I work as the team lead on the IT Security team where I work. I have close to 8 years of experience in cybersecurity.
Recently a junior engineer joined my team. He changed IT domains from development to cybersecurity, having previously worked as a developer for 3 years. He has worked with some tools that are also widely used in security field such SonarQube or Nessus, but only in his previous role as a developer.
The engineers on my team are responsible for conducting penetration testing of applications, company network, firewalls etc. As planning before pen testing is extremely important, today I was reviewing with him the OSI model and its 7 layers , and exploring the various attack methods that a bad actor could use at each layer.
Abstract concepts such network port to port communication streams, hashing input and output representation , and encryption keys intricacies seem to be very difficult for him to grasp. I drew pictures which helped only to a limited extent. The new team member still had some confusion even I explained these concepts using alternative phrasing.
For someone new to an IT domain, how could I explain abstract concepts in my work domain so to be easier to understand for a newcomer?