Skip to main content

600 - Security and Privacy

600 - References for Security and Privacy

  • Foundational Concepts
    • Information security - The practice of protecting information by mitigating information risks
    • Vulnerability - A weakness which can be exploited by a threat actor
    • Threat - A potential negative action or event facilitated by a vulnerability
      • Malware - Any software intentionally designed to cause disruption to a computer, server, client, or computer network
        • Ransomware - A type of malware from cryptovirology that threatens to publish the victim's personal data or perpetually block access to it unless a ransom is paid
      • Social engineering - The psychological manipulation of people into performing actions or divulging confidential information
        • Phishing - A type of social engineering where an attacker sends a fraudulent message designed to trick a person into revealing sensitive information
        • Business email compromise (BEC) - A type of phishing attack in which an attacker impersonates a high-level executive and attempts to trick an employee or customer into transferring money or sensitive data
  • Key Regulations and Standards
    • Laws & Regulations
    • Security & Privacy Frameworks
      • NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations
        • AC - Access Control
        • AT - Awareness and Training
        • AU - Audit and Accountability
        • CA - Assessment, Authorization and Monitoring
        • CM - Configuration Management
        • CP - Contingency Planning
        • IA - Identification and Authentication
        • IR - Incident Response
        • MA - Maintenance
        • MP - Media Protection
        • PE - Physical and Environmental Protection
        • PL - Planning
        • PM - Program Management
        • PS - Personnel Security
        • PT - Personally Identifiable Information Processing and Transparency
        • RA - Risk Assessment
        • SA - System and Services Acquisition
        • SC - System and Communications Protection
        • SI - System and Information Integrity
        • SR - Supply Chain Risk Management
      • NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
      • ISO/IEC 27001: Information security, cybersecurity and privacy protection — Information security management systems (ISMS)
      • ISO/IEC 27002: Information security, cybersecurity and privacy protection — Information security controls
      • ISO/IEC 27018: Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
    • Industry & Audit Standards
    • Hardening & Implementation Guides
  • Vulnerability Management & Reporting
  • Security Hardware
    • TPM (Trusted Platform Module) - An international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys

610 - Secure Software Development

  • Foundational Principles & Frameworks
    • Secure Software Development Framework (SSDF) - A set of fundamental, sound, and secure software development practices based on established secure software development practice documents
    • OWASP Application Security Verification Standard (ASVS)
    • OWASP Cheat Sheet Series
    • NIST SP 800-207: Zero trust architecture (ZTA)
      • All data sources and computing services are considered resources.
      • All communication is secured regardless of network location.
      • Access to individual enterprise resources is granted on a per-session basis.
      • Access to resources is determined by dynamic policy and may include other behavioral and environmental attributes.
      • The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
      • All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
      • The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture.
  • Software Supply Chain Security
    • SLSA framework - A specification for describing and incrementally improving supply chain security
    • in-toto - A framework to secure the integrity of software supply chains
  • Threat modeling - A process by which potential threats can be identified, enumerated, and prioritized from a hypothetical attacker's point of view
    • STRIDE model - A mnemonic for categorizing computer security threats into six categories
      • Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
    • MITRE ATT&CK - A globally-accessible knowledge base of adversary tactics and techniques
      • Tactics: The high-level objectives or goals that an adversary aims to achieve during an attack.
      • Techniques: The specific methods or ways adversaries achieve their tactical objectives.
      • Procedures: The specific implementations or variations of techniques that adversaries utilize in their operations.
    • Tools
      • OWASP Threat Dragon - A free, open-source, cross-platform threat modeling application
      • threatspec - An open source project that helps you to add threat modeling to your software development lifecycle
  • Attack Simulation Tools
    • Evilginx - A man-in-the-middle attack framework used for phishing login credentials along with session cookies

