Roadmap · 4 level

Telusuri dari level sampai sumber belajarnya.

Klik kartu untuk membuka cabang berikutnya: level, fase, modul, materi, lalu sumber belajar. Kartu sumber belajar langsung membuka link materinya.

Materi yang sudah kamu tandai0 materi

Progres tersimpan di browser ini saja.

Fase 0 — Pra-Fondasi: Literasi Digital (2–4 Minggu)

Fase 1 — Fondasi: Pemahaman Dasar (6–8 Minggu)

Sistem Operasi Linux

Navigasi terminal: ls, cd, cat, grep, find, chmod, chown
User management: useradd, passwd, sudoers, /etc/shadow
Package manager: apt/yum, update, upgrade, install
Proses: ps aux, top, htop, kill, systemctl, journalctl
File permissions: rwx, numeric notation, SUID/SGID
- Youtube: Rahasia manajemen file
- Artikel: Penjelasan manajemen file

Jaringan Komputer

Model OSI 7 layer — fungsi tiap layer dan contoh protokolnya
- Youtube: Model OSI Layer
TCP/IP, UDP, ICMP — perbedaan dan kapan digunakan
IP addressing & subnetting CIDR — praktek sampai mahir
DNS, DHCP, ARP, NAT — cara kerja di jaringan nyata
Wireshark: capture, filter, dan baca packet secara dasar
- Youtube: Packet analysis
- Artikel: Wireshark Guide

Python & Bash Scripting

Python: variabel, kondisi, loop, fungsi, modul, file I/O
- Youtube: Python Full Course
String manipulation dan regex dasar untuk parsing log
requests library: GET/POST ke API dan scraping dasar
- Youtube: Web Scraping
- Artikel: Membuat Web Scraper
Bash: variabel, loop, kondisi, pipe, redirect, cron job
- Youtube: Bash dan Cron Job
- Artikel: 6 Tips nulis bash
Buat tools kecil: port scanner, log parser, file encryptor

Konsep Keamanan Inti

CIA Triad mendalam dengan kasus nyata Indonesia
AAA framework: Authentication, Authorization, Accounting
Threat vs Vulnerability vs Risk vs Exploit — definisi presisi
Defense in Depth, Least Privilege, Fail-Safe Defaults
Attack surface, threat modeling konsep, kill chain

Database & Web Dasar

SQL dasar: SELECT, INSERT, UPDATE, DELETE, JOIN, WHERE
- Youtube: Pengenalan SQL
- Artikel: SQL Cheat Sheet
Client-server model dan request-response cycle
REST API: method, endpoint, header, body, status code
HTTP methods dan developer tools browser
Cara aplikasi web modern bekerja dari browser ke database

Fase 2 — Kriptografi & Post-Quantum Cryptography (5–7 Minggu)

Kriptografi Klasik

Enkripsi simetris: AES-128/256, DES (kelemahan), 3DES
Enkripsi asimetris: RSA, ECC, Diffie-Hellman key exchange
Hashing: SHA-256, SHA-3, MD5 (broken), BLAKE2
MAC & HMAC untuk integritas dan autentikasi pesan
- Youtube: MAC dan HMAC
- Youtube: Kenapa Hashing saja tidak cukup
Cryptographic randomness dan kenapa PRNG bisa berbahaya

PKI, TLS & Sertifikat

Public Key Infrastructure (PKI) — arsitektur dan chain of trust
Certificate Authority, X.509, dan validasi sertifikat
TLS 1.3 handshake lengkap step-by-step
HTTPS: certificate pinning, HSTS, OCSP stapling
Common TLS misconfigurations: weak cipher, expired cert, MITM

Post-Quantum Cryptography (PQC)

Kenapa RSA dan ECC akan "broken" oleh quantum computer
Konsep "Harvest Now, Decrypt Later" (HNDL) risiko terbesar saat ini
NIST PQC Standards: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA
Lattice-based cryptography — prinsip dasar yang membuatnya quantum-safe
PQC migration planning: inventarisasi enkripsi dan roadmap transisi

