Cybersecurity

The organising principle of defensive security is that no system is unbreakable, so the goal is not perfect protection but the management of risk. One author puts it directly: security is not about building an unhackable system, which does not exist, but about reducing the risk that data is disclosed, altered or made unavailable without authorisation, and doing so cost-effectively, since the cost of a control should not exceed the cost of the harm it prevents.[1] The three properties a control defends, confidentiality, integrity and availability, recur throughout the field as the CIA triad, and availability, the author notes, is the one most often forgotten.[1] The certification literature organises the same ground into formal bodies of knowledge; the guides to the main credentials lay out domains from security and risk management through asset security, identity and access management, security operations and secure software development.[41]

The counterpart on the building side is to design for security from the start rather than bolt it on afterwards. One developer-facing book contrasts bolt-on security, such as intrusion detection and antivirus added to a finished system, with security by design, and recommends the latter wherever the builder is free to choose it.[2] Its core activity is threat modelling, a session in which a mixed team asks what an attacker would want and how they would get it, then rates and prioritises the fixes; the same book sets out the supporting principles the field relies on, reducing the attack surface, compartmentalising a system into isolated segments, granting each part the least privilege it needs, layering defences so that no single failure is fatal, and planning to fail gracefully and to respond when, not if, a breach occurs.[2] It also warns against security by obscurity, the hope that an attacker will not discover a hidden weakness, which fails as soon as a skilled person looks.[2] A longer reference for web developers organises every defence around a repeating five-step structure, identifying the asset, identifying the risks, choosing countermeasures, noting the risks the countermeasure itself introduces, and weighing the cost, so that each control is paired with its own trade-offs.[20]

A set of recipe books by one author covers the same cryptographic operations in each of the major languages, so a developer can find the idiom for the platform in hand. The Modern Cryptography CookBook works mostly through the OpenSSL command line, covering symmetric ciphers and their block modes, authenticated encryption, hashing and message authentication codes, password hashing, and the building of a certificate authority.[6] Python Cryptography gives the same material in Python with the pyca/cryptography library, with complete scripts for key exchange, RSA encryption and signing, and elliptic-curve signatures.[7] GoLang Cryptography for Developer does it in Go, including the memory-hard password hash Argon2 and the Curve25519 key exchange,[8] Cryptography for Java Script Developer in browser JavaScript through the WebCrypto API and the Stanford JavaScript Crypto Library,[9] and Cryptography for PHP Developers through PHP's OpenSSL functions, though its free sample shows only the two functions that list the available ciphers and digests.[10] The reader should note these five are from 2018 and 2019 and that some of their sample code is dated, using Python 2 syntax in one case.[7] For the Java platform, Java Cryptography: Tools and Techniques is a longer and more recent treatment built around the Bouncy Castle libraries, covering what the standard Java runtime leaves out: certificate management, secure messaging, TLS and a chapter on post-quantum algorithms.[11]

Several of the same books go beyond encrypting a message to the infrastructure that makes encryption usable at scale. The OpenSSL cookbook builds a hierarchical public-key infrastructure step by step, a root authority signing an intermediate authority which signs an end-entity certificate, and covers the ten fields of an X.509 certificate, certificate revocation lists, the Online Certificate Status Protocol for checking a certificate's status, and the configuration and testing of TLS 1.3 on a server.[6] Managing the secrets themselves, the keys, tokens and credentials that applications need, is a discipline of its own: Getting Started with HashiCorp Vault introduces a dedicated secrets manager, opening with a foreword on the problem of secret sprawl, credentials scattered in plaintext across source code and configuration, and describing a workflow built on three concepts, secrets held by pluggable engines, deny-by-default policies, and authentication by token, together with dynamic secrets that are generated on demand and revoked automatically.[12] Its sample is version-dated to a 2020 release of the tool despite a later publication date.[12]

A web application is reached through a browser, and several books begin by explaining the exchange an attacker works within. A browser's job, one author writes, is DNS resolution, an HTTP exchange over a TCP connection, and rendering; the HTTP message it sends is a start line, headers and an optional body, and the attack surface lies largely in how that exchange and the rendering of its result are handled.[4] Because web servers log the request path, durable secrets must never travel in a URL, which is one reason state-changing requests carry their data in the body rather than the query string.[4] A dedicated HTTP primer covers the same ground more slowly, from request methods and status codes to sessions, authentication and secured connections, as groundwork for both web development and penetration testing.[5] The protective layer the browser offers is a growing set of HTTP response headers: the author of the web-security book devotes a chapter to HTTP Strict Transport Security, which forces encrypted connections, and the related headers that constrain what a page may load and how its cookies behave, including the SameSite cookie attribute that removes a whole class of cross-site request forgery.[4]

