Computer Security

Secrets are one of the most overlooked risks in modern infrastructure. Secrets at Scale is a practical guide to managing credentials, API keys, certificates and other sensitive data across modern software environments. It gives engineers, DevOps teams, platform teams and security professionals the tools to build secure, scalable secrets management.

Josh saw the shooting outside his college. His AI headset did not let him see the people who carried it out. Three milliseconds earlier, a routine safety update had changed the rules.

Mobile apps handle some of our most sensitive data, making security essential. Mobile Application Security explores how Android, iOS and cross-platform apps are attacked and secured. Covering secure coding, cryptography, reverse engineering and penetration testing, it gives developers, security professionals and students the practical skills to build and assess secure mobile applications.

Go beyond Kotlin and unlock the full power of Android native development with practical NDK projects in security, audio, video, computer vision, and on-device AI.

AI is changing exploit development. Learn how to use large language models with tools like IDA Pro, Ghidra and Binary Ninja to speed up vulnerability research, reverse engineering and proof-of-concept exploit development while understanding where human expertise still matters.

Modern web security goes far beyond the basics. This book covers advanced web attacks including injection flaws, SSRF, API abuse, request smuggling and exploit chaining, plus 2026 topics like React2Shell, HTTP/3, AI-driven attacks, WebAssembly and supply chain compromises. Built for penetration testers, application security engineers and experienced developers.

Every web application has security headers, cookies, TLS configurations, and CORS policies that need to be correct. Most teams find out they're wrong only after a penetration test — or worse, after an incident. This book shows you how to build a scanner that catches these issues automatically. You'll create a Python CLI tool that uses Hurl (declarative HTTP testing) to assert security properties, SSLyze to validate TLS protocol versions, and AI to generate specific remediation for every failure it finds. The output: structured JSON reports, visual HTML dashboards, and AI-generated security posture assessments. **What you'll build:** - 9 declarative Hurl security test files (headers, cookies, CORS, HSTS, CSP, CSRF, redirects, TLS) - A preprocessor that handles domain substitution and authentication - An output parser with built-in remediation guidance for every test - A TLS scanner validating SSL 2.0/3.0 disabled and TLS 1.2/1.3 enabled - An AI analyzer that generates context-specific fixes using Ollama, OpenAI, or Bedrock - An HTML reporter with dark-themed visual dashboards - Docker multi-architecture deployment - CI/CD pipeline with GitHub Actions **Who this is for:** - Developers who want security checks before deploying - DevSecOps engineers building CI/CD security gates - Penetration testers who need quick baseline assessments - Security students learning web vulnerability concepts hands-on - Platform teams enforcing security standards across services Every failure includes: what was expected, what was received, why it matters, how to fix it, and a documentation link. AI adds domain-specific code examples on top.

Every web application has security headers, cookies, TLS configurations, and CORS policies that need to be correct. Most teams find out they're wrong only after a penetration test — or worse, after an incident. This book shows you how to build a scanner that catches these issues automatically. You'll create a Python CLI tool that uses Hurl (declarative HTTP testing) to assert security properties, SSLyze to validate TLS protocol versions, and AI to generate specific remediation for every failure it finds. The output: structured JSON reports, visual HTML dashboards, and AI-generated security posture assessments. **What you'll build:** - 9 declarative Hurl security test files (headers, cookies, CORS, HSTS, CSP, CSRF, redirects, TLS) - A preprocessor that handles domain substitution and authentication - An output parser with built-in remediation guidance for every test - A TLS scanner validating SSL 2.0/3.0 disabled and TLS 1.2/1.3 enabled - An AI analyzer that generates context-specific fixes using Ollama, OpenAI, or Bedrock - An HTML reporter with dark-themed visual dashboards - Docker multi-architecture deployment - CI/CD pipeline with GitHub Actions **Who this is for:** - Developers who want security checks before deploying - DevSecOps engineers building CI/CD security gates - Penetration testers who need quick baseline assessments - Security students learning web vulnerability concepts hands-on - Platform teams enforcing security standards across services Every failure includes: what was expected, what was received, why it matters, how to fix it, and a documentation link. AI adds domain-specific code examples on top.

