Security

The message = Don't want anyone to see us naked on bike...
A.) HTTP = driving naked through windowed tunnel
B.) HTTPS = driving naked through covered tunnel
C.) Auth + MessageSigning/WS-Security = biking with clothes & helmet on (covered tunnel optional), extra security entourage keeps people far away so they can't stop your bike and/or strip your clothes off, guaranteed security but HTTPS covered tunnel optional

Security is the real or perceived protection from real or potential external and internal threats. Threats may be to personal harm, group harm or large-scale societal harm; and may come in any number of forms, from compromising of an individual (as in death or physical injury) to compromising of equipment (as in hardware damage, theft or vandalism) to information such as software or data (as in theft of customer data, company trade-secrets, leaking of personal emails, or overall damage to information consistency).

Specifications

PKI

Public-Key Infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. A PKI consists of:

1. A Certificate Authority (CA) that both issues and verifies the digital certificates.
2. A Registration Authority (RA) which verifies the identity of users requesting information from the CA
3. A central directory (i.e. a secure location in which to store and index keys)
4. A certificate management system (i.e. a user interface or software tool exposing client/server or other architecture for displaying information such as public-private key pairs and key contents to authenticated/authorized user)

x509

• Internet X.509 Public Key Infrastructure: http://www.faqs.org/rfcs/rfc2459.html

PCI

The Payment Card Industry (PCI) is an informal and unofficial grouping for any company that processes payment for a product/service.

• PCI Security standards: https://www.pcisecuritystandards.org/

PCI SSC

Payment Card Industry Security Standards Council (PCI SSC) is an official group of payment processing providers and interested parties. When people talk about "PCI compliance", they really mean adherance to the set of standards by the PCI SSC.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard by the PCI SSC which is intended for organizations that handle cardholder information of any of the major debit, credit, prepaid, e-purse, ATM, and POS cards.

PA-DSS

The Payment Application Data Security Standard (PA-DSS) is the global security standard created by the PCI SSC for the purpose of providing the definitive data standard for software vendors that develop payment applications. The standard aims to prevent developed payment applications for third parties from storing prohibited secure data including magnetic stripe, CVV2, or PIN.

There are currently 14 requirements for PA-DSS compliance: 1. Do not retain full magnetic stripe, card validation, code or value, or PIN block data. 2. Protect stored cardholder data. 3. Provide secure authentication features. 4. Log payment application activity. 5. Develop secure payment applications. 6. Protect wireless transmissions. 7. Test payment applications to address vulnerabilities. 8. Facilitate secure network implementation. 9. Cardholder data must never be stored on a server connected to the internet. 10. Facilitate secure remote software updates. 11. Facilitate secure remote access to payment application. 12. Encrypt sensitive traffic over public networks. 13. Encrypt all non-console administrative access. 14. Maintain instructional documentation and training programs for customers, resellers, and integrators.

To date, less than 800 organizations have reached full PA-DSS compliance.

CVSS

• Common Vulnerability Scoring System (CVSS) v3.1 -- specification document: https://www.first.org/cvss/v3.1/specification-document | EXAMPLE

MITRE

• MITRE: https://www.mitre.org/
• wikipedia: Mitre Corporation

Jargon File

• The Jargon File: http://www.catb.org/~esr/jargon/html/

• Bit rot: http://www.catb.org/~esr/jargon/html/B/bit-rot.html

SRI

• W3C - SubResource Integrity (SRI) spec: https://www.w3.org/TR/SRI/
• New PHP/CSP directive to make Subresource Integrity mandatory (`require-sri-for`): https://frederik-braun.com/new-csp-directive-to-make-subresource-integrity-mandatory-require-sri-for.html

CSP

Content Security Policy (commonly abbreviated CSP)

• Content Security Policy (CSP), level 2: https://www.w3.org/TR/CSP2/

Security.txt

• Security.txt standard: https://securitytxt.org/ | SPEC (proposed standard which allows websites to define security policies)

InfoSec frameworks

ISO

27000 series

Covered within ISO standards 27001 & 27002, among others, this framework was developed and continues to be maintained by the International Organization for Standardization (ISO) and focuses on providing requirements of creating an Information Security Management System (ISMS). Their framework sets out to provide a systematic approach to risk management by focusing on controls to protect people, processes, and technology.

COBIT

Control Objectives for Information Technology (COBIT).

Algorithms

SHA

Secure Hash Algorithm (commonly abbreviated SHA) is a set of cryptographic hash functions designed by the National Security Agency (NSA) and published by the NIST as a U.S. Federal Information Processing Standard. The three SHA algorithms are structured differently and are distinguished as SHA-0, SHA-1, SHA-2 & SHA-3. The SHA-2 family uses an identical algorithm with a variable digest size which is distinguished as SHA-224, SHA-256, SHA-384, and SHA-512. The SHA-3 family is the most recent and secure (but costly/time-consuming), yet offers the same hash sizes as SHA-2.

HMAC

Hash-based Message Authentication Code (commonly abbreviated HMAC), is a specific construction for calculating a message authentication code (MAC) involving a cryptographic hash function in combination with a secret key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message. Any iterative cryptographic hash function, such as MD5 or SHA-1, may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly. The cryptographic strength of the HMAC depends upon the cryptographic strength of the underlying hash function, on the size and quality of the key and the size of the hash output length in bits.

MD5

• MD5 Encrypt: http://www.iwebtool.com/md5

E-Security

Electronic Security (commonly shortened as E-Security or eSecurity) is a concept representing the relative trustworthiness, reliability, access protections and safeguards against unauthorized access, tampering or damages to data or activities in any digital systems. These measures are designed to preserve the confidentiality and integrity of each and every user's data as well as more broadly to the protection of physical assets and/or intellectual property which may be accessed or protected electronically.

Cybersecurity

Related to the concept of "E-Security" is the subset of "Cybersecurity" which focuses on the protection of all users' data and property as well as corporate data, physical assets and intellectual property which is potentially accessible over a network (typically focused broadly on the entire Internet and wide-area networks, but also applicable to corporate intranets and/or local network).

• USAID - CyberSecurity primer: https://www.usaid.gov/sites/default/files/documents/10-26-21_EXTERNAL_CyberPrimer-CLEARED-accessible.pdf
• Microsoft on “How to organize your security team - The evolution of cybersecurity roles and responsibilities”: https://www.microsoft.com/security/blog/2020/08/06/organize-security-team-evolution-cybersecurity-roles-responsibilities/
• US Congress -- H.R.3599 - Federal Rotational Cyber Workforce Program Act of 2021: https://www.congress.gov/bill/117th-congress/house-bill/3599
• Cybersecurity and Infrastructure Security Agency (CISA) -- Cloud Security - Technical Reference Architecture: https://www.cisa.gov/sites/default/files/publications/Cloud%20Security%20Technical%20Reference%20Architecture.pdf

Threat Assessment

• CISA Launches Insider Threat Self-Assessment Tool: https://www.govinfosecurity.com/cisa-launches-insider-threat-self-assessment-tool-a-17657

Security Awareness Training

• Security Awareness hub: https://securityawareness.usalearning.gov | Refresher
• KnowBe4 -- Security Awareness training: https://www.knowbe4.com/products/kevin-mitnick-security-awareness-training/ ("infamous" hacker Kevin Mitnick's company/course)
• SANS -- Security Awareness training: https://www.sans.org/security-awareness-training
• Curricula -- Security Awareness training: https://www.getcurricula.com/cyber-security-awareness-training/
• Rapid7 -- Security Awareness training: https://www.rapid7.com/fundamentals/security-awareness-training/
• Beauceron -- Security Awareness training: https://www.beauceronsecurity.com/overview

Attacks

• Denial-of-Service
• XSS
• CSRF
• SQL Injection
• LDAP injection
• Clickjacking
• Session hijacking
• URL manipulation
• Parameter tampering
• Authentication bypass
• IDOR/BOLA
• Command injection (via HTML FORMs, GreaseMonkey, or DevTools)
• Web services analysis (SOAP & REST protocol private/internal API attacks)
• Java, Flash, ActiveX clients analysis
• Active Content exploits
• XML, XPATH, JSON injection
• Remote file inclusion (via JSONp, File Upload forms, etc)
• Malformed File Format & Memory buffer overrun (File Uploads)
• Weak cryptographic mechanism exploits
• Brute Force
• Man-in-the-Middle
• Relay
• Phishing
• Snooping
• Forgery
• Identity Fraud
• Keystroke Analysis
• Spyware
• Malware
• Worm
• Virus
• Trojan Horse
• Organizational In-Person Deception/Espionage
• Malvertising
• Request Stuffing

Phishing

• Canadian Anti-Fraud Centre (CAFC): http://www.antifraudcentre-centreantifraude.ca/index-eng.htm

Spear-Phishing

Highly-targeted attacks directed at specific individuals or groups within a company such as those who make purchasing decisions, finance department members, managers, HR & hiring decision-makers, vendor selection, Security team leads, Developers, etc.

