Around Cybersecurity in 90 Days

Wed, 01 Jul 2026 00:00:00 +0000

It’s not a post about my personal life, as why would you care? But here I’m talking about a concept that I used to shift from a web development mindset to a cybersecurity one; either for CTFs or work.

Zero Kelvin

CTFs or setting a roadmap wasn’t enough for me at the very beginning, and I, as a person, can’t stick to tight goals, so I just made my own sauce. There was an old Facebook post that I don’t remember but talks about something like “what stops you from moving forward is not seeing what you already accomplished”. So idk, I just decided to write down my own daily accomplishment of anything I do related to cybersecurity.

DeLorean Fuel

It started with pen and paper in 2020 during quarantine, so I had all the time in the world, and I targeted 90 days, hence the name “90 Days of Cybersecurity”, and even if a day I couldn’t do something, I just didn’t count it, and only counted days with at least one thing related to cybersecurity, and “anything” means ANYTHING, like I’d write down handshaking people from the community! (Damn, the old me was really committed to the TCP shit)

Also, the important thing is “write what you accomplished”, not what you wanted to (because then you will stress yourself about the perfect end), for example, not “finished video blabla”, if you just watched the first 5 minutes then “watched 5 minutes of blabla”, reading a good post on LinkedIn, it’s your future fuel, so just feed it.

A sample from the challenge log, May 2021 on Notion

The Secret of 90

Fuck “90”, there is nothing special about it, do 17 days of cybersecurity, or 1 month, who cares?! I just picked that up because of the momentum I had as a passionate student with plenty of time during COVID-19 and summer holidays, and I recently started a 7-week cycle too! But a little bit guided with 3 simple weekly goals which I’m sure with the minimal effort I can achieve, be easy on yourself, you won’t be happy if you set one big goal that you can’t achieve, and we’re counting on stamina here.

Arise

Cybersecurity or not, don’t waste time on making plans, instead take action, it’s pretty enough to know your compass direction and the next step, gamify your learning experience, make time slices out of your journey, see the results at the end of the cycle, no results? Start a new cycle. Yup, that easy.

It’s not a race, it’s a marathon.

Journey to the Center of GCFA (FOR508)

Thu, 18 Jun 2026 00:00:00 +0000

Phew, what a long journey!

I did not want to certify GREM (FOR610), because I wanted something to challenge my mind with, a new knowledge. Sometimes I regretted that decision, but I’m proud of that.

I spent about 15 months on that one, and that’s take #1: don’t overestimate it and get it off your chest as soon as you can.

But honestly, I didn’t take it seriously at first. Like, the first 7 months was just reading the books as if I’m reading a novel, not limiting myself with a deadline, and few events happened in between that made that journey even longer. So I think that could’ve been compressed down to 3 months.

What makes DFIR different from Reverse Engineering mindset?

It’s the freakin’ certainty!

In RE, everything is just straightforward. The assembly instructions won’t have two meanings, you want to know the functionality of a piece of binary, and you just can know it and be certain about it.

On the other hand, that DFIR sh!t is just an assumption after an assumption. I remember very well how the Prefetch/ShimCache/Amcache made me lose it, like WTF? Just tell me, was that binary executed or not!

Eureka moment

A book after the other, it was all clear.

My Eureka moment was timelines, it’s the one thing that makes every puzzle piece fit together and tell a story chronologically!

Some comments on the course

SANS did a pretty good job in making that material, but order of topics is “Meh”, like it could be better.

And you will see a small digital hell in making an index or summary notes, because topics are revisited across books, and sometimes in the same book but different pages, so enjoy *devilish laugh*.

What kind of index is better?

I don’t know, differs from person to person. Some are more comfortable with topics index like in pancakes method, others are with sorted-keywords, and I did that. It’s really something relative.

And by the way, neither I nor my friend used the index that much. Posters, notes, and book tabs did the heavy lifting here.

What would I’ve done if I went back in time?

I would’ve done a better time management, put some certain tight deadlines.

Reading fast in the first pass without highlighting or indexing, solving labs after finishing all books in that first pass.

Then doing a second pass which should be in deep, highlighting books, putting tabs, solving labs again while taking notes, then creating an index.

Then it is time to test that index with just these 2 passes in the practice test, and from the practice test’s insights I should refine that index more, and revise topics I suck at.

Then the third and final pass, which should last only 7-14 days to the final exam.

TL;DR

I hate Microsoft, like, really. The team sucks, and you will see that the more you go deep into internals, you may find a rotten apple inside, and it’s just there for backward compatibility.

That Windows sh!t is confusing as hell, so just be ready for some logic out of the Windows. But apart from that, it’s a rewarding experience and builds a good mindset.

Study on