safinglink.com

Week-by-Week Action Plan: What to Do in Weeks 1–12

Published on safinglink.com · Cybersecurity · Tech | 网络安全 · 技术

Week 1: Set Up Your Lab and Pick a Track | 第1周：搭建实验环境与选定方向

Install VirtualBox on a host with 16GB RAM and create two VMs: Kali Linux and Ubuntu Server. Register a free TryHackMe account and complete the Pre Security path (about 8 hours). Choose one track: blue team (defensive) or red team (offensive). Blue team suits those targeting SOC roles; red team suits penetration testing. Budget MYR 0 for software; only your electricity and time. Avoid installing Kali on bare metal before you understand snapshots.

先准备一台至少16GB内存的电脑，安装 VirtualBox，建立两个虚拟机：Kali Linux 与 Ubuntu Server。注册免费的 TryHackMe 帐号，完成 Pre Security 路径，约需8小时。选定一条主线：蓝队（防御）或红队（攻击）。蓝队适合想进入 SOC 岗位者，红队适合渗透测试方向。软件成本为0令吉，只需电费与时间。常见坑：在还没学会快照前就把 Kali 装在实体机上，一旦系统损坏难以复原。建议每周固定投入6至8小时，先求稳定节奏，不要贪多。

Week 2: Master Linux Basics and Command Line | 第2周：掌握 Linux 基础与命令行

Spend 7 hours on Linux fundamentals: file permissions, users, systemd, and bash scripting. Use OverTheWire Bandit (levels 0–15) for hands-on practice. Learn to read logs in /var/log and use grep, awk, and journalctl. In Malaysia, most SOC job ads list Linux as a hard requirement. Document every command in a Markdown file on GitHub. Avoid memorizing commands without context; always ask what problem each command solves.

本周投入7小时学习 Linux 基础：文件权限、用户管理、systemd 与 bash 脚本。用 OverTheWire Bandit 第0至15关做实操。学会阅读 /var/log 日志，并熟练使用 grep、awk、journalctl。马来西亚多数 SOC 职缺把 Linux 列为硬性要求。把每条命令记录在 GitHub 的 Markdown 文件里。常见坑：只背命令不理解场景，遇到真实日志就卡住。建议每天30分钟命令行练习，周末做一次总结，确保能独立排查服务启动失败问题。

Week 3: Networking and Packet Analysis | 第3周：网络基础与封包分析

Dedicate 8 hours to TCP/IP, DNS, HTTP, and subnetting. Install Wireshark and capture your own traffic while browsing local sites like Maybank2u and MyDigital ID. Use tcpdump on Ubuntu Server to capture 100 packets and identify a DNS query. Learn to read a three-way handshake. Avoid capturing on public Wi-Fi without permission; it is illegal under Malaysia's Computer Crimes Act 1997. Practice subnetting with subnettingpractice.com for 20 minutes daily.

本周投入8小时学习 TCP/IP、DNS、HTTP 与子网划分。安装 Wireshark，在浏览本地网站如 Maybank2u 与 MyDigital ID 时抓取自己的流量。在 Ubuntu Server 上用 tcpdump 抓100个封包，找出一次 DNS 查询，并读懂三次握手。常见坑：在公共 Wi-Fi 上未经允许抓包，在马来西亚可能触犯1997年电脑犯罪法。建议每天用 subnettingpractice.com 练20分钟子网划分，周末用 Wireshark 分析一次完整网页加载流程。

Week 4: Blue Team Foundations with SIEM | 第4周：蓝队基础与 SIEM 入门

Install Splunk Free or use Elastic Stack on a 8GB VM. Ingest Ubuntu auth logs and create three alerts: failed SSH logins, new user creation, and sudo usage. Spend 9 hours. Learn SPL queries like index=main sourcetype=linux_secure. This mirrors what Malaysian banks and GLCs use in their SOC. Avoid ingesting too much data at once; start with one log source. Document alert logic and false positives.

在8GB内存虚拟机上安装 Splunk Free 或 Elastic Stack，导入 Ubuntu 认证日志，建立三个警报：SSH 登录失败、新建用户、sudo 使用。本周投入9小时。学会 SPL 查询，例如 index=main sourcetype=linux_secure。这正是马来西亚银行与政联公司 SOC 的日常操作。常见坑：一次导入太多日志导致查询缓慢，应先从一个日志源开始。把警报逻辑与误报情况记录成文档，方便日后面试展示。

Week 5: Vulnerability Scanning and CVE Handling | 第5周：漏洞扫描与 CVE 处理

Use OpenVAS or Nessus Essentials to scan a deliberately vulnerable VM like Metasploitable2. Spend 8 hours. Learn to read CVSS scores and prioritize by exploitability and business impact. Map findings to MITRE ATT&CK. In Malaysia, PDPA 2010 requires organizations to protect personal data, so vulnerability management is a compliance issue. Avoid scanning any system you do not own. Write a one-page remediation report with MYR cost estimates for patching downtime.

用 OpenVAS 或 Nessus Essentials 扫描故意有漏洞的 Metasploitable2 虚拟机，本周投入8小时。学会阅读 CVSS 分数，按可利用性与业务影响排序。把发现对应到 MITRE ATT&CK。在马来西亚，2010年个人资料保护法要求机构保护个人数据，漏洞管理属于合规议题。常见坑：扫描不属于自己的系统，可能违法。写一份一页的修复报告，估算修补停机带来的令吉成本，练习向管理层沟通。

Week 6: Web Application Security Basics | 第6周：Web 应用安全基础

Complete PortSwigger Web Security Academy labs on SQL injection, XSS, and broken access control. Spend 10 hours. Install Burp Suite Community and intercept requests on DVWA. Learn OWASP Top 10 2021. Many Malaysian e-commerce sites run on WooCommerce and are targeted for payment skimming. Avoid testing live sites without written permission. Document each lab with request/response screenshots and a short root-cause note.

