Merge pull request #53 from CarterPerez-dev/phase/1.2
Phase 1.2: Create ROADMAPS folder with complete certification paths
This commit is contained in:
Carter Perez
GitHub
commit
f001d20a4d
|
|
@ -10,7 +10,7 @@ on:
|
|||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'PROJECTS/api-rate-limiter/**'
|
||||
- 'PROJECTS/advanced/api-rate-limiter/**'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
|
|
|||
|
|
@ -10,9 +10,9 @@ on:
|
|||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'PROJECTS/caesar-cipher/**'
|
||||
- '!PROJECTS/caesar-cipher/README.md'
|
||||
- '!PROJECTS/caesar-cipher/Justfile'
|
||||
- 'PROJECTS/beginner/caesar-cipher/**'
|
||||
- '!PROJECTS/beginner/caesar-cipher/README.md'
|
||||
- '!PROJECTS/beginner/caesar-cipher/Justfile'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
|
@ -41,10 +41,10 @@ jobs:
|
|||
pip install build
|
||||
|
||||
- name: Build package
|
||||
working-directory: PROJECTS/caesar-cipher
|
||||
working-directory: PROJECTS/beginner/caesar-cipher
|
||||
run: python -m build
|
||||
|
||||
- name: Publish to PyPI
|
||||
uses: pypa/gh-action-pypi-publish@release/v1
|
||||
with:
|
||||
packages-dir: PROJECTS/caesar-cipher/dist/
|
||||
packages-dir: PROJECTS/beginner/caesar-cipher/dist/
|
||||
|
|
|
|||
|
|
@ -10,9 +10,9 @@ on:
|
|||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'PROJECTS/dns-lookup/**'
|
||||
- '!PROJECTS/dns-lookup/README.md'
|
||||
- '!PROJECTS/dns-lookup/justfile'
|
||||
- 'PROJECTS/beginner/dns-lookup/**'
|
||||
- '!PROJECTS/beginner/dns-lookup/README.md'
|
||||
- '!PROJECTS/beginner/dns-lookup/justfile'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
|
@ -41,10 +41,10 @@ jobs:
|
|||
pip install build
|
||||
|
||||
- name: Build package
|
||||
working-directory: PROJECTS/dns-lookup
|
||||
working-directory: PROJECTS/beginner/dns-lookup
|
||||
run: python -m build
|
||||
|
||||
- name: Publish to PyPI
|
||||
uses: pypa/gh-action-pypi-publish@release/v1
|
||||
with:
|
||||
packages-dir: PROJECTS/dns-lookup/dist/
|
||||
packages-dir: PROJECTS/beginner/dns-lookup/dist/
|
||||
|
|
|
|||
151
README.md
151
README.md
|
|
@ -34,7 +34,7 @@
|
|||
- [Beginner Projects](#beginner-projects)
|
||||
- [Intermediate Projects](#intermediate-projects)
|
||||
- [Advanced Projects](#advanced-projects)
|
||||
- [Certification Roadmaps by Role](#certification-roadmaps-by-role)
|
||||
- [Certification Roadmaps](#certification-roadmaps)
|
||||
- [Cybersecurity Tools](#cybersecurity-tools)
|
||||
- [Study Platforms & Courses](#study-platforms--courses)
|
||||
- [Certifications & Exam Prep](#certifications--exam-prep)
|
||||
|
|
@ -248,144 +248,23 @@ Analyze software dependencies for vulnerabilities and malicious packages. Detect
|
|||
|
||||
---
|
||||
|
||||
## <img src="https://media2.giphy.com/media/QssGEmpkyEOhBCb7e1/giphy.gif?cid=ecf05e47a0n3gi1bfqntqmob8g9aid1oyj2wr3ds3mg700bl&rid=giphy.gif" width ="30"> **Certification Roadmap by Role** <img src="https://media2.giphy.com/media/QssGEmpkyEOhBCb7e1/giphy.gif?cid=ecf05e47a0n3gi1bfqntqmob8g9aid1oyj2wr3ds3mg700bl&rid=giphy.gif" width ="30">
|
||||
## Certification Roadmaps
|
||||
|
||||
# Certification Roadmaps By Role
|
||||
Structured certification paths for 10 cybersecurity career tracks, from entry-level to senior positions.
|
||||
|
||||
### 1. SOC Analyst
|
||||
[](https://skillicons.dev)
|
||||
**[View All Certification Roadmaps](./ROADMAPS/README.md)**
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Entry** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
||||
| **Intermediate** | **GCIH** (Certified Incident Handler) | GIAC | [Website](https://www.giac.org/certifications/certified-incident-handler-gcih/) |
|
||||
| **Intermediate** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/) |
|
||||
| **Advanced** | **GCIA** (Certified Intrusion Analyst) | GIAC | [Website](https://www.giac.org/certifications/certified-intrusion-analyst-gcia/) |
|
||||
| **Senior/Management** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
|
||||
---
|
||||
|
||||
### 2. Penetration Tester
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Entry-Level Pentest** | **PenTest+** | CompTIA | [Website](https://www.comptia.org/certifications/pentest) |
|
||||
| **Intermediate** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh-v12/) |
|
||||
| **Advanced** | **OSCP** (Gold Standard) | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/oscp-certification) |
|
||||
| **Expert** | **OSEP** | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/osep-certification) |
|
||||
| **Expert** | **GXPN** (Exploit Researcher) | GIAC | [Website](https://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn/) |
|
||||
|
||||
---
|
||||
|
||||
### 3. Security Engineer
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Intermediate** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cysa) |
|
||||
| **Advanced** | **SecurityX** (formerly CASP+) | CompTIA | [Website](https://www.comptia.org/certifications/securityx) |
|
||||
| **Advanced/Expert** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
| **Expert (Cloud-focused)** | **CCSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CCSP) |
|
||||
|
||||
---
|
||||
|
||||
### 4. Incident Responder
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Entry** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
||||
| **Core IR Cert** | **GCIH** (Certified Incident Handler) | GIAC | [Website](https://www.giac.org/certifications/certified-incident-handler-gcih/) |
|
||||
| **Forensics/Advanced** | **GCFA** (Certified Forensic Analyst) | GIAC | [Website](https://www.giac.org/certifications/certified-forensic-analyst-gcfa/) |
|
||||
| **Malware Analysis/Expert** | **GREM** (Reverse Engineering Malware) | GIAC | [Website](https://www.giac.org/certifications/reverse-engineering-malware-grem/) |
|
||||
|
||||
---
|
||||
|
||||
### 5. Security Architect
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Advanced** | **SecurityX** (formerly CASP+) | CompTIA | [Website](https://www.comptia.org/certifications/securityx) |
|
||||
| **Architect/Management** | **CISSP** (Required) | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
| **Cloud Architecture** | **CCSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CCSP) |
|
||||
| **Security Architecture Framework** | **SABSA** | SABSA Institute | [Website](https://sabsa.org/sabsa-chartered-architect-programme/) |
|
||||
| **Enterprise Architecture** | **TOGAF** | The Open Group | [Website](https://www.opengroup.org/certifications/togaf-certifications) |
|
||||
|
||||
---
|
||||
|
||||
### 6. Cloud Security Engineer
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **AWS Cloud Security** | **AWS Security Specialty** | AWS | [Website](https://aws.amazon.com/certification/certified-security-specialty/) |
|
||||
| **Azure Cloud Security** | **Azure Security Engineer** | Microsoft | [Website](https://learn.microsoft.com/en-us/certifications/azure-security-engineer/) |
|
||||
| **Vendor-Neutral** | **CCSK** | Cloud Security Alliance | [Website](https://cloudsecurityalliance.org/education/ccsk) |
|
||||
| **Advanced** | **CCSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CCSP) |
|
||||
| **Advanced Practice** | **SecurityX** (formerly CASP+) | CompTIA | [Website](https://www.comptia.org/certifications/securityx) |
|
||||
| **Expert/Management** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
|
||||
---
|
||||
|
||||
### 7. GRC Analyst/Consultant
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Audit Focused** | **CISA** (Certified Information Systems Auditor) | ISACA | [Website](https://www.isaca.org/credentialing/cisa) |
|
||||
| **Risk Management** | **CRISC** (Risk and Information Systems Control) | ISACA | [Website](https://www.isaca.org/credentialing/crisc) |
|
||||
| **Advanced** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
| **Compliance-Heavy** | **ISO 27001 Lead Auditor** | PECB (and others) | [Website](https://pecb.com/en/education-and-certification/iso-iec-27001-lead-auditor) |
|
||||
|
||||
---
|
||||
|
||||
### 8. Threat Intelligence Analyst
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cysa) |
|
||||
| **Cyber Threat Intelligence** | **GCTI** | GIAC | [Website](https://www.giac.org/certification/cyber-threat-intelligence-gcti/) |
|
||||
| **Intrusion Analysis** | **GCIA** | GIAC | [Website](https://www.giac.org/certification/certified-intrusion-analyst-gcia/) |
|
||||
| **OSINT (Optional)** | **GOSI** | GIAC | [Website](https://www.giac.org/certification/open-source-intelligence-gosi/) |
|
||||
| **OSINT (Optional)** | **C\|OSINT** | McAfee Institute | [Website](https://www.mcafeeinstitute.com/products/certified-osint) |
|
||||
|
||||
---
|
||||
|
||||
### 9. Application Security
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Foundation/Core** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/) |
|
||||
| **Foundation/Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
||||
| **Secure Software Lifecycle** | **CSSLP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CSSLP) |
|
||||
| **Web App Exploitation** | **OSWE** | Offensive Security | [Website](https://www.offensive-security.com/web-expert-oswe/) |
|
||||
| **Web App Pentest** | **GWAPT** | GIAC | [Website](https://www.giac.org/certifications/web-application-penetration-tester-gwapt/) |
|
||||
|
||||
---
|
||||
|
||||
### 10. Network Engineer (Security-Focused)
|
||||
[](https://skillicons.dev)
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Network+** | CompTIA | [Website](https://www.comptia.org/certifications/network) |
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Associate** | **CCNA** (Cisco Certified Network Associate) | Cisco | [Website](https://www.cisco.com/c/en/us/training-events/training-certifications/certifications/associate/ccna.html) |
|
||||
| **Advanced** | **CCNP Security** | Cisco | [Website](https://www.cisco.com/c/en/us/training-events/training-certifications/certifications/professional/ccnp-security.html) |
|
||||
| **Architect/Management** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
**Available Paths:**
|
||||
- [SOC Analyst](./ROADMAPS/SOC-ANALYST.md)
|
||||
- [Penetration Tester](./ROADMAPS/PENTESTER.md)
|
||||
- [Security Engineer](./ROADMAPS/SECURITY-ENGINEER.md)
|
||||
- [Incident Responder](./ROADMAPS/INCIDENT-RESPONDER.md)
|
||||
- [Security Architect](./ROADMAPS/SECURITY-ARCHITECT.md)
|
||||
- [Cloud Security Engineer](./ROADMAPS/CLOUD-SECURITY-ENGINEER.md)
|
||||
- [GRC Analyst/Consultant](./ROADMAPS/GRC-ANALYST.md)
|
||||
- [Threat Intelligence Analyst](./ROADMAPS/THREAT-INTELLIGENCE-ANALYST.md)
|
||||
- [Application Security](./ROADMAPS/APPLICATION-SECURITY.md)
|
||||
- [Network Engineer](./ROADMAPS/NETWORK-ENGINEER.md)
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,316 @@
|
|||
# Application Security Certification Roadmap
|
||||
|
||||
A structured path to becoming an Application Security professional, specializing in securing the software development lifecycle and finding vulnerabilities in applications.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Application Security professionals work with development teams to build secure software. This role requires understanding both security and software development, including secure coding practices, vulnerability assessment, penetration testing, and integrating security into DevOps pipelines (DevSecOps).
