Roadmap
Progress tracker across all five programs. Update this file whenever a submodule is added or completed.
Legend:
[x]— documented[ ]— planned, not yet started[~]— in progress
1. Security Foundations, Governance and Risk
Status: in progress
Module: Security Governance & Compliance
- [x] Introduction to Cybersecurity — CIA/CIAS triad, threats, vulnerabilities, risk, countermeasures, mind map
- [x] Cybersecurity Governance — top-down alignment, precision vs accuracy, CISSP/CISM; precise definitions of threat / vulnerability / risk, risk equation, assets, risk treatments
- [x] Legal and Regulatory Compliance — alignment with law, governance vs control frameworks, NIST CSF, audits, compliance ≠ security; practical playbook anchored in ISO/IEC 27000 family (ISMS, PIMS, cyber-insurance, supply chain)
- [x] Cybersecurity Policies and Procedures — policies (why) → standards (what) → procedures (how); playbooks and SOPs; nine-policy starter set (AUP, ACP, IR, DR, BCP, etc.)
- [x] Future of Cybersecurity Compliance — NIS2, DORA, CRA, EU AI Act, SEC disclosure rules, NIST CSF 2.0, structural shifts
Module: Introduction to Risk Management
- [x] Risk Assessment — anatomy of a risk (asset/vulnerability/threat); quantitative six-step method (AV, EF, SLE, ARO, ALE, cost-benefit); qualitative surveys; hybrid
- [x] Risk Management — four risk responses (mitigate/transfer/accept/ignore); 3 control categories × 6 control types; NIST RMF six-stage cycle
- [x] Threat Modeling — proactive vs reactive; asset/attacker/software approaches; STRIDE; decomposition (trust boundaries, inputs, privileges); prioritization via probability × damage, H/M/L, and DREAD
- [~] Business Continuity Planning — placeholder stub; deep dive planned
Module: Personnel and Third-Party Security
- [x] Overview — module landing, feeds-from / feeds-into map
- [x] 01 · Education, Training, and Awareness — SETA definitions, DBIR statistics, program best practices, social engineering (phishing, pretexting, typosquatting)
- [x] 02 · Personnel Security — employment life-cycle, separation of duties, least privilege, employment agreements, termination, three insider-threat archetypes (Broadcom paper); PIM, Identity Governance, DLP, risk-based auth, virtualization security
- [x] 03 · Vendor Risk Management — SolarWinds/ASUS/NotPetya/Target case studies, 5-step VRM life-cycle, NIST cyber supply-chain best practices
- [x] 04 · Acquisition Strategy — M&A risk, minimum requirements, on-site assessments, software acquisition, regulatory carry-over, vendor lock-in and technical debt
Module: (later modules TBD)
- [ ] TBD
2. DevSecOps and Secure Software Delivery
Status: not started
Modules to be filled in when the program begins.
3. Application Security — OWASP Top 10 and Threat Modeling
Status: in progress
Module: OWASP Top 10 — Web Application Security Risks
- [x] Overview · OWASP Top 10:2025 — history 2003→2025, methodology, 2021→2025 change table
- [x] A01 · Broken Access Control — IDOR, missing function-level authz, deny-by-default, centralized policy engine
- [x] A02 · Security Misconfiguration — hardened defaults, IaC, CSPM, policy-as-code
- [x] A03 · Software Supply Chain Failures — SolarWinds/Log4Shell/XZ, SBOM, SLSA, signed builds
- [x] A04 · Cryptographic Failures — TLS 1.3/HSTS, Argon2id, AEAD, KMS, PQC readiness
- [x] A05 · Injection — SQLi/NoSQL/OS/LDAP/XSS/SSTI/prompt injection; parameterization
- [x] A06 · Insecure Design — abuse cases, ASVS, threat modeling as prevention
- [x] A07 · Authentication Failures — Passkeys/WebAuthn, NIST 800-63B, session hygiene
- [x] A08 · Software or Data Integrity Failures — insecure deserialization, SRI, signature verification at admission
- [x] A09 · Security Logging and Alerting Failures — SIEM, structured logs, alerts with runbooks
- [x] A10 · Mishandling of Exceptional Conditions — fail-closed, timeouts, idempotency, chaos engineering; SSRF absorbed
Module: Threat Modeling Methodologies
- [x] Overview · The 12 Methods and How to Choose
- [x] Manifesto and Four-Question Framework — values, principles, anti-patterns
- [x] STRIDE in Depth — DFDs, per-Element chart, per-Interaction, threat trees, TMT/Threat Dragon/pytm
- [x] PASTA — 7-stage risk-centric framework
- [x] LINDDUN — privacy threat modeling; L·I·N·D·D·U·N; GO/PRO/MAESTRO
- [x] Attack Trees — Schneier 1999; AND/OR; annotated leaves
- [x] Alternative Frameworks — VAST, Trike, OCTAVE, hTMM, PnG, Security Cards, Quantitative TMM, CVSS
- [x] MITRE ATT&CK — tactics/techniques/procedures; D3FEND; threat-informed defense
4. Data Protection, Privacy Engineering and AI Security
Status: not started
Modules to be filled in when the program begins.
5. Responsible AI Engineering
Status: not started
Modules to be filled in when the program begins.
How to update this file
When you start a new submodule:
- Add it under the correct module with
[~]. - Once the note is finished, flip it to
[x]and add the link to the note. - If new modules or programs appear that overlap with existing content, add a short cross-reference under the new item rather than duplicating.