Autentikasi & Token Modern

Password hashing: bcrypt, Argon2, PBKDF2 — jangan MD5/SHA1!
Multi-Factor Authentication: TOTP, FIDO2, Passkeys
JSON Web Token (JWT): struktur, signing, validasi, dan risiko
OAuth 2.0 & OpenID Connect — authorization flow lengkap
Passkeys dan masa depan passwordless authentication

Fase 3 — Serangan & Pertahanan (8–10 Minggu)

Malware & Ancaman Modern

Virus, Worm, Trojan, RAT, Backdoor — cara kerja & bedanya
Ransomware : double extortion, RaaS (Ransomware-as-a-Service)
Spyware, Adware, Rootkit, Bootkit, Fileless malware
Supply chain attacks: SolarWinds, XZ Utils, npm poisoning
APT (Advanced Persistent Threat) dan nation-state actors
- Youtube: Penjelasan APT
- Artikel: Nation state actors & contoh real

Social Engineering & AI-Powered Attacks

Phishing, Spear Phishing, Whaling
AI-generated phishing: deepfake voice, hyper-realistic email
Vishing & Smishing yang makin canggih dengan AI
Business Email Compromise (BEC) — kerugian terbesar secara finansial
Defense: security awareness training dan email security (SPF, DKIM, DMARC)

Serangan & Pertahanan Jaringan

MITM: ARP spoofing, DNS poisoning, SSL stripping
DoS & DDoS: volumetric, protocol, application layer (L7)
Port scanning dengan Nmap — timing, stealth, service detection
Sniffing & packet injection — Scapy basics
Pertahanan: Firewall next-gen, IDS/IPS Snort/Suricata, network segmentation

Web App Security — OWASP Top 10

A01 Broken Access Control — IDOR, privilege escalation, path traversal
A03 SQL Injection — error-based, blind, time-based, out-of-band
- Youtube: Penjelasan SQLi
- Lab: SQL Injection
A07 XSS — stored, reflected, DOM-based; cara eksploitasi & mitigasi
- Youtube: Penjelasan XSS
- Lab: XSS
CSRF, SSRF, XXE, Insecure Deserialization
Burp Suite Community: intercept, repeater, intruder, scanner

Vulnerability Assessment

CVE database dan CVSS v3.1 scoring — cara baca dan interpretasi
OpenVAS / Nessus Essentials — setup, scan, dan laporan
ExploitDB dan cara menemukan PoC yang relevan
Patch management lifecycle dan risk-based prioritization
Vulnerability report writing: executive summary + technical detail
- Artikel: Cara membuat laporan VA

Fase 4 — Infrastruktur & Cloud (6–8 Minggu)

Hardening Sistem Operasi

CIS Benchmarks Level 1 & 2 — implementasi langkah per langkah
Disable unnecessary services, ports, dan SUID binaries
SELinux / AppArmor — mandatory access control
Windows GPO, Local Security Policy, dan PowerShell hardening
auditd, syslog, dan log forwarding ke remote server

Cloud Security Dasar

Shared Responsibility Model — siapa bertanggung jawab untuk apa
IAM: users, roles, policies, permission boundaries, least privilege
S3/Storage bucket misconfiguration — kasus nyata dan cara deteksi
VPC, security groups, NACLs, dan network segmentation di cloud
Cloud logging: CloudTrail, CloudWatch, Azure Monitor, GCP Audit Logs

Container & DevSecOps

Docker security: non-root user, read-only filesystem, capabilities
Container image scanning: vulnerability dan malware detection
Kubernetes RBAC, network policies, pod security standards
CI/CD pipeline security: SAST, secrets scanning, dependency check
Infrastructure as Code security: Terraform, Ansible hardening

