# Security from Zero — Week 1 workbook

Goal: understand the job, observe your own Windows PC, and write a one-page note.
Keep raw observations private. Publish only a reviewed, redacted copy.

## 1. Find the role

Collect five recent entry-level job descriptions where you can work.

| Role and employer | URL and date checked | Required / preferred skills | Language, shifts, location, eligibility |
| --- | --- | --- | --- |
| 1 | | | |
| 2 | | | |
| 3 | | | |
| 4 | | | |
| 5 | | | |

Repeated skills:
My next three study priorities:
Evidence I already have:
Skills I still need to demonstrate:

## 2. Observe

Environment: Windows version / browser and version:
Date, time and time zone:

- Lab A: whoami, hostname, ipconfig, nslookup example.com.
- Lab B: Task Manager → Details; tasklist; filter your own observed PID; netstat -ano.
- Lab C: example.com → Inspect → Network → reload → request → Headers.

| Question | Observation and source | Time and time zone | What it supports | What it does not establish |
| --- | --- | --- | --- | --- |
| Which account and device? | | | | |
| Which local address and gateway? | | | | |
| Which DNS answer? | | | | |
| Which process and connection? | | | | |
| Which web request and response? | | | | |

If you observe no match or a failure, record that. Do not copy the lesson’s illustrative values as your results.

## 3. Write one page

Title: Observing normal activity on my Windows PC
Question:
Environment and method:
Evidence: two or three annotated observations:
Interpretation:
Limits:
Next check and why:

Before sharing:
- [ ] I completed the steps myself and can repeat them.
- [ ] I recorded the date, time zone and sources.
- [ ] Facts, interpretations and unknowns are separate.
- [ ] Names, device details and network values are consistently redacted.
- [ ] No cookies, credentials, tokens, private work data or signed-in HAR exports are included.
- [ ] I describe this as a personal learning exercise, not employment or a real incident.
- [ ] I can explain event vs alert vs incident, process vs program, and IP vs port vs URL.

Lesson: https://secopsnomad.si/blog/security-from-zero-01-blue-team-and-study-plan/