Whaling

Attacking top-level executives such as Presidents, C-suite and/or VPs.

Pharming

• wikipedia: Pharming
• Phishing, Pharming, Vishing, and Smishing: https://security.intuit.com/index.php/protect-your-information/phishing-pharming-vishing-and-smishing

Vishing

Voice phishing (by mimicking IVR, caller ID / Voicemail services, or possibly even real-time or recorded faked voice transformations.

• wikipedia: Vishing

Smishing

SMS/MMS-based phishing attacks.

• wikipedia: Smishing

SQL Injection

SQL Injection is a common web application vulnerability whereby a database is attacked by injecting unwanted or undesirable SQL queries at the end of a valid and expected SQL query.

The most common solution to this problem is to clean the string by trimming it at the end of its known and allotted length, while also escaping and/or dropping any non-expected characters that could comprise security by running undesired code.

• Protecting Your PHP/MySQL Queries from SQL Injection: http://www.metatitan.com/php/16/protecting-your-phpmysql-queries-from-sql-injection.html
• SQL Injection Walkthrough: http://www.securiteam.com/securityreviews/5DP0N1P76E.html

Clickjacking

• Clickjacking: https://martijnvanlambalgen.wordpress.com/2015/06/28/clickjacking/

IDOR

Insecure Direct Object Reference (IDOR).

• HowTo -- Find Insecure Direct Object Reference (IDOR) Vulnerabilities for large bounty rewards: https://www.bugcrowd.com/blog/how-to-find-idor-insecure-direct-object-reference-vulnerabilities-for-large-bounty-rewards/
• How to find more IDORs and maximize their impact while hunting for bugs: https://medium.com/@vickieli/how-to-find-more-idors-ae2db67c9489
• IDOR Techniques - MindMap: https://www.xmind.net/m/CSKSWZ/

XXE

• wikipedia: XXE
• XML external entity (XXE) injection: https://portswigger.net/web-security/xxe
• How to Find XML eXternal Entity (XXE) Processing Exploit: https://www.shiftleft.io/how-to-find-xml-external-entity-processing-exploit/
• XML Attacks (MINDMAP): https://www.xmind.net/m/xNEY9b/ | PDF

Bit Flipping

• Why We Should Be A Bit Worried About Rowhammer.js: https://blog.usejournal.com/why-we-should-be-a-bit-worried-about-rowhammer-js-2354d9a775f3

Signal Spoofing

Using electrical signals or radio signals to interrupt other communications or trick software/hardware to divulge, erase, lock or otherwise manipulate information or settings on a device.

Ransomware

• Combating Ransomware (2021) -- A Comprehensive Framework for Action - Key Recommendations from the "Ransomware Task Force": https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf

Killware

Malicious software or hardware hacks designed to injure, maim or kill individuals, groups or undisclosed (perhaps even unplanned/non-specific) members the general public.

• Killware -- Hype is Bigger Than the Threat, For Now: https://securityboulevard.com/2021/10/killware-hype-is-bigger-than-the-threat-for-now/

Defenses

• Caching
• Logging
• Observability & Real-time Event-Driven Alerting
• Audits
• Indicators Of Compromise (IOCs)
• Intrusion Prevention
• Intrusion Detection
• Directories (w. user-centric permissions)
• Honey Pots
• Hashing
• Encryption
• Signatures (Digital Certificate, Elliptic Curve, etc...)
• PKI (public/private keys)
• Validation (inputs must match a certain pattern or they are ignored)
• String Cleaning (HTML, Script tag, SQL and/or Server-side code removal)
• Filters (purifiers, removal of specific types of text/patterns)
• Type-checking (MIME-types delimitation/validation)
• URL Encoding/Decoding
• Firewalls
• IPsec
• Anti-Virus software

Auth

• Authentication
• Authorization
• Basic (Username:Password via HTTP Header)
• Digest (Username + Password + nonce/configs, sent in HTTP POST header only, automatically encrypted when using SSL/TLS)

DIGEST

HTTP Digest authentication differentiates from HTTP Basic authentication in that it specifies extra parameters that must appear in the challenge response's WWW-Authenticate header.

For instance, on an unauthenticated request to a DIGEST secured endpoint "https://localhost:8080/helloworld-webapp/account/username123" you should get a challenge response with HTTP status 401, and which contains the digest WWW-Authenticate header:

WWW-Authenticate: Digest realm="digest realm", qop="auth", nonce="1415713971682:2ffba5083baf438b90d2986cc77ae793", opaque="C4DAF43F253C0AFA5F006908F5595C8F"

Here are the additional parameters that need to be processed and sent in the response:

1. digest - the authentication scheme
2. realm - configurable on the server, for example, [<realm-name/>] on Tomcat
3. (Quality of Protection) qop - indicates the required digest calculation
4. nonce - A (cryptographic) nonce is a server-generated number, and is generated only once
5. opaque - This is harder to explain quickly (see the following links for more), but is not part of the digest calculation, and should be returned unchanged.

These parameters are used by the client, to calculate the digest for the subsequent request's Authorization header; for example:

Authorization: Digest username="restuser", realm="digest realm", nonce="1415716491557:de6af453ecd19abca5d55334e8146831", uri="/helloworld-webapp/account/username123", response="2b9d6d028c50cdd5fca231dd0cbc2ffe", qop=auth, nc=00000001, cnonce="f494e7c6145efa8651123920df2b3a2d", opaque="C4DAF43F253C0AFA5F006908F5595C8F"

• wikipedia: Digest access authentication

Strong Passwords

• wikipedia: Password
• <input type="password" />: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/password#Allowing_autocomplete (autocomplete="current-password" or autocomplete="new-password")
• What is the optimal password length -- How to choose a password that best protects you during a data breach: https://advancedweb.hu/what-is-the-optimal-password-length/
• NIST Special Publication -- 800-63, rev. 3 - Digital Identity Guidelines: https://pages.nist.gov/800-63-3/sp800-63-3.html

Credential enumeration protection

• What Is User Enumeration?: https://blog.rapid7.com/2017/06/15/about-user-enumeration/

Credential recognition protection

• Credential Evaluation and Credential Recognition: What Is the Difference?: https://www.wes.org/advisor-blog/difference-between-credential-evaluation-and-credential-recognition/

Multi-Factor Authentication

There are potentially any combination of the following three factors:

1. what you know - username, password, passphrase, etc
2. what you are - biometrics such as fingerprint reader, facial recognition, iris/retina scan, gait pattern (physical facility surveillance), etc
3. what you have - email address, phone number (calls or SMS text messages), encryption key fob, etc

• wikipedia: Two-factor authentication (2FA)
• wikipedia: Multi-factor authentication (MFA)
• Preventing Hacks of Multi-Factor Authentication: https://www.truthinit.com/index.php/video/2274

OTP

Web-based One-Time Password (commonly referred to as WebOTP or 1-time-pass) can be used to verify phone numbers on the web.

• Web OTP API: https://web.dev/web-otp/ | DEMO | SRC

Passwordless

• wikipedia: Universal 2nd Factor (Passwordless)
• wikipedia: WebAuthn
• wikipedia: Secure Shell

Password Managers

• KeePass - leading free & OSS Password Manager: https://keepass.info | DOWNLOAD | PortableApp
• BitWarden: https://bitwarden.com/
• NordPass: https://nordpass.com/
• 1password: https://1password.com/
• MasterPassword: https://masterpassword.app/
• MacPassApp: https://macpassapp.org/
• Dashlane: https://www.dashlane.com/plans
• LessPass: https://lesspass.com/#/
• LastPass: https://www.lastpass.com/password-manager

Secret Management

• Hashicorp Vault (commercial/OSS): https://www.hashicorp.com/products/vault | SRC | DOCS | LEARNING
• Vaultier (OSS): http://www.vaultier.org/ | SRC
• Bitnami Labs - Sealed Secrets: https://engineering.bitnami.com/articles/sealed-secrets.html | SRC
• LastPass Enterprise: https://www.lastpass.com/products/enterprise-password-management-and-sso
• CyberArk: https://www.cyberark.com/products/privileged-account-security-solution/core-privileged-account-security/

WAF

• wikipedia: Web application firewall
• Magic Quadrant for Web Application Firewalls (WAF) 2019: https://www.gartner.com/doc/reprints?id=1-1OI94B34&ct=190917&st=sb

SIEM

• wikipedia: Security information and event management (SIEM)

Zero-Trust

• wikipedia: Zero trust security model
• Why Zero-Trust Segmentation Beats CVE Chasing All Day, Every Day: https://www.bigmarker.com/techstrong/Why-Zero-Trust-Segmentation-Beats-CVE-Chasing-All-Day-Every-Day

DevSecOps

DevSecOps is an architectural pattern or extension of DevOps whereby Security (just like the emphasis on quality) gets baked in tot he Products/Projects being delivered.

