Fundamental IT Skills

The Knowledge Behind Every Cybersecurity Professional

When I started learning cybersecurity, I was naturally drawn to the more visible parts of the field: penetration testing, ethical hacking, vulnerability assessment, network security, and understanding how attackers compromise systems.

These topics are interesting, but the more I explore cybersecurity, the more I realise that there is something underneath all of them that deserves just as much attention: fundamental IT skills.

You cannot properly investigate a suspicious network connection if you do not understand how networks communicate. You cannot investigate unusual system behaviour if you have no idea how an operating system manages processes, users, permissions, and resources. And you cannot confidently work with security tools if you do not understand what those tools are actually doing.

Cybersecurity does not exist separately from IT. It operates on top of it.

Here are some of the fundamental IT skills I believe anyone learning cybersecurity should take seriously.

1. Understanding Operating Systems Beyond the Desktop

Most people interact with operating systems through graphical interfaces. We open applications, create folders, install software, and change settings. That is enough for everyday computer usage, but it is not enough when you start investigating how systems work.

An operating system manages processes, memory, storage, users, permissions, and communication between hardware and software.

As someone learning cybersecurity, I am particularly interested in understanding Linux and Windows from an administrative and security perspective.

For Linux, this means becoming comfortable with commands such as:

• "ls" – Listing files and directories.
• "cd" – Navigating between directories.
• "pwd" – Identifying the current working directory.
• "chmod" – Changing file permissions.
• "ps" – Viewing running processes.
• "grep" – Searching through text.
• "sudo" – Executing commands with elevated privileges.
• "ss" – Inspecting network sockets.

These are not just commands to memorise. They provide a way to inspect and understand what is happening inside a system.

For example, knowing how Linux file permissions work helps explain why certain users can access sensitive files while others cannot. Understanding running processes helps when investigating suspicious activity.

I also want to understand Windows beyond its graphical interface, particularly PowerShell, Event Viewer, user accounts, services, and NTFS permissions.

The goal is not to become dependent on commands. It is to understand the system well enough to know which commands are useful and why.

1. Networking: Understanding How Systems Communicate

Networking is one of the areas I consider essential for anyone pursuing cybersecurity.

Every time a device accesses a website, communicates with a server, or connects to another machine, networking protocols make that communication possible.

Without understanding networking, many cybersecurity concepts become difficult to follow.

Some of the concepts worth learning include:

• IP addressing: How devices are identified on a network.
• DNS: How domain names are translated into IP addresses.
• DHCP: How devices obtain network configuration automatically.
• TCP and UDP: Two transport protocols with different communication characteristics.
• HTTP and HTTPS: How web applications communicate with clients.
• Ports: How services are identified and accessed on a machine.
• Subnetting: How IP networks are divided into smaller networks.
• Firewalls: How network traffic is filtered according to defined rules.

Consider a practical example.

Suppose you are investigating a server that appears to be communicating with an unfamiliar external IP address.

Before jumping to conclusions, you need to understand what an IP address represents, which protocol is being used, which port is involved, and whether the connection is expected.

Tools such as Wireshark, "ping", "traceroute", "nslookup", and "nmap" become much more useful when you understand the networking principles behind them.

I am learning to treat networking as something to investigate, not just a collection of definitions to memorise.

1. Command-Line Proficiency

The command line deserves its own place because it changes how you interact with computers.

Graphical interfaces are useful, but they can hide details that become important when troubleshooting, automating tasks, or investigating security incidents.

Linux terminals and Windows PowerShell allow you to interact directly with system functionality.

For cybersecurity, command-line proficiency becomes useful in several situations:

• Inspecting system configurations.
• Searching logs for unusual activity.
• Managing users and permissions.
• Testing network connectivity.
• Identifying running services.
• Automating repetitive tasks.
• Working with security tools.

For example, imagine having thousands of log entries and needing to find failed login attempts.

Searching manually through every entry would be inefficient. Learning commands such as "grep", "awk", and "sort" can help narrow down the information.

The important distinction is understanding what a command does before executing it, particularly when working with elevated privileges or commands that modify system configurations.

1. File Systems, Permissions, and Access Control

One of the most important security concepts is controlling who can access what.

This sounds simple, but access control is deeply connected to how operating systems manage files, directories, users, groups, and permissions.

In Linux, permissions are commonly represented through read, write, and execute privileges.

For example:

ls -l

Might produce an entry such as:

-rwxr-xr-- 1 user developers 2048 example.sh

Understanding this output helps you identify who owns a file, which group it belongs to, and what different users are allowed to do.

This becomes particularly important when learning about:

• The principle of least privilege.
• Privilege escalation.
• File permission misconfigurations.
• Sensitive data exposure.
• User and group management.

