through retrieval
• Secure document processing pipelines
Hands-on Practice: - [ ] Build a simple RAG system with security controls - [ ] Test for information
leakage vulnerabilities - [ ] Implement access controls for knowledge bases

Fine Tuning
Duration: 2 weeks

Week 1: Fine-Tuning Fundamentals

■ Understanding Fine-Tuning
• Pre-training vs fine-tuning vs prompt engineering
• Types of fine-tuning: full, parameter-efficient (LoRA, QLoRA)
• When to use fine-tuning vs other approaches
• Data requirements and preparation
• [ ] Fine-Tuning Techniques
• Supervised fine-tuning (SFT)
• Reinforcement Learning from Human Feedback (RLHF)
• Constitutional AI approaches
• Domain-specific fine-tuning

Week 2: Fine-Tuning Security

■ Security Considerations in Fine-Tuning
• Training data security and privacy
 • Model poisoning through fine-tuning
• Backdoor attacks in fine-tuned models
• Model extraction risks
• [ ] Secure Fine-Tuning Practices
• Data sanitization and validation
• Secure training environments
• Model versioning and provenance
• Testing fine-tuned models for security
Hands-on Practice: - [ ] Fine-tune a small model with security considerations - [ ] Test for data
leakage in fine-tuned models - [ ] Implement secure fine-tuning pipelines

AI Agents
Duration: 1 week

Understanding AI Agents
■ AI Agent Fundamentals
• What are AI agents and how they differ from simple LLMs
• Agent architectures: ReAct, Plan-and-Execute, Multi-agent systems
• Tool use and function calling
• Memory and state management in agents
• [ ] Types of AI Agents
• Conversational agents
• Task-specific agents
• Autonomous agents
• Multi-agent systems and collaboration

AI Agent Security
■ Security Risks with AI Agents
• Excessive agency and unauthorized actions
• Tool misuse and privilege escalation
• Agent-to-agent communication security
• Persistent memory security risks
• [ ] Securing AI Agents
• Principle of least privilege for agents
• Action validation and approval workflows
• Monitoring agent behavior and decisions
• Secure tool integration patterns
Hands-on Practice: - [ ] Build a simple AI agent with security controls - [ ] Test agent behavior
under various scenarios - [ ] Implement monitoring for agent actions

Agentic AI
Duration: 1 week

Advanced Agentic Systems

■ Agentic AI Concepts
• Autonomous decision-making systems
• Goal-oriented AI behavior
• Planning and reasoning in agentic systems
• Human-AI collaboration patterns
• [ ] Agentic AI Architectures
• Multi-agent orchestration
• Hierarchical agent systems
• Distributed agentic networks
• Agent communication protocols

Security in Agentic AI
■ Unique Security Challenges
• Emergent behaviors in agentic systems
• Goal misalignment and specification gaming
• Inter-agent security and trust
• Scalability of security controls
• [ ] Governance for Agentic AI
• Establishing boundaries and constraints
• Monitoring and auditing agentic behavior
• Human oversight and intervention mechanisms
• Ethical considerations in autonomous systems
Hands-on Practice: - [ ] Design security controls for agentic systems - [ ] Analyze case studies of
agentic AI failures - [ ] Develop monitoring strategies for autonomous agents

MCP (Model Context Protocol)

Duration: 1 week

Understanding MCP
 ■ MCP Fundamentals
• What is Model Context Protocol
• MCP architecture and components
• Client-server communication patterns
• Resource management and sharing
• [ ] MCP Implementation
• Setting up MCP servers and clients
• Resource discovery and access
• Tool integration through MCP
• Context sharing between applications

MCP Security
■ Security Considerations
• Authentication and authorization in MCP
• Resource access control
• Data privacy in context sharing
• Network security for MCP communications
• [ ] Best Practices
• Secure MCP server deployment
• Client-side security measures
• Monitoring MCP interactions
• Incident response for MCP systems
Hands-on Practice: - [ ] Set up a secure MCP environment - [ ] Implement access controls for
MCP resources - [ ] Test MCP security configurations

Certifications
Duration: Based on your bandwidth and goals

AI/ML Security Certifications

■ Certified AI/ML Pentester
• SecOps Group Certification
• Covers LLM penetration testing methodologies
• Hands-on practical assessments
• [ ] Cloud AI Security Certifications
• AWS Machine Learning Specialty
• Google Cloud Professional ML Engineer
• Azure AI Engineer Associate
• Focus on security aspects of cloud AI services
Vendor-Specific Certifications
■ OpenAI Safety and Alignment
■ Anthropic Constitutional AI
■ Microsoft Responsible AI
■ Google AI Ethics
Preparation Resources: - [ ] AttackIQ Foundation of AI Security - [ ] Coursera AI for
Cybersecurity Specialization - [ ] IBM GenAI for Cybersecurity Professionals

GenAI Interview Questions

Technical Questions
■ LLM Fundamentals
• Explain the transformer architecture and its security implications
• What are the key differences between GPT, BERT, and T5 models?
• How do attention mechanisms work and what security risks do they pose?
• Describe the training process of large language models
• [ ] Security-Specific Questions
• Walk through the OWASP LLM Top 10 and provide examples
• How would you test an LLM application for prompt injection vulnerabilities?
• Explain the difference between direct and indirect prompt injection
• What are the main security considerations when implementing RAG?
• How would you secure a fine-tuning pipeline?

