How I Started Learning Cybersecurity as a BSc.CSIT Student

I didn’t start learning cybersecurity because I wanted to become a “hacker.”

I started because I was curious about how computers, networks, and the internet actually work. Over time, that curiosity turned into a real interest in how systems can be attacked, protected, and monitored.

As a BSc.CSIT student, my journey into cybersecurity has been a slow but exciting process of learning fundamentals, trying practical labs, making mistakes, and understanding what happens behind the scenes.

Starting with the Fundamentals

Before using security tools, I realized I needed to understand the basics first.

Networking became one of the first areas I focused on. I started learning about:

• IP addresses and subnetting
• DNS and DHCP
• VLANs
• Routing and switching
• STP
• Firewalls and access control

Using Cisco Packet Tracer helped me turn theory into practice. Instead of only reading about networks, I could build them, configure devices, and troubleshoot problems myself.

That made a huge difference in my learning.

Moving Towards Linux

Linux became another important part of my journey.

I started using Kali Linux in a virtual machine and gradually became more comfortable with the command line, file systems, networking tools, and security utilities.

One important lesson I learned is that knowing a tool is not the same as understanding security.

For example, running an Nmap scan is easy.
Understanding what the discovered ports mean, why a service is exposed, what risks it creates, and how it should be secured is much more important.

Learning Through Practical Labs

I learn best when I can actually experiment.

That is why I started working with intentionally vulnerable environments such as Metasploitable and practicing security concepts in controlled labs.

I have also worked with tools and platforms like:

• Nmap
• Burp Suite
• Wireshark
• Kali Linux
• Cisco Packet Tracer
• Metasploitable

These labs helped me understand reconnaissance, service enumeration, web security, vulnerabilities, and network traffic more clearly.

I also practiced a DNS exfiltration training scenario, which helped me understand how data can be hidden inside DNS traffic and why network monitoring is so important.

Cybersecurity Is More Than Hacking

One thing that changed my perspective is realizing that cybersecurity is much bigger than penetration testing.

There are many areas that interest me:

Security Operations (SOC)
Monitoring alerts, investigating suspicious activity, and responding to incidents.

Network Security
Understanding how networks are designed and how they can be protected.

Web Security
Learning how web applications fail and how those weaknesses can be prevented.

Threat Detection
Recognizing suspicious behavior instead of only looking for vulnerabilities.

Incident Response
Understanding what happens after a security incident and how organizations recover.

Right now, I am especially interested in building a strong foundation for a future role in security operations and defensive security.

Building Instead of Only Learning

Another important part of my journey has been building projects.

I have worked on web applications and hackathon projects using technologies like Next.js, Node.js, PostgreSQL, Python, Django, Supabase, and APIs.

Building software has helped me see cybersecurity from another angle.

When you create an application yourself, you start asking questions like:

• Where should authentication happen?
• How should passwords be stored?
• What happens if someone changes a request?
• Which data should a user be allowed to access?
• What if an API receives unexpected input?

These questions make security feel much more practical.

What I Am Learning Now

I am still at the beginning of my cybersecurity journey.

Right now, I am balancing my BSc.CSIT studies with cybersecurity learning, practical labs, projects, and experimentation.

My goal is not just to collect certificates.

I want to understand the technology deeply.

That means learning networking properly, becoming comfortable with Linux, understanding operating systems, improving programming skills, learning web security, practicing defensive security, and eventually working with real-world security monitoring and incident response.

The Road Ahead

I know there is still a lot to learn.

Cybersecurity is a field where technologies, vulnerabilities, and attack techniques keep changing. So I do not expect to “finish” learning cybersecurity.

Instead, I want to keep building.

More labs.
More projects.
More mistakes.
More debugging.
More reading.
More growth.

For me, cybersecurity is not about becoming a hacker overnight.

It is about understanding how systems work—and learning how to make them harder to break.

This is only the beginning.