Cybersecurity from Scratch

NOTICE — Sources and References ​

This repository contains personal study notes written by the author in their own words. It draws on the sources listed below. Every effort has been made to summarize ideas rather than reproduce copyrighted expression, and to cite third-party sources with their own copyright status intact.

If you are a rights-holder and believe any content here exceeds fair use / fair dealing, please open an issue on the repository and the material will be reviewed and, where appropriate, revised or removed.

How this repository uses its sources ​

  • Public-domain primary sources (US Government works: NIST, CISA, CERT/CC advisories, FTC guidance, US-CERT) — freely cited and summarized.
  • Openly-licensed material (OWASP under Creative Commons, RFCs under the Trust License) — freely cited, summarized, and where helpful, short excerpts included with attribution.
  • Freely-published corporate whitepapers (vendor research made publicly available for download without gating) — ideas summarized in the author's own words, with citation. No verbatim reproduction of substantial expression.
  • Industry reports (Verizon DBIR, IBM Cost of a Data Breach, Ponemon) — statistics cited as fact with attribution to the report, its year, and its publisher. Facts and statistics are not copyrightable.
  • News reporting on well-known security incidents (Target 2013, SolarWinds 2020, NotPetya 2017, etc.) — summarized from public reporting; no verbatim reproduction.
  • Educational material from online courses — used only as a study aid for the author. Course content itself is not reproduced; no lecture transcripts, slides, images, or verbatim passages appear in this repository. Concepts are re-explained in the author's own words, cross-referenced against public primary sources wherever possible.

Primary sources referenced across the curriculum ​

Standards, frameworks, and government publications ​

  • NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments.
  • NIST SP 800-37 Rev. 2 — Risk Management Framework for Information Systems and Organizations.
  • NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations.
  • NIST SP 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management.
  • NIST SP 800-161 Rev. 1 — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
  • NIST SP 800-218 — Secure Software Development Framework (SSDF).
  • NIST Cybersecurity Framework (CSF) 2.0.
  • NIST — Best Practices in Cyber Supply Chain Risk Management — Conference Materials (Jon Boyens et al.).
  • CISA — Known Exploited Vulnerabilities Catalog, and various Emergency Directives and Cybersecurity Advisories.
  • CERT/CC — Insider-threat research and definitions from Carnegie Mellon University's CERT Coordination Center.
  • ENISA — Various threat-landscape and supply-chain publications.
  • US Executive Order 14028 — Improving the Nation's Cybersecurity (2021), including SBOM requirements.
  • EU Cyber Resilience Act (CRA) — regulatory text.
  • EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679.
  • EU NIS2 Directive — Directive (EU) 2022/2555.
  • EU DORA — Regulation (EU) 2022/2554 (Digital Operational Resilience Act).
  • ISO/IEC 27001 and ISO/IEC 27002 — Information security management systems and controls.
  • ISO/IEC 27036 — Information security for supplier relationships.
  • PCI DSS v4.0 — Payment Card Industry Data Security Standard.
  • HIPAA Security Rule — 45 CFR Part 164, Subpart C.
  • SOX — Sarbanes-Oxley Act (2002).
  • AICPA SOC 2 — Trust Services Criteria.
  • ITAR — International Traffic in Arms Regulations.

OWASP (Creative Commons) ​

  • OWASP Top 10 (2021 and subsequent).
  • OWASP ASVS — Application Security Verification Standard.
  • OWASP SAMM — Software Assurance Maturity Model.
  • OWASP Cheat Sheet Series.
  • OWASP Dependency-Check and Dependency-Track.
  • OWASP Threat Dragon.

Threat-modeling frameworks and methodologies ​

  • STRIDE — Loren Kohnfelder & Praerit Garg (Microsoft, 1999); developed further in The Threat Modeling Manifesto and Adam Shostack's Threat Modeling: Designing for Security (Wiley, 2014).
  • PASTA — Tony UcedaVélez & Marco M. Morana, Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis (Wiley, 2015).
  • LINDDUN — Kim Wuyts et al., DistriNet (KU Leuven).
  • MITRE ATT&CK Framework — MITRE Corporation (available under a permissive license for non-commercial reuse with attribution).
  • Attack Trees — Bruce Schneier, Dr. Dobb's Journal (1999).
  • Security Cards — University of Washington.
  • VAST — ThreatModeler (industry framework).
  • Trike, OCTAVE Allegro — carnegie Mellon / SEI.
  • The Threat Modeling Manifesto (threatmodelingmanifesto.org).