完成 PortSwigger Web Security Academy 的 SQL 注入、XSS 与访问控制失效实验，本周投入10小时。安装 Burp Suite Community，在 DVWA 上拦截请求。学习 OWASP Top 10 2021。马来西亚许多电商网站使用 WooCommerce，常成为支付侧录目标。常见坑：未取得书面授权就测试真实网站，可能触法。每个实验都要截图请求与响应，并写简短根因笔记。周末复习一次，确保能解释漏洞成因与修复方式。

Week 7: Phishing Simulation and Email Security | 第7周：钓鱼模拟与邮件安全

Set up GoPhish on a local VM and run a simulation against your own test email accounts. Spend 7 hours. Learn SPF, DKIM, and DMARC records; check a local domain using MXToolbox. In Malaysia, BEC scams often impersonate suppliers asking for payment to a new bank account. Avoid sending simulations to anyone without consent. Write a one-page awareness guide in Bahasa Malaysia and English for non-technical staff.

在本地虚拟机架设 GoPhish，对自己拥有的测试邮箱做一次钓鱼模拟，本周投入7小时。学习 SPF、DKIM 与 DMARC 记录，用 MXToolbox 检查本地域名。马来西亚常见商业电子邮件诈骗，冒充供应商要求把款项汇到新银行账户。常见坑：未经同意就向他人发送模拟邮件，可能引发投诉。写一份马来文与英文对照的一页安全意识指南，给非技术同事阅读，练习把技术风险翻译成业务语言。

Week 8: Incident Response and Digital Forensics | 第8周：事件响应与数字取证

Learn the NIST incident response lifecycle. Use Autopsy to analyze a provided disk image and Volatility for memory analysis. Spend 9 hours. Practice writing an incident timeline for a simulated ransomware case. In Malaysia, organizations must report certain breaches to CyberSecurity Malaysia and the Personal Data Protection Department. Avoid modifying evidence; always work on copies and hash-verify with SHA-256. Document chain of custody.

学习 NIST 事件响应生命周期。用 Autopsy 分析提供的磁盘映像，用 Volatility 做内存分析，本周投入9小时。针对模拟勒索软件案例，练习写事件时间线。在马来西亚，机构须向 CyberSecurity Malaysia 与个人资料保护局通报特定外泄事件。常见坑：直接改动原始证据，导致取证无效。务必在副本上操作，并用 SHA-256 校验哈希，记录证据监管链。周末做一次完整复盘，整理成可展示的报告。

Week 9: Cloud Security on AWS and Azure | 第9周：AWS 与 Azure 云端安全

Create a free-tier AWS account and learn IAM, S3 bucket policies, and CloudTrail. Spend 8 hours. Use AWS CloudGoat or flaws.cloud for hands-on labs. In Malaysia, many SMEs adopt cloud without understanding shared responsibility. Avoid leaving access keys in code repositories. Set a billing alarm at USD 5 to prevent surprise charges. Document least-privilege policies in a GitHub repo.

注册 AWS 免费方案，学习 IAM、S3 存储桶策略与 CloudTrail，本周投入8小时。用 AWS CloudGoat 或 flaws.cloud 做实操。马来西亚许多中小企业上云却不理解责任共担模型。常见坑：把访问密钥写进代码仓库，导致泄露；务必用环境变量或密钥管理服务。设置5美元帐单警报，避免意外收费。把最小权限策略记录到 GitHub 仓库，方便日后审计与面试展示。

Week 10: Build a Home SOC and Automate | 第10周：搭建家庭 SOC 与自动化

Combine your skills: SIEM plus a vulnerable VM plus an attack box. Write a Python script to parse logs and send alerts. Spend 10 hours. Use TheHive or Shuffle for case management and SOAR basics. Automate one repetitive task, such as enriching IPs with AbuseIPDB. Avoid over-engineering; one working automation beats five broken ones. Record a 3-minute demo video for your portfolio.

整合前面技能：SIEM 加漏洞虚拟机加攻击机。写一个 Python 脚本解析日志并发出警报，本周投入10小时。用 TheHive 或 Shuffle 做案件管理与 SOAR 基础。自动化一个重复任务，例如用 AbuseIPDB 丰富 IP 情报。常见坑：过度设计，五个半成品不如一个能跑通的自动化。录一段3分钟演示视频放进作品集。周末检查警报是否准确，降低误报率，并写下改进清单。

Week 11–12: Certification, Portfolio, and Job Prep | 第11至12周：认证、作品集与求职准备

Weeks 11–12 focus on validation. Book CompTIA Security+ (about MYR 1,700) or pursue free alternatives like Google Cybersecurity Certificate. Polish your GitHub portfolio with 5 projects and write a one-page resume in English and Bahasa Malaysia. Practice 20 interview questions on incident response and risk. In Malaysia, HRDF claimable courses and MDEC digital upskilling programs can offset training costs. Avoid paying for bootcamps before testing free resources.

第11至12周专注验证成果。可报考 CompTIA Security+，费用约1,700令吉，或先完成免费的 Google Cybersecurity Certificate。整理 GitHub 作品集，至少5个项目，并准备英文与马来文一页简历。练习20道事件响应与风险类面试题。在马来西亚，HRDF 可申报课程与 MDEC 数字技能提升计划可抵扣部分培训费。常见坑：还没试过免费资源就花大钱报训练营。最后复盘12周投入时数，找出最弱环节，制定下一个90天计划。

 ·