farhanashrafdev/90DaysOfCyberSecurity: A 90-Day Structured Cybersecurity Plan

farhanashrafdev/90DaysOfCyberSecurity: A 90-Day Structured Cybersecurity Plan

Introduction

Breaking into cybersecurity presents a familiar paradox: the field demands broad technical competence across networking, systems, scripting, and offensive security, yet newcomers struggle to find a coherent path through the noise of scattered tutorials and certification prep materials. Self-learners often stall at the "what do I study today?" stage, cycling through disconnected resources without building cumulative expertise. The 90DaysOfCyberSecurity repository directly addresses this fragmentation with a day-by-day curriculum that spans 95 days of structured learning—from Network+ fundamentals through resume preparation and job applications. With 17,634 GitHub stars, 2,003 forks, and an active maintenance record (last commit March 14, 2026), this MIT-licensed project has emerged as one of the most starred open-source cybersecurity roadmaps available. This article examines what the plan actually covers, who benefits most from its structure, and how to extract maximum value from its daily modules without getting lost in the breadth of topics.

What is farhanashrafdev/90DaysOfCyberSecurity?

90DaysOfCyberSecurity is a self-paced, open-source study plan maintained by Farhan Ashraf and a small contributor community (7 documented contributors). It belongs to the cybersecurity education/curriculum category—not a tool or framework in the conventional sense, but a structured knowledge product delivered through GitHub's native documentation format. The repository's core artifact is its README.md and accompanying learn.md, which partition cybersecurity fundamentals into daily assignments with explicit resource links, video playlists, and hands-on lab recommendations.

The plan's relevance stems from its pragmatic scope compression: it attempts to cover what typically requires 6-12 months of unstructured study into 90 days of focused daily work. The curriculum explicitly targets CompTIA Network+ and Security+ certification preparation, Linux proficiency, Python^{↗ Bright Coding Blog} scripting for security automation, traffic analysis with Wireshark and Suricata, SIEM fundamentals via the ELK stack, cloud platform exposure (GCP, AWS^{↗ Bright Coding Blog}, or Azure), and introductory penetration testing. The repository's 17,634-star count indicates substantial community validation, though stars on educational repositories typically reflect bookmarking behavior rather than completion rates. The MIT license permits unrestricted adaptation—organizations or educators could fork and customize the curriculum for cohort-based delivery.

Notably, the repository's primary language is marked "Unknown" in GitHub's classification, reflecting its documentation-native structure without substantial code. This is accurate: the value proposition is curation and sequencing, not executable software.

Key Features

Day-Level Granularity with Modular Topics

The plan divides into 11 topic blocks ranging from 7 to 14 days each. Days 1-7 cover Network+ concepts via Professor Messer's N10-009 playlist; Days 8-14 address Security+ through Messer's SY0-701 or Pete Zerger's alternative playlist; Days 15-28 dedicate 14 days to Linux fundamentals through Linux Journey, Cisco NetAcad's Linux Unhatched, and LabEx hands-on labs. This granularity prevents the paralysis of undefined scope—each day has predetermined content.

Multi-Modal Resource Curation

Each module combines video instruction (YouTube playlists), interactive tutorials (Codecademy, Git Immersion, Learn Git Branching), documentation references (Python.org, Elastic.co), and hands-on platforms (Hack The Box, VulnHub, AWS Cloud Quest, Google Cloud Skills Boost). The Git module (Days 57-63) exemplifies this: it layers Codecademy's structured course, Git Immersion's narrative tutorial, Try Git's quickstart, and Learn Git Branching's visual CLI simulator.

Explicit Certification Alignment

The Network+ and Security+ modules directly reference current exam objectives (N10-009, SY0-701) through Professor Messer's widely-used free video series. This isn't incidental—the README states the goal of developing "technical skills necessary for certifications such as CompTIA Network+ and Security+."

Career Transition Support

Days 91-95 extend beyond technical content into resume construction (with template links from BowTiedCyber, Indeed, and Resume-Now) and job search mechanics (Indeed, LinkedIn). This acknowledges that technical competence without presentation and distribution fails to convert to employment.

Cloud Platform Flexibility

Days 71-77 offer parallel tracks for GCP, AWS, or Azure rather than mandating vendor lock-in, with each path providing getting-started documentation, official tutorials, and gamified labs (Google Cloud Skills Boost, AWS Cloud Quest, Microsoft Learn sandbox environments).