A cluster of offensive books catalogues the vulnerability classes a tester looks for, each typically paired with its defence. Exploitology: Web Apps Exploits is a long guide with a chapter per class, from subdomain takeover, cross-site scripting and cross-site request forgery through command injection, path traversal, SQL and NoSQL injection, server-side template and request-side forgery, insecure deserialisation and request smuggling, each closing with mitigation.[13] Web Application Advanced Hacking concentrates on the less-covered, stack-specific techniques, attacks on JSON Web Tokens and OAuth flows, NoSQL and GraphQL, misconfigured cloud storage and advanced server-side request forgery.[14] JavaScript for hackers approaches the browser from the attacker's side, studying how JavaScript payloads are constructed and how same-origin-policy bypasses are found,[15] while The Brute Art of Bypass is a short reference framing cross-site-scripting filter evasion as a repeatable method rather than a list of payloads.[16] Python For Hackers teaches by demonstration against a supplied practice virtual machine, pairing common web attacks such as directory traversal and cross-site scripting with a prevention section for each, and noting that modern web frameworks escape output and block these attacks by default.[17] Essential Node.js Security narrows the subject to applications built on Node.js and the Express framework, pairing each risk with a practical mitigation,[18] and Pwning OWASP Juice Shop takes the opposite approach to all of these: it is the companion guide to a deliberately insecure practice application, used for training, awareness and capture-the-flag events.[19] For infrastructure as well as code, one long reference walks web developers through hardening the server, the network and the cloud deployment, with chapters on container security, intrusion detection and the shared-responsibility model.[20]

As applications decomposed into services, the security questions moved to the interfaces between them. Identity And APIs organises API security around identity, contrasting HTTP authentication, API keys, JSON Web Tokens and OAuth, and covering the less common OAuth flows and the role of identity in microservices and the internet of things.[21] The API Gateway Handbook treats the gateway that sits in front of an API, a specialised reverse proxy that enforces authentication, validates tokens, terminates TLS and applies rate limits, as one of the places that security is enforced, with worked examples on an open-source gateway.[22] Email has its own book: Email security: attack and defence works through the authentication mechanisms that protect mail, the Sender Policy Framework, DomainKeys Identified Mail, DMARC, ARC and BIMI, then a set of attacks the author has performed against them on professional penetration tests, and a proposed defence.[23]

The orientation books describe penetration testing as a staged process: reconnaissance, scanning, exploitation and post-exploitation, followed by the writing of a clear report, which the authors stress is as much of the job as the technical work.[24][25] A tester also keeps reference material close to hand; Payloads All The Things is described as a cheatsheet-style collection of payloads and techniques for finding and exploiting vulnerabilities, though its free sample and table of contents were not available, so nothing more specific about its contents can be confirmed from the inputs.[26] Practising safely requires an isolated environment, and Building Virtual Machine Labs: A Hands-on Guide (Second Edition) is a long hands-on guide to building a virtual laboratory on any of five hypervisors, with a pfSense firewall, a Snort or Suricata intrusion-detection sensor and a Splunk log collector, suitable for both attack practice and defensive study.[27]

Understanding a binary without its source is a core skill for both malware analysts and those who harden software against analysis. Programming Linux Anti-Reversing Techniques works from the defender's side, taking a simple C program and modifying it chapter by chapter to show how a reverse engineer would examine it and how to frustrate that examination, through stripping symbols, obfuscating strings and control flow, and detecting a debugger.[28] Frida handbook documents a widely used dynamic-instrumentation toolkit that hooks into running programs across Linux, macOS, Windows and Android, moving from basic use to techniques such as reading decrypted text from memory.[29] The low-level groundwork these assume is taught elsewhere: Accelerated Windows Memory Dump Analysis, Seventh Edition, Part 1, Process User Space is a transcript of exercises in analysing Windows process memory dumps with the WinDbg debugger, built around a catalogue of named diagnostic patterns such as heap corruption and deadlock.[30]