Scenario-Based Questions
■ Risk Assessment Scenarios
• "A company wants to implement a customer service chatbot using GPT-4. What security
risks would you identify?"
• "How would you conduct a security assessment of an existing LLM application?"
• "Design a secure architecture for a RAG-based document Q&A system"
• [ ] Incident Response Scenarios
• "An LLM application is leaking sensitive customer data. How would you investigate?"
• "Users report that the chatbot is providing inappropriate responses. What's your approach?"
• "A competitor seems to have extracted your fine-tuned model. How do you respond?"

Governance and Compliance

■ Regulatory Questions
• How does the EU AI Act impact LLM deployments?
• What are the key components of NIST AI RMF?
 • How would you implement AI governance in an organization?
• What metrics would you use to measure AI security posture?

Hands-on Technical Challenges

■ Practical Exercises
• Demonstrate prompt injection techniques
• Show how to implement LLM Guard or similar tools
• Explain model scanning and vulnerability detection
• Design monitoring and alerting for LLM applications

GenAI Security Tools

Open Source Security Tools
■ LLM Guard by ProtectAI
• GitHub Repository
• Playground
• Input/output filtering and sanitization
• Prompt injection detection
• Sensitive data detection and redaction
• [ ] Model Scanning Tools
• ModelScan by ProtectAI
• Scans AI/ML models for security vulnerabilities
• Detects malicious code in model files
• Supports multiple model formats
• [ ] AI/ML Exploit Tools
• AI Exploits by ProtectAI
• Collection of AI/ML security exploits
• Educational and testing purposes
• Demonstrates common attack vectors

Commercial Security Platforms

■ Lakera Guard
• Real-time LLM security monitoring
• Prompt injection detection
• Content filtering and moderation
• API-based integration
• [ ] Robust Intelligence
• AI security and monitoring platform
 • Model validation and testing
• Continuous monitoring for drift and attacks
• Enterprise-grade security controls
• [ ] WhyLabs
• ML monitoring and observability
• Data drift detection
• Model performance monitoring
• Security-focused analytics

Testing and Assessment Tools

■ Garak
• LLM vulnerability scanner
• Automated testing for various attack types
• Extensible framework for custom tests
• Community-driven development
• [ ] PromptFoo
• LLM evaluation and testing framework
• Security-focused test cases
• Automated red teaming capabilities
• Integration with CI/CD pipelines

Bug Bounty and Research Platforms

■ [Link]
• World's first AI/ML bug bounty platform
• Responsible disclosure for AI vulnerabilities
• Community-driven security research
• Rewards for finding AI security issues

Monitoring and Observability

■ LangSmith
• LLM application monitoring
• Trace analysis and debugging
• Performance and security metrics
• Integration with LangChain
• [ ] Weights & Biases
• ML experiment tracking
• Model monitoring and versioning
• Security-focused metrics and alerts
• Team collaboration features
Cloud-Native Security Tools
■ AWS Bedrock Guardrails
• Content filtering and safety controls
• Custom guardrail policies
• Real-time monitoring and blocking
• Integration with AWS services
• [ ] Azure AI Content Safety
• Content moderation and filtering
• Custom classification models
• API-based integration
• Multi-language support
• [ ] Google Cloud AI Platform Security
• Model security scanning
• Access controls and IAM
• Audit logging and monitoring
• Compliance reporting

Implementation Checklist
■ Evaluate tools based on your specific use case
■ Set up monitoring and alerting for LLM applications
■ Implement input/output filtering and validation
■ Deploy model scanning in CI/CD pipelines
■ Establish incident response procedures
■ Regular security assessments and penetration testing
■ Stay updated with latest tools and techniques

Additional Resources
1. Courses & University Materials
2. Stanford CS324: Large Language Models
3. Princeton COS 597G: Understanding Large Language Models
4. Coursera: Generative AI with LLMs (AWS & [Link])
5. Coursera: Generative AI Engineering with LLMs Specialization
6. Coursera: Generative AI for Cybersecurity Professionals (IBM)
7. Coursera: AI for Cybersecurity Specialization (Johns Hopkins)
8. AttackIQ: Foundations of AI Security
9. Security Guides & Checklists
10. OWASP Top 10 for LLM Applications
11. OWASP LLM AI Security and Governance Checklist
12. NIST AI Risk Management Framework (AI RMF)
13. NIST AI RMF Playbook
14. NIST Adversarial Machine Learning
15. Microsoft: Threat Modeling AI/ML
16. [Link]: Quick AI Threat Model Check
17. Failure Modes in Machine Learning
18. Articles & Blogs
19. DataCamp: What are Foundation Models
20. Lasso Security: Riding the RAG Trail
21. IronCore Labs: Security Risks with RAG Architectures
22. Cloud Security Alliance: Mitigating Security Risks in RAG
23. Nightfall AI: RAG - The Essential Guide
24. Immuta: Why RAG is Revolutionising GenAI
25. Medium: Prompt Injection Jailbreaking
26. Medium: Safeguarding LLM with LLM Guard
27. Mercari: Security Incident Response using LLM
28. Tools & Platforms
29. LLM Security Portal
30. PortSwigger: Web LLM Attacks
31. [Link]: AI/ML Bug Bounty Platform
32. ProtectAI GitHub (LLM Guard, ModelScan, AI Exploits)
33. LLM Guard Playground
34. Challenges & CTFs
35. Gandalf: LLM Security Challenge
36. Prompt Airlines: AI Security CTF
37. SecOps Group: Certified AI/ML Pentester Exam
38. Videos
39. WhyLabs: Intro to LLM Security
 Chapter 20

Product Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for the job roles which require good
knowledge of Product Security. Also, I assume you have already checked and are comfortable
with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be a Product Security
Engineer / Product Security Lead. Product Security is different from a pure "pentesting" role. It is
closer to Application Security, but more embedded with product teams, helping them ship secure
features quickly while balancing risk, user experience, and business goals.