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Foundation/Core** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/) |
|
||||
| **Foundation/Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
||||
| **Secure Software Lifecycle** | **CSSLP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CSSLP) |
|
||||
| **Web App Exploitation** | **OSWE** | Offensive Security | [Website](https://www.offensive-security.com/web-expert-oswe/) |
|
||||
| **Web App Pentest** | **GWAPT** | GIAC | [Website](https://www.giac.org/certifications/web-application-penetration-tester-gwapt/) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental security knowledge:
|
||||
- Security concepts and controls
|
||||
- Network security basics
|
||||
- Cryptography fundamentals
|
||||
- Web application basics
|
||||
- Common vulnerabilities
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- OWASP Top 10 documentation
|
||||
- Web security basics
|
||||
|
||||
### Phase 2: Offensive Security Basics (4-6 months)
|
||||
**Target:** CEH and/or CySA+
|
||||
|
||||
Learn attack methodologies:
|
||||
|
||||
**CEH Path:**
|
||||
- Web application vulnerabilities
|
||||
- Injection attacks
|
||||
- Authentication bypass
|
||||
- Session management flaws
|
||||
- Security testing tools
|
||||
|
||||
**CySA+ Path:**
|
||||
- Vulnerability scanning
|
||||
- Threat analysis
|
||||
- Security monitoring
|
||||
- Incident response
|
||||
|
||||
**Resources:**
|
||||
- EC-Council CEH training
|
||||
- CompTIA CySA+ materials
|
||||
- Hands-on web app labs
|
||||
|
||||
### Phase 3: Secure Development Lifecycle (6-12 months)
|
||||
**Target:** CSSLP
|
||||
|
||||
Master secure software principles:
|
||||
- Secure software concepts
|
||||
- Secure software requirements
|
||||
- Secure software design
|
||||
- Secure software implementation/coding
|
||||
- Secure software testing
|
||||
- Secure software lifecycle management
|
||||
- Secure software deployment, operations, and maintenance
|
||||
- Supply chain and software acquisition
|
||||
|
||||
**Resources:**
|
||||
- CSSLP official study guide
|
||||
- Secure coding guidelines (OWASP, CERT)
|
||||
- SDL frameworks (Microsoft SDL, OWASP SAMM)
|
||||
- Code review practices
|
||||
|
||||
**Critical:** CSSLP requires 4 years of software development lifecycle experience (can be reduced with education).
|
||||
|
||||
### Phase 4: Web Application Exploitation (1-2 years experience)
|
||||
**Target:** OSWE
|
||||
|
||||
Master advanced web exploitation:
|
||||
- Advanced XSS techniques
|
||||
- SQL injection exploitation
|
||||
- Authentication and session attacks
|
||||
- Template injection
|
||||
- Deserialization attacks
|
||||
- Advanced web penetration testing
|
||||
- Custom exploit development
|
||||
- Source code analysis
|
||||
|
||||
**Resources:**
|
||||
- Offensive Security AWE course (WEB-300)
|
||||
- Advanced web app labs
|
||||
- Bug bounty practice
|
||||
- Code auditing
|
||||
|
||||
**Note:** OSWE is hands-on - you must find and exploit vulnerabilities in real applications during a 48-hour exam.
|
||||
|
||||
### Phase 5: Comprehensive Web Pentesting (Optional, 2+ years)
|
||||
**Target:** GWAPT
|
||||
|
||||
Deepen web app testing expertise:
|
||||
- Web application reconnaissance
|
||||
- Authentication and authorization testing
|
||||
- Input validation testing
|
||||
- Client-side attacks
|
||||
- API security testing
|
||||
- Web services testing
|
||||
|
||||
**Resources:**
|
||||
- SANS web app pentest course (SEC542)
|
||||
- Burp Suite mastery
|
||||
- Advanced testing techniques
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Security Testing:**
|
||||
- Web application penetration testing
|
||||
- API security testing
|
||||
- Mobile app security testing
|
||||
- Code review and static analysis
|
||||
- Dynamic application security testing (DAST)
|
||||
- Interactive application security testing (IAST)
|
||||
- Security test case development
|
||||
|
||||
**Secure Development:**
|
||||
- Secure coding practices
|
||||
- Input validation
|
||||
- Authentication and authorization
|
||||
- Session management
|
||||
- Cryptography implementation
|
||||
- Error handling and logging
|
||||
- Secure configuration
|
||||
|
||||
**Tools and Technologies:**
|
||||
- Burp Suite Professional
|
||||
- OWASP ZAP
|
||||
- Metasploit
|
||||
- Static analysis tools (SonarQube, Checkmarx, Fortify)
|
||||
- Dynamic analysis tools (Acunetix, Nessus)
|
||||
- Dependency scanners (Snyk, OWASP Dependency-Check)
|
||||
- Container security tools
|
||||
|
||||
**Programming Languages:**
|
||||
- Python (automation and tools)
|
||||
- JavaScript/TypeScript (web apps)
|
||||
- Java (enterprise apps)
|
||||
- C# (Microsoft stack)
|
||||
- Go (cloud-native apps)
|
||||
- SQL (database security)
|
||||
|
||||
**DevSecOps:**
|
||||
- CI/CD pipeline security
|
||||
- Security as Code
|
||||
- Container security
|
||||
- Infrastructure as Code security
|
||||
- Security automation
|
||||
- Security gates in pipelines
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Core:** 6-10 months
|
||||
- **Core to Secure Development:** 1-2 years
|
||||
- **Secure Development to Expert:** 2-3 years
|
||||
|
||||
Total time to senior level: **4-6 years** with hands-on application security experience.
|
||||
|
||||
---
|
||||
|
||||
## OWASP Top 10 Web Application Risks
|
||||
|
||||
Must understand and test for:
|
||||
|
||||
1. **Broken Access Control**
|
||||
- Unauthorized access to resources
|
||||
- Missing function-level access control
|
||||
- Insecure direct object references
|
||||
|
||||
2. **Cryptographic Failures**
|
||||
- Weak encryption
|
||||
- Exposed sensitive data
|
||||
- Missing encryption
|
||||
|
||||
3. **Injection**
|
||||
- SQL injection
|
||||
- Command injection
|
||||
- LDAP injection
|
||||
- XML injection
|
||||
|
||||
4. **Insecure Design**
|
||||
- Missing security controls
|
||||
- Insufficient threat modeling
|
||||
- Insecure design patterns
|
||||
|
||||
5. **Security Misconfiguration**
|
||||
- Default configurations
|
||||
- Unnecessary features enabled
|
||||
- Missing security headers
|
||||
|
||||
6. **Vulnerable and Outdated Components**
|
||||
- Unpatched libraries
|
||||
- End-of-life software
|
||||
- Vulnerable dependencies
|
||||
|
||||
7. **Identification and Authentication Failures**
|
||||
- Weak passwords
|
||||
- Session fixation
|
||||
- Missing MFA
|
||||
|
||||
8. **Software and Data Integrity Failures**
|
||||
- Insecure deserialization
|
||||
- CI/CD pipeline compromise
|
||||
- Auto-update without integrity checks
|
||||
|
||||
9. **Security Logging and Monitoring Failures**
|
||||
- Insufficient logging
|
||||
- Missing alerts
|
||||
- Inadequate incident response
|
||||
|
||||
10. **Server-Side Request Forgery (SSRF)**
|
||||
- Unvalidated URL redirects
|
||||
- Internal network access
|
||||
- Cloud metadata abuse
|
||||
|
||||
---
|
||||
|
||||
## Secure Development Lifecycle (SDL)
|
||||
|
||||
**Requirements Phase:**
|
||||
- Security requirements definition
|
||||
- Threat modeling
|
||||
- Privacy requirements
|
||||
- Compliance requirements
|
||||
|
||||
**Design Phase:**
|
||||
- Security architecture review
|
||||
- Attack surface analysis
|
||||
- Security design patterns
|
||||
- Crypto algorithm selection
|
||||
|
||||
**Implementation Phase:**
|
||||
- Secure coding guidelines
|
||||
- Code reviews
|
||||
- Static analysis
|
||||
- Unit testing with security focus
|
||||
|
||||
**Verification Phase:**
|
||||
- Security testing (SAST, DAST, IAST)
|
||||
- Penetration testing
|
||||
- Fuzz testing
|
||||
- Security regression testing
|
||||
|
||||
**Release Phase:**
|
||||
- Security sign-off
|
||||
- Incident response plan
|
||||
- Security documentation
|
||||
- Security training
|
||||
|
||||
**Operations Phase:**
|
||||
- Security monitoring
|
||||
- Patch management
|
||||
- Vulnerability management
|
||||
- Security updates
|
||||
|
||||
---
|
||||
|
||||
## Career Progression
|
||||
|
||||
**Application Security Analyst (0-2 years)**
|
||||
- Perform security testing
|
||||
- Conduct code reviews
|
||||
- Support development teams
|
||||
- Manage findings
|
||||
|
||||
**Application Security Engineer (2-5 years)**
|
||||
- Lead security testing efforts
|
||||
- Design security solutions
|
||||
- Build security tools
|
||||
- Advise on architecture
|
||||
|
||||
**Senior AppSec Engineer (5-8 years)**
|
||||
- Define security standards
|
||||
- Lead SDL implementation
|
||||
- Mentor junior engineers
|
||||
- Cross-team leadership
|
||||
|
||||
**Principal AppSec Engineer (8+ years)**
|
||||
- Enterprise-wide security strategy
|
||||
- Security innovation
|
||||
- Industry thought leadership
|
||||
- Executive advisory
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Build application security skills with these projects:
|
||||
- [Web Vulnerability Scanner](../SYNOPSES/intermediate/Web.Vulnerability.Scanner.md)
|
||||
- [API Security Scanner](../PROJECTS/intermediate/api-security-scanner)
|
||||
- [OAuth Token Analyzer](../SYNOPSES/intermediate/OAuth.Token.Analyzer.md)
|
||||
- [Bug Bounty Platform](../PROJECTS/advanced/bug-bounty-platform)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,244 @@
|
|||
# Cloud Security Engineer Certification Roadmap
|
||||
|
||||
A structured path to becoming a Cloud Security Engineer, specializing in securing cloud infrastructure, platforms, and applications.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Cloud Security Engineers design, implement, and maintain security controls for cloud environments. With organizations rapidly moving to cloud platforms, this role is in high demand. Cloud security requires deep knowledge of both traditional security principles and cloud-specific architectures across AWS, Azure, and GCP.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **AWS Cloud Security** | **AWS Security Specialty** | AWS | [Website](https://aws.amazon.com/certification/certified-security-specialty/) |
|
||||
| **Azure Cloud Security** | **Azure Security Engineer** | Microsoft | [Website](https://learn.microsoft.com/en-us/certifications/azure-security-engineer/) |
|
||||
| **Vendor-Neutral** | **CCSK** | Cloud Security Alliance | [Website](https://cloudsecurityalliance.org/education/ccsk) |
|
||||
| **Advanced** | **CCSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CCSP) |
|
||||
| **Advanced Practice** | **SecurityX** (formerly CASP+) | CompTIA | [Website](https://www.comptia.org/certifications/securityx) |
|
||||
| **Expert/Management** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental security knowledge:
|
||||
- Network security basics
|
||||
- Security controls and technologies
|
||||
- Cryptography and PKI
|
||||
- Risk management
|
||||
- Compliance frameworks
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- Cloud computing basics
|
||||
- Linux fundamentals
|
||||
|
||||
### Phase 2: Cloud Platform Specialization (4-8 months)
|
||||
**Target:** AWS Security Specialty OR Azure Security Engineer
|
||||
|
||||
Choose your primary cloud platform:
|
||||
|
||||
**AWS Security Specialty:**
|
||||
- Incident response in AWS
|
||||
- Logging and monitoring
|
||||
- Infrastructure security
|
||||
- Identity and access management
|
||||
- Data protection
|
||||
- AWS security services (GuardDuty, Security Hub, etc.)
|
||||
|
||||
**Azure Security Engineer:**
|
||||
- Manage identity and access
|
||||
- Secure networking
|
||||
- Secure compute, storage, and databases
|
||||
- Manage security operations
|
||||
- Azure security services (Sentinel, Defender, etc.)
