Cyber Security Foundations | SHIELD 2040

Start here: Cyber Security Foundations

In 2026 almost every job touches data, and the people who understand how to protect it are in demand. The path to 2040 starts with a handful of ideas: the CIA triad, threats and risk, how networks and operating systems work, a little cryptography and good everyday habits. NIST's NICE Framework describes the work roles you can grow into, and its Cybersecurity Framework 2.0 shows how organizations think about risk. This page is pillar S of SHIELD 2040, Security foundations. It gives you a free, ordered path from curious beginner to ready for an entry-level job.

What you'll be able to do

Explain the CIA triad

Describe confidentiality, integrity and availability with everyday examples, and spot which one an incident hurts.

Tell threats, vulnerabilities and risk apart

Use the plain-language chain: a threat exploits a vulnerability, and risk is how likely and how costly that is.

Read a network and an OS

Describe IP addresses, ports, DNS, firewalls and how a computer manages users, files and permissions.

Understand cryptography basics

Explain hashing, symmetric and public-key encryption and why strong passwords and multi-factor sign-in matter.

Practice security awareness

Recognize phishing and social engineering, and teach family and friends how to stay safe online.

Choose a first role

Map your interests to a NICE Framework work role so you know which entry-level job you are heading toward.

Core concepts in five ideas

Every credential below teaches some version of these five ideas. Learn them first and the courses will feel familiar rather than overwhelming.

1. The CIA triad

Confidentiality (only the right people see it), Integrity (it is accurate and unaltered) and Availability (it works when needed). Almost every security decision protects one of these three.

2. Threats, vulnerabilities and risk

A threat is something that could cause harm (a criminal, a mistake, a storm). A vulnerability is a weakness (an unpatched app, a reused password). Risk combines how likely the harm is with how bad it would be. The NIST Cybersecurity Framework 2.0 turns this thinking into six functions: Govern, Identify, Protect, Detect, Respond, Recover.

Read NIST CSF 2.0

3. Networking and operating-system basics

Know how data travels (IP, DNS, ports, TCP/UDP) and how Windows and Linux handle accounts, permissions and logs. Defenders read these things all day, which is why the Cisco Networking Basics step below comes early.

4. Cryptography basics

Hashing proves a file has not changed, encryption hides it, and digital signatures prove who sent it. Public-key methods used today are being replaced by post-quantum standards over the coming years. You will explore that in the Emerging threats part of SHIELD 2040.

Explore SHIELD 2040

5. Security awareness

Most real attacks begin with a person, not a machine. Learn to pause before clicking, use a password manager and turn on multi-factor sign-in. The CISA "Secure Our World" campaign gives four simple habits you can teach anyone.

CISA Secure Our World

Your beginner → entry-job path

Follow the steps in order. Steps 1 to 7 cost $0. Hours are our own estimates unless an official page states them. Where a page does not confirm a certificate, we say so. Paid exams appear only in the optional "Later, when sponsored" block at the end.

Step 1 · Build the habits: CISA Secure Our World and security awareness

Provider: CISA and the National Cybersecurity Alliance. You earn: everyday safe habits and the shared vocabulary (no certificate). Cost: Free course · Level: Beginner · About 2 hours (estimate) Age: suitable for all ages with a coach.

CISA Secure Our World Stay Safe Online

Step 2 · Cisco Networking Academy: Introduction to Cybersecurity

Provider: Cisco Networking Academy. You earn: course completion on your NetAcad profile. The course page does not state a badge or certificate, so certificate not confirmed. Cost: Free course · Level: Beginner · About 6 to 15 hours (estimate; sources vary) Age: minimum age not stated on the course page; under-18s should sign up with a coach or teacher.

Open the course

Step 3 · Cisco Networking Academy: Networking Basics

Provider: Cisco Networking Academy. You earn: course completion on your NetAcad profile (certificate not confirmed on the course page). Cost: Free course · Level: Beginner · About 22 hours (estimate; sources vary) Age: minimum age not stated on the course page; under-18s should sign up with a coach or teacher.

Open the course

Step 4 · IBM SkillsBuild: Cybersecurity Fundamentals badge

Provider: IBM SkillsBuild. You earn: the Cybersecurity Fundamentals digital badge on Credly. Pass the end-of-course assessment with 80% or higher. Covers threat groups, attack types, social engineering, cryptography and security strategy. Cost: Free badge · Level: Beginner · About 10 hours (estimate; the badge page does not state hours) Age: the Credly page says adult learners (18+) can complete this credential. Younger learners can explore SkillsBuild courses through the students pathway, but badge eligibility for them is not confirmed.

See the badge requirements SkillsBuild for adults SkillsBuild for students

Step 5 · Fortinet Training Institute: NSE 1 and NSE 2 (formerly Fortinet Certified Fundamentals)

Provider: Fortinet Training Institute. You earn: NSE 1 (cybersecurity and the threat landscape) and NSE 2 (next-generation firewall basics). Fortinet says all self-paced courses are free of charge. On July 15, 2026 the old Fortinet Certified Fundamentals (FCF) credentials were converted to NSE 1 and NSE 2. Fortinet lists these as complete the online course and test; whether the test itself is free is not confirmed on the pages we checked, so confirm before you start. Optional hands-on labs are paid. Cost: Free course · Level: Beginner · About 4 to 8 hours per course (estimate) Age: not stated; check the Training Institute terms for under-18s.