It is more towards: - enabling and coaching product & engineering teams, - building and improving
security into the product lifecycle, - driving secure design, threat modeling, and remediation, -
partnering with AppSec, Cloud, and GRC to make security a feature of the product.

Usually it will take you 6-12 months to be good at the Product Security fundamentals to get a job
at entry level or move laterally from AppSec/engineering into a Product Security role.

In short:
1. Product Security is not only bug hunting or pentesting.
2. Think more of a combination of application security engineer, product engineer, and
security program owner.
3. You work very closely with PMs, tech leads, architects, and developers.
4. You should be comfortable talking about risk, trade■offs, and timelines.
5. You should know enough AppSec, Cloud, and SDLC to help teams make good decisions.
6. You must be able to translate technical issues into business impact and priorities.

ToC:
1. Product Security Fundamentals - 3-4 weeks
2. Working with Product and Engineering - 2-3 weeks
3. Secure SDLC in Product Teams - 4-6 weeks
4. Threat Modeling and Risk-Based Prioritization - 3-4 weeks
5. Metrics, Backlog and Communication - 2-3 weeks
6. Integrations with AppSec, Cloud and GRC - 2-3 weeks
7. Books
 8. Videos
9. Courses
10. Certifications
11. Interview Questions

Product Security Fundamentals

Duration: 3-4 weeks

Goal here is to understand what Product Security is and where it sits between AppSec,
engineering, and the rest of the security org.

Week 1-4: The Role & Lifecycle

1. Understand the role and responsibilities of Product Security:
2. How it differs from Application Security, Security Architecture, and Pentesting.
3. Typical responsibilities: partnering with product teams, reviewing designs, helping with
threat modeling, triaging findings, guiding remediation.
4. Read or refresh:
5. Application Security Study Plan
6. API Security Study Plan
7. Security Architecture Study Plan
8. Understand the typical lifecycle of a feature in a product team:
9. Idea / requirements
10. Design
11. Implementation
12. Testing
13. Release and monitoring
14. Map where Product Security can add value in each step.

Working with Product and Engineering

Duration: 2-3 weeks

Product Security is a people and process heavy role.

Week 5-7: Integration & Culture

1. Learn how product management works:
2. Basic concepts: product roadmap, backlog, epics, user stories.
3. How priorities are decided (OKRs, business goals, customer requests).
4. Learn how engineering teams work:
 5. Agile / Scrum / Kanban basics.
6. Sprint planning, stand■ups, demos, retros.
7. Understand how to integrate security into these workflows:
8. Security requirements in user stories.
9. "Definition of done" including security checks.
10. Security champions model in teams.
11. Practice communication:
12. Explaining an issue in business terms.
13. Proposing mitigations that fit within team constraints.
14. Writing clear tickets and documentation.

Secure SDLC in Product Teams

Duration: 4-6 weeks

Here you focus on making the Secure SDLC practical for product teams.

Week 8-13: Practical SDLC

1. Read Security Development Lifecycle (SDL) Study Plan.
2. Map SDL activities to real product workflows:
3. When to do security design reviews.
4. When to run SAST/SCA/DAST/IAST and what to do with results.
5. How to handle security sign■off for high■risk features.
6. Tools and automation (examples, not endorsements):
7. SAST (e.g., tools mentioned in AppSec plan).
8. SCA/Dependency scanning.
9. Secret scanning.
10. Container and IaC scanning.
11. Learn to define and roll out simple, opinionated security guardrails:
12. Minimum controls per type of feature (auth, logging, encryption, rate limiting, etc.).
13. Checklists for new services/APIs.
14. Baseline for SDLC security activities.

Threat Modeling and Risk-Based Prioritization

Duration: 3-4 weeks

Threat modeling is a key part of Product Security.

Week 14-17: Threat Modeling

 1. Read Threat Modeling Study Plan.
2. Practice at least one structured method (e.g., STRIDE or similar).
3. Focus on practical threat modeling in product teams:
4. Short, facilitated sessions with the team.
5. Using architecture diagrams and data flows.
6. Capturing a small, actionable list of mitigations.
7. Learn risk-based prioritization:
8. Simple risk scoring (likelihood x impact).
9. Aligning with internal risk rating (e.g., Critical/High/Medium/Low).
10. When to accept risk vs when to push for fixes.

Metrics, Backlog and Communication

Duration: 2-3 weeks

You also need to help leadership understand where the product stands.

Week 18-20: Reporting & Strategy

1. Learn basic security metrics for product security, such as:
2. Number of open security issues by severity and age.
3. Mean time to remediate (MTTR) for different severities.
4. Coverage of critical controls (e.g., auth, logging, encryption) across services.
5. Understand how to manage a security backlog:
6. Grouping issues by theme.
7. Balancing tactical fixes vs strategic improvements.
8. Practice reporting:
9. Writing short monthly/quarterly updates.
10. Showing trends instead of isolated numbers.
11. Highlighting wins (reduced risk, improved coverage, closed gaps).

Integrations with AppSec, Cloud and GRC

Duration: 2-3 weeks

Product Security sits in the middle of several other teams.

Week 21-23: Cross-Functional Collaboration

1. With Application Security:
2. Share findings and patterns across products.
3. Reuse AppSec guidelines and standards.
 4. Coordinate on SAST/DAST/SCA and code review approaches.
5. With Cloud / Infrastructure Security:
6. Understand cloud security baselines.
7. Ensure product teams follow secure cloud patterns.
8. Work together on network, IAM, and data protection.
9. With GRC / Compliance:
10. Map product controls to policies and frameworks (e.g., ISO, SOC 2, GDPR).
11. Help prepare for audits and customer security reviews.
12. Turn compliance requirements into concrete product controls.

