By the end of this lesson you will be able to
- Describe what cybersecurity and cloud computing work involve day to day.
- Explain why both directions need strong foundations in networking, Linux and troubleshooting.
- Choose a beginner project that is safe, legal and finishable.
- Describe honest expectations for time, effort and costs.
Cybersecurity and cloud computing are two of the most talked about areas in technology, and many people are drawn to them for the wrong reasons: films, big salaries or fear of missing out. The real work is quieter and more careful than most people expect. This lesson explains what these directions involve, what you already have from the module you just finished, and how to begin safely. It also gives an honest picture of how much time and effort is needed, so that you can decide with open eyes.
Why foundations come first
Both directions sit on top of everything you have learnt. A security analyst reading a Log file needs to understand services, users and networks. A cloud engineer renting a Virtual machine from a Cloud provider still manages a Linux machine, its users, its updates and its backups. If those foundations are weak, the new vocabulary of each field will feel like a pile of unrelated words. If they are strong, the new ideas fit on top of what you already know.
Where you are heading
Read this figure as text
A stack of layers with foundations at the bottom, then Linux and networking, then security and cloud specialisms at the top.
A stack of layers, top to bottom. Top: specialisms, which are cybersecurity and cloud computing. Second: Linux administration, networking and scripting. Third: troubleshooting method, files, users and permissions. Bottom: how computers work, including hardware, operating system, memory and storage. Each upper layer depends on the layers beneath it.
Cybersecurity
Cybersecurity is the work of protecting systems, data and people from harm. Most of it is defensive and routine: keeping systems updated, checking logs, managing accounts, training colleagues, testing backups and responding calmly when something goes wrong, which is called Incident response. A smaller part is Penetration testing, where authorised people test whether defences work. Writing that you are authorised is not a formality: without written permission, testing someone else's system is a crime in most countries.
- Skills you already have: threat modelling, secure settings, multi-factor sign-in, least privilege, updates and backups, and the ethics of safe practice.
- Skills to add: deeper networking (ports, firewalls, DNS), Linux comfort, reading logs at scale, scripting to automate checks, and clear report writing.
- Beginner project: write a threat model and a hardening checklist for a fictional small clinic with three computers and a Wi-Fi network. Then apply the safe parts of the checklist to a virtual machine you own and record before and after results.
- Beginner goal: in three months, finish the checklist project and be able to explain, in plain words, how a phishing message works and what to do about it.
Cloud computing
Cloud work means designing, building and looking after services that run on rented computers in a provider's data centres. You have seen the main ideas: remote servers, storage services, and software, platform and infrastructure models. Cloud professionals add skills in virtual networks, access control, cost management and automation, because in the cloud a mistake can be repeated hundreds of times in seconds, and also billed for.
A key idea is Shared responsibility. The provider looks after its buildings, hardware and the basic platform. You are still responsible for your accounts, settings and data. Most cloud security failures are not clever attacks. They are settings left open, such as a storage folder anyone can read, or an account with too many permissions.
- Data centre and power
- Hardware and cables
- Sharing hardware safely
Looks after the building and machines
- Accounts and passwords
- Updates on your machine
- Firewall and access rules
- Data and backups
Looks after what you put there
Read this figure as text
Two columns showing what the provider secures and what the customer must secure.
Two columns. The provider looks after: the physical data centre and its power and cooling, the hardware and the network cables, and the software that shares the hardware between customers. The customer looks after: user accounts and passwords, who is allowed to do what, operating system updates on the virtual machine, firewall settings, and the data and its backups.
- Skills you already have: the cloud versus local idea, service models, Linux administration basics, backups and access control.
- Skills to add: virtual networks and subnets, identity and access management, storage types, monitoring and billing alerts, and automation with scripts.
- Beginner project: run an Ubuntu virtual machine on your own computer first. Once you are confident, you may try a provider's free tier, but only after setting a budget alert and using a strong password with two-step sign-in. Host a simple static page, back it up and then delete everything you created.
- Beginner goal: in three months, explain the three service models with an example of each and complete one project end to end, including deleting the resources.