Open the Training Institute Entry-level certifications

Step 6 · CISA Learning (the replacement for FedVTE)

Provider: CISA. You earn: no-cost online training with about 850 hours of content mapped to the NICE Framework, from beginner to advanced, including courses carried over from FedVTE. Open to the general public, veterans and government staff. Sign in with Login.gov. Some FedVTE courses were still being migrated, so check the catalog. Certificate details: not confirmed; CISA's help page mentions historical records and certificates. Cost: Free course · Level: Beginner to Advanced · Choose by course (about 1 to 40 hours each, estimate) Age: Login.gov accounts are for adults; younger learners should work alongside a coach.

About CISA Learning Sign in at learning.cisa.gov

Step 7 · NICCS education and training catalog: pick a course for your target role

Provider: CISA NICCS. You earn: a searchable directory of cybersecurity courses from many providers, filterable by NICE Framework work role. It is a directory, so cost and certificates vary by listing. Choose the free ones for the $0 path. Cost: Free to browse (listings vary) · Level: Beginner to Advanced · Varies

Browse the catalog NICE Framework resource center

Optional · SANS free resources

Provider: SANS Institute. You earn: free workshops, webcasts, posters, cheat sheets, the Internet Storm Center daily diary and free course previews. A free SANS Community account unlocks them. Note: SANS Cyber Aces was retired on June 1, 2023 and is no longer a learning path. Cost: Free course · Level: Beginner to Intermediate · Pick by webcast (about 1 hour each, estimate)

SANS webcasts SANS posters Internet Storm Center

Optional · DoD Cyber Awareness Challenge

Provider: DoD Cyber Exchange. You earn: a short annual awareness course. Access not confirmed for the public: the cyber.mil page now redirects to a DoD sign-in, and we could not confirm that a login-free public version exists. Check before you recommend it; Secure Our World (Step 1) covers the same habits. Cost: Free course (access not confirmed) · Level: Beginner · About 1 hour (estimate)

cyber.mil page

Later, when sponsored

These are real, respected credentials, but they are not free. They are not part of the $0 path. Ask a Curiosity Coach about sponsorship and check the official page for the current price first.

ISC2 Certified in Cybersecurity (CC): the free offer has ended

Provider: ISC2. You earn: the ISC2 CC entry-level certification. ISC2's "One Million Certified in Cybersecurity" free course and free exam closed to new enrollments on May 20, 2026. People who already hold an unexpired exam code can still sit the exam by December 31, 2026. Everyone else now pays the standard exam price. Cost: Paid exam, $199 USD; annual maintenance fee $50 USD · Level: Beginner · About 20 to 30 hours of study (estimate)

ISC2 CC details (paid) Program closure notice

Microsoft SC-900: Security, Compliance, and Identity Fundamentals

Provider: Microsoft Learn. You earn: the free Microsoft Learn learning path teaches the exam topics and costs nothing. The exam itself is paid (price depends on the country where you test) and is proctored, 45 minutes. Completing the learning path earns Learn achievements, not the certification. Cost: Free course (learning path) · paid exam · Level: Beginner · About 10 hours of learning (estimate) Age: Microsoft Learn accounts follow Microsoft's age rules; students can test through Certiport.

Free learning path SC-900 certification and exam (paid)

Google Cybersecurity Professional Certificate (Coursera)

Provider: Google on Coursera. You earn: a shareable Professional Certificate, preparation for the CompTIA Security+ exam and up to 9 recommended college credits (ACE). It is not free. In the U.S. and Canada it is $49 per month after a 7-day free trial, and Coursera says most learners finish for under $300. Financial aid is available, so apply for it if cost is a barrier. Cost: Paid, or free with financial aid ($49 per month) · Level: Beginner · About 130 to 170 hours (per Coursera)

Course page and financial aid

For Curiosity Coaches

Use this page as a six-week launch for a learner who is new to cybersecurity. Keep each session to 45 to 60 minutes and end every one with a "what would an attacker try?" question.

Discussion prompts

Pick one app you use daily. Which part of the CIA triad matters most for it, and why?
What is one threat, one vulnerability and one risk in your own home network?
If a password leaks, what protects you next? Why is multi-factor sign-in a second layer?
Look at the NICE work roles. Which one sounds like you on your best day?

A 4-week starter plan

Week 1: the five core ideas and Step 1. Learner sets up a password manager and multi-factor sign-in.
Week 2: Step 2, Cisco Introduction to Cybersecurity. Discuss one real breach in the news.
Week 3: Step 3, Networking Basics (start). Draw the home network on paper.
Week 4: Step 4, the IBM SkillsBuild badge assessment, or Fortinet NSE 1. Then pick a work role from the NICE catalog and plan the next four weeks. Move on to Hands-on Defense.

Age and level fit

Ages 10 to 12: do Step 1 together, then use the discussion prompts. Skip the sign-ups.
Ages 13 to 17: Steps 1 to 3 with a coach or teacher creating the accounts. IBM badge eligibility for under-18s is not confirmed, so check first.
Adults and career-changers: the full path, then CISA Learning for role-specific depth.