|
||||
|
||||
**Resources:**
|
||||
- Official cloud provider training
|
||||
- Hands-on labs and sandboxes
|
||||
- Cloud security best practices
|
||||
|
||||
**Note:** Many organizations use multiple clouds. Learn your primary platform deeply, then expand.
|
||||
|
||||
### Phase 3: Vendor-Neutral Cloud Security (6-12 months)
|
||||
**Target:** CCSK
|
||||
|
||||
Master cloud security fundamentals:
|
||||
- Cloud computing architecture
|
||||
- Governance and enterprise risk
|
||||
- Legal and compliance
|
||||
- Information management and data security
|
||||
- Interoperability and portability
|
||||
- Traditional security in cloud
|
||||
- Cloud application security
|
||||
- Incident response
|
||||
- Virtualization and containers
|
||||
- DevSecOps
|
||||
|
||||
**Resources:**
|
||||
- Cloud Security Alliance materials
|
||||
- CSA Security Guidance
|
||||
- Multi-cloud security patterns
|
||||
|
||||
### Phase 4: Advanced Cloud Security (2-3 years experience)
|
||||
**Target:** CCSP
|
||||
|
||||
Demonstrate comprehensive cloud security expertise:
|
||||
- Cloud concepts, architecture, and design
|
||||
- Cloud data security
|
||||
- Cloud platform and infrastructure security
|
||||
- Cloud application security
|
||||
- Cloud security operations
|
||||
- Legal, risk, and compliance
|
||||
|
||||
**Resources:**
|
||||
- CCSP official study guide
|
||||
- Cloud security frameworks
|
||||
- Real-world cloud security implementation
|
||||
|
||||
**Critical:** CCSP requires 5 years of IT experience (including 3 years in information security and 1 year in cloud security).
|
||||
|
||||
### Phase 5: Enterprise Security Architecture (Optional, 4+ years)
|
||||
**Target:** SecurityX
|
||||
|
||||
Expand to enterprise security:
|
||||
- Enterprise security architecture
|
||||
- Cloud integration with on-premise
|
||||
- Hybrid cloud security
|
||||
- Multi-cloud management
|
||||
- Security automation
|
||||
|
||||
### Phase 6: Strategic Leadership (Optional, 5+ years)
|
||||
**Target:** CISSP
|
||||
|
||||
Move into security leadership:
|
||||
- Security program management
|
||||
- Strategic security planning
|
||||
- Cross-functional leadership
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Cloud Platforms:**
|
||||
- AWS security services and best practices
|
||||
- Azure security services and best practices
|
||||
- GCP security services and best practices
|
||||
- Multi-cloud management
|
||||
|
||||
**Technical Skills:**
|
||||
- Infrastructure as Code (Terraform, CloudFormation)
|
||||
- Container security (Docker, Kubernetes)
|
||||
- CI/CD pipeline security
|
||||
- Cloud-native application security
|
||||
- Identity and access management (IAM)
|
||||
- Encryption and key management
|
||||
- Network security groups and firewall rules
|
||||
- Security monitoring and SIEM integration
|
||||
- Compliance automation
|
||||
|
||||
**Scripting and Automation:**
|
||||
- Python for cloud automation
|
||||
- PowerShell for Azure
|
||||
- Bash for Linux automation
|
||||
- Cloud CLI tools
|
||||
- Infrastructure scanning tools
|
||||
|
||||
**Soft Skills:**
|
||||
- DevOps/DevSecOps collaboration
|
||||
- Cloud architecture communication
|
||||
- Cost-benefit analysis
|
||||
- Risk assessment and reporting
|
||||
- Vendor management
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Specialization:** 6-12 months
|
||||
- **Specialization to Advanced:** 1-2 years
|
||||
- **Advanced to Expert:** 2-3 years
|
||||
|
||||
Total time to senior level: **4-6 years** with hands-on cloud security implementation.
|
||||
|
||||
---
|
||||
|
||||
## Cloud Security Domains
|
||||
|
||||
**Infrastructure Security:**
|
||||
- Network segmentation
|
||||
- Security groups and NACLs
|
||||
- VPC design and isolation
|
||||
- DDoS protection
|
||||
- WAF configuration
|
||||
|
||||
**Identity and Access:**
|
||||
- Least privilege implementation
|
||||
- Role-based access control
|
||||
- Multi-factor authentication
|
||||
- Service accounts and credentials
|
||||
- Identity federation
|
||||
|
||||
**Data Protection:**
|
||||
- Encryption at rest
|
||||
- Encryption in transit
|
||||
- Key management systems
|
||||
- Data classification
|
||||
- Backup and disaster recovery
|
||||
|
||||
**Application Security:**
|
||||
- Secure API design
|
||||
- Container security
|
||||
- Serverless security
|
||||
- Third-party integration security
|
||||
- DevSecOps integration
|
||||
|
||||
**Compliance and Governance:**
|
||||
- Cloud compliance frameworks
|
||||
- Audit logging
|
||||
- Security posture management
|
||||
- Policy as code
|
||||
- Compliance automation
|
||||
|
||||
---
|
||||
|
||||
## Common Cloud Security Challenges
|
||||
|
||||
**Configuration Issues:**
|
||||
- Public S3 buckets
|
||||
- Overly permissive IAM roles
|
||||
- Missing encryption
|
||||
- Exposed databases
|
||||
- Insecure API endpoints
|
||||
|
||||
**Monitoring Gaps:**
|
||||
- Insufficient logging
|
||||
- No real-time alerts
|
||||
- Missing security metrics
|
||||
- Incomplete audit trails
|
||||
|
||||
**Access Control:**
|
||||
- Weak authentication
|
||||
- Excessive permissions
|
||||
- Shared credentials
|
||||
- Missing MFA
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Build cloud security skills with these projects:
|
||||
- [Cloud Asset Inventory](../SYNOPSES/intermediate/Cloud.Asset.Inventory.md)
|
||||
- [Cloud Security Posture Management](../SYNOPSES/advanced/Cloud.Security.Posture.Management.md)
|
||||
- [Container Security Scanner](../SYNOPSES/intermediate/Container.Security.Scanner.md)
|
||||
- [Docker Security Audit](../PROJECTS/intermediate/docker-security-audit)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,261 @@
|
|||
# GRC Analyst/Consultant Certification Roadmap
|
||||
|
||||
A structured path to becoming a Governance, Risk, and Compliance (GRC) professional, focused on managing security programs, risk assessment, and regulatory compliance.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
GRC Analysts ensure organizations meet security standards and regulatory requirements while managing risk effectively. This role bridges technical security and business operations, requiring knowledge of frameworks, auditing, risk management, and compliance regulations.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Audit Focused** | **CISA** (Certified Information Systems Auditor) | ISACA | [Website](https://www.isaca.org/credentialing/cisa) |
|
||||
| **Risk Management** | **CRISC** (Risk and Information Systems Control) | ISACA | [Website](https://www.isaca.org/credentialing/crisc) |
|
||||
| **Advanced** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
| **Compliance-Heavy** | **ISO 27001 Lead Auditor** | PECB (and others) | [Website](https://pecb.com/en/education-and-certification/iso-iec-27001-lead-auditor) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental security knowledge:
|
||||
- Security concepts and controls
|
||||
- Risk management basics
|
||||
- Compliance fundamentals
|
||||
- Security policies and procedures
|
||||
- Security technologies overview
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- Risk management frameworks
|
||||
- Compliance basics
|
||||
|
||||
### Phase 2: Information Systems Auditing (6-12 months)
|
||||
**Target:** CISA
|
||||
|
||||
Master IT audit principles:
|
||||
- Information system auditing process
|
||||
- Governance and management of IT
|
||||
- Information systems acquisition, development, and implementation
|
||||
- Information systems operations and business resilience
|
||||
- Protection of information assets
|
||||
|
||||
**Resources:**
|
||||
- CISA Review Manual
|
||||
- ISACA study materials
|
||||
- Audit methodology training
|
||||
- Practice audit scenarios
|
||||
|
||||
**Critical:** CISA requires 5 years of IS audit, control, or security work experience (can be reduced with certain education/certifications).
|
||||
|
||||
### Phase 3: Risk Management (1-2 years experience)
|
||||
**Target:** CRISC
|
||||
|
||||
Specialize in risk management:
|
||||
- IT risk identification
|
||||
- IT risk assessment
|
||||
- Risk response and mitigation
|
||||
- Risk and control monitoring and reporting
|
||||
- Information systems control design and implementation
|
||||
- Information systems control monitoring and maintenance
|
||||
|
||||
**Resources:**
|
||||
- CRISC Review Manual
|
||||
- Risk management frameworks (NIST RMF, ISO 31000)
|
||||
- Risk assessment tools
|
||||
- Real-world risk scenarios
|
||||
|
||||
**Critical:** CRISC requires 3 years of risk management experience in at least 2 of the 4 CRISC domains.
|
||||
|
||||
### Phase 4: Security Leadership (3-5 years experience)
|
||||
**Target:** CISSP
|
||||
|
||||
Demonstrate comprehensive security knowledge:
|
||||
- Security and risk management
|
||||
- Asset security
|
||||
- Security architecture and engineering
|
||||
- Communication and network security
|
||||
- Identity and access management
|
||||
- Security assessment and testing
|
||||
- Security operations
|
||||
- Software development security
|
||||
|
||||
**Resources:**
|
||||
- CISSP official materials
|
||||
- Security frameworks and standards
|
||||
- Management and leadership training
|
||||
|
||||
### Phase 5: Compliance Specialization (Optional, 3+ years)
|
||||
**Target:** ISO 27001 Lead Auditor
|
||||
|
||||
Master international security standards:
|
||||
- ISO/IEC 27001 requirements
|
||||
- Information Security Management Systems (ISMS)
|
||||
- Audit principles and techniques
|
||||
- ISMS implementation and certification
|
||||
- Risk treatment and management
|
||||
|
||||
**Resources:**
|
||||
- ISO 27001 Lead Auditor training
|
||||
- ISMS implementation guides
|
||||
- Audit practice and case studies
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- GRC platforms (ServiceNow, Archer, MetricStream)
|
||||
- Risk assessment methodologies
|
||||
- Audit techniques and tools
|
||||
- Control framework mapping
|
||||
- Compliance automation
|
||||
- Policy management systems
|
||||
- Security metrics and KPIs
|
||||
- Third-party risk assessment
|
||||
|
||||
**Framework Knowledge:**
|
||||
- NIST Cybersecurity Framework
|
||||
- ISO 27001/27002
|
||||
- CIS Controls
|
||||
- COBIT
|
||||
- SOC 2
|
||||
- PCI-DSS
|
||||
- HIPAA
|
||||
- GDPR
|
||||
- SOX
|
||||
|
||||
**Business Skills:**
|
||||
- Risk communication to executives
|
||||
- Business impact analysis
|
||||
- Vendor risk management
|
||||
- Contract negotiation
|
||||
- Policy development
|
||||
- Training and awareness
|
||||
- Stakeholder management
|
||||
|
||||
**Soft Skills:**
|
||||
- Report writing
|
||||
- Presentation skills
|
||||
- Attention to detail
|
||||
- Critical thinking
|
||||
- Diplomacy and tact
|
||||
- Project management
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Audit:** 8-16 months
|
||||
- **Audit to Risk:** 1-2 years
|
||||
- **Risk to Advanced:** 2-3 years
|
||||
|
||||
Total time to senior level: **4-6 years** with progressive GRC responsibility.
