Overview
"Cybersecurity" is a large field made of several specialized areas, often called domains. Knowing the domains helps you see where a given task fits and which skills it needs. This lesson gives you a map of the major domains you will encounter.
Learning objectives
- Name the major domains of cybersecurity.
- Explain what each domain is responsible for.
- Locate the paths in this curriculum within that map.
Core concept
A widely used reference is the set of knowledge areas from professional frameworks such as (ISC)²'s CISSP Common Body of Knowledge and the NICE Workforce Framework for Cybersecurity (NIST SP 800-181). While the exact groupings differ between frameworks, the practical domains most learners meet are:
- Security and risk management — governance, policy, compliance, and deciding what risk is acceptable.
- Asset security — classifying and protecting data and equipment across its life cycle.
- Network security — protecting data as it moves between systems.
- Identity and access management (IAM) — making sure the right people (and services) have the right access, and no more.
- Application/software security — building and testing software that resists abuse.
- Security operations — day-to-day monitoring, detection, and incident response (the "blue team").
- Offensive security / security testing — authorized attempts to find weaknesses before real attackers do (the "red team").
How it works
These domains overlap constantly. Investigating one suspicious login touches IAM (whose account?), network security (where did it connect from?), and security operations (how do we detect and respond?). Strong practitioners are deep in one or two domains and literate in the rest.
Cybersecurity relevance
The learning paths here map directly onto these domains: Networking and Linux build the technical foundation; Web Security, Ethical Hacking, and Bug Bounty are offensive testing; SOC & Blue Team is security operations; OSINT is a reconnaissance skill used across many domains.
Common mistakes
- Thinking the domains are rigid silos. Real incidents cut across all of them.
- Chasing the "offensive" domains while skipping foundations. You cannot attack or defend a network you do not understand.
Key takeaways
- Cybersecurity splits into overlapping domains such as risk management, network security, IAM, application security, security operations, and offensive testing.
- Every practical task usually touches more than one domain.
- This curriculum's paths each correspond to one or more domains.
Check your understanding
- Which domain owns "resetting a compromised user's password and reviewing what they could access"?
- Which two domains would a web application penetration test most directly involve?