Active Directory & IAM Enterprise

Active Directory: forest, domain, OU, trust relationships
- Artikel: Domain, forest, AD trust
Kerberos authentication — AS-REQ, TGT, TGS, service ticket
- Artikel: Karberos Attack Guide
Kerberoasting, AS-REP Roasting, Pass-the-Hash (defensive perspective)
- Artikel: AS-REP Roasting
- Artikel: Pengenalan Pass the hash
Privileged Access Management (PAM) dan Just-In-Time access
- Artikel: PAM dan Just in time access
Zero Trust Architecture — prinsip "never trust, always verify"
- Dokumen: NIST 800-207: Zero Trust Architecture

Fase 5 — Security Communication (3–4 Minggu)

Security Report Writing

Vulnerability report structure: executive summary, findings, CVSS, remediation
Incident report: timeline, impact, root cause, lessons learned, prevention
- Artikel: Mengenal incident response report
- Referensi: Contoh SANS incident response report
Risk report untuk board: bahasa bisnis, angka, dan rekomendasi actionable
- Artikel: Buat report ke manajemen board
Technical documentation: runbook, playbook, SOP yang bisa dieksekusi orang lain
- Artikel: Runbooks, playbooks, SOP
Visual communication: diagram arsitektur, attack flow, risk matrix
- Artikel: Risk matrix
- Tools: PlantUML

Komunikasi Risiko kepada Stakeholder

Bahasa risiko vs bahasa teknis — cara terjemahkan untuk audience berbeda
Risk communication kepada C-level: ROI security investment, business impact
Security awareness presentation yang engaging dan tidak membosankan
- Artikel: Cybersecurity awareness
- Artikel: security awareness training
Menjelaskan keputusan security kepada tim developer (empati, bukan intimidasi)
Negosiasi: meyakinkan manajemen untuk investasi security
- Artikel: Strategi secure investment
- Artikel: Tips security pich deck untuk investor

Kolaborasi & Security Culture

Membangun security culture tanpa menciptakan fear dan paranoia
Security champion program: cara embed security di tim development
Tabletop exercise facilitation: simulasi insiden untuk manajemen
Cross-departemen komunikasi: IT, legal, HR, finance dalam konteks security
- Artikel: Cross-functional security collaboration
- Youtube: Security collaboration across departments
Vendor dan third-party security communication
- Artikel: Third-party risk communication
- Youtube: Vendor security communication basics

Career Communication & Personal Branding

Menulis write-up CTF dan security blog yang membangun reputasi
LinkedIn optimization untuk cybersecurity professional
Presentasi di conference atau meetup — cara pitch talk proposal
Membangun portfolio yang terlihat oleh recruiter
- Artikel: Portfolio cybersecurity untuk recruiter
Networking di komunitas cybersecurity Indonesia dan global
- Artikel: Networking strategy for cybersecurity professionals

Fase 6 — Governance, Risk & Compliance (5–7 Minggu)

Manajemen Risiko

Risk identification: aset, ancaman, kerentanan, dan dampak
Qualitative vs quantitative risk analysis — FAIR model
NIST RMF: Categorize, Select, Implement, Assess, Authorize, Monitor
- Youtube: NIST Risk Management Framework
- Artikel: NIST RMF step by step
Risk treatment: mitigate, transfer (asuransi), accept, avoid
Risk register dan continuous monitoring
- Artikel: Cara membuat risk register
- Youtube: Continuous monitoring in risk management

ISO/IEC 27001:2022

PDCA cycle dan klausul 4–10 secara mendalam
Annex A: 93 kontrol dalam 4 tema (organizational, people, physical, technological)
Statement of Applicability (SoA) — dokumen jantung ISMS
- Artikel: Apa itu Statement of Applicability
- Youtube: Menyusun SoA
Internal audit ISO 27001: planning, fieldwork, nonconformity
- Artikel: Internal audit ISO 27001
- Youtube: ISO 27001 internal audit basics
Management review dan continual improvement

