Akhbar Yawmiya

💻 Coding

Coding means writing instructions that a computer understands and carries out. It's the foundation of everything in tech: apps, games, websites, and even cybersecurity tools.

A plan to get started

1. Pick one language — we suggest Python: it's easy to read and widely used in cybersecurity, AI and automation.
2. Learn the basics: variables, conditions (if), loops (for and while), functions, and lists.
3. Practice every day, even for 30 minutes: you learn to code by doing, not just by watching.
4. Build small projects: a calculator, a number-guessing game, or a password generator.
5. Learn Git and GitHub: to save and share your projects and build a portfolio.
6. Choose a specialty: web development, game development, data analysis, or cybersecurity.

Your first program: a password strength checker

This Python program combines coding and security — it checks whether a password is strong:

password = input("Enter a password: ")

long_enough = len(password) >= 12
has_digit = any(ch.isdigit() for ch in password)
has_symbol = any(not ch.isalnum() for ch in password)

if long_enough and has_digit and has_symbol:
    print("Strong password ✅")
else:
    print("Weak ❌ Use 12+ characters with numbers and symbols")

You can try it for free without installing anything in Google Colab.

Practice: type the code yourself

Type the code shown into the box next to it, character by character, then press "Check". Typing it yourself teaches you how commands are written faster than copying.

print("Hello, World!")

Hello, World!

name = "Sara"
age = 20
print(name, age)

Sara 20

score = 85
if score >= 50:
    print("You win!")
else:
    print("Game over")

You win!

for attempt in range(3):
    print("Login attempt", attempt + 1)

Login attempt 1
Login attempt 2
Login attempt 3

Resources

• CS50 from Harvard: the world's most popular free introduction to computer science.
• freeCodeCamp: complete free paths for learning web development.
• The official Python tutorial.
• For Arabic speakers: Satr (an Arabic platform for learning to code) and Tuwaiq Academy (tech bootcamps in Saudi Arabia).

🛡️ Cybersecurity

Cybersecurity is protecting devices, networks and data from hacking, theft and sabotage.

The three core principles

The most common attacks

Phishing

Fake messages or websites pretending to be a bank, a company or a game, to steal your details.

Malware

Harmful software that often comes with unknown files, game "hacks" or pirated software, and steals your accounts or spies on you.

Ransomware

Encrypts your files and demands money to give them back.

Social engineering

Tricking the person rather than the system — like a call from "customer support" asking for your verification code.

Password theft

Trying passwords leaked from other sites on your accounts, because many people reuse the same password.

Protect yourself in 6 steps

• Turn on two-step verification for all your accounts, especially email and gaming accounts like Steam, PlayStation and Xbox.
• Use a different password for every site, and a password manager to remember them.
• Never share a verification code (OTP) with anyone, even if they claim to be from your bank or an official body.
• Keep your device and apps updated — updates close security holes.
• Don't download game hacks or pirated software, and don't believe "free in-game currency" offers.
• Keep a backup of your important files.

How does an attacker think?

To protect a system, you need to understand how someone trying to break into it thinks. Most attacks go through similar stages known as the "Cyber Kill Chain", and stopping the attacker at any stage makes the whole attack fail.

1. Reconnaissance: gathers information about the victim from the internet and social media, and looks for exposed devices and services.🛡️ Defense: share less about yourself and your work, and close services you don't need.
2. Weaponization: prepares the attack tool, such as a convincing phishing message or a booby-trapped file.🛡️ Defense: regular updates defeat many ready-made tools.
3. Delivery: sends the tool by email, message, link, or a game "hack".🛡️ Defense: don't open unknown attachments or links, and turn on email filtering.
4. Exploitation: exploits a software flaw or a human mistake to run the malicious code.🛡️ Defense: update your software and use an account with limited privileges.
5. Installation: plants a program that stays on the device even after a restart.🛡️ Defense: security software, and watching for any new program you didn't install.
6. Command & control: the infected device connects to the attacker's server to receive orders.🛡️ Defense: monitor the network — this is where network analysis comes in (below).
7. Actions on objectives: stealing data, encrypting it for ransom, or spying.🛡️ Defense: backups, encrypting important data, and watching for data leaving the network.

Rules of the attacker mindset:

• They look for the weakest link — and it's usually a person, not a device.
• They take the easiest path: a reused password, an unpatched device, or an exposed setting.
• They only need to succeed once, while defenders must succeed every time — which is why we use several layers of protection.
• They exploit urgency, fear and greed: "Your account will be closed in an hour", "Win free in-game currency".

To go deeper: the MITRE ATT&CK framework documents real attacker techniques in detail and is used by defenders worldwide.

Network analysis: see what's happening on your network

Everything you send over the internet is split into small packets, and each packet has a sender address, a receiver address and a port number that identifies the type of service. Network analysis means reading these packets to understand what's happening and spot anything unusual — one of the most important skills for a security analyst.