|
||||
|
||||
---
|
||||
|
||||
## GRC Functional Areas
|
||||
|
||||
**Governance:**
|
||||
- Security policies and procedures
|
||||
- Security program management
|
||||
- Board reporting
|
||||
- Security strategy alignment
|
||||
- Security awareness training
|
||||
- Security metrics and reporting
|
||||
|
||||
**Risk Management:**
|
||||
- Risk assessment and analysis
|
||||
- Risk treatment planning
|
||||
- Third-party risk management
|
||||
- Vendor security assessments
|
||||
- Risk register maintenance
|
||||
- Business impact analysis
|
||||
- Continuous risk monitoring
|
||||
|
||||
**Compliance:**
|
||||
- Regulatory requirements mapping
|
||||
- Compliance gap analysis
|
||||
- Control implementation
|
||||
- Audit coordination
|
||||
- Evidence collection
|
||||
- Remediation tracking
|
||||
- Compliance reporting
|
||||
|
||||
---
|
||||
|
||||
## Common Regulations and Standards
|
||||
|
||||
**Financial:**
|
||||
- SOX (Sarbanes-Oxley Act)
|
||||
- GLBA (Gramm-Leach-Bliley Act)
|
||||
- PCI-DSS (Payment Card Industry)
|
||||
|
||||
**Healthcare:**
|
||||
- HIPAA (Health Insurance Portability)
|
||||
- HITECH Act
|
||||
|
||||
**Privacy:**
|
||||
- GDPR (General Data Protection Regulation)
|
||||
- CCPA (California Consumer Privacy Act)
|
||||
- PIPEDA (Canada)
|
||||
|
||||
**Federal:**
|
||||
- FISMA (Federal Information Security)
|
||||
- FedRAMP (Federal Risk Authorization)
|
||||
- NIST SP 800-53
|
||||
|
||||
**Industry Standards:**
|
||||
- ISO 27001/27002
|
||||
- NIST Cybersecurity Framework
|
||||
- CIS Controls
|
||||
- SOC 2 Type II
|
||||
|
||||
---
|
||||
|
||||
## Career Progression
|
||||
|
||||
**GRC Analyst (0-2 years)**
|
||||
- Conduct compliance assessments
|
||||
- Maintain documentation
|
||||
- Track remediation efforts
|
||||
- Support audit activities
|
||||
|
||||
**Senior GRC Analyst (2-4 years)**
|
||||
- Lead compliance programs
|
||||
- Perform risk assessments
|
||||
- Coordinate audits
|
||||
- Develop policies and procedures
|
||||
|
||||
**GRC Manager (4-7 years)**
|
||||
- Manage GRC program
|
||||
- Strategic risk management
|
||||
- Vendor risk program
|
||||
- Executive reporting
|
||||
|
||||
**Director/VP of GRC (7+ years)**
|
||||
- Enterprise-wide GRC strategy
|
||||
- Board presentations
|
||||
- Program leadership
|
||||
- Industry representation
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Understand GRC through practical application:
|
||||
- [Password Policy Auditor](../SYNOPSES/intermediate/Password.Policy.Auditor.md)
|
||||
- [File Integrity Monitor](../SYNOPSES/beginner/File.Integrity.Monitor.md)
|
||||
- [Cloud Asset Inventory](../SYNOPSES/intermediate/Cloud.Asset.Inventory.md)
|
||||
- [Backup Integrity Checker](../SYNOPSES/intermediate/Backup.Integrity.Checker.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,203 @@
|
|||
# Incident Responder Certification Roadmap
|
||||
|
||||
A structured path to becoming an Incident Responder, specializing in investigating, containing, and remediating security breaches and cyber attacks.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Incident Responders are the front-line defenders when security incidents occur. They investigate breaches, contain threats, perform forensic analysis, and coordinate recovery efforts. This role requires deep technical skills in forensics, malware analysis, and threat hunting.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Entry** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
||||
| **Core IR Cert** | **GCIH** (Certified Incident Handler) | GIAC | [Website](https://www.giac.org/certifications/certified-incident-handler-gcih/) |
|
||||
| **Forensics/Advanced** | **GCFA** (Certified Forensic Analyst) | GIAC | [Website](https://www.giac.org/certifications/certified-forensic-analyst-gcfa/) |
|
||||
| **Malware Analysis/Expert** | **GREM** (Reverse Engineering Malware) | GIAC | [Website](https://www.giac.org/certifications/reverse-engineering-malware-grem/) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental knowledge:
|
||||
- Security concepts and terminology
|
||||
- Network protocols and analysis
|
||||
- Operating systems internals
|
||||
- Attack methodologies
|
||||
- Security tools basics
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- Network protocol analysis
|
||||
- Basic forensics concepts
|
||||
|
||||
### Phase 2: Cyber Defense Operations (4-6 months)
|
||||
**Target:** CySA+
|
||||
|
||||
Develop defensive analysis skills:
|
||||
- Threat detection and analysis
|
||||
- Security monitoring techniques
|
||||
- Vulnerability assessment
|
||||
- Incident response fundamentals
|
||||
- Threat intelligence
|
||||
- Security tools proficiency
|
||||
|
||||
**Resources:**
|
||||
- CySA+ study materials
|
||||
- SIEM training
|
||||
- Incident response simulations
|
||||
- Network traffic analysis practice
|
||||
|
||||
### Phase 3: Incident Handling (6-12 months)
|
||||
**Target:** GCIH
|
||||
|
||||
Master incident response:
|
||||
- Incident response methodology
|
||||
- Windows forensic analysis
|
||||
- Linux forensic analysis
|
||||
- Network forensics
|
||||
- Memory analysis
|
||||
- Timeline reconstruction
|
||||
- Evidence handling
|
||||
- Attack reconstruction
|
||||
|
||||
**Resources:**
|
||||
- SANS incident handling course (SEC504)
|
||||
- Incident response frameworks (NIST, SANS)
|
||||
- Practice incident scenarios
|
||||
- Real-world IR experience
|
||||
|
||||
**Note:** GCIH is hands-on focused - you'll analyze real attacks and learn practical IR techniques.
|
||||
|
||||
### Phase 4: Digital Forensics (1-2 years experience)
|
||||
**Target:** GCFA
|
||||
|
||||
Specialize in forensic investigation:
|
||||
- Advanced file system analysis
|
||||
- Registry forensics
|
||||
- Browser forensics
|
||||
- Email forensics
|
||||
- Mobile device forensics
|
||||
- Cloud forensics
|
||||
- Anti-forensics detection
|
||||
- Expert witness testimony
|
||||
|
||||
**Resources:**
|
||||
- SANS forensics course (FOR500)
|
||||
- Forensic tool training (EnCase, FTK, Autopsy)
|
||||
- Case study analysis
|
||||
- Mock investigations
|
||||
|
||||
### Phase 5: Malware Analysis (2-3 years experience)
|
||||
**Target:** GREM
|
||||
|
||||
Master reverse engineering:
|
||||
- Malware behavior analysis
|
||||
- Static code analysis
|
||||
- Dynamic malware analysis
|
||||
- Debugger proficiency
|
||||
- Assembly language
|
||||
- Obfuscation techniques
|
||||
- Malware family identification
|
||||
- Threat actor attribution
|
||||
|
||||
**Resources:**
|
||||
- SANS malware analysis course (FOR610)
|
||||
- Reverse engineering platforms
|
||||
- Malware analysis labs
|
||||
- IDA Pro/Ghidra training
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- Forensic tools (EnCase, FTK, Volatility, Autopsy)
|
||||
- Network analysis (Wireshark, tcpdump, NetworkMiner)
|
||||
- Malware analysis (IDA Pro, Ghidra, x64dbg)
|
||||
- Memory forensics (Volatility, Rekall)
|
||||
- Log analysis (Splunk, ELK, grep mastery)
|
||||
- Scripting (Python for automation)
|
||||
- Operating system internals
|
||||
- File system analysis
|
||||
- Registry analysis
|
||||
|
||||
**Soft Skills:**
|
||||
- High-pressure decision making
|
||||
- Clear communication during crises
|
||||
- Detailed documentation
|
||||
- Analytical thinking
|
||||
- Persistence and patience
|
||||
- Teamwork and coordination
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Entry to Core:** 6-10 months
|
||||
- **Core to Advanced:** 1-2 years
|
||||
- **Advanced to Expert:** 2-3 years
|
||||
|
||||
Total time to expert level: **4-6 years** with hands-on incident response experience.
|
||||
|
||||
---
|
||||
|
||||
## Incident Response Lifecycle
|
||||
|
||||
Understanding the IR process:
|
||||
|
||||
1. **Preparation**
|
||||
- Develop IR plans and playbooks
|
||||
- Train team members
|
||||
- Establish communication channels
|
||||
- Deploy monitoring tools
|
||||
|
||||
2. **Detection & Analysis**
|
||||
- Identify potential incidents
|
||||
- Determine scope and severity
|
||||
- Collect initial evidence
|
||||
- Classify incident type
|
||||
|
||||
3. **Containment**
|
||||
- Short-term containment (isolate systems)
|
||||
- Long-term containment (apply patches, harden)
|
||||
- Evidence preservation
|
||||
- System backups
|
||||
|
||||
4. **Eradication**
|
||||
- Remove malware and backdoors
|
||||
- Patch vulnerabilities
|
||||
- Strengthen defenses
|
||||
- Verify removal
|
||||
|
||||
5. **Recovery**
|
||||
- Restore systems to production
|
||||
- Monitor for reinfection
|
||||
- Validate business operations
|
||||
- System hardening
|
||||
|
||||
6. **Lessons Learned**
|
||||
- Document incident details
|
||||
- Analyze root cause
|
||||
- Update procedures
|
||||
- Share intelligence
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Practice incident response skills with these projects:
|
||||
- [File Integrity Monitor](../SYNOPSES/beginner/File.Integrity.Monitor.md)
|
||||
- [SSH Brute Force Detector](../SYNOPSES/beginner/SSH.Brute.Force.Detector.md)
|
||||
- [Network Traffic Analyzer](../SYNOPSES/beginner/Network.Traffic.Analyzer.md)
|
||||
- [Malware Analysis Platform](../SYNOPSES/advanced/Malware.Analysis.Platform.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,291 @@
|
|||
# Network Engineer (Security-Focused) Certification Roadmap
|
||||
|
||||
A structured path to becoming a Network Engineer with security expertise, specializing in designing and securing enterprise network infrastructure.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Network Engineers with security focus build and maintain secure network infrastructure. This role requires deep knowledge of networking protocols, architecture, and security controls. Network security engineers implement firewalls, VPNs, intrusion detection systems, and ensure network resilience against attacks.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Network+** | CompTIA | [Website](https://www.comptia.org/certifications/network) |
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Associate** | **CCNA** (Cisco Certified Network Associate) | Cisco | [Website](https://www.cisco.com/c/en/us/training-events/training-certifications/certifications/associate/ccna.html) |
|
||||
| **Advanced** | **CCNP Security** | Cisco | [Website](https://www.cisco.com/c/en/us/training-events/training-certifications/certifications/professional/ccnp-security.html) |
|
||||
| **Architect/Management** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Networking Foundations (3-6 months)
|
||||
**Target:** Network+
|
||||
|
||||
Build fundamental networking knowledge:
|
||||
- OSI and TCP/IP models
|
||||
- IP addressing and subnetting
|
||||
- Routing and switching basics
|
||||
- Network protocols (TCP, UDP, ICMP, ARP)
|
||||
- Network topologies and infrastructure
|
||||
- Network troubleshooting
|
||||
- Basic network security
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Network+ materials
|
||||
- Packet Tracer labs
|
||||
- Network fundamentals courses
|
||||
|
||||
**Note:** Strong networking fundamentals are critical before moving to security.
|
||||
|
||||
### Phase 2: Security Fundamentals (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Add security knowledge layer:
|
||||
- Security concepts and controls
|
||||
- Network security devices
|
||||
- Cryptography and PKI
|
||||
- Security protocols (TLS, IPsec, SSH)
|
||||
- Threat landscape
|
||||
- Risk management
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- Network security basics
|
||||
- Security best practices
|
||||
|
||||
### Phase 3: Cisco Networking (6-12 months)
|
||||
**Target:** CCNA
|
||||
|
||||
Master enterprise networking:
|
||||
- Network fundamentals
|
||||
- Network access
|
||||
- IP connectivity
|
||||
- IP services
|
||||
- Security fundamentals
|
||||
- Automation and programmability
|
||||
|
||||
**CCNA covers:**
|
||||
- Routing protocols (OSPF, EIGRP, BGP)