620 - Identity and Access Management

  • Integrated IAM - The organizational and technical processes for first registering and authorising the identity and the access rights associated with it
    • FusionAuth CE - A free, self-hosted version of FusionAuth that you can deploy anywhere
    • KeyCloak - An open source Identity and Access Management solution aimed at modern applications and services
    • FreeIPA - An integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System)
    • Microsoft Entra ID - A cloud-based identity and access management service that helps your employees sign in and access apps and resources
    • AWS IAM - A service that helps you securely control access to AWS resources
      • AWS Security Token Service (STS) - A web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users)
    • Amazon Cognito - A service that lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily
    • Auth0 - A flexible, drop-in solution to add authentication and authorization services to your applications
    • Athenz - An open source platform for X.509 certificate-based service authentication and fine-grained access control in dynamic infrastructures
    • System for Cross-domain Identity Management (SCIM) - A standard for automating the exchange of user identity information between identity domains, or IT systems
  • Directory service - A software system that stores, organizes, and provides access to directory information
    • LDAP - An open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network
    • OpenLDAP - A free, open source implementation of the Lightweight Directory Access Protocol (LDAP)
    • 389 Directory Server - A full-featured, open source LDAPv3 compliant server
  • Authentication - The act of proving an assertion, such as the identity of a computer system user
    • Basic authentication - A method for an HTTP user agent (e.g. a web browser) to provide a user name and password when making a request
    • JSON Web Token (JWT) - A proposed Internet standard for creating data with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims
    • TOTP (Time-Based One-Time Password)
      • PyOTP - The Python One-Time Password Library
    • OpenID Connect - A simple identity layer on top of the OAuth 2.0 protocol
      • Dex - A Federated OpenID Connect Provider
    • SAML (Security Assertion Markup Language) - An XML-based framework for communicating user authentication, entitlement, and attribute information
    • WS-Federation - A specification that defines how to request and receive security tokens from web services, and how to manage trust relationships
    • FIDO2 (Fast Identity Online 2) - The overarching term for a set of specifications that enables users to leverage common devices to easily authenticate to online services in both mobile and desktop environments
      • Relying party - The website or online service that wants to verify a user's identity (e.g., your bank's website)
      • Authenticator - The device or software that securely stores cryptographic keys and performs authentication for the user.
      • Client - The software on the user's device, typically a web browser or operating system component, that communicates between the Relying Party and the Authenticator.
      • WebAuthn - An API for accessing Public Key Credentials
      • CTAP - A protocol that enables an external authenticator to communicate with a client platform
      • Passkeys - A phishing-resistant replacement for passwords
    • SPIFFE (Secure Production Identity Framework For Everyone) - A set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments
      • SPIRE (SPIFFE Runtime Environment) - A production-ready implementation of the SPIFFE APIs that performs node and workload attestation in order to securely issue SVIDs to workloads
    • Kerberos - A network authentication protocol
      • MIT Kerberos - An implementation of the Kerberos network authentication protocol
    • Firebase Authentication - A service that provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app
    • Supabase Auth - An open source Firebase alternative
  • Authorization - The function of specifying access rights/privileges to resources related to information security and computer security in general and to access control in particular
    • Access control list (ACL) - A list of permissions associated with a system resource (object)
    • Role-based access control (RBAC) - A policy-neutral access-control mechanism defined around roles and privileges
      • Azure RBAC - A system that enables fine-grained access management of Azure resources
        • Security principal kinds: User, Group, Service Principal, Managed Identity
      • Entra ID RBAC - A system that provides fine-grained access management of Microsoft Entra resources
    • OAuth 2.0 Authorization Framework - The industry-standard protocol for authorization
      • Resource owner - the user who owns the data or resources that are being accessed
      • Resource server - the server that hosts the protected resources
      • Client - an application or service that wants to access the resources on behalf of the resource owner
      • Authorization server - the server that issues access tokens to the client
    • Permify - An open-source authorization service that helps you to create any kind of authorization system easily with its panel and API
    • Azure Shared Access Signature (SAS) - A signed URI that points to one or more storage resources and includes a token that contains a special set of query parameters
    • Linux Fine-grained Access Control
      • Linux capabilities - The distinct units into which the privileges traditionally associated with the superuser are divided
    • Linux Mandatory Access Control
      • SELinux - A mandatory access control (MAC) security system for the Linux operating system
      • AppArmor - An effective and easy-to-use Linux application security system

630 - PKI and Secure Communications

640 - Static Security Check

  • Static application security test (SAST)
  • System configuration check
    • OpenSCAP - A collection of open source tools for implementing and enforcing this standard
    • Lynis - A battle-tested security tool for systems running Linux, macOS, or Unix-based operating system
    • Trivy - A comprehensive and versatile security scanner
    • checkov - A static code analysis tool for scanning infrastructure as code (IaC) files for misconfigurations
    • Haskell Dockerfile Linter
    • kube-score
    • kubesec
    • PSRule - Build test and governance controls for Infrastructure as Code (IaC)
  • Cloud security posture management (CSPM)
  • Secret detection
  • Software composition analysis (SCA)
    • Syft - A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems
    • OWASP CycloneDX format
    • SPDX format
    • Feluda - A Rust-based command-line tool that analyzes the dependencies of a project, notes down their licenses, and flags any permissions that restrict personal or commercial usage
  • Vulnerability scanning
    • Trivy
    • Grype - A vulnerability scanner for container images and filesystems. Easily install the binary to try it out
    • Safety - A Python dependency vulnerability scanner
    • Clair - An open source project for the static analysis of vulnerabilities in application containers (currently including OCI and docker)
    • GitLab Container Scanning

650 - Runtime Protection

660 - Other Security Tools

670 - Cryptography