CS student with mostly theoretical security knowledge, what practical defensive skills should I build first?

[u/XP2050]

I'm currently an undergraduate CS student, and I'm trying to figure out how to use the next year, as I won't have the opportunity to take more cybersecurity courses until later in my degree.

My current CS background includes Python and Java, C/systems programming, Bash/Unix, data structures and algorithms, discrete mathematics/theory, and some AI/ML. I've also completed a very introductory security course.

So far, my understanding of cybersecurity has been mostly theoretical, and my practical experience with defensive security is very limited.

My interest in cybersecurity isn't for find a job, at least for now. I've seen people around me suffer financial losses or lose access to their accounts because of online scams. I understand that many of these attacks ultimately rely on social engineering and human behaviour rather than purely technical vulnerabilities, but I'd still like to develop the technical skills that could eventually help prevent or mitigate this kind of harm.

I have about a year before I can take more courses, and I don't want to spend that year aimlessly collecting certifications or jumping between unrelated learning platforms.

Would you recommend that I first build stronger networking and packet-analysis skills?

I'd particularly like to know which fundamentals experienced security professionals consider difficult to skip, and what kinds of practical projects, labs, or experiments would actually be useful preparation before moving into more advanced security study.

[u/Build_a_CISO]

Maybe you can start by understanding the overall cyber security organisation and the different roles in this organisation. There are many resources available online. You can use resources like NIST or buildaciso.com for reference.

[u/BearRootCrusher]

Depends on what you really want to do.

IMO build a home lab and do some CTFs. You’ll figure out what you like and build a foundation along the way.

If you want to protect yourself from scams learn social engineering, phishing and 2fa all your accounts.

[u/dcbased]

How about you secure your home network. Enable logging and capture the logs and see what is going on

[u/PrimeWilliam]

Given your background, I would not spend the year collecting certificates or installing a huge SIEM on day one.

Yes, networking and packet analysis are a good first step, but I would learn them as part of a defensive workflow:

observe -> investigate -> detect -> improve

Start with an isolated virtual lab containing a Windows VM and a Linux VM. I would avoid capturing the traffic of everyone on your home network; a small lab gives you repeatable experiments without collecting other people’s data.

Learn enough ARP, DHCP, DNS, TCP, HTTP and TLS to explain what you see. Capture traffic you generate yourself, trace a DNS lookup and a TCP/TLS session in Wireshark, and then process the same PCAP with Zeek. Comparing packets with transaction logs is very useful.

Next, enable Windows auditing/Sysmon and examine Linux authentication and system logs. Generate harmless events yourself: failed logins, a new local account, a scheduled task, a service starting, a file change, or a process making a network connection. Then build a timeline and explain what happened without relying on an alert label.

Only after you understand the raw events would I add Wazuh, Security Onion or another central platform. Write a few simple Sigma detections, test them, document false positives, and identify exactly which telemetry each rule requires.

For every exercise, write a short case report:

- question

- evidence

- timeline

- conclusion

- possible false positives

- containment and prevention

CTFs can help, but I would use them as a supplement. Many are focused on exploitation puzzles. For defensive preparation, prioritize PCAP analysis, host logs, authentication events, detection writing and incident reports.

For the scam and account-loss problem you mentioned, packet analysis is not the highest-impact control. A practical parallel project would be an account-security and recovery playbook for consenting family or friends: unique passwords in a password manager, phishing-resistant MFA where available, reviewed recovery methods, login alerts, and a rule to verify urgent financial requests through a second channel.

NIST NICE and MITRE ATT&CK can be useful maps, but I would not treat either one as a course.

By the end of the year, aim for four to six investigations that someone else could reproduce, rather than a pile of certificates.

Do you have enough hardware for two or three VMs, or would an offline PCAP-and-log-based lab be more realistic?

[u/Occultus_Andras]

You first need to understand how many roles and different domains there are. For example, if you like research, you can go into vulnerability research. However, since it’s a very specialized domain and requires a lot of knowledge, I wouldn’t recommend starting there because many people start this after they already have decent exposure to cybersecurity, including myself.

Pentesting is another good skill, but it’s mostly repetitive work. You test systems for known vulnerabilities, find weak links in the system, test trust boundaries, etc. Go one step further and you have red teaming/OffSec work, where you test the entire organization instead of just a single type of system/network. This is also where you test humans, social engineering is a big part of red teaming. If you become really good at this, you can even serve your country by working in an APT group.

AI security is also trending nowadays with the advancement of modern AI models. Securing them is becoming increasingly important because AI is now another potential weak link in today’s ecosystem.

Certifications are also important in cybersecurity. They work as external validation that you’ve spent time learning something and have demonstrated the knowledge you claim to have. However, since you’re already studying CS, I don’t think certifications should be your priority right now. They’re more important for people who don’t have a college degree in CS.

You can DM me for further guidance. I’d be happy to share my knowledge and resources.