To homelab or not to homelab is not a question
Early on, Hayden told me his favorite interview candidates had Security+ and a homelab. They were folks who proved actionable curiosity and a sense of autonomy.
So that was my baseline. Security+ and a homelab. Easy, two steps. Right?
My first homelab was the stuff of legends. I started with an Ubuntu. I allocated it 4gb RAM and 80gb HDD storage, didn’t bother with the networking, and made a directory with a file. test@test-VirtualBox:~$ Mkdir example
test@test-VirtualBox:~$ cd example
test@test-VirtualBox:~$ touch file1.txt
I’d created a file without right clicking, truly remarkable stuff. From there, I was told to dig into logs and active processes.
test@test-VirtualBox:~$ cat ./var/log/syslog
I closed the terminal. Tried the other bit.
test@test-VirtualBox:~$ top
I closed that terminal. Tried another angle.
test@test-VirtualBox:~$ top | head 20
I left it open, but was thoroughly baffled. That’s where I was in month 1, but I had a feeling that wasn’t it.
So I looked around. Every homelab post was about the same thing, “security detection homelab 101” or “top 10 homelab projects for beginners”. But the content was wildly different.
Some folks started at networking, some at installations. Some didn’t seem to find any issue with SIEM configuration, while others preferred labs that looked directly into the log sources, no SIEM. What do you do? Who do you trust?
That’s when I took a break and researched. For about 3 months, all I did was research. Yes, it’s helpful to set things up and break them. Everyone says, “I broke my system and that’s how I learned,” yeah that’s learning, but what was the focus? Sysadmin, security engineer, or SOC analyst?After my 3 month research + Tryhackme stint, I built again. But when you learn concepts from pre-built labs, you get an idea that it’s no big deal, you just do the thing (see: LinkedIn).
But it kinda is a big deal. And computers aren’t so gracious to just let you “do the thing”. Then I wrote another LinkedIn about my sufferings and hit the drawing board. But at this point, four months after Hayden’s talk of interviewees, it hit me.
I’ve done all this before. I studied rock drums, then jazz drums, then classical percussion, piano, guitar, vocals… but I wasn’t learning the instruments, really, I was learning the art of mastery and project planning. What does any successful project start with? Scope.
So I started a Google Doc labeled “Planning Cybersecurity Homelabs”. Every question, piece of research, interesting thought, and hot take got dumped there. How was I to define scope on a project that was mentally framed as “The next 40 years of my professional life” and informed by “Top 10 homelab projects for beginners”?Now, 7 months into homelab, I realized what SOC Analysis is. It’s investigative work that requires niche hard-skills, actionable curiosity, and autonomous problem-solving. So I defined:
Target role
Skill gap
Learning objectives
Minimum environment
Observable evidence
Final Deliverable
With my planning doc reorganized, I learned 3 key points.
#1: Sometimes you gotta switch gears. The first project I needed was one that showed an understanding of SIEM investigations and documentation. I didn’t need it at scale. I needed it done. So I used pre-built logs and dedicated a VM to a trial of Splunk. What was I doing in the months prior? Configuring SIEMs, troubleshooting telemetry, etc– all on the backburner so that I had at least one deliverable.#2: You start where you start.
And I started at absolute 0. My basis for Cybersecurity was a 120wpm typing speed and a music degree. This means my new homelab 3.0 projects are not “15-step APT recreation + DFIR writeup”– no, they’re monitoring for suspicious logons and lateral movement.
#3: You don’t learn everything in homelab. Homelab is where you show everything you’ve learned. If your education looks like 10 hours out of homelab and 1 in, you’ve got it right.
This might mean a month of dedicated Tryhackmes to better understand tools, two months of studying for a certificate that will give you the background necessary to plan your scope– that’s why we have our “Planning Cybersecurity Homelabs” doc.
The title of this article is “to homelab or not to homelab is not a question” because it isn’t a question. It’s hundreds of questions. Hundreds of questions that you put in a Google Doc and very slowly answer or realize that they don’t fit your scope. Homelab is not always a VM. It’s not always an exercise. It’s not always a writeup. Most of the time, homelab is a living process that encapsulates your expertise and acts as a vessel for both your learning process and product. So don’t procrastinate homelabs. Reframe them.
To homelab or not to homelab is not a question.
