Cybersecurity is a broad field that encompasses many disciplines. So broad, in fact, that no one person can master everything. Where do you start?
Where to start
First and foremost, you’ll need a solid understanding of computer and network fundamentals. However, even that is a multi-faceted statement. You’ll need to understand the various components of a computer, and how they all work together at a low level: how the CPU, memory, storage, peripherals, and network connectivity all function as an interconnected whole. Knowing what happens behind the scenes between pressing a key on the keyboard and having a character appear onscreen, for example.
You’ll also need to understand how data is represented in a computer: how it’s represented and operated upon in memory, how a CPU executes instructions, how data is moved to and from nonvolatile storage. You’ll need to be conversant in the various ways of representing data: binary, hexadecimal, octal, decimal (a.k.a., base 2, base 16, base 8, base 10). An understanding of the fundamental logic structure of a CPU wouldn’t go amiss, either: being able to understand what a stack is, what an instruction pointer is, what word alignment means will aid greatly in certain aspects of security.
Knowing how networks function both at the micro and macro levels will also come in handy. You’ll want to know how data moves from a computer onto a network, and back again. You’ll need an understanding of the various ways in which a computer can be networked (e.g., WiFi, Bluetooth, Ethernet, etc. The physical layer), and how each of those protocols functions. You’ll need a good grasp of the OSI seven-layer model, and each layer in it. You’ll have to know the major protocols used at the various layers, and understand how each operates.
You’ll want to learn about how the Internet functions, which means you’ll need to understand routers and routing protocols. You’ll need a foundation in how data gets from point A to point B on the internet, and all the entities it may traverse to get there (switches, routers, IDS/IPS, firewalls, etc.). You’ll need to understand routing tables, nameservers, mail servers, DHCP servers, file servers, domain controllers, webservers, and on, and on, and on. You’ll want to be able to understand network flow data and packet captures.
You’ll need a deep understanding of at least one major operating system, including how they function at a fairly low level, what components, processes, and services are typical, and how they behave. You’ll want to know about filesystems and how they work. You’ll benefit from some knowledge of software development, both from a process standpoint and as a developer.
Once you’ve got all that, you’ll need to start learning the ins and outs of various security controls, and typical tools used in cybersecurity, from nc and nmap to ArcSight and Splunk.
Wait, what?
That’s a LOT. It’s overwhelming, particularly to someone looking to get their start in the field. My advice? Pick and area and jump in with both feet. Set up a home lab with virtual machines, physical devices, or a combination of both. Create projects for yourself. Don’t be afraid to fail. That’s how you learn: by trying things that don’t always work.
Find online communities related to infosec. Read everything you can find. Don’t feel like you have to purchase every book on the topic, either. Most of the information can be found online, for free. Don’t be afraid to ask questions, and don’t be offended when some few people are jerks in response.
Explore. Create. Test ideas. Get in there and start doing things. Even if you’re currently pursuing a security-related degree, make it a point to do things outside the classroom requirements.
Contribute. Find a project that intrests you, and find some way to add to it. Give back to the community. Even if you know not a single iota of technical esoterica, you can volunteer to transcribe documentation, help set up or tear down at conferences or local community meetings, do data entry, and so forth.
Don’t get star-struck, don’t get imposter syndrome, and don’t constantly measure yourself against others. Just go out there and do stuff. If you create something new, every day, you’ll quickly have an entire body of work you can point to and say, “I did that.” Find areas where your knowledge is lacking, and dive in. You’re going to make mistakes. You’re going to get things wrong. But, most importantly, you’re going to learn.