|
||||
- Switching and VLANs
|
||||
- Wireless networking
|
||||
- Network automation
|
||||
- Basic security configuration
|
||||
|
||||
**Resources:**
|
||||
- Cisco official training
|
||||
- Packet Tracer and GNS3 labs
|
||||
- Cisco documentation
|
||||
- Hands-on lab practice
|
||||
|
||||
**Note:** CCNA is highly valued in the industry and covers both networking and basic security.
|
||||
|
||||
### Phase 4: Advanced Network Security (1-2 years experience)
|
||||
**Target:** CCNP Security
|
||||
|
||||
Specialize in Cisco security:
|
||||
- Secure network access
|
||||
- Network security platforms
|
||||
- Securing cloud and content
|
||||
- Threat detection and response
|
||||
|
||||
**CCNP Security includes:**
|
||||
- **Core Exam (SCOR 350-701):**
|
||||
- Security concepts
|
||||
- Network security
|
||||
- Securing the cloud
|
||||
- Content security
|
||||
- Endpoint protection and detection
|
||||
- Secure network access
|
||||
- Visibility and enforcement
|
||||
|
||||
- **Concentration Exam (choose one):**
|
||||
- SISE (Identity Services Engine)
|
||||
- SVPN (Virtual Private Networks)
|
||||
- SSFIPS (Firepower Threat Defense)
|
||||
- SISE (Secure Workload)
|
||||
|
||||
**Resources:**
|
||||
- Cisco official training
|
||||
- Hands-on security device configuration
|
||||
- Real-world implementation
|
||||
|
||||
### Phase 5: Strategic Security Leadership (Optional, 5+ years)
|
||||
**Target:** CISSP
|
||||
|
||||
Transition to security leadership:
|
||||
- Security program management
|
||||
- Risk assessment and management
|
||||
- Security architecture
|
||||
- Network security strategy
|
||||
|
||||
**Resources:**
|
||||
- CISSP official materials
|
||||
- Security frameworks
|
||||
- Management training
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Core Networking:**
|
||||
- Routing protocols (OSPF, BGP, EIGRP)
|
||||
- Switching and VLANs
|
||||
- Network design and architecture
|
||||
- Quality of Service (QoS)
|
||||
- Network monitoring
|
||||
- Troubleshooting methodology
|
||||
|
||||
**Network Security:**
|
||||
- Firewalls (ASA, Firepower, Palo Alto, Fortinet)
|
||||
- VPN technologies (IPsec, SSL VPN)
|
||||
- Intrusion Detection/Prevention Systems (IDS/IPS)
|
||||
- Network Access Control (NAC)
|
||||
- Web application firewalls (WAF)
|
||||
- DDoS mitigation
|
||||
- Network segmentation
|
||||
- Zero Trust network architecture
|
||||
|
||||
**Security Protocols:**
|
||||
- IPsec (site-to-site and remote access VPN)
|
||||
- TLS/SSL (secure communications)
|
||||
- SSH (secure management)
|
||||
- 802.1X (port-based authentication)
|
||||
- RADIUS/TACACS+ (authentication)
|
||||
|
||||
**Monitoring and Analysis:**
|
||||
- NetFlow/sFlow analysis
|
||||
- SIEM integration
|
||||
- Packet capture and analysis
|
||||
- Security event correlation
|
||||
- Anomaly detection
|
||||
|
||||
**Automation:**
|
||||
- Python for network automation
|
||||
- Ansible for configuration management
|
||||
- Network device APIs
|
||||
- Infrastructure as Code
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Associate:** 9-18 months
|
||||
- **Associate to Advanced:** 1-2 years
|
||||
- **Advanced to Architect:** 3-5 years
|
||||
|
||||
Total time to senior level: **5-7 years** with progressive network security experience.
|
||||
|
||||
---
|
||||
|
||||
## Network Security Architecture
|
||||
|
||||
**Perimeter Security:**
|
||||
- Next-generation firewalls (NGFW)
|
||||
- Intrusion prevention systems
|
||||
- DDoS protection
|
||||
- DMZ design
|
||||
- Web application firewalls
|
||||
|
||||
**Internal Network Security:**
|
||||
- Network segmentation
|
||||
- VLANs and access control lists (ACLs)
|
||||
- Private VLANs
|
||||
- Microsegmentation
|
||||
- Zero Trust implementation
|
||||
|
||||
**Access Security:**
|
||||
- 802.1X authentication
|
||||
- Network Access Control (NAC)
|
||||
- VPN concentrators
|
||||
- Multi-factor authentication
|
||||
- Certificate-based authentication
|
||||
|
||||
**Monitoring and Detection:**
|
||||
- Network traffic analysis
|
||||
- Security information and event management (SIEM)
|
||||
- Network behavior analysis
|
||||
- Threat intelligence integration
|
||||
- Security orchestration
|
||||
|
||||
**Wireless Security:**
|
||||
- WPA3 encryption
|
||||
- Wireless IDS/IPS
|
||||
- Rogue access point detection
|
||||
- Guest network isolation
|
||||
- Wireless authentication (802.1X)
|
||||
|
||||
---
|
||||
|
||||
## Common Network Security Technologies
|
||||
|
||||
**Cisco:**
|
||||
- ASA Firewalls
|
||||
- Firepower NGFW
|
||||
- Identity Services Engine (ISE)
|
||||
- Cisco Secure Email
|
||||
- Stealthwatch
|
||||
|
||||
**Palo Alto:**
|
||||
- PA-Series Firewalls
|
||||
- Panorama (management)
|
||||
- Prisma Cloud
|
||||
- Cortex XDR
|
||||
|
||||
**Fortinet:**
|
||||
- FortiGate Firewalls
|
||||
- FortiManager
|
||||
- FortiAnalyzer
|
||||
- FortiMail
|
||||
|
||||
**Check Point:**
|
||||
- Security Gateways
|
||||
- SmartConsole
|
||||
- Threat Prevention
|
||||
- Mobile Access
|
||||
|
||||
---
|
||||
|
||||
## Career Progression
|
||||
|
||||
**Network Engineer (0-3 years)**
|
||||
- Configure network devices
|
||||
- Maintain network infrastructure
|
||||
- Troubleshoot connectivity issues
|
||||
- Implement security policies
|
||||
|
||||
**Senior Network Engineer (3-6 years)**
|
||||
- Design network solutions
|
||||
- Lead network projects
|
||||
- Implement complex security
|
||||
- Mentor junior engineers
|
||||
|
||||
**Network Architect (6-10 years)**
|
||||
- Design enterprise architecture
|
||||
- Define network standards
|
||||
- Strategic planning
|
||||
- Technology evaluation
|
||||
|
||||
**Principal/Director (10+ years)**
|
||||
- Enterprise-wide strategy
|
||||
- Technology leadership
|
||||
- Cross-functional collaboration
|
||||
- Budget and vendor management
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Build network security skills with these projects:
|
||||
- [Simple Port Scanner](../PROJECTS/beginner/simple-port-scanner)
|
||||
- [Network Traffic Analyzer](../SYNOPSES/beginner/Network.Traffic.Analyzer.md)
|
||||
- [WiFi Network Scanner](../SYNOPSES/beginner/WiFi.Network.Scanner.md)
|
||||
- [Network Intrusion Prevention](../SYNOPSES/intermediate/Network.Intrusion.Prevention.md)
|
||||
- [DDoS Mitigation Tool](../SYNOPSES/intermediate/DDoS.Mitigation.Tool.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,173 @@
|
|||
# Penetration Tester Certification Roadmap
|
||||
|
||||
A structured path to becoming a professional penetration tester, from foundations through advanced offensive security expertise.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Penetration testers ethically hack systems to identify vulnerabilities before malicious actors can exploit them. This roadmap progresses from basic security knowledge to advanced exploit development and penetration testing.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Entry-Level Pentest** | **PenTest+** | CompTIA | [Website](https://www.comptia.org/certifications/pentest) |
|
||||
| **Intermediate** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh-v12/) |
|
||||
| **Advanced** | **OSCP** (Gold Standard) | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/oscp-certification) |
|
||||
| **Expert** | **OSEP** | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/osep-certification) |
|
||||
| **Expert** | **GXPN** (Exploit Researcher) | GIAC | [Website](https://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn/) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental knowledge in:
|
||||
- Network protocols and architecture
|
||||
- Operating systems (Windows/Linux)
|
||||
- Security concepts and terminology
|
||||
- Basic cryptography
|
||||
- Security tools fundamentals
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ official materials
|
||||
- Basic networking courses
|
||||
- Linux fundamentals training
|
||||
|
||||
### Phase 2: Pentesting Basics (3-6 months)
|
||||
**Target:** PenTest+
|
||||
|
||||
Learn core penetration testing:
|
||||
- Reconnaissance and enumeration
|
||||
- Vulnerability scanning
|
||||
- Exploitation basics
|
||||
- Post-exploitation techniques
|
||||
- Reporting and documentation
|
||||
|
||||
**Resources:**
|
||||
- CompTIA PenTest+ study materials
|
||||
- TryHackMe beginner paths
|
||||
- HackTheBox easy machines
|
||||
|
||||
### Phase 3: Ethical Hacking (4-8 months)
|
||||
**Target:** CEH
|
||||
|
||||
Expand attack methodology:
|
||||
- Advanced footprinting
|
||||
- System hacking techniques
|
||||
- Web application attacks
|
||||
- Wireless network attacks
|
||||
- Social engineering
|
||||
- Malware analysis basics
|
||||
|
||||
**Resources:**
|
||||
- EC-Council CEH training
|
||||
- Practical hacking labs
|
||||
- CTF competitions
|
||||
|
||||
### Phase 4: Advanced Penetration Testing (6-12 months)
|
||||
**Target:** OSCP (Industry Gold Standard)
|
||||
|
||||
Master practical penetration testing:
|
||||
- Manual exploitation techniques
|
||||
- Buffer overflow exploitation
|
||||
- Privilege escalation (Windows/Linux)
|
||||
- Active Directory attacks
|
||||
- Lateral movement
|
||||
- Real-world lab environments
|
||||
|
||||
**Resources:**
|
||||
- Offensive Security PWK course
|
||||
- Proving Grounds practice labs
|
||||
- OSCP preparation guides
|
||||
|
||||
**Note:** OSCP requires hands-on exam - you must compromise multiple machines within 24 hours. No multiple choice.
|
||||
|
||||
### Phase 5: Advanced Evasion (12+ months experience)
|
||||
**Target:** OSEP
|
||||
|
||||
Learn evasion and advanced techniques:
|
||||
- AV/EDR evasion
|
||||
- Code signing and obfuscation
|
||||
- Process injection
|
||||
- Advanced Active Directory attacks
|
||||
- Lateral movement techniques
|
||||
|
||||
**Resources:**
|
||||
- Offensive Security PEN-300 course
|
||||
- Advanced red team training
|
||||
- Real-world penetration testing experience
|
||||
|
||||
### Phase 6: Exploit Development (2-3 years experience)
|
||||
**Target:** GXPN
|
||||
|
||||
Specialize in exploit research:
|
||||
- Vulnerability research
|
||||
- Exploit development
|
||||
- Reverse engineering
|
||||
- Zero-day discovery
|
||||
- Advanced binary exploitation
|
||||
|
||||
**Resources:**
|
||||
- SANS exploit development courses
|
||||
- Reverse engineering platforms
|
||||
- Bug bounty programs
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- Linux command line mastery
|
||||
- Scripting (Python, Bash, PowerShell)
|
||||
- Web application testing (Burp Suite, OWASP ZAP)
|
||||
- Network exploitation (Metasploit, custom exploits)
|
||||
- Active Directory attacks
|
||||
- Binary exploitation
|
||||
- Report writing
|
||||
|
||||
**Soft Skills:**
|
||||
- Critical thinking
|
||||
- Attention to detail
|
||||
- Problem-solving under pressure
|
||||
- Clear communication (technical reports)
|
||||
- Ethical judgment
|
||||
- Continuous learning mindset
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Entry:** 5-10 months
|
||||
- **Entry to Advanced:** 10-18 months
|
||||
- **Advanced to Expert:** 1-3 years
|
||||
|
||||
Total time to expert level: **3-5 years** with continuous practical experience.
