🔒 Cybersecurity & DevSecOps Learning Path¶

🚀 Real Cybersecurity & Infrastructure Defense: From Control Plane Policing (CoPP) and VRF microsegmentation to Web Application Firewalls (WAF), Zero-Trust Identity (IAM/mTLS), Container Security (Falco eBPF), and SIEM Incident Response.

📊 Learning Path Overview¶

Metric	Target Specification
Estimated Completion Time	30 – 35 Hours (Hands-on labs & scenario-driven drills)
Milestone Stages	6 Progressive Stages (Packet Analysis → AppSec/WAF → Zero-Trust → Network & CoPP Defense → Container Security → SIEM & IR)
Lab Framework	Containerlab + Arista cEOS + Linux Security Tools (Runs 100% locally on macOS OrbStack or Linux Docker)
Target Roles	Cybersecurity Engineer, DevSecOps Engineer, Security Operations (SecOps) Lead, Cloud Security Architect
Target Employers	Hyperscalers, Financial Tech (FinTech), Healthcare, Defense Contractors, and Security Operations Centers (SOC)

🧠 Core Cybersecurity Domains & Real Engineering Tools¶

Security Domain	Real Engineering Tool	Key Technical Mechanics
Network & Switch Defense	Arista cEOS / CoPP / iACLs	CPU control plane rate-limiting, BGP TTL security, and VRF microsegmentation
AppSec & WAF	OWASP Top 10 / ModSecurity	Preventing SQLi, XSS, CSRF, and enforcing API rate-limiting rules
IAM & Zero-Trust Auth	OAuth2 / OIDC / mTLS / Vault	Secret lifecycle management, mTLS client certificates, and scoped JWT validation
Cloud & Container Sec	Trivy / Falco / K8s RBAC	Static image vulnerability scanning and eBPF runtime kernel call interception
IDS / IPS & Detection	Suricata / Snort / Zeek	Deep packet inspection, signature matching, and automated threat blocking
SIEM & SecOps	Wazuh / Elastic SIEM / PCAP	Centralized security log ingestion, forensic analysis, and automated triage playbooks

🗺️ 6-Stage Progressive Milestone Roadmap¶

01

Stage 1 · Packet Forensics & Traffic Inspection

Deep Packet Inspection

Dissect raw TCP 3-way handshake anomalies, TCP window exhaustion, and protocol evasion techniques using Wireshark and tcpdump.

Wireshark tcpdump PCAPs Layer 2-7 Forensics

02

Stage 2 · Application Security & Edge WAF

AppSec

Defend microservices and APIs against OWASP Top 10 exploits by configuring Web Application Firewall rules and rate-limiting thresholds.

OWASP Top 10 ModSecurity API Rate Limiting

03

Stage 3 · Zero-Trust Identity & Secrets Management

Zero-Trust

Enforce cryptographic identity boundaries with Mutual TLS (mTLS), scoped OAuth2/OIDC JWT tokens, and automated HashiCorp Vault secret rotation.

Mutual TLS (mTLS) OAuth2 / OIDC HashiCorp Vault

04

Stage 4 · Network Fabric Hardening & CoPP Defense

Switch Hardening

Protect switch Supervisor CPUs from DDoS floods using Control Plane Policing (CoPP), Infrastructure ACLs (iACL), and VRF microsegmentation.

CoPP CPU Protection Infrastructure ACLs VRF Route Leaking MACsec AES-256

05

Stage 5 · Container & Cloud DevSecOps

eBPF Security

Detect container breakouts and privilege escalations in real time using eBPF system call filtering with Falco and static image scanning with Trivy.

Falco eBPF Trivy Vulnerability Scanner Linux Capabilities

06

Stage 6 · SIEM Ingestion & Incident Response Playbooks

SecOps

Aggregate security telemetry into Wazuh / Elastic SIEM, triage multi-stage attack vectors, and execute containment playbooks.

Wazuh SIEM Log Correlation Incident Response

🚀 Interactive Lesson Directory (Click Any Lesson to Start)¶

Milestone Stage	Security Domain	Clickable Lessons & Hands-on Labs	Runnable Lab	Action
Stage 1 `Packet Forensics`	Wireshark Dissection, TCP Handshake Anomalies, tcpdump PCAPs	• Linux Networking & Packet Diagnostics	Local Terminal	Start Stage 1 →
Stage 2 `AppSec & WAF`	OWASP Top 10 Defenses, ModSecurity Rules, Rate-Limiting	• Application Security & Reverse Proxy Architecture	Local Container	Start Stage 2 →
Stage 3 `Zero-Trust Auth`	OAuth2 Scopes, OIDC Claims, mTLS Client Certs, HashiCorp Vault	• Zero-Trust Architecture & Interview Drills	Local Terminal	Review Questions →
Stage 4 `Network Defense`	Control Plane Policing (CoPP), Infrastructure ACLs, VRF Isolation, MACsec	• Phase 8 · Lab 01: CoPP CPU Protection • Phase 8 · Lab 02: VRF Microsegmentation • Phase 8 · Lab 03: Infrastructure ACLs (iACL) • Phase 8 · Lab 04: MACsec Line-Rate Security	`labs/security-lab`	Start Stage 4 →
Stage 5 `Container Security`	Trivy Image Scanning, Linux Namespaces, Falco eBPF System Call Filters	• Container Security & eBPF Drills	Local Docker	Review Drills →
Stage 6 `SIEM & IR Playbooks`	Wazuh SIEM Ingestion, Alert Correlation, Incident Containment	• Telemetry Alerting & Anomaly Detection	`labs/telemetry-lab`	Start Stage 6 →