Books
There is no single canonical "Product Security" book, but these are very useful:

1. Application Security Program Handbook

2. Agile Application Security
3. Alice and Bob Learn Application Security
4. Any good book on product management or working with product teams (to understand their
language and priorities).

Videos
1. Talks on building or scaling Product Security / AppSec programs (search recent
OWASP/BSides/Black Hat talks).
2. Videos on secure SDLC and DevSecOps that emphasize working with product/engineering
teams.
3. Threat modeling and secure design talks (linked from the Threat Modeling and Application
Security study plans).

Courses
1. Courses on building Application Security or Product Security programs from well■known
training providers.
2. DevSecOps / Secure SDLC courses that include integration with CI/CD and product
workflows.
3. Threat modeling and architecture courses that show how to work with cross■functional
teams.

Certifications
 1. CSSLP: Certified Secure Software Lifecycle Professional
2. Cloud security certifications (AWS/Azure/GCP) if your products are cloud■native.
3. Application Security or DevSecOps■oriented certifications, depending on your focus.

Interview Questions
You can reuse many questions from the Application Security interview questions but think about
them in terms of how you would embed security into product teams.

Additional Product Security■focused questions could be:

1. How would you integrate security into a team that ships features every 1-2 weeks?
2. How do you decide which security issues must be fixed before release and which can go
into backlog?
3. How would you introduce threat modeling into a product team that has never done it
before?
4. How would you communicate a critical security issue to product and engineering
leadership?
 Chapter 21

IAM Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for job roles which require strong
Identity & Access Management skills (AppSec, Cloud Security, Product Security, GRC, Security
Architecture, etc.).

Also, I assume you have already checked and are comfortable with Common Security Skills study
plan.

It will cover what you need to learn to excel at IAM from both application and cloud perspectives.

How this connects: Use this plan alongside the AWS, Azure, and GCP security study plans for
cloud-specific IAM, and with the Application Security, Security Architecture, and Security
Development Lifecycle study plans when you are designing or reviewing secure systems.

In short
1. IAM is not just “creating users and groups” - it is access control for everything.
2. Think of IAM as the new perimeter across apps, APIs, cloud, and SaaS.
3. You must be comfortable with AuthN/AuthZ concepts and common protocols.
4. You should understand how IAM is implemented in AWS, Azure, and GCP at a high level.
5. You should recognize common IAM misconfigurations and how to avoid them.

ToC
1. IAM Fundamentals - 2 weeks
2. Authentication (AuthN) Deep Dive - 2 weeks
3. Authorization (AuthZ) & Access Control - 2 weeks
4. Cloud Provider IAM (AWS/Azure/GCP) - 3-4 weeks
5. Identity Lifecycle, Privileged Access & Federation - 2-3 weeks
6. Threats, Misconfigurations & Hardening - 2-3 weeks
7. Books
8. Videos
9. Courses
10. Certifications
11. Interview Questions
IAM Fundamentals
Duration: 2 weeks

Goal: build a solid mental model of IAM, identities, and access control.

Week 1-2: Core Concepts

1. What is IAM?
2. Digital identities, principals, subjects.
3. Resources, permissions, policies.
4. Types of Identities:
5. Human identities (users, groups).
6. Machine identities (service accounts, workloads, applications).
7. External identities (partners, customers, B2B/B2C).
8. Access Models:
9. Discretionary Access Control (DAC).
10. Mandatory Access Control (MAC).
11. Role-Based Access Control (RBAC).
12. Attribute-Based Access Control (ABAC).
13. Core Principles:
14. Least privilege.
15. Separation of duties.
16. Zero Trust (never trust, always verify).
17. Just-In-Time (JIT) and Just-Enough-Access (JEA).

Authentication (AuthN) Deep Dive

Duration: 2 weeks

Goal: understand how we prove who a user or service is.

Week 3: Traditional AuthN

1. Credentials: passwords, password policies, password managers.
2. Multi-Factor Authentication (MFA): SMS, TOTP apps, FIDO keys.
3. Sessions & Cookies: session IDs, secure flags, timeouts.

Week 4: Modern Protocols

1. OAuth 2.0 (high level): roles (resource owner, client, auth server), grant types.
2. OpenID Connect (OIDC): ID token, userinfo endpoint, common flows.
3. SAML 2.0 basics: assertions, IdP vs SP, SSO scenarios.
4. Modern web/mobile auth patterns: SPA, mobile apps using OAuth/OIDC.
Authorization (AuthZ) & Access Control
Duration: 2 weeks

Goal: understand how we decide what a user or service is allowed to do.

Week 5-6: AuthZ Models & Implementation

1. RBAC: roles, role hierarchies, role explosion problem.
2. ABAC: policies based on attributes (user, resource, environment).
3. Policy Languages & Engines (high level):
4. XACML, OPA/Rego, custom JSON/YAML-based policies.
5. Application-Level Authorization:
6. Route/method-level access control.
7. Object-level (BOLA) and function-level (BFLA) authorization.
8. Mapping business roles to technical permissions.

Cloud Provider IAM (AWS/Azure/GCP)

Duration: 3-4 weeks

Goal: understand how major cloud providers implement IAM.