• '
• 10 Tips for Integrating Security Into DevOps: https://dzone.com/articles/10-tips-for-integrating-security-into-devops

Dependency Vulnerability Checker

• Dependency Check: https://jeremylong.github.io/DependencyCheck/ (checks libraries such as JARs, DLLs, etc against the leading "known vulnerability" databases)
• National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/search
• Common Platform Enumeration identiers (CPE): https://cpe.mitre.org/
• Common Weakness Enumeration (CWE): https://cwe.mitre.org/
• Common Vulnerability & Exposure (CVE): http://cve.mitre.org/
• CVE Details lookup: https://www.cvedetails.com/
• Open Vulnerability and Assessment Language (OVAL) definitions: https://www.itsecdb.com/oval/OVAL

• Snyk: https://snyk.io/product/open-source-security-management/

BoM

Bill of Materials (BoM).

• Zoom -- BOM - OSS libs: https://oracle.zoom.us/opensource/source (Open Source Software Source Code)

SBOM

Software Bill of Materials (SBoM).

• SOFTWARE BILL OF MATERIALS (SBOM): https://www.ntia.gov/SBOM
• The Minimum Required Elements of a Software Bill of Materials: https://fossa.com/blog/minimum-required-elements-software-bill-of-materials/ (also describes main OSS standard format)
• Understanding SBOM standards - CycloneDX, SPDX, SWID: https://www.settletop.com/insights/understanding-sbom-standards-cyclonedx-spdx-swid

SPDX

• Software Package Data Exchange (SPDX): https://spdx.dev/
• SPDX - License List: https://spdx.org/licenses/

SWID

• Software Identification (SWID) Tagging: https://csrc.nist.gov/projects/Software-Identification-SWID

CycloneDX

OWASP CycloneDX is a lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.

• CycloneDX: https://cyclonedx.org/

OpenChain

• OpenChain Specification (version 2.1): https://raw.githubusercontent.com/OpenChain-Project/Specification/master/Official/en/2.1/openchainspec-2.1.pdf
• SPDX Lite overview: https://wiki.linuxfoundation.org/_media/openchain/spdx-lite-overview-20190829.pdf

Secret protection

This includes API Keys, Tokens (JWT, auth tokens, Cookie IDentifiers, SessionIDs), Usernames/Passwords, encrypted hashes, public keys, and other forms of credentials or secrets. The best defense for these is ensuring they are never leaked in the first place.

• Introducing Postman Security Scans: https://blog.postman.com/postman-security-scans/

Key rotation policies

These protect keys in the event of unauthorized access, snooping/spying (codebase, client-side code & network requests), accidental leaks, etc.

AST

Application Security Testing (AST).

• Gartner -- Critical Capabilities for Application Security Testing: https://www.gartner.com/doc/reprints?id=1-275ICNLA&ct=210812&st=sb

SAST

Static Application Security Testing (SAST).

• wikipedia: Static application security testing (SAST)
• Marianna Trench: https://mariana-tren.ch/ | SRC | DOCS

DAST

Dynamic Application Security Testing (DAST).

• wikipedia: Dynamic application security testing (DAST)

IAST

Interactive Application Security Testing (IAST).

• wikipedia: Interactive application security testing (IAST)

RASP

Runtime Application Self-Protection (RASP).

• wikipedia: Runtime application self-protection (RASP)

PAC

• What is a PAC file?: https://www.websense.com/content/support/library/web/v76/pac_file_best_practices/PAC_explained.aspx
• How to set PAC proxy settings: https://community.atlassian.com/t5/SourceTree-questions/how-to-set-PAC-proxy-settings/qaq-p/444644

Digital Signature

A Digital Signature is an electronic cryptographic identification or symbol representing an individual.

• wikipedia: Digital Signature

Checksum

A specific type of Digital Signature is a file or library checksum.

• How to Check/Verify MD5 CheckSum of a File on Windows, Mac and Linux: http://www.droidviews.com/check-md5sum-of-a-file-on-windows-mac-and-linux/
• Apache OpenOffice - How to verify the integrity of the downloaded file?: https://www.openoffice.org/download/checksums.html (MD5/SHA on Windows/Mac/Linux)
• How to check a file's checksum on Mac: http://www.techradar.com/how-to/how-to-check-a-files-checksum-on-mac (verify a downloaded file's integrity)
• How to verify your files in Linux with MD5: http://www.techradar.com/us/news/computing/pc/how-to-verify-your-files-in-linux-with-md5-641436
• How To Verify File Integrity in Windows with FCIV: https://www.lifewire.com/how-to-verify-file-integrity-in-windows-with-fciv-2625186
• How to verify MD5, SHA1, and SHA256 Checksum on Windows: https://bhoover.com/how-to-verify-checksum-windows/
• Microsoft Windows (MD5 or SHA1 cryptographic hash) File Checksum Integrity Verifier: http://www.microsoft.com/en-ca/download/details.aspx?id=11533
• Desktop MD5 & SHA-1 Checksum Utility: http://download.cnet.com/MD5-SHA-Checksum-Utility/3000-2092_4-10911445.html
• How to verify signature?: https://www.linuxquestions.org/questions/linux-newbie-8/how-to-verify-signature-137111/
• 10 Tools to Verify File Integrity Using MD5 and SHA1 Hashes: https://www.raymond.cc/blog/7-tools-verify-file-integrity-using-md5-sha1-hashes/view-all/
• How to Check and Verify SHA1 and MD5 with File Checksum Integrity Verifier: https://www.mydigitallife.net/how-to-check-and-verify-sha1-and-md5-with-file-checksum-integrity-verifier-kb841290-fciv/
• How can I verify SHA-2 signature of PE file?: https://stackoverflow.com/questions/31114259/how-can-i-verify-sha-2-signature-of-pe-file
• How to verify MD5, SHA1, and SHA256 Checksum on Windows: https://bhoover.com/how-to-verify-checksum-windows/
• How do I check the SHA1 hash of a file?: https://askubuntu.com/questions/61826/how-do-i-check-the-sha1-hash-of-a-file
• Generate an OpenSSL Certificate Request with SHA256 Signature: https://itigloo.com/security/generate-an-openssl-certificate-request-with-sha-256-signature/
• Change OpenSSL Default Signature Algorithm: https://itigloo.com/security/change-openssl-default-signature-algorithm/
• How to verify your download with PGP/ASC signatures and MD5, SHA256 hash values?: https://www.openoffice.org/download/checksums.html
• Composer public keys: https://composer.github.io/pubkeys.html
• How to Verify MD5, SHA-1, and SHA-256 Checksum in Windows 10: https://www.maketecheasier.com/verify-md5-sha-1-sha-256-checksum-windows10/
• What Are MD5, SHA-1, and SHA-256 Hashes, and How Do I Check Them?: https://www.howtogeek.com/67241/htg-explains-what-are-md5-sha-1-hashes-and-how-do-i-check-them/

Watermark

• wikipedia: Watermark

Steganography

Hiding data within images (such as other images, secret messages, etc).

• wikipedia: Steganography

Security Headers

• (Protecting against) Common Threats in Web Application Security -- Security Headers: https://auth0.com/blog/common-threats-in-web-app-security/

Content Security Policy

• Content Security Policy spec, v2.0: https://www.w3.org/TR/CSP2/ | CSP v1.0
• Content Security Policy (CSP) -- Quick Reference Guide: https://content-security-policy.com | [PRESENTATIONS]
• MDN - CSP overview: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• Chrome - CSP overview: https://developers.google.com/web/fundamentals/security/csp/

Principle of Least Privilege

• wikipedia: Principle of least privilege
• What is the principle of least privilege and why it's such a hard thing to achieve: https://advancedweb.hu/what-is-the-principle-of-least-privilege-and-why-its-such-a-hard-thing-to-achieve/
• Principle Of Least Authority (POLA) Would Have Prevented the Event-Stream Incident: https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99

Ethical Hacking

Ethical Hacking (related to "White hat" hacking). For hacking to be deemed ethical, the hacker must obey the following rules:

1. Expressed (preferrably written) permission should be given to penetrate or access a network and attempt to identify potential security risks.
2. Respect must be given to the individual's, company's or end users' privacy at all times.
3. Hacking traces and/or exploits must be closed out, not leaving anything open for future exploits.
4. Inform the software developer or hardware manufacturer of any security vulnerabilities (if not already known) which have been located in their software or hardware.