|
||||
|
||||
---
|
||||
|
||||
## Practice Platforms
|
||||
|
||||
- **TryHackMe** - Guided learning paths
|
||||
- **HackTheBox** - Realistic machines
|
||||
- **VulnHub** - Downloadable VMs
|
||||
- **PentesterLab** - Web app focused
|
||||
- **Proving Grounds** - OSCP-like practice
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Build pentesting skills with these projects:
|
||||
- [Web Vulnerability Scanner](../SYNOPSES/intermediate/Web.Vulnerability.Scanner.md)
|
||||
- [Reverse Shell Handler](../SYNOPSES/intermediate/Reverse.Shell.Handler.md)
|
||||
- [Simple Port Scanner](../PROJECTS/beginner/simple-port-scanner)
|
||||
- [Automated Penetration Testing](../SYNOPSES/advanced/Automated.Penetration.Testing.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
# Certification Roadmaps by Role
|
||||
|
||||
Structured certification paths for different cybersecurity career tracks. Each roadmap provides a progression from entry-level to advanced certifications, with estimated timelines and skill development guidance.
|
||||
|
||||
---
|
||||
|
||||
## Available Roadmaps
|
||||
|
||||
### Defensive Security
|
||||
|
||||
1. **[SOC Analyst](./SOC-ANALYST.md)**
|
||||
- Monitor and respond to security incidents
|
||||
- Timeline: 4-6 years to senior level
|
||||
- Key Certs: Security+, CySA+, GCIH, GCIA, CISSP
|
||||
|
||||
2. **[Incident Responder](./INCIDENT-RESPONDER.md)**
|
||||
- Investigate and remediate security breaches
|
||||
- Timeline: 4-6 years to expert level
|
||||
- Key Certs: Security+, CySA+, GCIH, GCFA, GREM
|
||||
|
||||
3. **[Security Engineer](./SECURITY-ENGINEER.md)**
|
||||
- Design and implement security solutions
|
||||
- Timeline: 5-7 years to senior level
|
||||
- Key Certs: Security+, CySA+, SecurityX, CISSP, CCSP
|
||||
|
||||
### Offensive Security
|
||||
|
||||
4. **[Penetration Tester](./PENTESTER.md)**
|
||||
- Ethically hack systems to find vulnerabilities
|
||||
- Timeline: 3-5 years to expert level
|
||||
- Key Certs: Security+, PenTest+, CEH, OSCP, OSEP, GXPN
|
||||
|
||||
5. **[Application Security](./APPLICATION-SECURITY.md)**
|
||||
- Secure software development lifecycle
|
||||
- Timeline: 4-6 years to senior level
|
||||
- Key Certs: Security+, CEH, CSSLP, OSWE, GWAPT
|
||||
|
||||
### Architecture & Governance
|
||||
|
||||
6. **[Security Architect](./SECURITY-ARCHITECT.md)**
|
||||
- Design enterprise security frameworks
|
||||
- Timeline: 7-10 years to architect level
|
||||
- Key Certs: Security+, SecurityX, CISSP, CCSP, SABSA, TOGAF
|
||||
|
||||
7. **[GRC Analyst/Consultant](./GRC-ANALYST.md)**
|
||||
- Governance, Risk, and Compliance
|
||||
- Timeline: 4-6 years to senior level
|
||||
- Key Certs: Security+, CISA, CRISC, CISSP, ISO 27001 Lead Auditor
|
||||
|
||||
### Specialized Tracks
|
||||
|
||||
8. **[Cloud Security Engineer](./CLOUD-SECURITY-ENGINEER.md)**
|
||||
- Secure cloud infrastructure and services
|
||||
- Timeline: 4-6 years to senior level
|
||||
- Key Certs: Security+, AWS/Azure Security, CCSK, CCSP, SecurityX, CISSP
|
||||
|
||||
9. **[Threat Intelligence Analyst](./THREAT-INTELLIGENCE-ANALYST.md)**
|
||||
- Analyze and disseminate threat intelligence
|
||||
- Timeline: 4-6 years to senior level
|
||||
- Key Certs: Security+, CySA+, GCTI, GCIA, GOSI
|
||||
|
||||
10. **[Network Engineer (Security-Focused)](./NETWORK-ENGINEER.md)**
|
||||
- Secure network infrastructure
|
||||
- Timeline: 5-7 years to senior level
|
||||
- Key Certs: Network+, Security+, CCNA, CCNP Security, CISSP
|
||||
|
||||
---
|
||||
|
||||
## How to Use These Roadmaps
|
||||
|
||||
1. **Choose Your Path** - Select the role that aligns with your career goals
|
||||
2. **Start at Your Level** - If you have experience, enter at the appropriate certification level
|
||||
3. **Build Skills** - Use related projects to practice concepts between certifications
|
||||
4. **Get Hands-On** - Certifications alone aren't enough - build real-world experience
|
||||
5. **Stay Current** - Security evolves rapidly - continuous learning is essential
|
||||
|
||||
---
|
||||
|
||||
## General Advice
|
||||
|
||||
### Entry-Level (0-2 years experience)
|
||||
- Start with CompTIA Security+ regardless of chosen path
|
||||
- Build foundational skills before specializing
|
||||
- Practice on free platforms (TryHackMe, HackTheBox)
|
||||
- Contribute to open-source security projects
|
||||
|
||||
### Mid-Level (2-5 years experience)
|
||||
- Specialize in your chosen track
|
||||
- Pursue advanced certifications (OSCP, GCIH, etc.)
|
||||
- Gain practical experience in production environments
|
||||
- Start building a professional network
|
||||
|
||||
### Senior-Level (5+ years experience)
|
||||
- Consider leadership certifications (CISSP, CISM)
|
||||
- Mentor junior team members
|
||||
- Contribute to the security community
|
||||
- Focus on strategic thinking and business alignment
|
||||
|
||||
---
|
||||
|
||||
## Certification Comparison
|
||||
|
||||
### By Organization
|
||||
|
||||
**CompTIA** - Vendor-neutral, broad knowledge, good for entry/mid-level
|
||||
**Offensive Security (OffSec)** - Hands-on, practical, highly respected for pentesting
|
||||
**GIAC/SANS** - Deep technical knowledge, expensive but comprehensive
|
||||
**(ISC)²** - Management-focused, industry standard for senior roles
|
||||
**EC-Council** - Ethical hacking and security tools
|
||||
|
||||
### By Cost
|
||||
|
||||
- **Budget-Friendly:** CompTIA certifications ($300-400 per exam)
|
||||
- **Mid-Range:** (ISC)² certifications ($700-750 per exam)
|
||||
- **Premium:** SANS/GIAC certifications ($2,000-8,000 including training)
|
||||
- **Hands-On:** Offensive Security ($1,000-2,500 with lab time)
|
||||
|
||||
---
|
||||
|
||||
## Related Resources
|
||||
|
||||
- **[Study Platforms & Courses](../RESOURCES/COURSES.md)**
|
||||
- **[Practice Projects](../README.md#projects)**
|
||||
- **[Cybersecurity Tools](../RESOURCES/TOOLS.md)**
|
||||
- **[Exam Prep Resources](../RESOURCES/CERTIFICATIONS.md)**
|
||||
|
||||
---
|
||||
|
||||
**Last Updated:** January 2026
|
||||
|
||||
[Back to Main README](../README.md)
|
||||
|
|
@ -0,0 +1,234 @@
|
|||
# Security Architect Certification Roadmap
|
||||
|
||||
A structured path to becoming a Security Architect, responsible for designing enterprise-wide security frameworks and strategies.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Security Architects design the overall security infrastructure for organizations, creating frameworks that balance security requirements with business needs. This senior role requires extensive technical knowledge, business acumen, and strategic thinking. Architects typically have 7-10 years of hands-on experience before moving into this role.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Advanced** | **SecurityX** (formerly CASP+) | CompTIA | [Website](https://www.comptia.org/certifications/securityx) |
|
||||
| **Architect/Management** | **CISSP** (Required) | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
| **Cloud Architecture** | **CCSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CCSP) |
|
||||
| **Security Architecture Framework** | **SABSA** | SABSA Institute | [Website](https://sabsa.org/sabsa-chartered-architect-programme/) |
|
||||
| **Enterprise Architecture** | **TOGAF** | The Open Group | [Website](https://www.opengroup.org/certifications/togaf-certifications) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental security knowledge:
|
||||
- Security concepts and controls
|
||||
- Network security basics
|
||||
- Cryptography foundations
|
||||
- Risk management fundamentals
|
||||
- Compliance basics
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- Security fundamentals courses
|
||||
- Basic architecture concepts
|
||||
|
||||
**Note:** Most architects have 5+ years experience before pursuing this path. Security+ is the foundation, not the starting point for architecture roles.
|
||||
|
||||
### Phase 2: Advanced Technical Security (1-2 years experience)
|
||||
**Target:** SecurityX (formerly CASP+)
|
||||
|
||||
Develop enterprise security expertise:
|
||||
- Enterprise security architecture
|
||||
- Risk management and analysis
|
||||
- Security research and analysis
|
||||
- Integration of computing elements
|
||||
- Advanced cryptographic concepts
|
||||
- Security controls for hosts and applications
|
||||
|
||||
**Resources:**
|
||||
- SecurityX study materials
|
||||
- Enterprise architecture patterns
|
||||
- Advanced security frameworks
|
||||
|
||||
### Phase 3: Strategic Security Leadership (5-7 years experience)
|
||||
**Target:** CISSP
|
||||
|
||||
Master security management and governance:
|
||||
- Security and risk management
|
||||
- Asset security
|
||||
- Security architecture and engineering
|
||||
- Communication and network security
|
||||
- Identity and access management
|
||||
- Security assessment and testing
|
||||
- Security operations
|
||||
- Software development security
|
||||
|
||||
**Resources:**
|
||||
- CISSP official materials
|
||||
- Security frameworks (NIST, ISO 27001)
|
||||
- Leadership and management training
|
||||
|
||||
**Critical:** CISSP requires 5 years of paid work experience in 2 or more CISSP domains.
|
||||
|
||||
### Phase 4: Cloud Architecture (Optional, 7+ years experience)
|
||||
**Target:** CCSP
|
||||
|
||||
Specialize in cloud security architecture:
|
||||
- Cloud concepts, architecture, and design
|
||||
- Cloud data security
|
||||
- Cloud platform and infrastructure security
|
||||
- Cloud application security
|
||||
- Cloud security operations
|
||||
- Legal, risk, and compliance
|
||||
|
||||
**Resources:**
|
||||
- CCSP official materials
|
||||
- Cloud architecture frameworks
|
||||
- Multi-cloud security design
|
||||
|
||||
### Phase 5: Security Architecture Frameworks (8+ years experience)
|
||||
**Target:** SABSA
|
||||
|
||||
Master business-driven security architecture:
|
||||
- Business requirements analysis
|
||||
- Strategy and planning
|
||||
- Concept design
|
||||
- Detailed design
|
||||
- Implementation and operations
|
||||
- Performance management
|
||||
|
||||
**Resources:**
|
||||
- SABSA Foundation and Practitioner courses
|
||||
- SABSA white papers and case studies
|
||||
- Enterprise architecture implementation
|
||||
|
||||
### Phase 6: Enterprise Architecture (Optional, 8+ years experience)
|
||||
**Target:** TOGAF
|
||||
|
||||
Integrate security into enterprise architecture:
|
||||
- Architecture development method
|
||||
- Architecture content framework
|
||||
- Enterprise continuum
|
||||
- Architecture capability framework
|
||||
- Reference models
|
||||
|
||||
**Resources:**
|
||||
- TOGAF Foundation and Certified courses
|
||||
- Enterprise architecture patterns
|
||||
- Integration with security frameworks
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- Security architecture patterns
|
||||
- Cloud architecture (AWS, Azure, GCP)
|
||||
- Network architecture and design
|
||||
- Application security architecture
|
||||
- Identity and access management design
|
||||
- Data protection architecture
|
||||
- Secure SDLC integration
|
||||
- Zero Trust architecture
|
||||
- Architecture documentation (diagrams, models)
|
||||
|
||||
**Business Skills:**
|
||||
- Business strategy alignment
|
||||
- Risk assessment and communication
|
||||
- Vendor evaluation and management
|
||||
- Budget planning and justification
|
||||
- Regulatory compliance
|
||||
- Business case development
|
||||
|
||||
**Leadership Skills:**
|
||||
- Strategic thinking
|
||||
- Stakeholder management
|
||||
- Team leadership and mentoring
|
||||
- Cross-functional collaboration
|
||||
- Executive communication
|
||||
- Change management
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Advanced:** 1-2 years
|
||||
- **Advanced to Strategic:** 3-5 years
|
||||
- **Strategic to Architect:** 2-3 years
|
||||
|
||||
Total time to architect level: **7-10 years** of progressive security experience and increasing responsibility.
