সাইবার সিকিউরিটি

## ধাপে ধাপে Cyber Security রোডম্যাপ (১২-২৪ মাস) **Month 1-3 — IT Foundation:** - Networking: TCP/IP, OSI model, DNS, HTTP/HTTPS, Subnetting - Linux command line (Kali Linux install করো) - Windows administration basics - Python scripting (automation এর জন্য) - Cert target: CompTIA Network+ basics **Month 4-6 — Security Fundamentals:** - CIA triad (Confidentiality, Integrity, Availability) - Cryptography basics (hash, encryption, PKI) - Authentication (MFA, OAuth, JWT) - Common vulnerabilities (OWASP Top 10) - Cert target: **CompTIA Security+** ⭐ (entry-level industry standard) **Month 7-9 — Ethical Hacking + Penetration Testing:** - Reconnaissance (Nmap, Recon-ng) - Vulnerability scanning (Nessus, OpenVAS) - Web app pentesting (Burp Suite, OWASP ZAP) - SQL injection, XSS, CSRF practice (DVWA, PortSwigger Academy) - Wireless attacks (aircrack-ng) - TryHackMe + HackTheBox (do 50+ labs) **Month 10-12 — Specialization (একটা pick করো):** **Track A: Penetration Tester/Red Team** - Metasploit framework - Active Directory attacks - Cert: OSCP (Offensive Security Certified Professional) — gold standard **Track B: SOC Analyst/Blue Team** - SIEM (Splunk, ELK) - Incident response - Threat hunting - Cert: CompTIA CySA+, Splunk Core User **Track C: Cloud Security** - AWS Security, Azure Security - Cert: AWS Certified Security Specialty **Track D: Application Security** - Secure code review - DevSecOps (SAST, DAST tools) **Month 13-18 — Advanced + Job Ready:** - CTF (Capture The Flag) competition - Build home lab (VirtualBox + Kali + vulnerable VMs) - Write blog/CVE write-up **কোথা থেকে শিখবে:** - **Free:** TryHackMe (free tier), PortSwigger Web Security Academy ⭐ (best free resource), HackTheBox Academy, Professor Messer YouTube (Security+) - **YouTube:** John Hammond, IppSec, NetworkChuck, The Cyber Mentor - **Books:** "The Web Application Hacker's Handbook", "Penetration Testing" - Georgia Weidman **যা avoid করবে:** - Production system এ unauthorized test — jail time - শুধু tool clicking — underlying concept বুঝতে হবে - "1 month এ ethical hacker" type fake course

## Cyber Security Freelancing Playbook 🔒 ### সততা প্রথম: Cyber Security freelancing অন্য skill এর চেয়ে কঠিন ### Client কোথা থেকে পাবে: 3. **Toptal** — premium security consultant pool 4. **Cobalt.io, Synack** — vetted pentester platform 5. **LinkedIn** — direct outreach to CTO/CISO of SaaS companies 6. **Local Bangladesh** — Bank, telecom, government tender (BTRC certified vendor হতে হয়) 7. **Compliance market** — startup দের SOC2, ISO 27001, HIPAA preparation ### আমি client পাবো কি পাবো না? - **পাবো:** Cyber attack বাড়ছে, demand stable - **পাবো না (যদি):** Certification নেই, কোনো proof নেই। Client trust ছাড়া কেউ network access দিবে না। - **Reality:** শুরুতে **bug bounty দিয়ে portfolio build করো** — তারপর paid freelancing। ### ঝুঁকি (Risks): - ❌ **Legal risk** — unauthorized test = criminal offense (Bangladesh ICT Act, US CFAA) - ❌ Trust barrier — beginner দের কেউ system access দেয় না - ❌ NDA + responsible disclosure জটিলতা 1. **Bug Bounty দিয়ে শুরু করো** ⭐ — HackerOne এ ছোট target দিয়ে শুরু, ১-২ valid bug = portfolio + cash 2. **Security+ certification নাও** — entry door খুলে দেয় 3. **CTF competition খেলো** — CTFtime ranking দেখিয়ে credibility build করো 4. **Niche pick করো:** Web App Pentesting (সবচেয়ে accessible), Cloud Security (AWS), Mobile App Pentesting 5. **Bangla content YouTube/blog** — Bangladesh এ Bangla cybersecurity content কম, audience build করো ### Pro tip: - **Niche specialty + writing public CVE/blog = inbound client।** Generic "pentester" এর তুলনায় "AWS Security Auditor" specific positioning ৩x বেশি কাজ আনে। - **Always work under signed contract + scope of work।** Verbal permission যথেষ্ট না।