UU ITE & UU PDP Indonesia

UU ITE: kejahatan siber, konten ilegal, dan jerat hukumnya
UU PDP: 11 hak subjek data, kewajiban pengendali vs prosesor
Perbedaan kritis UU PDP Indonesia vs GDPR Eropa
- Artikel: UU PDP vs GDPR
- Youtube: Perbandingan regulasi privasi
Sanksi pidana dan administratif pelanggaran UU PDP
BSSN, Kominfo, dan Komdigi — peran regulator siber Indonesia

GDPR & Privasi Data Global

7 prinsip GDPR lengkap dengan contoh implementasi
11 hak subjek data dan bagaimana memfasilitasinya
DPO (Data Protection Officer): kapan wajib dan apa tugasnya
DPIA: kapan wajib, cara lakukan, dan dokumentasi
- Artikel: Data Protection Impact Assessment
- Youtube: Cara melakukan DPIA
Breach notification: 72 jam, kepada siapa, apa isinya
- Artikel: GDPR breach notification requirements
- Youtube: 72-hour breach reporting

PCI DSS v4.0 & HIPAA

12 PCI DSS requirements — dari network security sampai policy
Cardholder Data Environment (CDE) scoping dan network segmentation
- Artikel: CDE scoping and segmentation
- Youtube: PCI DSS scoping
SAQ types: A, B, C, D — mana yang relevan untuk bisnis kamu
- Artikel: PCI SAQ types explained
- Youtube: Memahami SAQ PCI
HIPAA Security Rule: administrative, physical, technical safeguards
PHI definition dan 18 identifier yang harus dilindungi
- Artikel: What is PHI
- Youtube: PHI and HIPAA basics

Regulasi AI & ISO 42001

ISO/IEC 42001:2023 — AI Management System, kontrol, dan audit
EU AI Act: prohibited AI, high-risk AI, transparency obligations
NIST AI RMF: Govern, Map, Measure, Manage
Indonesia: Peraturan Presiden AI dan peta jalan AI nasional
AI impact assessment dan cara dokumentasinya

Fase 7 — SOC & Operasi Keamanan (6–8 Minggu)

SIEM & Log Management

SIEM architecture: collector, normalizer, correlator, dashboard
Log sources: Windows Event Log, Syslog, EDR, firewall, cloud logs
SPL (Splunk) atau KQL (Elastic/Sentinel) query dasar sampai menengah
Correlation rules: tuning untuk kurangi false positive
Log retention, archiving, dan compliance requirements

Incident Response & Playbook

PICERL lifecycle: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
Incident classification: severity P1–P4, escalation matrix
Playbook: ransomware, phishing, data breach, insider threat, DDoS
Evidence preservation: order of volatility, imaging, chain of custody
SOAR integration: automasi triage dan response dengan AI assist

Digital Forensics Dasar

Order of volatility dan kenapa urutan collection penting
Disk imaging: dd, FTK Imager, dcfldd — best practices
Memory forensics: Volatility 3 — proses, network, artifacts
Log analysis dan timeline reconstruction menggunakan plaso/log2timeline
Network forensics: analisis PCAP, extract artifacts dari capture

Threat Intelligence & Hunting

MITRE ATT&CK: Tactics (14), Techniques (200+), Procedures — cara pakai Navigator
Threat hunting: hypothesis-driven, TTP-based, anomaly-based
IOC types: hash, IP, domain, URL, mutex, registry — cara ekstrak & share
OSINT untuk threat research: Shodan, WHOIS, VirusTotal, Censys
STIX/TAXII, OpenCTI, MISP untuk threat intelligence sharing

AI-Assisted SOC Operations

AI untuk alert triage: mengurangi false positive secara otomatis
LLM-assisted threat hunting: natural language query ke log
Agentic AI dalam SOAR: autonomous containment dan response
AI-powered threat intelligence summarization
Human-in-the-loop: kapan tetap butuh keputusan manusia