Honest expectations
Both fields are broad and move quickly. Most people do not start in the exciting version they imagine. Many begin in IT support or system administration and move across after a year or two. Studying for a first Certification such as CompTIA Security+ for security, or a provider's fundamentals exam for cloud, can give a clear syllabus. Check the cost and the current exam content on the organiser's website before you decide.
| Goal | Typical time | Notes |
|---|---|---|
| Understand the vocabulary and basic ideas | 2 to 3 months | Builds on the foundations you already have |
| Finish a first practical project and portfolio piece | 3 to 6 months | Document it with notes and before and after results |
| Prepare for a fundamentals certificate | 3 to 6 months | Optional, with exam fees |
| First role that uses these skills | Varies widely | Often through support or administration first |
These are estimates, not promises. Your time, your starting point and the job market will all change them. What does not change is that regular practice, written notes and a small portfolio of honest work give you the best chance of progress.
- Do I own this system, or have written permission to test it?
- YesCan I afford to break it and rebuild it?
- YesHave I written what I will do and how to undo it?
- YesDo thisGo ahead, and record the results as you go.
- NoDo thisWrite the plan first, then start.
- NoDo thisMake a copy or a virtual machine first, then continue.
- YesHave I written what I will do and how to undo it?
- NoDo thisDo not test it. Build your own practice virtual machine instead.
- YesCan I afford to break it and rebuild it?
Read this figure as text
A yes or no tree that leads from a question about permission to a safe next step.
A decision tree. Start: Do I own the system or have written permission to test it? If no, stop: do not test it, and build a practice virtual machine instead. If yes, ask: Can I afford to break it and rebuild it? If no, make a copy or a virtual machine first. If yes, ask: Have I noted what I will do and how I will undo it? If no, write the plan first. If yes, go ahead and record the results.
Common mistakes
✖ Instead of: Believing security is mostly dramatic hacking.
✔ Do this: Most of the work is routine defence: updates, accounts, logs, backups and writing clear reports.
✖ Instead of: Creating cloud resources without a budget alert.
✔ Do this: Set a spending limit or alert first, list what you create and delete it afterwards.
✖ Instead of: Testing a system because you are 'only looking'.
✔ Do this: Without ownership or written permission, do not test it. Use your own virtual machine.
✖ Instead of: Buying an exam before building any project.
✔ Do this: Build one small project first, then decide whether a certificate adds value for you.
If something goes wrong
- I feel overwhelmed by the number of terms.
- Keep a short glossary of your own with one example for each term, and learn a few new ones each week. Return to the foundations when a term does not make sense.
- My virtual machine will not start.
- Check that virtualisation is enabled in the computer's firmware settings, that you have enough free disk space and memory, and read the error message exactly. Search for it before changing anything.
- I am not sure whether something is legal to test.
- Treat it as not allowed. Test only what you own or have written permission for, and ask a teacher or mentor if unsure.
- I am worried about cloud costs.
- Practise on a local virtual machine first. If you try a provider, read the free-tier rules, set a budget alert and delete resources when you finish.
Key terms
- Cloud provider
- A company that rents out computing power, storage and services over the internet.
- Shared responsibility
- The idea that a cloud provider secures its own equipment while the customer secures their own settings, accounts and data.
- Incident response
- The planned steps you follow when something goes wrong with security, from spotting it to recovering.
- Penetration testing
- Testing a system's security by carefully trying to break in, only with the owner's written permission.
- Certification
- A qualification, usually from an exam, that shows you know a set of skills.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Paper exercise: a small threat model and responsibility list
Choose a fictional business, such as Wanjiru's two-person tailoring shop with a laptop, a phone and cloud storage for customer measurements. On one page, list three assets, one threat to each and one defence for each threat. Then, for the cloud storage, write two things the provider looks after and two things Wanjiru must look after. You do not need to use a real cloud account for this exercise.
Challenge: write an honest plan
Pick cybersecurity or cloud computing. Write a plan for the next six months with a project, a weekly time budget that fits your real life, three milestones, the practice environment you will use (a virtual machine you own is a good choice), a rule for what you will never test, and a line saying what you would do if you changed your mind. Include any possible costs and how you will avoid surprise bills.
Knowledge check
6 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Security and cloud work build on Linux, networking, troubleshooting and clear habits.
- Most security work is defensive and routine, and cloud security is largely about settings.
- The provider and the customer share responsibility, and the customer always looks after accounts and data.
- Practise only on systems you own or are allowed to test, and watch cloud costs.
- Expect months of regular practice, and be wary of fast promises.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Ubuntu tutorials (Canonical)
- CompTIA Security+ (CompTIA)
- NCSC guidance for individuals and families (National Cyber Security Centre (UK))
- Cybersecurity and Infrastructure Security Agency (CISA)