• wikipedia: Ethical Hacking
• wikipedia: White hat (computer security)
• wikipedia: Certified Ethical Hacker (CEH)
• wikipedia: Bug bounty program

Red Team

Red Teaming (also known as "Chaos Engineering") is the practice of deliberately attacking, misusing, or otherwise playing "devil's advocate" to ideation (if "Shift-left Red Teaming") of a given product, service or complete set of IT systems, for the purpose of uncovering any application-level or organization-level weaknesses or vulnerabilities and fixing them before they can be found or exploited by malicious parties such as geo-political adversaries, competitors or hackers.

Initially, where such a practice is not being carried out (maybe even frowned upon in the early days of introducing the concept) the "Red Team" is intentionally setup to provide controlled attempts to thwart, hack/crack/crash, or derail a given project. Later on, the role of the "Red Team" may be spread to specific representatives across departments/teams made up from roles from around the organization who understand the value of the "attack ourselves and find our weaknesses before our enemies do" mindset, so as to avoid creating yet another "security silo" or "security bottleneck".

• wikipedia: Red team
• Chaos Engineering - the history, principles, and practice: https://www.gremlin.com/community/tutorials/chaos-engineering-the-history-principles-and-practice/

Blue Team

• wikipedia: Blue team

Tools

• Have-I-Been-Pwned?: https://haveibeenpwned.com/ | SRC
• UserSearch — username lookup (usage by site) tool: https://usersearch.org/
• Common Attack Pattern Enumeration and Classification (CAPEC): http://capec.mitre.org/ (Hack/Exploit dictionary lookup)
• Security Testing Tools You Need To Know About: http://dzone.com/articles/security-testing-tools-you-need-to-know-about
• Audit Your Web Security with Acunetix Vulnerability Scanner: https://www.acunetix.com/vulnerability-scanner/
• AEM Security Scan: http://scan.zapts.com/
• Content Security Policy (CSP) builder: https://report-uri.io/home/generate
• CSP test tool: https://csp-evaluator.withgoogle.com/ (tests CSP before you publish/push it to a live server)
• CSP validator: https://cspvalidator.org/#url=https://cspvalidator.org/ (validates CSP running on an existing site)
• Security Headers checking tool: https://securityheaders.com/ | ALC.ca
• sha1sum command-line tool for MS Windows: http://lists.gnupg.org/pipermail/gnupg-announce/2004q4/000184.html
• Hash'em all! -- Free online text & file hashing: http://www.hashemall.com/
• Sub-Resource Integrity (SRI) - Scan tool: https://sritest.io/
• SRI - Hash Generator: https://www.srihash.org
• IBM Security QRadar SIEM: http://www-03.ibm.com/software/products/en/qradar-siem/ (Firewall-level security solution)
• Protect Your Privacy Online With These Data-Guarding Browser Extensions: https://medium.com/popular-science/protect-your-privacy-online-with-these-data-guarding-browser-extensions-b3f8054820c1
• API attack vector calculator: https://apicalculator.datatheorem.com
• YARA - Malware threat assessment "swiss-army knife": https://virustotal.github.io/yara/ (helping malware researchers to identify and classify malware)

Anti-Virus Software

NETWORK

• Cisco NAC: http://www.cisco.com/en/US/products/ps6128/
• Nortell: http://www.novell.com/solutions/identity-and-security/

OS

• AVAST - Free Antivirus: http://www.avast.com (Czech Republic) | DOWNLOAD
• Anti-Virus Guard (AVG): http://free.avg.com/ (Czech Republic) | DOWNLOAD
• Avira: http://www.avira.com (Germany) | DOWNLOAD
• ESET: http://www.eset.com/ (Slovakia) | DOWNLOAD
• BitDefender: http://www.bitdefender.com/ (Romania) | DOWNLOAD
• Panda: http://www.pandasecurity.com (Spain) | DOWNLOAD
• Kaspersky: http://www.kaspersky.com/ (Russia) | DOWNLOAD
• Symantec (Norton): http://www.symantec.com (USA) | DOWNLOAD
• Mcafee: http://www.mcafee.com (USA) | DOWNLOAD
• TrendMicro: http://www.trendmicro.com/ (USA) | DOWNLOAD
• Microsoft Security Essentials: http://www.microsoft.com/en-in/security_essentials/ (USA) | DOWNLOAD (includes Windows Update, Windows Defender, Firewall & BitLocker)

VM

• InsightVM: https://www.rapid7.com/products/insightvm/

TESTING

• EICAR - industry standard (non-harmful) virus test file: http://eicar.org/anti_virus_test_file.htm

• Merlin: https://github.com/Ne0nd0g/merlin

DATA

• JAVA -- Apache Santuario: http://santuario.apache.org/ (xml-sec library)
• PHP -- xml-sec library: http://github.com/robrichards/xmlseclibs

Monitoring

TripWire

• TripWire: http://www.tripwire.com/
• Tripwire vs Puppet: https://www.upguard.com/articles/tripwire-vs-puppet

Scanning

• wikipedia: Dynamic Application Security Testing
• wikipedia: Burp suite
• wikipedia: w3af
• Tsunami: https://github.com/google/tsunami-security-scanner/blob/master/docs/orchestration.md | SRC | PLUGINS (general purpose network security scanner)

OWASP

Open Web Application Security Project (OWASP).

• Open Web Application Security Project (OWASP): http://www.owasp.org/index.php/Main_Page
• OWASP Top Ten Cheat Sheet: https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet | 2017 | 2013 | OWASP - Top 10 (2013)
• OWASP -- Security Testing Checklist: https://www.owasp.org/index.php/Testing_Checklist
• OWASP -- API Security Top 10: https://www.owasp.org/index.php/OWASP_API_Security_Project | 2019
• OWASP Mobile Top 10: https://owasp.org/www-project-mobile-top-10/
• OWASP Benchmark: https://www.owasp.org/index.php/Benchmark
• OWASP -- WebApp Security Testing checklist: https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet
• OWASP Secure Coding Practices - Quick Reference Guide: https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide
• OWASP -- Sample WebApp (with vulnerabilities) - "Juice Shop": https://owasp.herokuapp.com/#/search

DepedencyTrack

• OWASP - DependencyTrack: https://dependencytrack.org/ | DOCS | SRC | Jenkins plugin (creates an automated BoM, Bill of Materials)

DependencyCheck

• OWASP - DependencyCheck: https://www.owasp.org/index.php/OWASP_Dependency_Check | DOCS | SRC | Jenkins plugin

API Security

• A guide to the OWASP API top ten: https://blog.shiftleft.io/a-guide-to-the-owasp-api-top-ten-3f86e49ec3dc

ZAP

• Zed Attack Proxy (ZAP): https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project | SRC | DOCS
• Using ZAP-proxy and nginx to debug and tamper with HTTP traffic – Emulate timeouts and other unexpected behaviour: https://vanwilgenburg.wordpress.com/2018/10/02/zap-proxy-and-nginx/

MetaSploit

• MetaSploit - Penetration Testing framework: https://www.metasploit.com/

Arachni

• Arachni: https://www.arachni-scanner.com | SRC (free, simple, distributed, intelligent, powerful, friendly application security scanner with network/SSL scanning capabilities)

Minion

• Minion: https://wiki.mozilla.org/Security/Projects/Minion | SRC | DOCS(Mozilla's Security Scanning tool that incorporates ZAP and other tools)

Resources

• DevSecOps -- manifesto: https://www.devsecops.org
• ISO/IEC 27001 - INFORMATION SECURITY MANAGEMENT: https://www.iso.org/isoiec-27001-information-security.html | PDF
• Pragmatic Web Security - Free & Low-cost IT Security courses: https://courses.pragmaticwebsecurity.com/users/sign_in

