Cybersecurity - want to learn, need advice

[keylanbelle]

Hiiii i want to get into cybersecurity and although i have watched some videos and read some articles, i am still not sure where to start and what to learn x-x

Need advice from people who know stuff / work in the field! I know some basic stuff about IT & good at using my windows, but nothing more. Where do i start and what is the best way of learning? I feel like just reading text won't get me a lot of actual knowledge and i will forget it quickly

[arcus]

It's a wide field. What draws you to it? Are you curious to learn for personal security reasons? Do you want a career out of it?

[Tuffy!]

If you forget about the things you read about cybersecurity, is this really the field you want to expand/work in?

I mean I forget about everything that I read if it doesn't drive me mad or enlightens me in some way or the other. But things I'm really interested in, info about those topics is stored in my memory almost automatically 

[poesu]

There's a good book called Extreme Privacy by Michael Bazzell. As the title suggests, it mostly assumes you want to disappear from the face of the internet, so I'm not sure if it's good for beginners.

The most important thing to learn is that cybersecurity is a journey and a mindset! It's not a checklist. Don't beat yourself up and be extremely patient and slow (unless you're currently in danger). Try learning one thing at a time. For example, you can set a goal for this week or month to switch to FOSS instead of Google/Microslop that spy on you. Not to shamelessly self-advertise, but I have a page that lists programmes I use on a daily basis (security/privacy-focused ones are mostly in the deGoogling section).

I can't really point you to some articles/videos and whatnot, because my knowledge of cybersecurity comes from like thousands of sources. You learn one thing here, another thing there.

What will keep you remembering stuff is continuous practice. Let's say, you stuff all your passwords using a secure password manager like Bitwarden. If you do that and never open it again, continuing either coming up with weak passwords that you can remember or saving them in insecure places, of course, that's not good. You need to grow a habit of using a secure vault and generating crazy, random passwords and storing them in that vault. So if you read something, do it immediately/ASAP.

I can also suggest regularly being around people who care about the issue. Aside from giving you advice, they'll help you foster the mindset you need to keep going. For me these are just my friends. I don't have specific recommendations for this, maybe there're some Mastodon instances dedicated to the topic.

Soooo yeeaaah, very broad question. Maybe you have some specific needs so I can give you specific tips?

[lakes]

Some tips:

• Use a dedicated password manager instead of the one in your browser or the same password every website. An offline encrypted password manager is less likely to be hacked, which is why people recommend Keepass & its many variations. But a cloud-based password manager can also be encrypted & makes it easier to sync passwords between devices. If you do use a cloud-based password manager, avoid LastPass as it's had multiple data breaches.
• It's debated whether open source or proprietary software are more secure. But most people who take security seriously use open source software where they can. The argument for proprietary software is "security through obscurity" which means theoretically security vulnerabilities are less likely to be exploited because they aren't as well known, but usually it just means that the security bug will require additional hacking to find. Open source code lets developers not affiliated with the program audit the code which makes bugs easier to fix, especially if the unaffiliated developer decides to contribute, but the bugs are also more known about it & thus easier to exploit.
• Open source software is also less likely to sell your data than proprietary software. But it isn't always a guarantee.
• Use a firewall.
• Use a ad/tracker/content blocker. Ad blockers often come with built-in malware filters, ignoring the malware you can get from clicking on ads.
• There are also DNS & VPN providers that offer malware filtering like Mullvad VPN, Mullvad DNS & Libre DNS. DNS just means Domain Name System and looks up domain names to tie them to an IP address. You can change your DNS from your local ISP by going into your browser settings, using a program like NextDNS, or on Linux, configuring your Network Manager.