Week 7-8: AWS IAM Basics

1. Core Concepts: principals, policies, actions, resources, conditions.
2. Identity Types: IAM users, groups, roles, root account.
3. Policies: identity-based vs resource-based policies, SCPs (Organizations).
4. Common Services: IAM, AWS SSO/IAM Identity Center, STS, KMS.
5. Hands-on (if possible): create roles, attach policies, test access.

Week 9: Azure & GCP IAM Overview

1. Azure: Entra ID (formerly Azure AD), roles, role assignments, scopes (MG → Sub → RG
→ Resource).
2. GCP: IAM policies, members, roles, service accounts, resource hierarchy.
3. Compare Patterns:
4. How roles and scopes differ across AWS/Azure/GCP.
5. Common misconfigurations (overly broad roles, wildcard permissions).

Identity Lifecycle, Privileged Access & Federation

Duration: 2-3 weeks

Goal: understand how identities are managed over time and across systems.

Week 10-11: Identity Lifecycle & PAM

1. Lifecycle: joiner/mover/leaver processes.
2. Provisioning & Deprovisioning: HR systems, directories, SCIM basics.
3. Privileged Access Management (PAM):
4. Break-glass accounts.
5. Session recording and approvals.
6. JIT privileged access.

Week 12: Federation & B2B/B2C

1. Federation Concepts: trusting external IdPs, SSO across organizations.
2. Common Scenarios: SAML or OIDC from corporate IdP to SaaS/cloud.
3. Security Considerations: trust boundaries, token lifetimes, revocation.

Threats, Misconfigurations & Hardening

Duration: 2-3 weeks

Goal: connect IAM theory with real-world attacks and defenses.

Week 13-15: Attacks & Defenses

1. Common IAM-related Attacks:
2. Credential stuffing, password spraying.
3. MFA fatigue / MFA bypass social engineering.
4. OAuth misconfig (open redirect, overbroad scopes).
5. IDOR/BOLA/BFLA due to missing authorization checks.
6. Privilege escalation via misconfigured roles/policies.
7. Cloud IAM Pitfalls:
8. *:* permissions, public buckets, overly broad service roles.
9. Long-lived access keys and secrets.
10. Hardening Practices:
11. Enforce MFA for admins and remote access.
12. Regular access reviews and certification.
13. Least privilege role design and periodic cleanup.
14. Conditional access / risk-based authentication (where available).
Books
1. Any solid book on Identity & Access Management in enterprise or cloud contexts.
2. Books on OAuth 2.0 / OpenID Connect and modern authentication patterns.
3. Cloud security books that include strong IAM chapters (AWS/Azure/GCP).

Videos
1. Conference talks on IAM, SSO, OAuth/OIDC pitfalls, and cloud IAM misconfigurations.
2. Cloud provider official IAM deep-dive videos (AWS re:Invent, Azure, GCP).
3. Talks on Zero Trust and modern identity-centric security.

Courses
1. Cloud security fundamentals courses with strong IAM modules.
2. Vendor-specific identity courses (e.g., AWS, Azure, GCP IAM).
3. Courses focused on OAuth 2.0 / OIDC and modern auth patterns.

Certifications
1. Cloud security certifications (AWS/Azure/GCP) where IAM is a major part of the exam.
2. Identity-focused or access management certifications if they align with your goals.
3. General security certs (CISSP, CCSP, etc.) for broader context around IAM.

Interview Questions
You can reuse questions from Application Security, Cloud Security, and Security Architecture, but
focus on Identity & Access:

1. How would you design authentication and authorization for a new web/mobile app?
2. How would you migrate on-prem identities to a cloud IdP safely?
3. How do you enforce least privilege across many AWS accounts or Azure subscriptions?
4. How would you investigate and respond to a suspected IAM credential compromise?
 Chapter 22

Blue Team, Detection & Response

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for job roles focused on Blue Team,
SOC, Detection Engineering, and Incident Response.

Also, I assume you have already checked and are comfortable with Common Security Skills study
plan.

It will cover what you need to learn to monitor, detect, and respond to attacks across endpoints,
networks, applications, and cloud.

How this connects: Start with Common Skills and Network Security, then pair this plan with the
cloud study plans (AWS, Azure, GCP) and Web Pentest / Application Security so you can detect
attacks you or others already know how to perform. Combine it with Threat Modeling to turn
identified threats into concrete detections and playbooks.

In short
1. Blue Team is not just “watching a SIEM” - it’s about detecting and responding to real
attacks.
2. You must understand how logs, telemetry, and alerts are generated and correlated.
3. You should know the incident response lifecycle and how to build playbooks.
4. You should be comfortable mapping activity to frameworks like MITRE ATT&CK.
5. You should understand basics of cloud, endpoint, and network telemetry.

ToC
1. Blue Team & SOC Fundamentals - 2 weeks
2. Logging, Telemetry & SIEM - 2-3 weeks
3. Detection Engineering & Threat Hunting - 3-4 weeks
4. Incident Response (IR) Fundamentals - 3-4 weeks
5. Digital Forensics Basics - 2-3 weeks
6. Cloud & Modern Environments - 2-3 weeks
7. Books
8. Videos
9. Courses
10. Certifications
 11. Interview Questions

Blue Team & SOC Fundamentals

Duration: 2 weeks

Goal: understand what the Blue Team does and how SOCs operate.

Week 1-2: Core Concepts

1. Roles & Functions: Tier 1-3 analysts, incident handlers, detection engineers, IR lead.
2. SOC Operating Models: in-house, MSSP, hybrid.
3. Core Activities: triage, investigation, containment, eradication, recovery, reporting.
4. Frameworks: NIST CSF (Identify-Protect-Detect-Respond-Recover), basic exposure to
MITRE ATT&CK.