• TIPS, TOOLS AND HOW-TOS FOR SAFER ONLINE COMMUNICATIONS: https://ssd.eff.org/en#index
• National Institute of Standards & Technology (NIST) -- Cybersecurity and Infrastructure Security Agency (CISA) -- Defending Against Software Supply Chain Attacks: https://www.cisa.gov/sites/default/files/publications/defending_against_software_supply_chain_attacks_508.pdf
• NIST -- Framework for Improving - Critical Infrastructure Cybersecurity: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf

• Security Levels (CANADA) -- Protected A, B, C & Classified Confidential, Secret, Top-Secret: http://iss-ssi.pwgsc-tpsgc.gc.ca/outils-tools/ns-sl-eng.html | DIAGRAM
• Forrester - The State Of Application Security (2020): https://reprints.forrester.com/#/assets/2/1855/RES159057/reports
• Personal Information Protection and Electronic Documents Act (PIPEDA): http://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html (CANADA - law to govern the collection, use and disclosure of personal information)
• Secure Electronic Signature Regulations: http://laws-lois.justice.gc.ca/eng/regulations/SOR-2005-30/?showtoc=&instrumentnumber=SOR-2005-30
• RCMP - Canadian Firearms Ownership program: http://www.rcmp-grc.gc.ca/cfp-pcaf/index-eng.htm (Canadians can own, but requires special license and completion of three courses)
• FTC - Identity Theft prevention/recovery (US): https://www.consumer.ftc.gov/features/feature-0014-identity-theft
• UN -- Sanctions List: https://www.un.org/securitycouncil/sanctions/2374/materials (persons suspected of TF Terrorism Financing)

• Web Developer Security Checklist: https://medium.com/simple-security/web-developer-security-checklist-f2e4f43c9c56
• Introducing the InfoSec colour wheel — blending developers with red and blue security teams: https://medium.com/hackernoon/introducing-the-infosec-colour-wheel-blending-developers-with-red-and-blue-security-teams-6437c1a07700
• MozDev -- Web Security: https://developer.mozilla.org/en-US/docs/Web/Security
• InfoSec Institute -- Practice Exercises & Lab Files: https://www2.infosecinstitute.com/l/12882/2013-12-17/78gmt
• SecLists -- the security tester's companion: https://github.com/danielmiessler/SecLists (multiple types of lists used during security assessments, collected in one place including: usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more)
• E-Security group: http://www.esecurity.org.my
• Security Engineering — The Book (free e-edition): http://www.cl.cam.ac.uk/~rja14/book.html
• Learn Security: http://www.learnsecurity.com
• Web Dev Checklist: http://webdevchecklist.com/
• What Developers Need to Know About Java Security: https://www.java.com/en/security/developer-info.jsp
• Easy "Password Recovery" (or cracking) with these 5 applications: http://www.techrepublic.com/photos/easy-password-recovery-with-these-five-applications/6397760
• Beyond Passwords: 2FA, U2F and Google Advanced Protection: https://www.troyhunt.com/beyond-passwords-2fa-u2f-and-google-advanced-protection/
• The CIA Triad -- Confidentiality, Integrity, Availability: http://www.techrepublic.com/blog/it-security/the-cia-triad/ (well-known model for security policy development, used to identify problem areas and necessary solutions for information security)
• Keyless Lock Store: http://www.nokey.com/
• InfoSec & AppSec at PoolParty: https://www.poolparty.biz/wp-content/uploads/2019/02/PoolParty-Security-White-Paper_FINAL-1.pdf
• Enterprise/Corporate Security Awareness Training service: http://www.securingthehuman.org/
• Krebs On Security: https://krebsonsecurity.com/
• Project Shield: https://jigsaw.google.com/projects/#project-shield (Google-sponsored project to protect free-speech of journalists and others targeted by DDOS attacks)
• Same-origin policy: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy
• OWASP - HTML5 Security Cheat Sheet: https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet
• OWASP - Secure SDLC Cheat Sheet: ahttps://www.owasp.org/index.php/Secure_SDLC_Cheat_Sheet
• OWASP - Application Security Verification Standard (ASVS): https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
• OWASP - Testing Guide Introduction: https://www.owasp.org/index.php/Testing_Guide_Introduction
• OWASP - Proactive Controls: https://www.owasp.org/index.php/OWASP_Proactive_Controls
• X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
• Application Security Weekly (PODCAST): https://wiki.securityweekly.com/Application_Security_Weekly_Show_Notes | FEED
• SecurityJourney -- Application Security (PODCAST): https://securityjourney.com/application-security-podcast/ | FEED
• AppSec (PODCAST): https://www.appsecpodcast.org/ | FEED
• Hacker101 -- Capture The Flag (CTF) exercise: https://ctf.hacker101.com/about
• Assetnote Wordlists: https://wordlists.assetnote.io (high quality "wordlists" for content & subdomain discovery, specific to particular platforms)
• Gartner Report -- Hype Cycle for Application Security (2021): https://www.appdynamics.com/resources/reports/gartner-application-security-hype-cycle-report
• API Security Best Practices "Mega" Guide: https://expeditedsecurity.com/api-security-best-practices-megaguide/

Vulnerability Registries

• Oracle Security notices: https://www.oracle.com/security-alerts/
• Adobe Security bulletins: https://helpx.adobe.com/security.html
• Cisco Security advisories: https://tools.cisco.com/security/center/publicationListing.x | EXAMPLE - VPN
• Microsoft Technical Security notifications: https://www.microsoft.com/en-us/msrc/technical-security-notifications
• Apple Security updates: https://support.apple.com/en-us/HT201222
• Google - Open Source Vulnerabilities (OSV): https://osv.dev/

Vulnerable Websites/WebApps (for PenTesting)

• OWASP -- Vulnerable Web Application: https://github.com/OWASP/Vulnerable-Web-Application (website that is prepared for people who are interested in web penetration including intentional known vulnerabilities such as: Command Execution, File Inclusion, File Upload, SQL and XSS)
• Damn Vulnerable Web Application (DVWA): https://dvwa.co.uk/

For more info, see: Penetration Testing

Hacks

• Multiple Log4j scanners released by CISA, CrowdStrike: https://www.zdnet.com/article/multiple-log4j-scanners-released-by-cisa-crowdstrike-more/ | SRC
• NVD -- Apache Log4j2 <=2.14.1 vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 (aka. "LogJam" and/or "Log4Shell" hack)
• CVE -- CVE-2021-44228: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228

Breaches

• Breach-level index: https://www.breachlevelindex.com/
• World's Biggest Data Breaches (INTERACTIVE INFOGRAPHIC): http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
• SECURITIES AND EXCHANGE COMMISSION (SEC) -- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (2022-03-09): https://www.sec.gov/rules/proposed/2022/33-11038.pdf

Identity Theft Resource Center’s 2021 Annual Data Breach Report Sets New Record for Number of Compromises: https://www.idtheftcenter.org/post/identity-theft-resource-center-2021-annual-data-breach-report-sets-new-record-for-number-of-compromises

• Verizon 2018 Data Breach Investigation Report (DBIR) -- Tales of dirty deeds and unscrupulous activities: https://enterprise.verizon.com/resources/reports/dbir/
• CapitalOne 2019 credit card data breach: https://www.capitalone.ca/facts2019/
• Yahoo's $117 Million Data Breach Settlement Moves Forward: https://www.mediapost.com/publications/article/338495/yahoos-117-million-data-breach-settlement-moves.html
• Everything You Need to Know About The Adobe Data Exposure: https://solutionsreview.com/identity-management/everything-you-need-to-know-about-the-adobe-data-exposure/
• Wyze customers hit by online data leak, company confirms: https://www.digitaltrends.com/home/wyze-customers-hit-by-online-data-leak-company-confirms/
• After latest hack, experts say "Smart Home" security systems stink at securing data: https://www.digitaltrends.com/news/wyze-data-hack-protection/
• British Airways (BA) Hack Shows That Our 20th Century Methods Have Produced A Fragile Digital World: https://medium.com/@billatnapier/ba-hack-shows-that-our-20th-century-methods-have-produced-a-fragile-digital-world-82fb7931b6df
• App Analysis -- Plenty of Fish (data breach): https://theappanalyst.com/plentyoffish.html

• New Details Indicate That Scope of the 2019 MGM Data Breach Is Much Bigger Than Expected: https://www.cpomagazine.com/cyber-security/new-details-indicate-that-scope-of-the-2019-mgm-data-breach-is-much-bigger-than-expected/
• Critical, High-Severity Cisco Flaws Fixed in Data Center Network Manager (DCNM): https://threatpost.com/critical-high-severity-cisco-flaws-fixed-data-center-network-manager/157861/

