Cybersecurity Specialist · path guide

Cybersecurity Specialist: path guide

Read this before you start. It explains what the role is, what you'll be able to do at the end, which core lessons you need, how to set up your tools, what it may cost and how long it really takes.

The role

A cybersecurity specialist protects an organisation's systems, data and people. They work out what is worth protecting and what could go wrong, assess systems they own or have written permission to assess, and turn what they find into fixes that come with proof. They decide who can get into what, limit what a network exposes, and make sure that misuse leaves a trace and raises an alert in time. When something does go wrong, they respond calmly: contain the harm, keep the evidence, recover safely, tell the people who must be told, and make sure the same thing can't happen the same way again. They also help the organisation meet the standards and laws it is held to, and make sure that what it claims about its security is exactly true. Success is measured by risks reduced and incidents handled well, not by how clever an attack looked.

Everyday applications

• A clinic's booking app where patients can see only their own appointments, and staff logins lock after repeated wrong guesses.
• A bank's alert that notices a login from a new place followed by an unusual transfer, and asks the customer to confirm.
• A school's yearly review that finds a forgotten test copy of its results portal still online, and removes it.
• A company's plan for the morning ransomware appears, with printed contacts, offline backups and practised steps.
• An honest answer to a customer's security questionnaire, backed by evidence instead of slogans.

What you'll be able to do

By the end of the path you will be able to:

1. PO1 Identify assets, threats and risks, model the threats to a system with STRIDE, rank risks by likelihood and impact, and work only within written permission and scope (CY1).
2. PO2 Plan and carry out an authorised review of a system's settings, packages and security headers, rate findings with a written guide, and report them so they get fixed (CY2).
3. PO3 Fix injection, cross-site scripting and broken access control at their root, and prove each fix with a test that failed before it (CY3).
4. PO4 Store passwords safely, defend login pages, choose phishing-resistant second factors, manage sessions, and apply least privilege with regular access reviews (CY4).
5. PO5 Limit what a system exposes with firewalls and segmentation, protect traffic with TLS and headers, load secrets safely, and harden, patch and back up servers (CY5).
6. PO6 Log security events well, read logs safely, write detection rules with thresholds and windows, tune them against normal activity, and build timelines (CY6).
7. PO7 Prepare for, triage, contain, eradicate and recover from incidents, report them on time, and run blameless reviews (CY7).
8. PO8 Handle digital evidence with verified copies, hashes and a chain of custody, collect in order of volatility, and separate facts from inferences (CY8).
9. PO9 Map controls to frameworks, explain ISO 27001, SOC 2 and India's data protection law, collect evidence and make honest security claims (CY9).
10. PO10 Combine all of this in three tested projects and a capstone on the AarogyaDesk practice kit (CY10).

The coverage of each outcome by lessons, quizzes and the path test is listed at the end of this guide.

How it compares with neighbouring paths

The difference in one line: other paths build systems that work; this path makes sure they fail safely, that misuse is noticed, and that the organisation can show it.

Before you start: core lessons to know

The path opens after you pass the final examination. These core modules matter most; revisit them if the entry diagnostic shows a gap:

Setup guide

Tested on 2 November 2026 on Linux. Versions change, so check each tool's official page when you install. The practice kit pins its package in requirements.txt, so everyone installs the same version.

Install:

1. Install Python 3.11 or newer from python.org. Check: python3 --version prints 3.11 or newer.
2. Download the starter kit from this path's Projects page and unzip it. In a terminal, go to the aarogyadesk folder.
3. Create a virtual environment: python3 -m venv .venv, then activate it (source .venv/bin/activate; on Windows .venv\Scripts\activate).
4. Run pip install -r requirements.txt. It installs pytest and four small packages it needs, in a few seconds on a good connection.

Verify your setup: run python -m pytest. In the starter all 28 tests fail on purpose; what matters is that the tests start, list 28 checks and finish, which takes under a second.

Windows and macOS: we could only verify Linux on 2 November 2026, so Windows and macOS are marked "not verified" in the kit. The commands are the same apart from activating the virtual environment.

Hardware and accounts

• Computer: a laptop from the last 8 to 10 years with 4 GB of memory and about 200 MB of free disk space.

• No paid accounts, cloud services or security tools are needed. Everything runs on your own computer with invented data: the clinic, its staff and patients, the packages, the advisories and the logs. The addresses in the logs come from ranges set aside for documentation, so they belong to nobody.

• Work only on the kit and on systems you own. Assessing or testing any system you don't own, including a friend's or an employer's, needs the owner's written permission and a clear scope. Passing the tests shows your code handles the kit's cases; it doesn't make a real system safe.

Workload

Times are realistic estimates for a learner who has finished the core programme. They are not measured averages.

At 8 to 10 hours a week that is about 12 to 16 weeks.

How completion works

You complete the path when all of these are true, as shown on your completion record:

• every lesson is marked done;
• every module quiz is passed (70% or more);
• the path test is passed (70% or more);
• the three projects and the capstone are self-checked complete, with evidence links and your explanations.

Projects are self-checked for now: you tick the marking guide yourself and save your evidence on this device. Review by a team is planned for later; until then nothing on this site says a reviewer has approved your work. Progress is saved in this browser only, so download a backup from My progress now and then.

Outcome coverage