F FIELDNOTES / CYBERSECURITY
CAREER TOOLKITTECHNOLOGIES & CHEAT SHEETS
Home / Career toolkit / Technologies and cheat sheets

A PRACTICAL, LEVEL-BY-LEVEL ROADMAP

Technologies & cheat sheets

Learn the tools that help you understand, build, test, and secure products. Start with the foundations, then add technologies as your work moves from application security to product and AI security.

CAREER PATH · LEVEL 1

Foundations: computers, networks, and operating systems

Build comfort with the environment applications run in and the traffic they exchange. Focus on reading output and explaining what it means before automating it.

  • Operating systems: Linux command line and filesystem basics; Windows users, processes, services, PowerShell, Event Viewer; basic macOS Terminal and Activity Monitor.
  • Shells: Bash for Linux/macOS environments and PowerShell for Windows administration. Learn navigation, pipes, quoting, environment variables, and safe redirection.
  • Networking: IP addresses, ports, DNS, routing, HTTP/HTTPS, TLS certificates, and firewall rules. Use ip, ss, dig/nslookup, and curl to inspect your own systems and ordinary public services.
  • Virtual labs: use a disposable virtual machine or local container to experiment without changing your everyday device.
  • Version control: basic Git: inspect a diff, make a branch, and understand how changes are recorded.

Checkpoint: follow one request from DNS lookup to an HTTPS response and find a related event in your own system's logs.

Further resources

CAREER PATH · LEVEL 2

Application security: web, API, and mobile

Understand how the client, server, identity provider, API, and data store interact. You do not need to be an expert developer in every language, but you should be able to read common application patterns and follow data across boundaries.

  • Web basics: HTML, CSS, JavaScript, browser developer tools, same-origin rules, cookies, CORS, and Content Security Policy.
  • Web and APIs: HTTP methods/status codes/headers, REST-style APIs, JSON, OpenAPI descriptions, sessions, OAuth 2.0/OIDC, and JWT validation.
  • Programming: learn one server-side language well enough to read routes, validation, authorization, database calls, and tests. Python is a practical starting point; recognize JavaScript/TypeScript, Java/Kotlin, or C# where relevant to a target stack.
  • Databases: relational tables and SQL, parameterized queries, transactions, and basic access-control concepts.
  • Web testing: browser developer tools, Burp Suite Community Edition or OWASP ZAP, Postman or an equivalent API client. Practice only on local apps or explicitly authorized labs.
  • Android: Android Studio, emulator, ADB basics, app permissions, intents/deep links, Keystore, and secure network configuration.
  • iOS: Xcode and Simulator basics, entitlements, URL schemes/universal links, Keychain, and platform data protection. Familiarize yourself with Swift syntax when assessing iOS code.
  • Mobile testing: OWASP MASVS/MASTG concepts and a local MobSF setup for authorized test apps; validate scanner findings manually.

Checkpoint: draw a data flow for a feature, identify which server checks ownership, and show how the same authorization rule applies to web and mobile clients.

Open the application security guide →

Further resources

CAREER PATH · LEVEL 3

Product security: secure delivery and operations

Move from testing individual features to helping teams prevent recurring issues across design, development, release, and operations.

  • Software delivery: Git branching and review, CI/CD concepts, protected build/release workflows, and one pipeline such as GitHub Actions, GitLab CI, or Azure Pipelines.
  • Security automation: SAST, software composition analysis (SCA), secret detection, DAST, API testing, dependency advisories, and false-positive triage.
  • Supply chain: package managers and lockfiles, dependency provenance, SBOM formats such as CycloneDX or SPDX, artifact signing concepts, and build integrity.
  • Cloud security (supporting depth): learn cloud IAM and least privilege, security groups/network boundaries, storage permissions, secrets and KMS, logging/audit trails, container security, serverless basics, cloud APIs, and workload identity. Aim to secure applications deployed in cloud environments, not to become a dedicated cloud security specialist.
  • Observability: application logs, metrics, traces, audit events, alerting, and SIEM/SOC fundamentals. Avoid collecting secrets and unnecessary personal data.
  • Team practices: threat-model diagrams, security requirements as tests, vulnerability tracking, risk ownership, exception review, and evidence collection.

Checkpoint: add a security check to a sample CI workflow, assign an owner to a finding, and verify the fix with a regression test. For a cloud-hosted demo, trace one request across identity, network, storage, secrets, and audit logs.

Open the supporting Cloud Security tutorial →

Open the product security guide → · Review standards and assurance topics →

Further resources

CAREER PATH · LEVEL 4

AI application security: models, retrieval, and agents

Build on application and product security. Treat an AI feature as a system of services, data, models, and permissions—not as a prompt alone.

  • Programming and data: Python, JSON, HTTP APIs, asynchronous jobs, logging, testing, and dependency management.
  • Model interfaces: hosted model APIs, model/version configuration, token and latency limits, structured outputs, and provider data-handling settings.
  • RAG: embedding and chunking concepts, retrieval pipelines, vector databases, document ACLs, tenant isolation, source provenance, and deletion/retention behavior.
  • Agents and tools: tool/function calling, identity propagation, scoped credentials, approval gates, rate limits, audit logs, and protocols such as MCP where used.
  • AI testing: versioned evaluation datasets, prompt-injection and data-leakage tests, output validation, tool authorization, multi-tenant tests, and regression evaluation after model or prompt changes.
  • AI operations: AI gateways, model and prompt inventories, cost/abuse monitoring, secrets management, data minimization, and incident response for exposed data or unsafe actions.
  • AI governance (supporting depth): learn AI risk assessment, AI asset inventory, data governance, model/vendor risk, privacy, policy, lifecycle governance, and AI incident management. Use NIST AI RMF, ISO/IEC 42001, and EU AI Act concepts to collaborate with governance and compliance teams; technical AI application security remains the specialization.