• CRA shuts down online services after thousands of accounts breached in cyberattacks: https://www.cbc.ca/news/politics/canada-revenue-agency-cra-cyberattack-1.5688163

• Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

• API Security -- Issue 129 - Facebook and Clubhouse profiles scraped through APIs, Forrester’s “State of Application Security, 2021”: https://apisecurity.io/issue-129-facebook-clubhouse-profiles-scraped-apis-forresters-state-application-security-2021/

• Most Microsoft 365 Users Hit With Email Data Breaches, Study Claims: https://www.mediapost.com/publications/article/363183/most-microsoft-365-users-hit-with-email-data-breac.html
• LinkedIn Leaks 93% of Users’ Data—Refuses Blame for Breach: https://securityboulevard.com/2021/07/linkedin-leaks-93-of-users-data-refuses-blame-for-breach/
• Air India says February’s data breach affected 4.5 mln passengers: https://www.reuters.com/world/india/air-india-says-februarys-data-breach-affected-45-mln-passengers-2021-05-21/
• REPORT - how cybercriminals abuse API keys to steal millions (from CryptoCurrency Exchanges): https://cybernews.com/security/report-how-cybercriminals-abuse-api-keys-to-steal-millions/
• US Soldiers Expose Nuclear Weapons Secrets via "Flashcard/E-Learning Apps": https://www.bellingcat.com/news/2021/05/28/us-soldiers-expose-nuclear-weapons-secrets-via-flashcard-apps/
• Flaws in third-party software exposed dozens of Teslas to remote access: https://techcrunch.com/2022/01/24/teslamate-bug-teslas-exposed-remote/

Tutorials

• 9 Useful Tips For Linux Server Security: https://dzone.com/articles/9-useful-tips-for-linux-server-security
• Salted Password Hashing - Doing it Right: https://www.codeproject.com/Articles/704865/Salted-Password-Hashing-Doing-it-Right
• Serious Form Security: https://css-tricks.com/serious-form-security/
• Understanding Hash Functions and Keeping Passwords Safe: http://net.tutsplus.com/tutorials/php/understanding-hash-functions-and-keeping-passwords-safe/
• How To Safely Store A Password: https://codahale.com/how-to-safely-store-a-password/

• MD5 Hash Check Tutorial: http://www.hostknox.com/tutorials/miscellaneous/md5-hash-check
• A Java keytool certificate example - using keytool with certificate files: http://alvinalexander.com/java/java-using-keytool-certificate-file-create
• Generate Public and Private Keys within code (in Java): http://docs.oracle.com/javase/tutorial/security/apisign/step2.html
• Generate Keys for signing (Java) code from command-line: http://docs.oracle.com/javase/tutorial/security/toolsign/step3.html
• Understanding Java Keytool Keystore Commands: https://dzone.com/articles/understand-java-keytool-keystore-commands
• Cryptography with Java: http://www.informit.com/articles/article.aspx?p=170967&seqnum=4&rll=1
• Steganography (in Java): http://www.dreamincode.net/forums/topic/27950-steganography/
• Hashing in Java: https://www.owasp.org/index.php/Hashing_Java (OWASP project)

• Prevention of SQL Injection (Java): https://www.owasp.org/index.php/Preventing_SQL_Injection_in_Java
• Trackr is now open source and shows some useful Security best-practices: http://blog.techdev.de/trackr-is-now-open-source/
• How to lock down Linux: http://www.zdnet.com/blog/open-source/how-to-lock-down-linux/9665
• AVG vs avast: http://anti-virus-software-review.toptenreviews.com/avg-vs-avast.html (battle of the free anti-virus software apps)
• AngularJS & Spring Security -- Part I - A Secure Single Page Application: http://spring.io/blog/2015/01/12/spring-and-angular-js-a-secure-single-page-application
• AngularJS & Spring Security -- Part II - The Login Page: http://java.dzone.com/articles/login-page-angular-js-and
• AngularJS & Spring Security -- Part III - (Securing) The Resource Server: http://spring.io/blog/2015/01/20/the-resource-server-angular-js-and-spring-security-part-iii
• AngularJS & Spring Security -- Part IV - The API (Security) Gateway Pattern: http://spring.io/blog/2015/01/28/the-api-gateway-pattern-angular-js-and-spring-security-part-iv
• AngularJS & Spring Security -- Part V - SSO with OAuth2: http://java.dzone.com/articles/sso-oauth2-angular-js-and
• Your Password is Too Damn Short: http://blog.codinghorror.com/your-password-is-too-damn-short/ (design decisions in application authentication/authorization)
• Secure Existing RESTful Services with nginx proxy - No Need to Change Code: https://dzone.com/articles/secure-existing-restful-services-no-need-for-chang

• The Basics of Java Security: https://www.baeldung.com/java-security-overview
• An Introduction to Java SASL: https://www.baeldung.com/java-sasl
• Realistic password strength estimation: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/
• Passwords vs. Pass Phrases: https://blog.codinghorror.com/passwords-vs-pass-phrases/

• Secure your web application with these HTTP headers: https://medium.freecodecamp.org/secure-your-web-application-with-these-http-headers-fd66e0367628
• The JavaScript Supply Chain Paradox - SRI, CSP and Trust in Third Party Libraries: https://www.troyhunt.com/the-javascript-supply-chain-paradox-sri-csp-and-trust-in-third-party-libraries/
• I’m harvesting credit card numbers and passwords from your site. Here’s how: https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 (npm packages, minification/obsfucation, lack of proper CSP, 3rd-party libs, Google Tag Manager & Google Analytics all add additional risks)
• Hacker Noon -- Part 2 - How to stop me harvesting credit card numbers and passwords from your site: https://hackernoon.com/part-2-how-to-stop-me-harvesting-credit-card-numbers-and-passwords-from-your-site-844f739659b9
• Dev corrupts NPM libs 'colors' and 'faker' breaking thousands of apps: https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/
• Pro-Ukraine sabotage renews scrutiny on open source security: https://www.techtarget.com/searchitoperations/news/252515031/Pro-Ukraine-sabotage-renews-scrutiny-on-open-source-security?utm_campaign=20220325_Pro-Ukraine+protests+put+open+source+in+the+spotlight&utm_medium=EM&utm_source=NLN&track=NL-1806&ad=940650&asrc=EM_NLN_212627293
• Abusing JSONP with Rosetta Flash: https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
• Intercept HTTP traffic with Burp Proxy: https://portswigger.net/burp/documentation/desktop/getting-started/intercepting-http-traffic

• Spring Security for a REST API: http://www.baeldung.com/securing-a-restful-web-service-with-spring-security
• Spring Security – security none, filters none, access permitAll: https://www.baeldung.com/security-none-filters-none-access-permitAll
• An Overview of the Security Ecosystem in Programming: https://blog.codeship.com/an-overview-of-the-security-ecosystem-in-program/
• How Time-based One-Time Passwords work and why you should use them in your app: https://medium.freecodecamp.org/how-time-based-one-time-passwords-work-and-why-you-should-use-them-in-your-app-fdd2b9ed43c3
• Everything you need to know about passwordless logins: https://thisdata.com/blog/an-introduction-to-passwordless-logins/

• Unrestricted File Upload: https://www.owasp.org/index.php/Unrestricted_File_Upload
• How to Prevent File Upload Vulnerabilities: https://www.wordfence.com/learn/how-to-prevent-file-upload-vulnerabilities/
• Limit the size of a File Upload (HTML input, via JS): https://stackoverflow.com/questions/5697605/limit-the-size-of-an-file-upload-html-input (not totally secure but a good first check worth doing)
• FileUpload protection against Malicious files: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Protect_FileUpload_Against_Malicious_File.md

• DevSecOps -- What it is and how it can help you innovate in cybersecurity: https://www.zdnet.com/article/devsecops-what-it-is-and-how-it-can-help-you-innovate-in-cybersecurity/
• Ways to Plan a Vulnerability Test Over a Web Application Using OWASP ZAP: https://www.indusface.com/blog/ways-to-plan-a-vulnerability-test-over-a-web-application-using-owasp-zap/
• Security DevOps - Free pentesters' time to focus on high-hanging fruits // HackPra 2015: https://www.slideshare.net/cschneider4711/hackpra-2015-security-devops-free-pentesters-time-to-focus-on-highhanging-fruits
• How to secure your application secrets with Environment variables: https://medium.com/chingu/protect-application-assets-how-to-secure-your-secrets-a4165550c5fb
• Securing a Webapp series: Step 0 - An Introduction
• Please Stop Writing Your Own User Authentication Code: https://betterprogramming.pub/stop-writing-your-own-user-authentication-code-e8bb50388ec4
• 1000$ for "Open Redirect" via unknown technique (BugBounty writeup): https://ruvlol.medium.com/1000-for-open-redirect-via-unknown-technique-675f5815e38a
• The Confessions of Marcus Hutchins, the Hacker Who Saved the Internet: https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/?utm_source=pocket-newtab