🧪 Detailed Milestone Curricula¶

📍 Stage 1: Packet Forensics & Traffic Inspection¶

Core Focus: Mastering raw packet capture analysis and protocol behavior at Layer 2 through Layer 7.
Key Concepts: TCP 3-way handshake anomalies, TCP window exhaustion, ARP poisoning detection, and ICMP tunneling.

📍 Stage 2: Application Security & Edge WAF¶

Core Focus: Defending web APIs and microservices against the OWASP Top 10 web application vulnerabilities.
Key Concepts: SQL injection patterns, cross-site scripting (XSS), request rate-limiting, and CRS rule tuning in ModSecurity.

📍 Stage 3: Zero-Trust Identity & Secrets Management¶

Core Focus: Cryptographic mutual authentication and dynamic secret issuance.
Key Concepts: Public Key Infrastructure (PKI), TLS 1.3 handshakes, mutual TLS (mTLS) with client certs, OAuth2 scopes, and HashiCorp Vault transit secrets.

📍 Stage 4: Network Fabric Hardening & CoPP Defense¶

Core Focus: Hardening network switches and routers against control-plane exhaustion and unauthorized lateral movement.
Key Concepts: Modular QoS CLI (MQC) Control Plane Policing (CoPP), Infrastructure ACLs (iACLs) dropping spoofed traffic, BGP Generalized TTL Security Mechanism (GTSM RFC 5082), and VRF microsegmentation.
Interactive Labs:
Local Runner:
```
cd labs/security-lab
./run.sh --guided
```

📍 Stage 5: Container & Cloud DevSecOps¶

Core Focus: Securing cloud-native containers across CI/CD build time and cluster runtime.
Key Concepts: Static vulnerability scanners (Trivy), Linux kernel capabilities, and eBPF system call tracing with Falco.

📍 Stage 6: SIEM Ingestion & Incident Response Playbooks¶

Core Focus: Detecting, triaging, and responding to security incidents with verifiable audit trails.
Key Concepts: Syslog/gNMI telemetry ingestion, correlation rules, PCAP deep dives, and automated quarantine scripts.

🛠️ Executable Local Lab Environment¶

Test your network security policies on live Arista cEOS containers:

# 1. Navigate to the Security & Microsegmentation lab
cd labs/security-lab

# 2. Launch the guided interactive runner
./run.sh --guided

# Or deploy the complete verified topology in one command
./run.sh --all

🎯 Cybersecurity Engineer Technical Interview Drills¶

❓ Question 1: How does eBPF runtime detection (Falco) catch container breakouts without adding latency?¶

Answer: Traditional security agents run in user space and poll process tables, adding substantial CPU overhead. Falco uses eBPF (Extended Berkeley Packet Filter) programs loaded directly inside the Linux kernel to intercept system calls (execve, clone, openat) in real-time. If a container executes an unauthorized shell (/bin/sh) or modifies sensitive host paths (/etc/shadow), Falco triggers an instant alert with zero user-space context switching overhead.

❓ Question 2: Explain the difference between OAuth2, OIDC, and mTLS in a Zero-Trust architecture.¶

Answer: - OAuth2: An authorization framework providing scoped access tokens (Bearer JWT) to third-party applications. - OIDC (OpenID Connect): An identity layer on top of OAuth2 (id_token) providing cryptographically signed user authentication claims. - mTLS (Mutual TLS): A transport-layer security mechanism where both client and server present X.509 cryptographic certificates to mutually authenticate before exchanging application payload bytes.

❓ Question 3: Why is Control Plane Policing (CoPP) mandatory on high-throughput datacenter switches?¶

Answer: Switch ASICs forward data plane packets at terabit speeds using dedicated TCAM. However, packets destined for the switch CPU (BGP keepalives, OSPF hellos, ARP, ICMP, SSH) travel across an internal low-bandwidth PCIe bus. Without CoPP rate-limiters, a simple ping flood or SYN flood can overwhelm the Supervisor CPU, causing BGP sessions to time out and bringing down the entire datacenter fabric.