|
||||
|
||||
---
|
||||
|
||||
## Architecture Frameworks
|
||||
|
||||
Security Architects must be familiar with:
|
||||
|
||||
**Security Frameworks:**
|
||||
- NIST Cybersecurity Framework
|
||||
- NIST 800-53 Security Controls
|
||||
- ISO/IEC 27001/27002
|
||||
- CIS Controls
|
||||
- MITRE ATT&CK
|
||||
|
||||
**Architecture Frameworks:**
|
||||
- SABSA (Security Architecture)
|
||||
- TOGAF (Enterprise Architecture)
|
||||
- Zachman Framework
|
||||
- FEAF (Federal Enterprise Architecture)
|
||||
|
||||
**Industry Regulations:**
|
||||
- PCI-DSS (Payment Card Industry)
|
||||
- HIPAA (Healthcare)
|
||||
- GDPR (Data Protection)
|
||||
- SOX (Financial)
|
||||
- FedRAMP (Federal Cloud)
|
||||
|
||||
---
|
||||
|
||||
## Career Progression
|
||||
|
||||
**Security Engineer (0-3 years)**
|
||||
- Implement security solutions
|
||||
- Build security expertise
|
||||
- Learn business operations
|
||||
|
||||
**Senior Security Engineer (3-6 years)**
|
||||
- Design security solutions
|
||||
- Lead technical projects
|
||||
- Mentor junior engineers
|
||||
|
||||
**Lead Security Engineer (6-8 years)**
|
||||
- Define security standards
|
||||
- Multi-project leadership
|
||||
- Cross-team collaboration
|
||||
|
||||
**Security Architect (8-10 years)**
|
||||
- Design enterprise security architecture
|
||||
- Strategic security planning
|
||||
- Executive stakeholder management
|
||||
|
||||
**Principal/Enterprise Architect (10+ years)**
|
||||
- Organization-wide security strategy
|
||||
- Security innovation and research
|
||||
- Industry thought leadership
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Understand architecture through implementation:
|
||||
- [Bug Bounty Platform](../PROJECTS/advanced/bug-bounty-platform)
|
||||
- [Cloud Security Posture Management](../SYNOPSES/advanced/Cloud.Security.Posture.Management.md)
|
||||
- [Zero Trust Architecture](../SYNOPSES/advanced) (when available)
|
||||
- [API Security Scanner](../PROJECTS/intermediate/api-security-scanner)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,179 @@
|
|||
# Security Engineer Certification Roadmap
|
||||
|
||||
A structured path to becoming a Security Engineer, focused on designing, implementing, and maintaining security solutions across enterprise infrastructure.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Security Engineers build and maintain the technical security infrastructure that protects organizations. This role combines deep technical knowledge with architecture design, requiring expertise in network security, application security, cloud security, and security operations.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Intermediate** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cysa) |
|
||||
| **Advanced** | **SecurityX** (formerly CASP+) | CompTIA | [Website](https://www.comptia.org/certifications/securityx) |
|
||||
| **Advanced/Expert** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
| **Expert (Cloud-focused)** | **CCSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CCSP) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build core security knowledge:
|
||||
- Network security fundamentals
|
||||
- Operating system security (Windows/Linux)
|
||||
- Security controls and technologies
|
||||
- Cryptography and PKI
|
||||
- Risk management basics
|
||||
- Compliance frameworks
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ official materials
|
||||
- Network fundamentals training
|
||||
- Linux/Windows administration basics
|
||||
|
||||
### Phase 2: Defensive Operations (4-6 months)
|
||||
**Target:** CySA+
|
||||
|
||||
Develop operational security skills:
|
||||
- Security monitoring and analysis
|
||||
- Threat detection and response
|
||||
- Vulnerability management lifecycle
|
||||
- Security tool integration
|
||||
- Log analysis and correlation
|
||||
- Incident triage
|
||||
|
||||
**Resources:**
|
||||
- CySA+ study materials
|
||||
- SIEM platform training (Splunk, ELK)
|
||||
- Hands-on lab environments
|
||||
|
||||
### Phase 3: Advanced Architecture (6-12 months)
|
||||
**Target:** SecurityX
|
||||
|
||||
Master enterprise security design:
|
||||
- Security architecture frameworks
|
||||
- Advanced network security design
|
||||
- Secure application development
|
||||
- Enterprise risk management
|
||||
- Security assessment and testing
|
||||
- Integration with business operations
|
||||
|
||||
**Resources:**
|
||||
- SecurityX official training
|
||||
- Enterprise architecture courses
|
||||
- Real-world implementation experience
|
||||
|
||||
### Phase 4: Management and Governance (2-3 years experience)
|
||||
**Target:** CISSP
|
||||
|
||||
Transition to strategic security:
|
||||
- Security program management
|
||||
- Asset security and classification
|
||||
- Security engineering principles
|
||||
- Communication and network security
|
||||
- Identity and access management
|
||||
- Security assessment and testing
|
||||
- Security operations management
|
||||
- Software development security
|
||||
|
||||
**Resources:**
|
||||
- CISSP study materials
|
||||
- Security frameworks (NIST, ISO 27001)
|
||||
- Management and leadership training
|
||||
|
||||
### Phase 5: Cloud Security Specialization (Optional)
|
||||
**Target:** CCSP
|
||||
|
||||
Focus on cloud security:
|
||||
- Cloud architecture and design
|
||||
- Cloud data security
|
||||
- Cloud platform security
|
||||
- Cloud application security
|
||||
- Cloud security operations
|
||||
- Legal, risk, and compliance
|
||||
|
||||
**Resources:**
|
||||
- CCSP official materials
|
||||
- Cloud platform security training
|
||||
- Hands-on cloud security implementation
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- Network security (firewalls, IDS/IPS, VPN)
|
||||
- Endpoint security (EDR, DLP, encryption)
|
||||
- Cloud security (AWS, Azure, GCP)
|
||||
- Application security (SAST, DAST, code review)
|
||||
- Infrastructure as Code (Terraform, CloudFormation)
|
||||
- Security automation and orchestration
|
||||
- Scripting (Python, PowerShell, Bash)
|
||||
- Container security (Docker, Kubernetes)
|
||||
|
||||
**Soft Skills:**
|
||||
- Project management
|
||||
- Cross-team collaboration
|
||||
- Technical documentation
|
||||
- Risk communication
|
||||
- Vendor management
|
||||
- Strategic thinking
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Intermediate:** 6-10 months
|
||||
- **Intermediate to Advanced:** 1-2 years
|
||||
- **Advanced to Expert:** 2-3 years
|
||||
|
||||
Total time to senior level: **5-7 years** with progressive responsibility and hands-on implementation experience.
|
||||
|
||||
---
|
||||
|
||||
## Career Progression
|
||||
|
||||
**Junior Security Engineer (0-2 years)**
|
||||
- Implement security controls
|
||||
- Maintain security tools
|
||||
- Assist with security projects
|
||||
- Monitor security alerts
|
||||
|
||||
**Security Engineer (2-5 years)**
|
||||
- Design security solutions
|
||||
- Lead security implementations
|
||||
- Conduct security assessments
|
||||
- Manage security projects
|
||||
|
||||
**Senior Security Engineer (5-8 years)**
|
||||
- Architect enterprise security
|
||||
- Lead security initiatives
|
||||
- Mentor junior engineers
|
||||
- Drive security strategy
|
||||
|
||||
**Principal/Staff Engineer (8+ years)**
|
||||
- Define security standards
|
||||
- Enterprise-wide architecture
|
||||
- Technical leadership
|
||||
- Innovation and research
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Build security engineering skills with these projects:
|
||||
- [API Rate Limiter](../PROJECTS/advanced/api-rate-limiter)
|
||||
- [Web Application Firewall](../SYNOPSES/intermediate/Web.Application.Firewall.md)
|
||||
- [Container Security Scanner](../SYNOPSES/intermediate/Container.Security.Scanner.md)
|
||||
- [Cloud Security Posture Management](../SYNOPSES/advanced/Cloud.Security.Posture.Management.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
# SOC Analyst Certification Roadmap
|
||||
|
||||
A structured path to becoming a Security Operations Center Analyst, from entry-level to senior/management positions.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
SOC Analysts monitor, detect, investigate, and respond to cybersecurity threats. This roadmap progresses from foundational knowledge through incident handling and intrusion analysis.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Entry** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
||||
| **Intermediate** | **GCIH** (Certified Incident Handler) | GIAC | [Website](https://www.giac.org/certifications/certified-incident-handler-gcih/) |
|
||||
| **Intermediate** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/) |
|
||||
| **Advanced** | **GCIA** (Certified Intrusion Analyst) | GIAC | [Website](https://www.giac.org/certifications/certified-intrusion-analyst-gcia/) |
|
||||
| **Senior/Management** | **CISSP** | (ISC)² | [Website](https://www.isc2.org/Certifications/CISSP) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Foundation (3-6 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental knowledge in:
|
||||
- Network security concepts
|
||||
- Threat landscape and attack types
|
||||
- Cryptography basics
|
||||
- Security policies and compliance
|
||||
- Risk management
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ training materials
|
||||
- Practice labs and simulations
|
||||
- Security fundamentals courses
|
||||
|
||||
### Phase 2: Core SOC Skills (4-8 months)
|
||||
**Target:** CySA+
|
||||
|
||||
Develop analyst capabilities:
|
||||
- Security operations and monitoring
|
||||
- Threat intelligence analysis
|
||||
- Vulnerability management
|
||||
- Incident response fundamentals
|
||||
- Log analysis and SIEM tools
|
||||
|
||||
**Resources:**
|
||||
- CySA+ official study materials
|
||||
- SOC analyst training platforms
|
||||
- Hands-on lab environments (TryHackMe, HackTheBox)
|
||||
|
||||
### Phase 3: Incident Handling (6-12 months)
|
||||
**Target:** GCIH and/or CEH
|
||||
|
||||
Master incident response:
|
||||
- Incident detection and analysis
|
||||
- Malware analysis basics
|
||||
- Forensic investigation
|
||||
- Ethical hacking techniques
|
||||
- Attack methodologies
|
||||
|
||||
**Resources:**
|
||||
- SANS incident handling courses
|
||||
- EC-Council CEH training
|
||||
- Incident response simulations
|
||||
|
||||
### Phase 4: Advanced Analysis (12+ months experience)
|
||||
**Target:** GCIA
|
||||
|
||||
Specialize in intrusion analysis:
|
||||
- Advanced network traffic analysis
|
||||
- Threat hunting techniques
|
||||
- Deep packet inspection
|
||||
- Attack pattern recognition
|
||||
- Advanced persistent threat (APT) detection
|
||||
|
||||
**Resources:**
|
||||
- GIAC training materials
|
||||
- Advanced threat hunting platforms
|
||||
- Real-world SOC experience
|
||||
|
||||
### Phase 5: Leadership (3-5 years experience)
|
||||
**Target:** CISSP
|
||||
|
||||
Transition to strategic roles:
|
||||
- Security program management
|
||||
- Risk assessment frameworks
|
||||
- Security architecture design
|
||||
- Policy and governance
|
||||
- Team leadership
|
||||
|
||||
**Resources:**
|
||||
- CISSP study materials
|
||||
- Management and leadership training
|
||||
- Industry frameworks (NIST, ISO 27001)
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- SIEM platforms (Splunk, ELK, QRadar)
|
||||
- Network traffic analysis (Wireshark, tcpdump)
|
||||
- Endpoint detection and response (EDR)
|
||||
- Log aggregation and correlation
|
||||
- Scripting (Python, PowerShell)
|
||||
- Threat intelligence platforms
|
||||
|
||||
**Soft Skills:**
|
||||
- Critical thinking and problem-solving
|
||||
- Communication (technical and non-technical)
|
||||
- Documentation and reporting
|
||||
- Time management under pressure
|
||||
- Teamwork and collaboration
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Entry to Core:** 6-12 months
|
||||
- **Core to Advanced:** 1-2 years
|
||||
- **Advanced to Senior:** 2-3 years
|
||||
|
||||
Total time to senior-level: **4-6 years** with continuous learning and hands-on experience.