Below the operating system, the hardware has its own attack surface. The narrative history of breaches devotes chapters to semiconductor supply chains, kernel and firmware flaws, embedded devices, hypervisors and even systems in orbit, arguing that a threat model must be built with isolation in mind from the chip upward.[31] At the board level, Diving into JTAG explains the JTAG debug and test protocol used to program and inspect embedded chips, and includes a chapter on its security, from protecting a device against JTAG access to the techniques used to extract firmware from an unprotected one.[32]

A network intrusion-detection system watches traffic for the signatures and behaviours of an attack. Suricata: An Operator's Guide is an operator's guide to one such system, Suricata, focused not on installation but on running and tuning it: the anatomy of a detection rule, measuring rule performance, placing sensors, reducing false positives and the alert fatigue they cause, and threat hunting against captured traffic; the author notes it is a work in progress with some chapters still to come.[33] At the level of a whole monitored estate, vRealize Network Insight Cookbook covers a commercial network-visibility product whose security use is planning micro-segmentation and firewall rules from observed traffic flows.[34]

Defending the individual machine and the small network is the subject of several lab-style guides. CyberDefensewithMicrosoftDefender walks through configuring Microsoft's endpoint and cloud defence tools against malware and ransomware, running simulated attacks against the configuration rather than only describing it.[35] Surviving a Ransomware Attack with Azure Site Recovery Volume 1 is a step-by-step lab in which the reader builds a nested virtual environment in Azure, simulates a ransomware attack on a domain controller, and recovers by failing over to the cloud, a reminder that recovery is part of security, though its procedure is specific to 2019-era Azure.[36] For the home, Safer @ Home with pfSense® is a book of firewall recipes built on pfSense, covering DNS and content filtering, separating work and home networks, isolating devices on the internet of things, remote access and alerting on new devices.[37]

Digital forensics reconstructs what happened on a system after the fact, and is closely tied to incident response. The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts is a community-written anthology whose chapters span malware analysis, password cracking, forensic imaging and triage, threat intelligence and the forensics of mobile and connected devices.[38] Much of Windows forensic practice centres on one widely used free toolset, and two books document it: EZ Tools Manuals is the official manual for the EZ Tools suite, documenting each command-line and graphical tool with its switches and output,[39] and Eric Zimmerman's Binary Foray collects the same author's blog posts on Windows registry internals, the tools' design, and benchmarks of the major forensic suites.[40]

Formal certifications structure much of a security career, and the library has a consistent series of exam-preparation references organised domain by domain. The guides cover, among others, the vendor-neutral credential for security professionals, the cloud-security credential, and the credential for information-systems auditors, each condensing the current exam syllabus for a candidate in the last stretch of study.[41][42][43] They are revision references rather than teaching texts, meant to be read after the main material; the broader career questions, which part of the field to enter and how to survive in it, are the subject of the orientation books above.[25]

The newest class of system to secure is one that can act. Securing Enterprise AI Agents argues that once an AI system can pick a tool, call an interface and change production state, reviewing its prompts and logging its sessions is no longer enough: it needs an identity, a bounded set of permissions, an audit trail and a way to fail safely, as any other actor would.[44] The book sets out a layered reference architecture from the human user down through the orchestrator, model, tool wrapper and data layer, treats evaluations and observability as release controls, and covers the specific attack surfaces of retrieval-augmented systems and the writing of policy as code, drawing its worked examples from regulated industries.[44]

A recurring theme across the field is that the weakest point is often the person, not the machine. Unethical Software Engineering catalogues the deceptive patterns software uses against its own users, from tracking pixels and covert surveillance to manipulated reviews and deepfakes, treating them as an ethical rather than a technical failure.[45] Hacking of the Free looks at influence operations against democratic elections, arguing that the main target of digital warfare is often human judgement rather than software, through predictive analytics, propaganda and the manipulation of social media, alongside the more technical attacks on voting infrastructure.[46] And Death by Identity Theft brings the same concern down to the individual, setting out how identity theft happens and how an ordinary person can lower its risk and recover from it.[47] The lesson the introductory books repeat is that security is a property of the whole system, including its users, and that educating them turns the weakest link into another sensor.[2]