Supply-chain and SBOM ecosystem ​

  • SLSA — Supply-chain Levels for Software Artifacts (OpenSSF).
  • Sigstore — code-signing infrastructure (Linux Foundation).
  • in-toto — supply-chain metadata specification.
  • CycloneDX — SBOM format (OWASP).
  • SPDX — SBOM format (Linux Foundation).
  • CVE and CVSS — MITRE / FIRST.

Industry reports and research ​

  • Verizon — Data Breach Investigations Report (DBIR), annual series (2019-present).
  • IBM Security — Cost of a Data Breach Report, annual series.
  • Ponemon Institute — insider-threat and privileged-access research (multi-year series).
  • Broadcom / CA Technologies — "I Have to Trust Someone… Don't I?" white paper on insider threats.
  • Verizon — Insider Threat Report (2018 and later editions).
  • Symantec / Broadcom — Internet Security Threat Reports.
  • CrowdStrike — Global Threat Reports.

Well-known public incidents referenced as case studies ​

All discussed on the basis of public reporting; only publicly known facts and widely-reported details are included.

  • Atlanta ransomware attack (2018) — SamSam.
  • Target data breach (2013) — HVAC-vendor pivot.
  • Edward Snowden / NSA (2013) — contractor-level access.
  • Terry Childs / San Francisco FiberWAN (2008) — disgruntled network administrator.
  • Hanjuan Jin / Motorola (2012) — trade-secret theft.
  • SolarWinds Orion supply-chain compromise (2020).
  • ASUS Live Update / ShadowHammer (2019).
  • M.E.Doc / NotPetya (2017).
  • Equifax data breach (2017).
  • Colonial Pipeline ransomware (2021).
  • Log4Shell / CVE-2021-44228 (2021).

Books and long-form references ​

  • Bruce Schneier — Secrets and Lies, Applied Cryptography, various essays.
  • Ross Anderson — Security Engineering (3rd edition, Wiley, 2020; chapters available free from the author's website).
  • Adam Shostack — Threat Modeling: Designing for Security (Wiley, 2014).
  • Michael Howard & Steve Lipner — The Security Development Lifecycle (Microsoft Press, 2006).
  • Tony UcedaVélez & Marco M. Morana — Risk Centric Threat Modeling (Wiley, 2015).
  • Gene Kim, Jez Humble, Patrick Debois & John Willis — The DevOps Handbook (IT Revolution, 2016 / 2021).

Regulatory bodies and standards organizations ​

  • NIST — National Institute of Standards and Technology (US).
  • CISA — Cybersecurity and Infrastructure Security Agency (US).
  • ENISA — European Union Agency for Cybersecurity.
  • ISO — International Organization for Standardization.
  • IETF — Internet Engineering Task Force (RFCs).
  • AICPA — American Institute of Certified Public Accountants.
  • PCI SSC — Payment Card Industry Security Standards Council.
  • IAPP — International Association of Privacy Professionals.

Trademarks ​

  • SOC 2® is a registered trademark of the AICPA.
  • ISO® and IEC® are registered trademarks of ISO and IEC.
  • OWASP® is a registered trademark of the OWASP Foundation.
  • MITRE ATT&CK® is a registered trademark of The MITRE Corporation.
  • CISSP® and other (ISC)² certifications are registered trademarks of (ISC)².
  • CISA®, CISM®, and CRISC® are registered trademarks of ISACA.
  • All other trademarks are the property of their respective owners.
  • Use of any trademark in this repository is for identification purposes only and does not imply endorsement.

Contact ​

To report a licensing or attribution concern, open an issue at https://github.com/elena-roff/cybersecurity-program/issues.

Personal learning notes — cybersecurity curriculum.

Content maintained by the author.