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Practice SOC skills with these projects:
|
||||
- [SIEM Dashboard](../SYNOPSES/intermediate/SIEM.Dashboard.md)
|
||||
- [Threat Intelligence Aggregator](../SYNOPSES/intermediate/Threat.Intelligence.Aggregator.md)
|
||||
- [Network Traffic Analyzer](../SYNOPSES/beginner/Network.Traffic.Analyzer.md)
|
||||
- [SSH Brute Force Detector](../SYNOPSES/beginner/SSH.Brute.Force.Detector.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
|
|
@ -0,0 +1,262 @@
|
|||
# Threat Intelligence Analyst Certification Roadmap
|
||||
|
||||
A structured path to becoming a Threat Intelligence Analyst, specializing in collecting, analyzing, and disseminating actionable intelligence on cyber threats.
|
||||
|
||||
## Career Path Overview
|
||||
|
||||
Threat Intelligence Analysts research adversaries, analyze attack patterns, and provide actionable intelligence to security teams. This role requires analytical thinking, research skills, and the ability to transform raw data into strategic insights that guide defensive operations.
|
||||
|
||||
---
|
||||
|
||||
## Certification Path
|
||||
|
||||
| Level | Certification | Organization | Link |
|
||||
|-------|--------------|--------------|------|
|
||||
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
||||
| **Core** | **CySA+** | CompTIA | [Website](https://www.comptia.org/certifications/cysa) |
|
||||
| **Cyber Threat Intelligence** | **GCTI** | GIAC | [Website](https://www.giac.org/certification/cyber-threat-intelligence-gcti/) |
|
||||
| **Intrusion Analysis** | **GCIA** | GIAC | [Website](https://www.giac.org/certification/certified-intrusion-analyst-gcia/) |
|
||||
| **OSINT (Optional)** | **GOSI** | GIAC | [Website](https://www.giac.org/certification/open-source-intelligence-gosi/) |
|
||||
| **OSINT (Optional)** | **C\|OSINT** | McAfee Institute | [Website](https://www.mcafeeinstitute.com/products/certified-osint) |
|
||||
|
||||
---
|
||||
|
||||
## Recommended Learning Path
|
||||
|
||||
### Phase 1: Security Foundations (2-4 months)
|
||||
**Target:** Security+
|
||||
|
||||
Build fundamental security knowledge:
|
||||
- Security concepts and terminology
|
||||
- Attack methodologies and threat actors
|
||||
- Network security basics
|
||||
- Malware types and indicators
|
||||
- Security operations overview
|
||||
|
||||
**Resources:**
|
||||
- CompTIA Security+ materials
|
||||
- Threat landscape overviews
|
||||
- Cyber threat fundamentals
|
||||
|
||||
### Phase 2: Cyber Defense Analysis (4-6 months)
|
||||
**Target:** CySA+
|
||||
|
||||
Develop analytical capabilities:
|
||||
- Threat detection and analysis
|
||||
- Security monitoring techniques
|
||||
- Vulnerability management
|
||||
- Threat intelligence fundamentals
|
||||
- Incident response support
|
||||
- Log analysis and correlation
|
||||
|
||||
**Resources:**
|
||||
- CySA+ study materials
|
||||
- SIEM training
|
||||
- Threat analysis platforms
|
||||
- Intelligence reporting practice
|
||||
|
||||
### Phase 3: Threat Intelligence Specialization (6-12 months)
|
||||
**Target:** GCTI
|
||||
|
||||
Master cyber threat intelligence:
|
||||
- Intelligence collection requirements
|
||||
- Threat actor profiling and attribution
|
||||
- Indicator analysis and validation
|
||||
- Threat intelligence platforms and tools
|
||||
- Intelligence dissemination and reporting
|
||||
- Strategic, operational, and tactical intelligence
|
||||
- Intelligence lifecycle
|
||||
- Threat modeling
|
||||
|
||||
**Resources:**
|
||||
- SANS cyber threat intelligence course (FOR578)
|
||||
- Threat intelligence platform training
|
||||
- Intelligence writing courses
|
||||
- Open-source intelligence techniques
|
||||
|
||||
### Phase 4: Advanced Analysis (1-2 years experience)
|
||||
**Target:** GCIA
|
||||
|
||||
Deepen technical analysis skills:
|
||||
- Advanced network traffic analysis
|
||||
- Intrusion detection techniques
|
||||
- Attack pattern recognition
|
||||
- Advanced persistent threat (APT) analysis
|
||||
- Malware behavior analysis
|
||||
- Threat hunting methodologies
|
||||
|
||||
**Resources:**
|
||||
- SANS intrusion analysis course (SEC503)
|
||||
- Network analysis tools (Wireshark, Zeek)
|
||||
- Threat hunting platforms
|
||||
- Real-world intelligence operations
|
||||
|
||||
### Phase 5: OSINT Specialization (Optional, 2+ years)
|
||||
**Target:** GOSI or C|OSINT
|
||||
|
||||
Specialize in open-source intelligence:
|
||||
- OSINT collection techniques
|
||||
- Social media intelligence
|
||||
- Dark web monitoring
|
||||
- Public database research
|
||||
- Geospatial intelligence
|
||||
- Technical footprinting
|
||||
- Legal and ethical considerations
|
||||
|
||||
**Resources:**
|
||||
- OSINT training courses
|
||||
- OSINT tools and frameworks
|
||||
- Intelligence collection practice
|
||||
- Case study analysis
|
||||
|
||||
---
|
||||
|
||||
## Skills to Develop
|
||||
|
||||
**Technical Skills:**
|
||||
- Threat intelligence platforms (MISP, ThreatConnect, Anomali)
|
||||
- SIEM platforms (Splunk, ELK, QRadar)
|
||||
- Network analysis (Wireshark, Zeek, tcpdump)
|
||||
- Malware analysis basics
|
||||
- OSINT tools (Maltego, Shodan, TheHarvester)
|
||||
- Scripting (Python for automation)
|
||||
- Indicator enrichment and validation
|
||||
- Threat modeling frameworks
|
||||
|
||||
**Analytical Skills:**
|
||||
- Critical thinking
|
||||
- Pattern recognition
|
||||
- Attribution analysis
|
||||
- Hypothesis development and testing
|
||||
- Data correlation
|
||||
- Trend analysis
|
||||
- Strategic thinking
|
||||
|
||||
**Intelligence Frameworks:**
|
||||
- MITRE ATT&CK framework
|
||||
- Diamond Model
|
||||
- Cyber Kill Chain
|
||||
- F3EAD (Find, Fix, Finish, Exploit, Analyze, Disseminate)
|
||||
- Intelligence cycle
|
||||
|
||||
**Communication Skills:**
|
||||
- Intelligence report writing
|
||||
- Executive briefings
|
||||
- Technical documentation
|
||||
- Stakeholder communication
|
||||
- Information sharing
|
||||
|
||||
---
|
||||
|
||||
## Estimated Timeline
|
||||
|
||||
- **Foundation to Core:** 6-10 months
|
||||
- **Core to Specialization:** 1-2 years
|
||||
- **Specialization to Advanced:** 2-3 years
|
||||
|
||||
Total time to senior level: **4-6 years** with hands-on intelligence analysis experience.
|
||||
|
||||
---
|
||||
|
||||
## Intelligence Types
|
||||
|
||||
**Strategic Intelligence:**
|
||||
- Long-term threat trends
|
||||
- Threat actor capabilities and intentions
|
||||
- Geopolitical analysis
|
||||
- Industry threat landscape
|
||||
- Executive decision support
|
||||
|
||||
**Operational Intelligence:**
|
||||
- Campaign tracking
|
||||
- Threat actor tactics, techniques, and procedures (TTPs)
|
||||
- Infrastructure analysis
|
||||
- Attack trend analysis
|
||||
- Medium-term planning
|
||||
|
||||
**Tactical Intelligence:**
|
||||
- Indicators of Compromise (IOCs)
|
||||
- Malware signatures
|
||||
- Attack patterns
|
||||
- Immediate threat response
|
||||
- Short-term defensive actions
|
||||
|
||||
---
|
||||
|
||||
## Intelligence Lifecycle
|
||||
|
||||
1. **Planning and Direction**
|
||||
- Define intelligence requirements
|
||||
- Prioritize collection efforts
|
||||
- Allocate resources
|
||||
|
||||
2. **Collection**
|
||||
- Gather raw data from sources
|
||||
- OSINT collection
|
||||
- Partner intelligence sharing
|
||||
- Internal telemetry
|
||||
|
||||
3. **Processing**
|
||||
- Data normalization
|
||||
- Deduplication
|
||||
- Enrichment
|
||||
- Categorization
|
||||
|
||||
4. **Analysis and Production**
|
||||
- Pattern identification
|
||||
- Correlation and fusion
|
||||
- Attribution analysis
|
||||
- Report generation
|
||||
|
||||
5. **Dissemination**
|
||||
- Deliver intelligence to stakeholders
|
||||
- Format for different audiences
|
||||
- Integrate with security tools
|
||||
- Share with community
|
||||
|
||||
6. **Feedback**
|
||||
- Assess intelligence value
|
||||
- Refine collection requirements
|
||||
- Improve analysis processes
|
||||
|
||||
---
|
||||
|
||||
## Threat Actor Categories
|
||||
|
||||
**Nation-State APTs:**
|
||||
- Advanced capabilities
|
||||
- Long-term persistence
|
||||
- Espionage and disruption
|
||||
- Well-resourced campaigns
|
||||
|
||||
**Cybercriminal Groups:**
|
||||
- Financial motivation
|
||||
- Ransomware operations
|
||||
- Data theft and fraud
|
||||
- Organized criminal enterprises
|
||||
|
||||
**Hacktivists:**
|
||||
- Political/ideological goals
|
||||
- Website defacement
|
||||
- DDoS attacks
|
||||
- Data leaks
|
||||
|
||||
**Insider Threats:**
|
||||
- Malicious insiders
|
||||
- Negligent employees
|
||||
- Compromised accounts
|
||||
- Third-party risks
|
||||
|
||||
---
|
||||
|
||||
## Related Projects
|
||||
|
||||
Build threat intelligence skills with these projects:
|
||||
- [Threat Intelligence Aggregator](../SYNOPSES/intermediate/Threat.Intelligence.Aggregator.md)
|
||||
- [OSINT Reconnaissance Framework](../SYNOPSES/intermediate/OSINT.Reconnaissance.Framework.md)
|
||||
- [Security News Scraper](../SYNOPSES/beginner/Security.News.Scraper.md)
|
||||
- [Phishing URL Detector](../SYNOPSES/beginner/Phishing.URL.Detector.md)
|
||||
|
||||
---
|
||||
|
||||
[Back to All Roadmaps](./README.md)
|
||||
Loading…
Reference in New Issue