Fase 8 — AI Security & Agentic AI (4–6 Minggu)

OWASP LLM Top 10 & AI Threats

LLM01: Prompt Injection — direct dan indirect, cara kerja & eksploitasi
LLM02: Sensitive Information Disclosure — PII leakage, training data exposure
LLM06: Excessive Agency — AI yang melakukan lebih dari yang seharusnya
LLM07: System Prompt Leakage — cara ekstrak instruksi tersembunyi
LLM09: Misinformation — hallucination dan dampak keamanan

Agentic AI Security

Apa itu Agentic AI: autonomous decision-making dan tool use
Agent goal hijacking — cara manipulasi tujuan agen
Tool misuse & identity abuse dalam multi-agent systems
Memory poisoning — injeksi memori jangka panjang agen
MCP (Model Context Protocol) security — attack surface baru

Model Security & Data Poisoning

Adversarial attacks: input perturbation untuk manipulasi output model
Data poisoning: corrupting training data — "Harvest Now, Corrupt Later"
Model extraction dan model inversion attacks
AI supply chain security: model dan dataset integrity
AI SBOM (Software Bill of Materials) untuk AI components

AI Governance & Regulasi

ISO/IEC 42001:2023 — AI Management System standard
EU AI Act: risk-based classification, prohibited AI, GPAI regulations
NIST AI RMF: Govern, Map, Measure, Manage
AI Impact Assessment dan Algorithmic Auditing
Indonesia: kebijakan AI nasional dan implikasinya

Securing AI Infrastructure

Securing LLM API: rate limiting, input validation, output filtering
RAG pipeline security: vector database poisoning prevention
AI model access control dan authentication
Monitoring dan observability untuk AI systems
DSPM & AI-SPM (AI Security Posture Management)

Fase 9 — Spesialisasi & Karier (6–12 Bulan (ongoing))

Red Team / Penetration Testing

Pentesting methodology: PTES, OSSTMM, OWASP Testing Guide
Exploitation: Metasploit, manual exploits, custom payload
Post-exploitation: pivoting, persistence, lateral movement, exfiltration
AD attacks: Kerberoasting, Pass-the-Hash, DCSync, Golden Ticket
Report writing profesional: executive summary + technical findings

Blue Team / SOC Analyst

Advanced SIEM correlation dan tuning untuk reduce false positives
EDR/XDR: CrowdStrike, Microsoft Defender, SentinelOne — cara operasikan
Threat hunting frameworks: PEAK, TaHiTI, hypothesis-driven
Malware triage: sandbox analysis, IOC extraction, YARA rules
AI-assisted SOC: Copilot for Security, Chronicle AI

AI Security Engineer

AI red teaming: attack dan assessment AI systems secara metodis
LLM security testing: prompt injection, jailbreaking, data extraction
Agentic AI defense: guardrails, input validation, output filtering
AI security architecture: secure LLM pipeline design
AI SBOM dan supply chain security untuk AI components

Cloud Security Engineer

Multi-cloud security architecture (AWS + Azure + GCP)
CSPM: Cloud Security Posture Management — Wiz, Prisma, Orca
DevSecOps pipeline dari dev hingga production
Container & Kubernetes security di produksi
Cloud compliance: SOC 2, FedRAMP, ISO 27017

Application Security (AppSec)

Secure SDLC dan threat modeling: STRIDE, PASTA, LINDDUN
SAST/DAST/IAST tools dan cara interpretasi hasil
API security: OWASP API Top 10, testing, dan defense
Security code review: Python, JavaScript, Java, Go
Supply chain security: dependency scanning, SBOM, Sigstore

GRC / Compliance Analyst

Audit methodology: planning, fieldwork, reporting, follow-up
Policy lifecycle management: drafting, review, approval, training
Vendor risk management program end-to-end
AI governance dan compliance dengan ISO 42001
Regulatory reporting dan hubungan dengan BSSN, OJK, Kominfo