Books

Stop clicking. Start engineering. In a world of cloud-native infrastructure and rapidly evolving threats, security shouldn't be a "configuration task" hidden inside a vendor’s UI. It should be first-class software. Detection-as-Code: The Architecture Blueprint is the definitive guide to removing the "Save" button from your security consoles and replacing it with a high-velocity, version-controlled, and AI-augmented defensive pipeline.

Cyber risk in M&A gets treated as a compliance check, a heat-map of red and yellow boxes, or a problem to deal with after close. By then it is too late.Quantitative Cyber Diligence (QCD) replaces qualitative cyber diligence with a five-pillar framework that produces a single dollar-denominated figure the investment committee can argue about — calibrated, defensible, and reproducible. Each pillar maps to a measurable exposure: external attack surface, vendor concentration, data sensitivity, security program maturity, and integration risk. The framework aggregates per-pillar exposures with explicit correlation discount, surfaces tail-driver scenarios that conventional analysis misses, and translates the aggregate figure into deal-architecture recommendations: reps and warranties, escrow, price adjustment, or walk-away.This book documents how QCD engagements actually run. Two worked examples (healthcare-IT and industrial-IT). Practitioner templates. Per-pillar pseudocode. Industry loss benchmarks. The complete framework, calibrated to the post-Change-Healthcare era.

Learn the Kung Fu of Linux CLI

Spring Security 7 from the inside out. Trace requests through the filter chain, build a custom identity provider with Spring Authorization Server, secure reactive WebFlux services, and ship production hardened systems backed by JWT, OAuth2, OIDC, SAML2, WebAuthn, and zero trust microservice patterns. Built around CineTrack on Spring Boot 4 and Java 21. Written for engineers who already ship Spring Boot in production.

The CISO's field guide to hardening ServiceNow, defending its APIs, and meeting NIS2, DORA, and EU AI Act obligations. Written by a former Principal Security Advisor in ServiceNow's Office of the CISO.

You've got forty vendors, a hundred integrations, and a SOC 2 report that tells you exactly nothing about what happens when one of them gets compromised. Your dependency map lives in someone's head. Your exposure estimate is a shrug. Your decision process is whoever talks loudest in the emergency meeting. And when it's over, every lesson learned evaporates before the next incident hits. Someone Else's Breach is the framework that replaces all of it — a quantitative, repeatable system for knowing what you're exposed to, deciding what to do about it, and getting better every time. From proactive resilience design to AI-augmented detection, this is the practitioner's guide to surviving incidents you didn't cause but can't ignore.

本书涵盖最新CISSP考试大纲中的所有主题，内容按照便于读者一目了然地深入钻研特定考试领域和概念的方式编排，是任何希望备考而不浪费时间和金钱的考生不可或缺的备考资料。

What IT policies should a higher education institution have? The CampusCISO IT Policy Framework answers that with an inventory of 17 policies, 24 standards, and seven sector-wide gaps, grounded in annual research that now spans 400+ institutions, including every R1 research university in the United States. Download for free by selecting the "Community Edition" link and providing your email.

Stop renting visibility. Start owning the infrastructure. Learn the protocol that delivered 548k hits and 95% Edge efficiency on a 20-year-old "rottame".

The security engineer interview is a high-stakes gauntlet demanding expertise from cryptography to cloud architecture. Stop drowning in 1,000-page encyclopedias and start mastering the curated, high-impact frameworks you actually need. This guide bridges the gap between deep technical flaws and broad business risks to get you interview-ready—fast.

Most universities have IT policies. Few have a formal strategy behind them. This guide draws on annual research across 400+ colleges and universities to show higher education leaders where the sector's policy gaps are, how the unique dynamics of academic culture shape security programs differently than corporate or government environments, and how to close those gaps systematically.

Secure boot is what separates a trusted device from a compromised one — but the chain of trust from hardware fuses to a verified OS is rarely explained clearly. This illustrated guide walks you through every layer: root of trust, key provisioning, bootloader handoffs, certificate chains, and real-world attack vectors. 8 chapters, all visual, zero fluff.

Across 30 chapters, you'll trace real code paths through nearly 400 CAS modules, learning the architecture decisions, design patterns, and implementation techniques that hold this massive system together. Whether you're a CAS contributor trying to fix a tricky bug, an architect evaluating CAS for your organization, or a Java developer who wants to study a mature, real-world Spring Boot application at scale — this book gives you the map. Written by a long-time CAS committer who has been involved since the original CAS 3.0 architecture, this book distills years of hard-won knowledge into a single, code-level reference.