Commands you can run on your computer now (in the command prompt or terminal):

ping google.com

Does the site respond, and how long does it take?

tracert google.com (on Linux and Mac: traceroute)

The path your data takes through devices to reach it.

nslookup google.com

What is this site's IP address?

netstat -an

All the connections open on your computer right now — the first command used to hunt for a suspicious connection.

Wireshark: a free program that captures network packets and shows them for analysis. After capturing, type a "filter" to show only what matters:

dns

The website names the device looked up.

http

Unencrypted connections, whose content can be read.

tcp.port == 443

Encrypted connections to websites (HTTPS).

ip.addr == 192.168.1.5

Everything involving one specific device.

tcp.flags.syn == 1 && tcp.flags.ack == 0

The start of new connections; lots of them from one address may mean a port scan.

Practice on ready-made files without capturing anything, from the Wireshark sample captures library.

⚠️ Signs worth your attention:

• A device connecting to an unfamiliar address on an unusual port, especially at odd hours like dawn.
• A sudden large upload of data, which may be a leak.
• Many fast connection attempts from one address to different ports: a port scan, i.e. the reconnaissance stage.
• Repeated failed logins: password guessing.
• Lots of DNS lookups for random, strange-looking site names.

Challenge yourself: analyze the connections

How to start a career in cybersecurity

1. Networking basics: how the internet works (IP, DNS and HTTP).
2. Linux and the command line: most security tools run on it.
3. Coding: Python to write your own tools and automate your work.
4. Security concepts: encryption, authentication, and common web vulnerabilities.
5. Hands-on practice on legal platforms (below).
6. A beginner certification such as CompTIA Security+.

Popular specialties include SOC analyst, penetration tester, incident response, cloud security, and governance & compliance.

Legal practice platforms

• TryHackMe: step-by-step interactive lessons, great for beginners.
• picoCTF: free challenges from Carnegie Mellon University.
• OverTheWire: free wargames that teach you Linux and the command line.
• Hack The Box: practice machines for intermediate and advanced levels.

In Saudi Arabia, follow the National Cybersecurity Authority for its programs and guidance.

⚖️ Cyber law

Saudi Arabia's Anti-Cyber Crime Law

Issued by Royal Decree No. M/17 in 1428H (2007), it defines cybercrimes and their penalties (official text from the Bureau of Experts at the Council of Ministers). Each article's penalty is prison, a fine, or both, up to these maximums:

• Attempts are punishable too: anyone who attempts a cybercrime faces up to half the maximum penalty (Article 10).
• Incitement, assistance and conspiracy are also punishable, even if the crime doesn't happen (Article 9).

Personal Data Protection Law

Regulates how personal data is collected and used in Saudi Arabia, supervised by the Saudi Data & AI Authority (SDAIA). Its penalties include up to 2 years in prison and/or a fine of up to SAR 3 million for disclosing or publishing sensitive data to harm its owner or for personal gain, and fines of up to SAR 5 million for other violations.

Other Arab countries

Most Arab countries have similar laws that criminalize hacking, blackmail and online fraud, including:

• UAE: Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes.
• Egypt: Law No. 175 of 2018 on Combating Information Technology Crimes.

At the international level: the International Criminal Court

In December 2025, the Office of the Prosecutor of the International Criminal Court (ICC) issued its Policy on Cyber-Enabled Crimes under the Rome Statute. Its core message: the Rome Statute is "technology-neutral", so genocide, crimes against humanity, war crimes, aggression, and offences against the Court's administration of justice can all be committed or facilitated by cyber means — and their perpetrators will be pursued just like those who use conventional weapons. The Court only deals with the most serious international crimes.

Examples from the policy of acts that may amount to international crimes, if their other conditions are met:

• Hacking power plants, water systems or hospitals in a way that causes civilian deaths.
• Hacking aircraft navigation or air traffic control systems, causing planes to crash.
• Releasing self-spreading malware (such as a worm) that hits military and civilian systems without distinction during an armed conflict.
• Using cyber means to disrupt food, water or humanitarian aid in order to starve civilians during a conflict.
• Directly and publicly inciting genocide on social media, or publishing humiliating images of captives or the dead.
• Threatening the Court's witnesses, spreading deepfake videos against them, or tampering with digital evidence.

• Helpers are responsible too: anyone who uses surveillance or hacking to locate victims, or deletes records to hide a crime, may be prosecuted as an accomplice.
• AI doesn't remove responsibility: a person who uses it as a tool and makes the decisions remains criminally responsible.
• The Court tries individuals only (aged 18 or over), not companies — but company officers and employees can be prosecuted.

Being blackmailed or hacked?

• Don't pay the blackmailer or negotiate with them.
• Keep the evidence: screenshots of messages, accounts and links.
• Change your passwords and turn on two-step verification.
• In Saudi Arabia, report it through the Kollona Amn (كلنا أمن) app or at the nearest police station. Elsewhere, contact your local police or national cybercrime unit.

This page is for awareness only and is not legal advice. Laws can change, so always check the official text or ask a qualified lawyer. Official texts: Anti-Cyber Crime Law and Personal Data Protection Law. Last reviewed: September 2026.