Use Cases

Aspiring Security Professionals Without Formal Training

The stated primary audience—"aspiring cybersecurity professionals preparing for entry-level roles or certifications"—matches the plan's zero-prerequisite design. The daily structure substitutes for the external accountability of formal education. Someone transitioning from retail, military service, or unrelated IT support can follow the sequence without constructing their own curriculum.

IT Professionals Pivoting to Security

The README explicitly identifies "IT professionals transitioning into a security-focused career" as intended users. For a systems administrator with Linux and networking experience but no security specialization, Days 8-14 (Security+), 43-56 (Traffic Analysis), and 85-90 (Hacking) provide targeted gap-filling without redundant foundational work.

Developers and DevOps^{↗ Bright Coding Blog} Engineers Expanding Security Literacy

The plan's inclusion of Git (Days 57-63), Python (Days 29-42), and cloud platforms (Days 71-77) creates natural entry points for developers whose existing skills overlap with these modules. A DevOps engineer already using Git and AWS might compress Days 57-77 and focus on Network+, Security+, and the hacking modules.

Bootcamp Instructors and Mentors

The MIT license and modular structure enable adaptation for cohort-based programs. An instructor could fork the repository, replace certain video resources with proprietary content, and maintain the day-by-day progression. The contributor guidelines explicitly welcome "mentoring" and "hosting study sessions" as contribution categories.

Self-Learners Requiring External Structure

The README acknowledges "self-learners seeking a structured and comprehensive study plan" as a core audience. The 90-day container creates commitment device psychology—finite duration, visible progress markers, and daily checkboxes.

Installation & Setup

90DaysOfCyberSecurity requires no software installation—it is a documentation repository. However, effective use demands environment preparation for hands-on modules. The README implies but does not explicitly detail setup; based on the prescribed resources, learners should prepare:

Core Environment Setup

# Clone the repository for local reference and progress tracking
git clone https://github.com/farhanashrafdev/90DaysOfCyberSecurity.git
cd 90DaysOfCyberSecurity

# Optional: fork to track personal modifications or contributions
git remote add my-fork https://github.com/YOUR_USERNAME/90DaysOfCyberSecurity.git

Linux Module Preparation (Days 15-28)

The curriculum references three Linux learning environments. LabEx provides browser-based terminals; Cisco NetAcad requires free account creation; Linux Journey runs in any browser. No local VM is mandatory, though learners may prefer local practice:

# Optional: local Ubuntu VM via multipass (not in README; common practitioner approach)
multipass launch --name cybersec-linux --cpus 2 --mem 4G --disk 20G
multipass shell cybersec-linux

Python Module Preparation (Days 29-42)

Codecademy provides browser-based execution; local Python installation enables offline practice:

# Verify Python installation for local exercises
python3 --version
# Expected: Python 3.8+ (HackerRank and Real Python examples)

# Create isolated environment for security scripting practice
python3 -m venv ~/cybersec-python
source ~/cybersec-python/bin/activate

Git Module Preparation (Days 57-63)

Git installation precedes the interactive tutorials:

# Verify Git installation
git --version

# Configure identity (required before repository operations)
git config --global user.name "Your Name"
git config --global user.email "your.email@example.com"

ELK Module Preparation (Days 64-70)

The Logz.io tutorial and Elastic documentation reference cloud-hosted and self-managed deployments. Local experimentation requires Docker^{↗ Bright Coding Blog} or native installation; the README does not prescribe a specific path.

Hacking Module Preparation (Days 85-90)

Hack The Box and VulnHub require VPN connectivity and VM infrastructure. The README links to these platforms without setup instructions—learners must independently configure VirtualBox/VMware and VPN clients.

Real Code Examples

The 90DaysOfCyberSecurity repository contains no executable code in its README—the value is entirely in documentation and resource linking. This section reflects the actual content rather than inventing examples. The "code" learners encounter comes from the prescribed external platforms.

Git Branching Visualization (from Learn Git Branching reference)

The README links to Learn Git Branching as an "interactive Git CLI simulator." This tool presents visual exercises like:

# Example exercise from Learn Git Branching (not in README; representative of linked resource)
git commit
git branch feature
git checkout feature
git commit
# Visualizer shows branch divergence and commit graph

The README's value is identifying this specific tool among dozens of Git tutorials—its interactive visualization addresses the common beginner confusion about branch topology.

Python Practice Pattern (implied by HackerRank reference)

Days 29-42 link to HackerRank's Python domain. Typical exercises there include:

# Representative HackerRank-style exercise (not in README; category-typical)
def analyze_logs(log_entries):
    """Count failed login attempts per IP—foundational security scripting."""
    from collections import Counter
    failed = [entry.split()[0] for entry in log_entries if "FAILED" in entry]
    return Counter(failed).most_common(5)

The README does not provide this code—it points to HackerRank's structured problem sets. Learners seeking Python-for-security specificity must supplement with [INTERNAL_LINK: python-security-automation] resources.