External Links

• wikipedia: Physical security
• wikipedia: Key (lock)
• wikipedia: Remote keyless system
• wikipedia: Identity document
• wikipedia: Smart card
• wikipedia: Magnetic stripe card
• wikipedia: Proximity card
• wikipedia: Common Access Card
• wikipedia: Electronic data interchange personal identifier
• wikipedia: Pretty Good Privacy
• wikipedia: Password
• wikipedia: Web development#Security_considerations
• wikipedia: Web application security
• wikipedia: Information security
• wikipedia: Classified information
• wikipedia: Hash-based message authentication code (HMAC)
• wikipedia: Zero-day attack
• wikipedia: Chinese intelligence operations in the United States
• wikipedia: Computer Fraud and Abuse Act
• wikipedia: Security information and event management (SIEM)
• wikipedia: Resilient control systems
• wikipedia: Cyber resilience
• wikipedia: Resilience (network)
• China buys Google (APRIL FOOLS): http://www.theregister.co.uk/2006/04/01/china_buys_google/
• China now has 'Pervasive access' to 80% of telecoms (NO JOKE): http://mobile.wnd.com/2012/07/chinese-have-pervasive-access-to-80-of-worlds-telecoms/
• China's Cyber-Army Ready to March on US: http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article2409865.ece
• Giant Internet Worm set to Change Tactics April Fools Day: http://www.japantoday.com/category/technology/view/giant-internet-worm-set-to-change-tactics-april-1
• Why is nobody using SSL client certificates?: http://pilif.github.com/2008/05/why-is-nobody-using-ssl-client-certificates/
• Google Hack Attack Was Ultra Sophisticated, New Details ShowRead More http://www.wired.com/threatlevel/2010/01/operation-aurora/#ixzz0n1KqnBoY: http://www.wired.com/threatlevel/2010/01/operation-aurora/
• Hackers Crack Internet Encryption: Should You Be Worried?: http://www.cio.com/article/690942/Hackers_Crack_Internet_Encryption_Should_You_Be_Worried_
• New attack bypasses EVERY Windows security product: http://www.zdnet.com/blog/hardware/update-new-attack-bypasses-every-windows-security-product/8268
• Information insecurity - businesses not ready for cyber crime wave: http://www.smartplanet.com/business/blog/business-brains/information-insecurity-businesses-not-ready-for-cyber-crime-wave/10063/
• Iranian, Chinese Computers Also Discovered to Have Been Hacking D.C. Internet Voting System: http://www.bradblog.com/?p=8118
• Security Startups Become Hot Acquisition Targets (to the tune of $10 Billion): http://www.devx.com/security/Article/45867?trk=DXRSS_
• Statistics from 10,000 leaked Hotmail passwords: http://www.acunetix.com/blog/news/statistics-from-10000-leaked-hotmail-passwords/
• The Top 50 Gawker Media Passwords: http://blogs.wsj.com/digits/2010/12/13/the-top-50-gawker-media-passwords/
• Hacking attacks from China hit energy companies worldwide: http://www.zdnet.com/blog/security/hacking-attacks-from-china-hit-energy-companies-worldwide/8119?tag=nl.e539
• DDoS -- How to take down WikiLeaks, MasterCard or any other Web site: http://www.zdnet.com/blog/networking/ddos-how-to-take-down-wikileaks-mastercard-or-any-other-web-site/422
• More customers exposed as big data breach grows: http://ca.news.yahoo.com/citi-capital-one-involved-widening-data-breach-20110403-091151-340.html
• The New RBAC: Resource-Based Access Control: http://www.katasoft.com/blog/2011/05/09/new-rbac-resource-based-access-control
• What is Phishing – eBay Phishing Examples: http://www.bustathief.com/what-is-phishing-ebay-phishing-examples/
• Phishing with Unicode Domains: https://www.xudongz.com/blog/2017/idn-phishing/ (browsers will patch, but for now "https://www.xn--80ak6aa92e.com" UTF-16 domain name appears as "https://www.apple.com")
• Bing ads lead to more malware; new Mac Trojan in the wild: http://www.zdnet.com/blog/bott/bing-ads-lead-to-more-malware-new-mac-trojan-in-the-wild/3702
• How to become a hacker: http://www.zdnet.com/blog/security/how-to-become-a-hacker/9501
• One in five Microsoft logins are in hands of hackers: http://www.zdnet.com/one-in-five-microsoft-logins-are-in-hands-of-hackers-7000000969/
• How I Might Have Hacked Any Microsoft Account: https://thezerohack.com/how-i-might-have-hacked-any-microsoft-account
• 25 most-used passwords revealed: Is yours one of them?: http://www.zdnet.com/blog/security/25-most-used-passwords-revealed-is-yours-one-of-them/12427
• Hacker Will Expose Potential Security Flaw In Four Million Hotel Room Keycard Locks: http://www.forbes.com/sites/andygreenberg/2012/07/23/hacker-will-expose-potential-security-flaw-in-more-than-four-million-hotel-room-keycard-locks/
• Facebook flaw allowed websites to steal users' personal data without consent: http://nakedsecurity.sophos.com/2011/02/02/facebook-flaw-websites-steal-personal-data/
• Java zero day skyrockets BlackHole exploit success rates: http://www.zdnet.com/java-zero-day-skyrockets-blackhole-exploit-success-rates-7000003467/
• The Password Fallacy - Why Our Security System Is Broken, and How to Fix It: http://www.theatlantic.com/technology/archive/2012/09/the-password-fallacy-why-our-security-system-is-broken-and-how-to-fix-it/262155/
• Chip-and-PIN flaw blamed for cloned bank cards: http://www.zdnet.com/chip-and-pin-flaw-blamed-for-cloned-bank-cards-7000004130/?s_cid=e539
• FTC Takes Aim at Tech Support Scareware Scams: http://www.eweek.com/security/ftc-takes-aim-at-tech-support-scareware-scams/?kc=EWKNLEDP10052012B
• 10 Best Antivirus For Enterprises: http://http://www.siliconindia.com/news/enterpriseit/10-Best-Antivirus-For-Enterprises-nid-128221-cid-7.html
• Which is the most popular (consumer) antivirus software?: http://www.zdnet.com/blog/security/which-is-the-most-popular-antivirus-software/12608
• Google Declares War on the Password: http://www.wired.com/wiredenterprise/2013/01/google-password/all/
• Homeland Security - Disable UPnP as tens of millions at risk: http://www.zdnet.com/homeland-security-disable-upnp-as-tens-of-millions-at-risk-7000010512/
• As Nasdaq's site hit by hackers, report says half of world's exchanges suffered cyberattacks: http://www.zdnet.com/as-nasdaqs-site-hit-by-hackers-report-says-half-of-worlds-exchanges-suffered-cyberattacks-7000018243/
• Wall Street False Flag Watch – Cybersecurity Exercise – Quantum Dawn 2 – Cyberattack Drill Aims To Cripple The Financial Services Networks Across America: http://investmentwatchblog.com/wall-street-false-flag-watch-cybersecurity-exercise-quantum-dawn-2-cyberattack-drill-aims-to-cripple-the-financial-services-networks-across-america/
• 2014 - The year everyone's security took a hit: http://www.zdnet.com/2014-the-year-everyones-security-took-a-hit-7000036224/
• Google nudges 'End-to-End' encryption alpha forward with Yahoo ideas: http://www.zdnet.com/article/google-nudges-end-to-end-encryption-alpha-forward-with-yahoo-ideas/
• FBI warns of 'destructive' malware following Sony hack: http://www.zdnet.com/article/fbi-warns-of-destructive-malware-following-sony-hack/
• Snowden docs reveal NSA digital warfare capabilities: http://www.zdnet.com/article/snowden-docs-reveal-nsa-digital-warfare-capabilities/
• GCHQ, NSA cyber war games will test bank security: http://www.zdnet.com/article/gchq-nsa-cyber-war-games-will-test-bank-security/
• The Benefits of Using a Keypad Door Lock: http://www.doityourself.com/stry/the-benefits-of-using-a-keypad-door-lock
• Closing the Barn Door on Software Security: http://blog.parasoft.com/closing-the-barn-door-on-software-security
• The 10 Most Important Security Controls Missing in JavaEE: http://eclipse.dzone.com/articles/10-most-important-security
• Fitness Tracking (wearable device market) goes under the Security spotlight: http://www.cnet.com/news/fitness-tracking-goes-under-the-security-spotlight/
• Should companies have to detail state of tech infrastructure?: http://www.zdnet.com/article/should-companies-have-to-details-state-of-tech-infrastructure/
• Hackers impersonating IT staff popular tactic in data breaches, FireEye finds: http://www.zdnet.com/article/hackers-impersonating-it-departments-becomes-popular-tactic-in-data-breaches-fireeye-finds/
• Does Facebook know my Password?: http://www.quora.com/Does-Facebook-know-my-password
• Bigger than Heartbleed, 'Venom' security vulnerability threatens most datacenters: http://www.zdnet.com/article/venom-security-flaw-millions-of-virtual-machines-datacenters/
• For Venom security flaw, the fix is in -- Patch your VM today: http://www.zdnet.com/article/venom-the-anti-toxin-is-here/
• Jeep Hacker Says IoT Security a Complex Issue: http://www.eweek.com/security/jeep-hacker-says-iot-security-a-complex-issue.html
• How one of the biggest data thefts in US history could have been stopped by basic security: http://www.zdnet.com/article/how-one-of-the-biggest-data-thefts-in-us-history-could-have-been-stopped-by-basic-security/ (Sophisticated attack on the OPM gave hackers access to 'most intimate and embarrassing details' of the lives of millions of government workers and their fingerprints in attack.)
• Your dentist is probably using horribly insecure patient software: http://www.zdnet.com/article/horribly-insecure-dentist-software-has-backdoor-flaws/ (3 popular dental practice mgmt. suites compromised: OpenDental, Dentrix, Dentsply-Sirona CDR DICOM)
• Hackers in the house -- Why your IoT devices may have already joined a botnet: http://www.zdnet.com/article/hackers-in-the-house-why-your-iot-devices-may-have-already-joined-a-botnet/
• A SSHowDowN in security -- IoT devices enslaved through 12 year old OpenSSH flaw: http://www.zdnet.com/article/a-sshowdown-in-security-iot-devices-attack-devices-through-12-year-old-flaw/

