Architecture/ecosystem
- Literally everything by Phil Venables
- The Razor's Edge - Cutting Your TLS Baggage (jschauma)
- Database anonymization for testing (John Cook)
- Incident response team *must* run its own infrastructure
- NIST CSF
- Belfer Center's Cybersecurity Campaign Playbook (election/campaign-specific, but some good general lessons also)
- Security and Privacy in Computer Systems - Willis Ware, RAND, 1967. Prescient.
- Learning from Near Misses (Adam Shostack
- Army War College Campaign Planning Handbook
- Coercion - a problem larger than authentication (the grugq)
- Dropbox's pro-researcher bug-bounty philosophy
- Paranoid Principles (jschauma)
- MITREattack as CSV
- The Anomaly of Cheap Complexity (Halvar Flake)
- Paint by Numbers: Resilience in Security (Kelly Shortridge)
- Device Guard and Application Whitelisting on Windows - An Airing of Grievances (@mattifestation)
- Introduction to logging for security purposes (SCSC/GCHQ)
- Daniel Ellsberg on the Limitations of Knowledge
- Inciteful Gujarat study on re-incentivizing audit
- FIRST Best Practice Guide Library (BPGL)
- Understanding Cyber Conflict: 14 Analogies (Carnegie Endowment, Perkovich & Levite eds)
- The Rational Rejection of Security Advice by Users (Cormac Herley)
- Future Cyberwar (Schneier excerpting Mark Cancian)
- In cyberwar, there are no rules (Why the world desperately needs digital Geneva Conventions.) (Tarah Wheeler)
- Supply Chain Security 101: An Expert’s View (Brian Krebs / Tony Sager)
- Stop using Apache Struts (Chad Loder)
- How to irregular cyber warfare - "Accomplishing one specific goal is hard, but accomplishing any goal is easy." (Rob Graham)
- Disable all crash dumps (John-Mark Gurney)
- A Theory of Information Warfare: Preparing for 2020 (USAF, 1995)
- Manage Insider Risk and Prevent ‘Big Brother’ Perception, Part 3 (OODA)
- Perry Metzger Twitter thread on certs, and computer security as actual warfare
- Misconceptions, Battle Scars, and Growth (Tim MalcomVetter)
- Designing Security for Billions (Facebook)
- Forcing the Adversary to Pursue Insider Theft (Bejtlich)
- Cyber Incident Response and Resiliency in Cities
- Fundamental Drivers of Security Risk (@philvenables)
- Security Program Tactics (@philvenables)
- Left and Right of Boom (@malcomvetter)
- Simple Rules of (InfoSec) Career Success (Phil Venables)
- Classifying Types of Security Work - applying Phoenix Project work types (Ryan McGeehan)
- MITRE ATT&CK Framework
- Your First Month as a CISO: Forming an Information Security Program (Lenny Zeltser)
- MITRE Shield Active Defense Matrix
- Technical Approaches to Uncovering and Remediating Malicious Activity (CISA)
- Raise the Baseline by Reducing the Cost of Control (Phil Venables)
- Hometown Security (CISA)
- Computer Security and the Internet: Tools and Jewels (Paul van Oorschot)
- (Technical) Infosec Core Competencies (@jschauma)
- Stewardship of global collective behavior
- The Actual Cybersecurity Workforce Challenge
- Cybersecurity: The Board's Perspective (Phil Venables)
- Account Takeover Checklist
- Some reasons to measure (Dan Luu - an inspiring take)
- Microsoft Cybersecurity Reference Architectures
- How to ask questions to succeed with security projects (Zeltser
- RFC 1087 - Ethics and the Internet
- Threat Modeling (shellsharks)
Ransomware
Networking / WAN
Risk
- Getting clear about risk (Godin) -
"How much would it cost you (in time, money, effort, distraction) to make yourself ten times less likely to be at risk?"
Monitoring, detection, and hunting
OSINT and general INT
Vulnerability management - reporting, detection, and modeling
Audit
Device inventory and classification
Zero-trust/BeyondCorp
PKI and certificates
Hardening and config management - general
Hardening and config management - mobile
Hardening and config management - web
Hardening and config management - browser
Hardening and config management - Windows
Hardening and config management - Apple
Password and secret management
Media/document cleaning and management
- CIRCLean - USB sanitizer (Pi-based media sanitization station)
- DangerZone (Convert PDF/doc/image to sanitized PDFs)
IR / malware analysis / reverse engineering
AAA
Encryption
Platform-specific
Regulatory compliance
Cloud
IoT
Training
Social engineering / phishing
Management/teams
Personal/individual
National/international/political
Toolkits
- FLARE-VMa fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc. (FireEye)
Bug reporting and bounties
General enterprise (lists)
Measurement and metrics
Meta - threads, summaries, and indexes