Logging, Telemetry & SIEM

Duration: 2-3 weeks

Goal: understand what to log, how, and where it lands.

Week 3-5: Data & Platforms

1. Log Types:
2. OS logs (Windows Event Logs, Linux syslog).
3. Network logs (firewall, proxies, IDS/IPS).
4. Application & API logs.
5. Cloud logs (CloudTrail, Azure Activity, GCP Audit, etc.).
6. Log Quality: timestamps, normalization, context, correlation IDs.
7. SIEM Concepts: ingestion, parsing, normalization, correlation, dashboards, alerts.
8. Hands-on (if possible):
9. Use a lab with an ELK stack, Splunk, or any SIEM-like tool to ingest and search logs.

Detection Engineering & Threat Hunting

Duration: 3-4 weeks

Goal: learn how to create high-quality detections and proactively hunt.

Week 6-9: Detections & Hunts

1. Detection Engineering Basics:
 2. Use cases, hypotheses, and detection rules.
3. Balancing false positives and false negatives.
4. MITRE ATT&CK Mapping:
5. Tactics vs techniques.
6. Mapping detections to techniques.
7. Query Languages:
8. SIEM query basics (KQL-like or SPL-like language if available).
9. Threat Hunting:
10. Hypothesis-driven hunts.
11. Baselines and anomaly detection at a high level.
12. Collect and document hunting notebooks.

Incident Response (IR) Fundamentals

Duration: 3-4 weeks

Goal: understand how to handle incidents end-to-end.

Week 10-13: IR Lifecycle

1. IR Phases: Preparation, Detection & Analysis, Containment, Eradication, Recovery,
Lessons Learned.
2. Playbooks & Runbooks:
3. Phishing incident playbook.
4. Ransomware or malware outbreak playbook.
5. Cloud credential compromise playbook.
6. Communication:
7. Internal stakeholders, leadership, legal, PR.
8. When to involve external parties (regulators, law enforcement).
9. Tabletop Exercises: running simulated incidents to test readiness.

Digital Forensics Basics

Duration: 2-3 weeks

Goal: learn fundamentals of collecting and analyzing evidence safely.

Week 14-16: Forensics Overview

1. Evidence Handling: chain of custody, integrity, imaging vs live response.
2. Endpoint Forensics Basics:
3. Windows (registry artifacts, event logs).
 4. Linux (logs, processes, file timelines).
5. Memory & Disk Analysis (high level): what’s possible and when it’s needed.
6. Cloud Forensics Basics: using cloud logs and snapshots to reconstruct events.

Cloud & Modern Environments

Duration: 2-3 weeks

Goal: understand detection & response in cloud, SaaS, and modern stacks.

Week 17-19: Modern Blue Teaming

1. Cloud Telemetry: AWS, Azure, GCP basic security logs and where they are configured.
2. Containers & Kubernetes: high-level understanding of pod/node logs and common attack
traces.
3. SaaS & IdP Logs: identity provider logs (SSO, MFA), email security logs, EDR logs.
4. Integration: sending these logs into SIEM / XDR and writing detections around them.

Books
1. Any strong Blue Team / SOC operations book.
2. Books on incident response and digital forensics.
3. Books that walk through case studies of real intrusions.

Videos
1. Conference talks on detection engineering, Blue Teaming, and SOC operations.
2. IR and DFIR case study talks (how real incidents were handled).
3. Vendor-agnostic content on SIEM best practices and ATT&CK-based detections.

Courses
1. Blue Team / SOC analyst fundamentals courses.
2. IR/DFIR-focused training with hands-on labs.
3. Threat hunting and detection engineering courses using common SIEM/XDR tools.

Certifications
1. Entry-level SOC / Blue Team certs if available from reputable providers.
 2. IR/DFIR-oriented certifications if you want to specialize.
3. General security certs (like Security+) to support foundational knowledge.

Interview Questions
You can reuse questions from Network Security, Cloud Security, and GRC but focus on detection
& response:

1. How would you design logging for a new web application or API?
2. How do you triage an alert that might be a false positive?
3. How would you investigate a suspected account compromise in a cloud environment?
4. How do you measure the effectiveness of your detections and IR process?
 Chapter 23

Mobile Application Security

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for job roles which require good
knowledge of mobile (Android/iOS) application security.

Also, I assume you have already checked and are comfortable with Common Security Skills study
plan and Web Pentest study plan.

It will cover what you need to learn to test and secure mobile apps, including client, API, and
backend aspects.

How this connects: Use this plan together with the Web Pentest, Application Security, and API
Security study plans, since mobile apps almost always talk to web backends and APIs.

In short
1. Mobile security is not just “web in a smaller screen” - there are platform-specific risks.
2. You must understand Android and iOS app models and storage.
3. You should be comfortable proxying traffic, analyzing APK/IPA, and using common tools.
4. You should align with OWASP MASVS/MSTG for methodology.
5. You must consider both the app and its backend APIs.

ToC
1. Mobile Fundamentals - 2 weeks
2. Android Security - 3-4 weeks
3. iOS Security - 3-4 weeks
4. Mobile Testing Methodology (OWASP MASVS/MSTG) - 3-4 weeks
5. Tools & Labs - 3-4 weeks
6. Books
7. Videos
8. Courses
9. Certifications
10. Interview Questions

Mobile Fundamentals
Duration: 2 weeks

Goal: understand how mobile apps are built and deployed.

Week 1-2: Architecture

1. Mobile App Models: native, hybrid, cross-platform.
2. Typical Architecture: client app ↔ API ↔ backend services.
3. Data Storage & Permissions: local storage, keychain/keystore, runtime permissions.