Wireshark Filter Syntax (implied by Traffic Analysis module)

Days 43-56 reference Wireshark University and TCPdump tutorials. Practitioner-typical filters learners encounter:

# TCPdump filter for suspicious port scanning (representative of DanielMiessler tutorial content)
sudo tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'

# Wireshark display filter for DNS exfiltration detection
udp.port == 53 and frame.len > 512

The README's TCPdump tutorial link (danielmiessler.com/study/tcpdump/) covers this syntax explicitly.

Advanced Usage & Best Practices

Compress Known Material, Don't Skip Sequentially

Experienced IT professionals should audit Days 1-14 (Network+/Security+) with practice exams rather than full video consumption. The README's modular design permits this—certification objectives provide self-assessment benchmarks. However, resist skipping Linux (Days 15-28) or Python (Days 29-42) entirely; security-specific applications of these fundamentals differ from generalist usage.

Parallelize Cloud Platform Exposure

Days 71-77 structure cloud as single-platform selection. Practitioners should complete primary platform labs, then return to alternatives—modern security roles routinely encounter multi-cloud environments. The Google Cloud Skills Boost, AWS Cloud Quest, and Microsoft Learn sandboxes all offer free tier access.

Document Progress in Forked Repository

The MIT license permits modification. Maintain a personal fork with completion dates, notes on resource quality, and supplemental links. This creates demonstrable evidence of structured learning for job applications—more compelling than "studied cybersecurity" on a resume.

Supplement ELK with Contemporary Alternatives

Days 64-70 focus on ELK (Elasticsearch, Logstash, Kibana). While foundational, security operations increasingly use Elastic's newer integrations or alternatives like Splunk, Datadog, or cloud-native solutions (Google Chronicle, AWS Security Lake). Treat ELK as SIEM concept introduction, not terminal expertise.

Engage Contributor Community for Accountability

The repository's contribution categories include "Community Support" and "Mentoring." Active GitHub Issues or Discussions participation creates external accountability beyond solitary study. The 7 documented contributors suggest manageable community scale—responses are feasible.

Comparison with Alternatives

90DaysOfCyberSecurity distinguishes itself through explicit temporal structure and zero cost barrier—alternatives either lack day-level granularity or require payment. However, it provides no hosted infrastructure; learners must independently configure VMs, VPNs, and lab environments that TryHackMe or PentesterLab supply. The trade-off is autonomy versus convenience.

FAQ

Is prior experience required?

No. The README states "No prior experience is required, though basic familiarity with computers, networks, or programming will be helpful."

How current are the certification references?

Network+ references N10-009; Security+ references SY0-701. Verify CompTIA's current exam versions as these update periodically.

Can I complete this while working full-time?

The 95-day structure implies ~1-2 hours daily. The README does not specify time estimates; individual module duration varies significantly.

Is the MIT license permissive for commercial use?

Yes. MIT permits commercial use, modification, and distribution with attribution. Fork for internal training programs freely.

What if I get stuck on a specific day?

The repository accepts "Community Support" contributions and "Bug reports." Open a GitHub Issue or engage existing discussions.

Are the cloud modules sufficient for certification?

No. Days 71-77 provide foundational exposure only. Cloud security certifications (CCSP, AWS Security Specialty) require substantially deeper preparation.

Why does GitHub show "Unknown" primary language?

The repository contains documentation without substantial code files. This is accurate classification.

Conclusion

farhanashrafdev/90DaysOfCyberSecurity delivers exactly what its 17,634 stars suggest: a credibly structured, zero-cost entry point into cybersecurity fundamentals without the fragmentation that stalls most self-directed learners. It is not a substitute for hands-on platform experience, certification exam fees, or mentorship relationships—but it eliminates the "what next?" decision fatigue that derails many transitions. The plan best serves disciplined beginners and structured learners who benefit from external scheduling, IT professionals with adjacent skills seeking efficient gap-filling, and educators needing MIT-licensed curriculum foundations to customize. Its limitations are explicit: no hosted labs, no instructor feedback, no job placement guarantees. For learners prepared to supplement daily assignments with community engagement and independent environment configuration, the repository provides rare coherence in cybersecurity self-education. Start at https://github.com/farhanashrafdev/90DaysOfCyberSecurity, fork for personal tracking, and commit to the 95-day structure with the understanding that completion—like most open-source value—depends on your execution rather than the tool itself.