Checkpoint: build a local RAG demo with synthetic documents for two users and prove that retrieval, caches, and citations do not cross user boundaries. Then record the AI use case, data sources, model/provider, key risks, and incident owner in a lightweight inventory.

Open the supporting AI Governance and Risk tutorial →

Open the AI application security guide →

Further resources

Linux command-line cheat sheet

Useful for navigating files, identifying processes, and reading logs on a Linux system you own or administer.

# Where am I? What is here?
pwd
ls -lah
cd /path/to/project

# Read and search files
less app.log
head -n 20 app.log
tail -n 50 app.log
grep -n "ERROR" app.log
find . -type f -name "*.log"

# Inspect processes and listening network sockets
ps aux
ss -lnt

# Inspect service logs (systemd-based Linux)
journalctl -u my-service --since "1 hour ago"

# File permissions: inspect first; avoid broad permission changes
stat app.conf
id

Use sudo only when needed and only for commands you understand. Avoid recursive ownership or permission changes as a troubleshooting shortcut.

Further resources

Watch Linux playlists

Bash cheat sheet

Quote paths and variables so spaces and special characters are handled as intended. Try commands in a disposable directory first.

# Variables and safe quoting
project_dir="$HOME/security-lab"
printf 'Working in: %s\n' "$project_dir"
mkdir -p "$project_dir"

# Redirect output; append instead of overwriting when appropriate
command --help > "$project_dir/help.txt"
printf '%s\n' "note" >> "$project_dir/notes.txt"

# Filter a local text file
grep -n "WARN" "$project_dir/app.log" | sort

# Read lines safely from a file
while IFS= read -r line; do
  printf '%s\n' "$line"
done < "$project_dir/notes.txt"

# Check the previous command's status
if command -v git >/dev/null 2>&1; then
  printf '%s\n' "Git is installed"
fi

Redirection with > replaces a file. Review the target path before writing; don't paste destructive commands you don't understand.

Further resources

Watch Bash playlists

Python cheat sheet

Use Python for small local analysis and repeatable defensive checks. This example uses only the standard library and reads a file without executing its contents.

from pathlib import Path
import hashlib
import json

log_path = Path("app.log")
for line_number, line in enumerate(
    log_path.read_text(encoding="utf-8").splitlines(), start=1
):
    if "ERROR" in line:
        print(f"{line_number}: {line}")

# Parse JSON as data; don't eval() untrusted text.
record = json.loads('{"event": "login", "success": true}')
print(record["event"], record["success"])

# Calculate a file digest to compare file contents.
digest = hashlib.sha256(log_path.read_bytes()).hexdigest()
print(digest)

Check file size and input format before processing untrusted files. Use a virtual environment for third-party packages, and never run unknown scripts with administrator privileges.

Further resources

Watch Python playlists

SQL cheat sheet

These read-only examples use a generic relational SQL style. Always scope queries deliberately before working with real data.

-- Inspect a small sample
SELECT id, email, created_at
FROM users
WHERE status = 'active'
ORDER BY created_at DESC
LIMIT 20;

-- Count records by status
SELECT status, COUNT(*) AS total
FROM users
GROUP BY status
ORDER BY total DESC;

-- Safe application pattern: bind values; do not concatenate input
-- Python sqlite3 example:
cursor.execute(
    "SELECT id, email FROM users WHERE email = ?",
    (email_address,)
)

SQL placeholder syntax differs between database drivers. Use parameterized queries in application code. Before an UPDATE or DELETE, verify the WHERE condition with a SELECT and use a transaction when appropriate.

Further resources

Watch SQL playlists

HTTP and cURL cheat sheet

Use these examples to inspect ordinary endpoints you own or are authorized to access. Avoid putting real credentials into shell history.

# Fetch response headers and body
curl --include https://example.com/

# Ask for headers only
curl --head https://example.com/

# Send JSON to your local development API
curl --request POST http://localhost:8000/api/items \
  --header "Content-Type: application/json" \
  --data '{"name":"sample"}'

# Inspect a local endpoint's response code and total time
curl --silent --show-error --output /dev/null \
  --write-out "HTTP %{http_code} in %{time_total}s\n" \
  http://localhost:8000/

Use a test account and synthetic data for API practice. Don't send scans, fuzzing payloads, or state-changing requests to systems without explicit authorization.

Further resources

Watch HTTP and API playlists

  • PortSwigger: Web Security Academy — official web and API security lessons from the team behind the free interactive labs; specialist instruction rather than a largest-subscriber pick.

Git cheat sheet

Git helps you inspect and track code changes. Review what will be committed before sharing it.

# Inspect repository and working changes
git status
git diff

# Create a branch and stage a specific file
git switch -c docs/security-notes
git add path/to/file.html
git diff --cached

# Save and inspect history
git commit -m "Add security learning notes"
git log --oneline -5

# Find accidentally tracked secrets before sharing
git status --short

Never commit passwords, API tokens, private keys, or real user data. If a secret is exposed, remove it from active use and rotate it; deleting it from the latest commit may not remove it from repository history.

Further resources

Watch Git playlists

  • GitHub: GitHub for Beginners — workflow instruction from a channel with approximately 692K subscribers; practice branching and review in a test repository.
← Return to all learning levels