0.3 The roadmap
Three routes. Same chapters.
Route A — "I want to understand security" (3 weeks, ~1 h/day)
| Days | Read | You'll be able to |
|---|---|---|
| 1–2 | Part 0–1 | Threat model, and use the vocabulary correctly |
| 3 | Part 2 (Ch 5–7) | Never confuse encoding with encryption again |
| 4–5 | Part 3 (Ch 8–11) | Hash properly; store passwords properly |
| 6–8 | Part 4 (Ch 12–16) | Symmetric crypto and AEAD |
| 9–11 | Part 5 (Ch 17–22) | Public keys, signatures, OpenSSL |
| 12 | Part 6 (Ch 23–26) | Post-quantum, and what to do about it |
| 13–15 | Part 7 (Ch 27–32) | TLS end to end, and your own CA |
| 16 | Part 8 (Ch 33–36) | SSH properly |
| 17–18 | Part 9 (Ch 37–40) | Network attacks and defences |
| 19–21 | Part 10 (Ch 41–48) | Web security / OWASP Top 10 |
Route B — "I need this for my job now" (6 weeks, ~1–2 h/day)
Weeks 1–3: Route A, doing every hands-on and break-it exercise. Week 4: Part 10 in depth + Project 3 (break and fix a vulnerable app). Week 5: Projects 1 and 2 (your own CA; harden a server). Week 6: Part 11 (operations) + Project 4 (PQC audit) + threat model your own production system.
Route C — "I want to be a security engineer" (12 weeks, ~2 h/day)
| Week | Focus | Deliverable |
|---|---|---|
| 1 | Part 0–1, lab built | A working lab; a threat model of one real system |
| 2 | Part 2–3 | A password-storage implementation you can defend |
| 3–4 | Part 4–5 | Every OpenSSL exercise; a written explainer of RSA vs ECC |
| 5 | Part 6 | Project 4: PQC audit of a real service |
| 6–7 | Part 7 | Project 1: CA + mTLS between two services |
| 8 | Part 8–9 | Project 2: a hardened, scanned, documented server |
| 9–10 | Part 10 | Project 3: full write-up of 10 vulnerabilities found and fixed |
| 11 | Part 11 | An incident-response runbook and a detection rule set |
| 12 | Consolidate | Publish a technical write-up; start a CTF habit |