Android Security
Duration: 3-4 weeks

Goal: understand Android internals and common vulnerabilities.

Week 3-6: Android Basics & Risks

1. Android Architecture: APK structure, components (activities, services, receivers).
2. Permissions & Manifest: exported components, dangerous permissions.
3. Common Issues: insecure storage, hardcoded secrets, insecure logging.
4. Reverse Engineering Basics: decompiling APKs, basic static analysis.

iOS Security
Duration: 3-4 weeks

Goal: understand iOS app model and security controls.

Week 7-10: iOS Basics & Risks

1. iOS Architecture: IPA packages, app sandboxing.
2. Keychain & Secure Storage: where secrets go and how they can leak.
3. Common Issues: insecure local storage, weak jailbreak detection, insecure URL
schemes.
4. High-Level Static & Dynamic Analysis: understanding what’s possible.

Mobile Testing Methodology (OWASP MASVS/MSTG)

Duration: 3-4 weeks

Goal: follow a structured approach for mobile security testing.

Week 11-14: Methodology

 1. OWASP MASVS: security requirements categories (architecture, storage, crypto, etc.).
2. OWASP MSTG: test cases and practical guidance.
3. Testing Focus Areas:
4. Local data storage.
5. Authentication and session management.
6. Network communication and certificate pinning.
7. Code tampering and reverse engineering resistance.

Tools & Labs

Duration: 3-4 weeks

Goal: get hands-on experience.

Week 15-18: Practice

1. Proxying & Interception: Burp/ZAP, cert installation, bypassing certificate pinning (at high
level).
2. Emulators & Devices: basic setup for Android and iOS testing.
3. Deliberately Vulnerable Apps: practice on intentionally vulnerable mobile apps from
reputable sources.
4. Backend APIs: reuse techniques from API Security Study Plan to test the APIs mobile
apps use.

Books
1. Any good book focused on mobile application security or testing.
2. Web and API security books to complement backend testing knowledge.

Videos
1. Conference talks on Android and iOS application security.
2. Walkthroughs of mobile app security assessments.
3. Official platform security overviews from Google/Apple.

Courses
1. Mobile application security or mobile pentesting courses with hands-on labs.
2. Android/iOS development basics (optional but helpful to understand code).
3. General web/API security courses to strengthen backend testing.
Certifications
1. Mobile security-focused certifications if they align with your goals.
2. General offensive security certs (OSCP/eWPTX/etc.) if you want broader pentest
credentials.

Interview Questions
You can reuse questions from Web & API Security but add mobile specifics:

1. How would you test a mobile banking app for insecure storage?
2. What is OWASP MASVS and how would you use it in an assessment?
3. How would you approach bypassing certificate pinning (conceptually)?
4. What are common pitfalls in mobile auth and session management?
 Chapter 24

Reverse Engineering & Malware

Analysis

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for roles which require reverse
engineering (RE), exploit analysis, or malware analysis skills.

Also, I assume you have already checked and are comfortable with Common Security Skills study
plan and Network Security study plan.

This plan is more advanced than others; treat it as a specialization.

How this connects: This plan is a good next step if you already know Network Security and have
some exposure to Blue Team, Detection & Response or Web Pentest. It helps you explain how
malware and exploits work behind the alerts.

In short
1. Reverse engineering is about understanding how software works from the binary up.
2. Malware analysis combines RE with incident response and threat intel.
3. You should be comfortable with low-level concepts (processes, memory, file formats).
4. You must treat malware safely (isolated labs, no real systems).
5. This path takes time; progress slowly and practice a lot.

ToC
1. Foundations: OS & Architecture - 3-4 weeks
2. Static Analysis Basics - 3-4 weeks
3. Dynamic Analysis Basics - 3-4 weeks
4. Malware Analysis Workflow - 3-4 weeks
5. Advanced Topics - 4-6 weeks
6. Books
7. Videos
8. Courses
9. Interview Questions
Foundations: OS & Architecture
Duration: 3-4 weeks

Goal: gain minimal low-level background.

Week 1-4: Core Concepts

1. Operating System Internals (high level): processes, threads, memory, syscalls.
2. File Formats: PE (Windows), ELF (Linux) basics.
3. Assembly Basics: x86/x64 registers, stack, common instructions.
4. Safe Lab Setup: VMs, snapshots, network isolation.

Static Analysis Basics

Duration: 3-4 weeks

Goal: understand binaries without running them.

Week 5-8: Static RE

1. Basic Tools: disassemblers and decompilers (choose one free/available to you).
2. Reading Simple Programs: follow control flow, identify functions and strings.
3. Indicators: imports, sections, packers/obfuscation indicators.
4. Documentation: always write notes on what you observe.

Dynamic Analysis Basics

Duration: 3-4 weeks

Goal: observe behavior in controlled environments.

Week 9-12: Dynamic RE

1. Sandboxing Concepts: safe execution, monitoring.
2. Basic Debugging: stepping through code, breakpoints, inspecting registers and memory.
3. Behavioral Analysis: file system changes, network connections, registry changes.
4. Combining Static + Dynamic: use static findings to guide runtime analysis.

Malware Analysis Workflow

Duration: 3-4 weeks

Goal: structure your approach to suspicious binaries.

Week 13-16: Structured Analysis
1. Triage: hash, AV checks, basic metadata, sandbox run.
2. Classification: trojan, ransomware, downloader, etc. (high level).
3. Reporting: technical reports for defenders and summaries for stakeholders.
4. Link to IR: feeding IOCs back into detection and response.