A file that is readable by everyone when it contains sensitive information is not merely an administrative oversight. It can become a security problem.

Learning permissions at the operating-system level makes security concepts much easier to understand in practice.

1. Basic Scripting and Automation

You do not necessarily need to become a software developer to work in cybersecurity, but knowing how to write scripts is a significant advantage.

Scripting helps reduce repetitive work and makes it possible to investigate information more efficiently.

Python and Bash are particularly useful starting points.

Python can help with:

• Processing log files.
• Working with APIs.
• Analysing structured data.
• Automating repetitive tasks.
• Performing basic network-related operations.

Bash is useful for interacting with Linux systems, combining commands, and automating administrative tasks.

For example, a simple Python script can count how many times a particular IP address appears in a log file.

That might sound like a small exercise, but it introduces useful skills: reading files, processing strings, using loops, and extracting information.

These are the same programming fundamentals that become useful when working with larger security datasets.

1. Understanding Virtualisation and How to Build a Lab

Reading about cybersecurity concepts is useful, but eventually you need an environment where you can experiment.

This is where virtualisation becomes important.

Tools such as VirtualBox and VMware allow you to run virtual machines without needing separate physical computers.

You can create a small lab containing:

• A Linux virtual machine.
• A Windows virtual machine.
• A deliberately vulnerable application.
• A virtual network connecting the machines.

This gives you an environment to practise system administration, networking, vulnerability assessment, and security monitoring.

For example, you could configure a Linux server, inspect its open ports, review its running services, and investigate its logs.

You could then introduce a configuration weakness in that isolated environment and observe how it affects the system.

The important thing is to practise in systems you own or have explicit permission to test.

A personal lab also makes mistakes less expensive. You can experiment, break configurations, restore snapshots, and repeat exercises without putting your everyday computer at risk.

1. Troubleshooting and Reading Logs

Troubleshooting is an underrated IT skill, especially when learning cybersecurity.

Not every unusual system event is an attack. Not every failed connection indicates malicious activity. Sometimes the problem is a misconfigured service, incorrect permissions, DNS resolution, or an application that has stopped responding.

The ability to investigate before making assumptions is valuable.

A good troubleshooting process involves:

1. Identifying the actual problem.
2. Gathering relevant information.
3. Checking logs and system configurations.
4. Testing possible explanations.
5. Making one change at a time.
6. Verifying whether the issue has been resolved.

Logs are particularly important because they provide a record of events that occurred within a system or application.

Learning where to find them and how to interpret them is a useful starting point for understanding security monitoring and incident response.

On Linux, you can begin exploring system logs through:

journalctl

On Windows, Event Viewer provides access to application, security, and system events.

Over time, you begin to understand that troubleshooting and security investigation share an important skill: following evidence instead of guessing.

Putting These Skills Into Practice

One thing I am trying to avoid while learning cybersecurity is collecting tools without understanding the technology behind them.

It is easy to install Kali Linux, open Nmap, run a scan, and admire the results. But the more valuable exercise is understanding what the scan actually discovered.

Why is a particular port open? What service is listening? Is that service supposed to be exposed? What does the service do? What would happen if it were misconfigured?

Those questions turn tool usage into actual learning.

A practical learning sequence could look something like this:

Area| Practical exercise
Linux| Create users, manage permissions, and inspect processes.
Networking| Configure IP addresses and investigate DNS resolution.
Command line| Search logs and automate simple tasks.
File systems| Experiment with file ownership and permissions.
Python| Write a script to analyse a sample log file.
Virtualisation| Build an isolated Linux and Windows lab.
Troubleshooting| Investigate and resolve a deliberately introduced configuration problem.

You do not need to master everything before moving into cybersecurity. However, revisiting these fundamentals while learning more advanced topics makes a noticeable difference.

Final Thoughts

I am beginning to see fundamental IT knowledge differently as I continue learning cybersecurity.

It is not simply a list of prerequisites to complete before getting into the interesting stuff. It is the knowledge that allows you to understand what security tools are measuring, what vulnerabilities actually affect, and why certain configurations create risks.

An individual can learn to run a vulnerability scanner without understanding the underlying network. They can execute Linux commands without knowing how permissions work. They can follow a penetration-testing tutorial without understanding why a particular vulnerability exists.

But there is a difference between following instructions and understanding the technology you are working with.

For me, the focus is on building that understanding one concept at a time.

Before learning how to secure a system, I want to understand how that system works, how it communicates, how it stores information, and how it can fail.

That is the foundation I want to build as I continue my cybersecurity journey.

---

What fundamental IT skill are you currently working on?

I'd be interested to hear what other people learning cybersecurity are prioritising, especially those who are building their knowledge from the ground up.