Threat modeling is broken. It takes days, costs thousands, and most teams skip it entirely. What if your AI coding assistant could do it for you — systematically, consistently, and in minutes? This book shows you how to build an MCP server that makes it happen. You'll create 80+ structured tools that guide any AI assistant through a rigorous 9-phase STRIDE threat modeling workflow. Not vague prompts that produce unstructured text — real, typed, validated tools that build up a complete threat model piece by piece: business context, architecture, threat actors, trust boundaries, data flows, STRIDE-based threats, mitigations, and a final JSON export compatible with AWS Threat Composer. **What you'll build:** - A full MCP server with FastMCP (stdio + SSE transport) - Pydantic v2 data models for type-safe threat modeling - Case-insensitive enum validation (because AI isn't always consistent) - 11 tool modules covering every phase of STRIDE analysis - Customizable organization security guidelines loaded from `.md` files - Docker deployment for team-wide access - Compliance gap analysis that validates against mandatory controls - A complete workflow orchestrator with progress tracking **What makes this different:** The server doesn't call any LLM itself. It provides the structure and tools — your AI assistant (Claude, Kiro, Cursor, Copilot) provides the intelligence. This means it works with any model, any provider, forever. No API keys, no token costs for the server itself. **Who this is for:** - Security engineers who want to automate repetitive threat modeling - Python developers building MCP servers for any domain - DevSecOps teams embedding security into AI-assisted workflows - Architects who need consistent, auditable threat models - Anyone curious about how MCP tools work under the hood **By the end of this book**, you'll have a production-ready MCP server, a deep understanding of how AI tools are structured, and transferable patterns for building MCP servers in any domain — not just security.

Security threat modeling is expensive ($5K–$20K per engagement), slow (2–5 days), and requires rare expertise. What if you could automate it? This book shows you how to build AITM — an open-source Python tool that uses Large Language Models to generate comprehensive STRIDE threat analyses from a simple system description. One command. 30 seconds. Professional results. You'll build every component from scratch: - A stateless threat modeling engine with a 3-step AI workflow - Multi-provider LLM integration (Amazon Bedrock, OpenAI, Ollama) - Structured output parsing with Pydantic — no regex, no fragile parsing - Architecture diagram analysis using vision models - A professional CLI with progress indicators and colored output - Markdown and JSON report generation Whether you're a developer automating security reviews, a DevSecOps engineer integrating threat modeling into CI/CD, or a student learning how to build real-world LLM-powered tools — this book gives you the complete blueprint. Includes 5 real-world use cases, full source code on GitHub, and step-by-step instructions that work on macOS and Linux. No security expertise required. Just Python and curiosity.

Before containers, service meshes, and modern security platforms, qmail showed how much could be achieved with Unix processes, file permissions, queues, and discipline.

Software and infrastructure only create value when they pull in the same direction as the business. This book shows IT leaders how to get there: from shaping IT strategy and the architecture roadmap to the daily discipline of IT and architecture governance, all built on a pattern-based approach that adapts to your organization rather than forcing it into a template.Grounded in established frameworks such as TOGAF, COBIT, and ITIL, it pairs solid fundamentals with numerous real-world examples — and gives growing weight to compliance and IT security, now central concerns of any IT management agenda.This English edition is based on the German standard work on the subject, fully revised in its 4th edition (late 2024). It is current with TOGAF 10 and reflects recent developments in business-oriented enterprise architecture — including the open-source tool EDGY and patterns for digital strategy — alongside the latest trends in IT risk management and cybersecurity architecture.

Every secure communication begins with mathematics.Every modern encryption system relies on number theory.Every intelligent cyber defense increasingly depends on Artificial Intelligence.But what happens when these three worlds converge?In Cryptography, Number Theory, and AI Security, Anshuman Mishra takes readers on a journey from the mathematical foundations of encryption to the cutting-edge frontier of AI-powered cybersecurity.Explore prime numbers, RSA, elliptic curves, blockchain security, machine learning for threat detection, homomorphic encryption, federated learning, adversarial AI, and post-quantum cryptography.Discover how mathematics and machine intelligence work together to secure the digital world.

Advanced cybersecurity research based on multi-source data correlation across honeypots, IDS systems and network telemetry, analyzing unified attacker behavior and infrastructure patterns