Network Security Learning Path – 2024 Updated
An ninh mạng không học xong là xong – là hành trình học suốt đời. Dưới đây lộ trình cấu trúc hóa từ cơ bản đến chuyên sâu.
Phase 0: Mindset & Foundation (Tuần 1-2)
- Tư duy: CIA Triad, Defense in Depth, Zero Trust, MITRE ATT&CK framework.
- Ngôn ngữ: Python (bắt buộc), Bash/PowerShell, Go (bonus).
- OS: Linux CLI (Ubuntu/Debian/Kali) – file system, permission, process, network, systemd, journalctl.
- Mạng: TCP/IP Guide (book), Computer Networking: A Top-Down Approach (Kurose/Ross), CCNA level.
Phase 1: Core Certifications (Tháng 1-3)
| Cert | Tại sao? | Resource miễn phí / rẻ |
|---|---|---|
| CompTIA Network+ | Cơ sở mạng vững chắc | Professor Messer (YouTube), Jason Dion (Udemy $15) |
| CompTIA Security+ | Baseline security knowledge, DoD 8570 | Professor Messer, Jason Dion, FreeCodeCamp (12h video) |
| Cisco CCNA (200-301) | Routing/Switching/Security cơ bản, lab thực tế | Jeremy IT Lab (YouTube), Neil Anderson (Udemy), Packet Tracer labs |
Phase 2: Hands-on Labs & Specialization (Tháng 3-9)
Chọn 1-2 track song song:
| Track | Lab Platform | Key Topics | Target Cert |
|---|---|---|---|
| Blue Team / SOC | TryHackMe (SOC Level 1, 2), Let's Defend, Blue Team Labs Online, RangeForce | SIEM (Splunk/Elastic), Windows Event Log, Sysmon, MITRE ATT&CK, Incident Response, Threat Hunting | SANS GCIH, GCFA, BTL1, CySA+ |
| Network Security Engineering | EVE-NG / GNS3 / Cisco Modeling Labs, Palo Alto VM-Series, FortiGate VM, Check Point CloudGuard | NGFW Policy, App-ID, User-ID, SSL Decrypt, VPN, HA, SD-WAN, Automation (Ansible/Terraform) | PCNSE, NSE 4/5/7, CCIE Security |
| Cloud Security | AWS/Azure/GCP Free Tier, CloudSLAW, Stratus Red Team, ScoutSuite, Prowler | IAM, VPC, Security Groups, GuardDuty, Security Hub, CSPM, CWPP, CIEM, Serverless/Container Sec | AWS Security Specialty, AZ-500, PCCSE |
| AppSec / DevSecOps | OWASP Top 10, Juice Shop, DVWA, WebGoat, GitHub Actions/GitLab CI, SAST/DAST/SCA tools | Secure Code Review, Threat Modeling (STRIDE), Pipeline Security, SBOM, SLSA | GWAPT, (ISC)² CSSLP |
| Offensive (Red Team) | Hack The Box (Pro), TryHackMe (Offensive), Proving Grounds, PG Practice, VulnHub | AD Attack/Defense, C2 (Cobalt Strike, Sliver, Havoc), Evasion, Pivoting, PrivEsc | OSCP, OSEP, CRTO, eWPTX |
Phase 3: Advanced Certs & Portfolio (Tháng 9-18+)
- CISSP (cần 5 năm exp) – quản trị, architecture.
- SANS GIAC (GCIH, GCFA, GNFA, GCED, GCTI, GDAT) – technical deep dive.
- Cloud Specialty – AWS/Azure/GCP.
- Portfolio GitHub: Detection rules (Sigma), Automation scripts, Lab write-ups, Tool development, Blog posts.
- CTF & Bug Bounty: CTFtime, HackerOne, Bugcrowd, Intigriti – thực chiến, thu nhập phụ.
Phase 4: Continuous Learning (Suốt đời)
- Threat Intel: CISA KEV, Mandiant M-Trends, Verizon DBIR, Microsoft Digital Defense Report, Unit 42, Talos, Kaspersky APT, Google TAG.
- Conference: Black Hat, DEFCON, RSA, BSides (local), SANS Summits – xem recording miễn phí.
- Community: Reddit r/netsec, r/AskNetsec, r/blueteamsec, Discord/Slack chuyên ngành, Mentorship.
- Newsletter: tl;dr sec, The Daily Swig, Security Weekly, Risky Business, Dark Reading.
Home Lab gợi ý (Budget <$500)
- Mini PC (Beelink, Minisforum, OptiPlex Micro) x2-3: Proxmox VE.
- VM: pfSense/OPNsense (Firewall), Windows Server (AD), Ubuntu (Linux Server), Kali/Parrot (Attack), Wazuh/Elastic (SIEM), Metasploitable/DVWA (Target).
- Switch managed (MikroTik CRS3xx, FS S3400, Cisco 2960) – VLAN, 802.1X, SPAN.
- AP Wi-Fi 6/6E (Ubiquiti U6+, TP-Link EAP670) – test WPA3, roaming.