Advanced Topics
Duration: 4-6 weeks

Goal: explore deeper areas as you gain confidence.

Week 17-22: Deeper RE

1. Obfuscation & Packing (high level): recognizing and lightly unpacking simple cases.
2. Anti-Debugging & Evasion: basic techniques used by malware.
3. Exploit Analysis (optional): looking at simple exploits and shellcode.
4. Threat Intel Integration: mapping findings to threat groups and techniques.

Books
1. Introductory RE or malware analysis books from reputable authors.
2. Books that walk through real-world malware case studies.

Videos
1. Conference talks on RE and malware analysis.
2. Walkthroughs of analyzing real malware samples (from trustworthy sources).
3. Short videos explaining assembly and OS internals.

Courses
1. Beginner RE/malware analysis courses with controlled labs.
2. More advanced RE courses if you decide to go deeper.
3. Complementary courses on Windows internals or exploit development.

Interview Questions
1. How would you safely analyze a suspicious binary you received from the SOC?
2. What is the difference between static and dynamic analysis and when would you use each?
3. How do you communicate your malware analysis findings back to defenders?
 Chapter 25

OSINT & Social Engineering

This study plan is based on milestones. So, check how much you can cover within the timeline.
The more you cover the topics, the better candidate you are for roles that benefit from strong
OSINT and social engineering awareness (red team, blue team, GRC, security awareness).

Also, I assume you have already checked and are comfortable with Common Security Skills study
plan.

This plan focuses on ethical OSINT and social engineering fundamentals.

How this connects: OSINT and social engineering skills complement Web Pentest and red
teaming, help GRC and Blue Team, Detection & Response understand human-focused risks, and
enrich Threat Modeling by adding people and process attack vectors.

In short
1. OSINT is about collecting and correlating public information from many sources.
2. Social engineering is about manipulating human behavior - use it ethically and within rules
of engagement.
3. Both attackers and defenders use OSINT and SE (offense and awareness/training).
4. Legal and ethical boundaries are critical.

ToC
1. OSINT Fundamentals - 2 weeks
2. People & Infrastructure OSINT - 3-4 weeks
3. Social Engineering Fundamentals - 2-3 weeks
4. Offensive Use Cases (Ethical) - 2-3 weeks
5. Defensive Use Cases & Awareness - 2-3 weeks
6. Books
7. Videos
8. Courses
9. Interview Questions

OSINT Fundamentals
Duration: 2 weeks

Goal: understand what OSINT is and is not.

Week 1-2: Core Concepts

1. Definition & Scope: open sources, legality, ethics.
2. Data Types: people, organizations, infrastructure, financial, technical.
3. OSINT Process: define objective → collect → analyze → report.

People & Infrastructure OSINT

Duration: 3-4 weeks

Goal: learn practical OSINT collection for people and infrastructure.

Week 3-6: Practical OSINT

1. People OSINT: profiles, resumes, public posts, breached data (viewing only where legally
allowed).
2. Company OSINT: org charts, technologies used, job postings, press releases.
3. Infrastructure OSINT (high level): public DNS records, certificate transparency logs,
basic passive fingerprinting.

Social Engineering Fundamentals

Duration: 2-3 weeks

Goal: understand social engineering tactics and psychology.

Week 7-9: SE Basics

1. Psychological Principles: authority, scarcity, reciprocity, social proof, etc.
2. Common Vectors: phishing, vishing, pretexting, physical SE.
3. Real-World Examples: review case studies (within legal/ethical material).

Offensive Use Cases (Ethical)

Duration: 2-3 weeks

Goal: understand how OSINT and SE are used in engagements with proper authorization.

Week 10-12: Red Team View

1. Pre-Engagement: scoping, rules of engagement, legal sign-offs.
 2. Reconnaissance: using OSINT to identify targets, email formats, tech stack (high level).
3. Campaign Design (Conceptual): planning ethical phishing simulations and pretexts.

Defensive Use Cases & Awareness

Duration: 2-3 weeks

Goal: use OSINT and SE knowledge to improve defenses.

Week 13-15: Blue & GRC View

1. Exposure Reduction: minimizing unnecessary public data about staff and systems.
2. Awareness Training: explaining common SE patterns and red flags.
3. Simulations & Metrics: phishing simulations, reporting rates, improvement over time.

Books
1. Books on social engineering and human-based attacks from reputable authors.
2. Books focused on OSINT techniques and case studies.

Videos
1. Talks on social engineering from security conferences.
2. OSINT practical walkthroughs (within ethical & legal boundaries).
3. Corporate awareness-style videos explaining phishing and SE.

Courses
1. Intro OSINT courses that emphasize legality and ethics.
2. Social engineering awareness and simulation courses.
3. Red team or phishing simulation courses if relevant to your job.

Interview Questions
1. How would you use OSINT during a security assessment while staying within legal and
ethical boundaries?
2. How would you design an internal phishing awareness campaign?
3. How can OSINT and SE knowledge help improve an organization■s security posture?
Resources & Links

Continue your cybersecurity learning journey with these additional resources curated by the
author:

Follow Sanjeev Jaiswal on LinkedIn

[Link]

GitHub Study Plan

[Link]

Security Interview Questions

[Link]

Cybersecurity Skills and Career Roadmap

[Link]

Python for Cybersecurity

[Link]

Awesome Cybersecurity Learning Resources

[Link]

Awesome GenAI Security

[Link]

Cybersecurity Career FAQs

[Link]

Thank you for reading! If you found this study plan helpful, please consider starring the GitHub
repository and sharing it with others who are starting their cybersecurity journey.
© 2025 Sanjeev Jaiswal. All rights reserved.