• The Dropbox hack is real: https://www.troyhunt.com/the-dropbox-hack-is-real/
• 500 million Yahoo users hacked: How to protect yourself: http://www.zdnet.com/article/how-to-protect-your-busted-yahoo-account/
• Yahoo attack not 'state-sponsored,' researchers claim: http://www.zdnet.com/article/yahoo-attack-not-state-sponsored-researchers-claim/
• Inside Google’s Internet Justice League and Its AI-Powered War on Trolls (as well as Phishers, Spammers & Cyber-criminals in general): https://www.wired.com/2016/09/inside-googles-internet-justice-league-ai-powered-war-trolls/
• The most vulnerable software vendors of 2015: http://www.itproportal.com/2016/01/13/the-most-vulnerable-software-vendors-of-2015/ (Apple surpasses Microsoft with most vulnerabilities for a software vendor)
• Internet Explorer does not support user names and passwords in Web site addresses (HTTP or HTTPS URLs): https://support.microsoft.com/en-us/kb/834489 (as of MS security update 832894)
• 10 Talks on Internet Safety/Security: http://www.trendhunter.com/course/internet-safety
• Atlassian's Severity Levels for Security Issues: https://www.atlassian.com/trust/security/security-severity-levels
• Top-Secret NSA Report Details Russian Hacking Effort Days Before 2016 Election: http://theintercept.com/2017/06/05/top-secret-nsa-report-details-russian-hacking-effort-days-before-2016-election/
• Equifax breach exposes 143 million people to identity theft: http://www.msn.com/en-ca/money/topstories/equifax-breach-exposes-143-million-people-to-identity-theft/ar-AArtEdT?li=AAgh0dA&OCID=ansmsnnews11
• Canadians among 143 million people affected in Equifax hack: https://www.thestar.com/business/2017/09/07/equifax-says-data-breach-may-affect-143-million-people-in-us.html
• How To Find Out If You've Been Hit By The Equifax Hack: http://www.huffingtonpost.ca/entry/how-to-check-equifax-security-hack_us_59b1f8a5e4b0354e4410c754 (ironically enough state that you need to provide your Social Insurance# to find out if your data, including SIN# was stolen)
• How To Protect Yourself From The Equifax Hack: https://medium.com/new-york-state-attorney-general/how-to-protect-yourself-from-the-equifax-hack-3ba5d8c231b7
• Equifax to offer free locking of credit files for life — unless you're Canadian http://www.cbc.ca/news/business/equifax-ceo-letter-1.4311856
• Equifax Hackers (4 members of Chinese Military PLA) Charged with Crime: https://www.infoq.com/news/2020/02/equifax-charges/
• Deloitte Gets Hacked - What We Know So Far: http://fortune.com/2017/09/25/deloitte-hack/
• One of the World's Biggest Accounting Firms Hacked After Basic Security Goof: https://gizmodo.com/one-of-the-worlds-biggest-accounting-firms-hacked-after-1818722565
• Global accounting firm Deloitte hacked: http://www.cbc.ca/news/technology/deloitte-hacked-1.4306018
• New York AG Looks Into Deloitte Data Breach: https://www.mediapost.com/publications/article/308737/new-york-ag-looks-into-deloitte-data-breach.html
• Data Breach Denial - Few Firms Are Focused On The Threat: https://www.mediapost.com/publications/article/315164/data-breach-denial-few-firms-are-focused-on-the-t.html
• The Biggest Data Breaches of 2017 (INFOGRAPHIC): http://interactive.howwegettonext.com/2017databreaches/ (an interactive visual timeline of the year's largest data breaches)
• I've Just Added 2,844 New Data Breaches With 80M Records To "Have I Been Pwned": https://www.troyhunt.com/ive-just-added-2844-new-data-breaches-with-80m-records-to-have-i-been-pwned/
• The CIA just lost control of its hacking arsenal. Here’s what you need to know: https://medium.freecodecamp.org/the-cia-just-lost-control-of-its-hacking-arsenal-heres-what-you-need-to-know-ea69fc1ce38c
• 11 Tell-Tale Signs Your Accounts and Devices Have Been Hacked: https://fieldguide.gizmodo.com/11-tell-tale-signs-your-accounts-and-devices-have-been-1824183422
• 5 ways security testing teams can tackle new source-code attacks: https://techbeacon.com/5-ways-security-testing-teams-can-tackle-new-source-code-attacks
• 150,000,000 Accounts Just Hacked: https://blog.producthunt.com/150-000-000-accounts-just-hacked-c719dbe14eaa
• Intro to "fuzz testing" -- How to prevent your next epic QA fail: https://techbeacon.com/intro-fuzz-testing-how-prevent-your-next-epic-qa-fail-easy-way
• How I gained commit access to Homebrew in 30 minutes: https://medium.com/@vesirin/how-i-gained-commit-access-to-homebrew-in-30-minutes-2ae314df03ab (Homebrew's Jenkins CI server was open to all, no logins required, exposed GitHub API token in the raw in "Environment Variables" section, that token had write access, no branch restrictions in place so anyone could push a change directly to master without PR or Code Review, but ethical hacker did not use this permission to push bad/unwanted changes)
• How I used a simple Google query to mine passwords from dozens of public Trello boards: https://medium.freecodecamp.org/discovering-the-hidden-mine-of-credentials-and-sensitive-information-8e5ccfef2724
• Pwned Passwords in Practice -- Real World Examples of Blocking the Worst Passwords: https://www.troyhunt.com/pwned-passwords-in-practice-real-world-examples-of-blocking-the-worst-passwords/
• Choosing A Master Password: https://medium.com/edgefund/choosing-a-master-password-5d585b2ba568
• How to Do Passwords Right in 2018: https://gizmodo.com/how-to-do-passwords-right-in-2018-1829707273
• Fiat–Shamir with a secret password: https://asecuritysite.com/encryption/fiat2
• A Recent Startup Breach Exposed Billions of Data Points: https://www.wired.com/story/apollo-breach-linkedin-salesforce-data/
• Here's Why [Insert Thing Here] Is Not a Password Killer: https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a-password-killer/
• Japan's cyber security minister admits never having used computer: https://japantoday.com/category/politics/Japan%27s-cyber-security-minister-admits-never-having-used-computer
• Why You Shouldn’t Use Facebook to Log In to Other Sites: https://medium.com/the-new-york-times/why-you-shouldnt-use-facebook-to-log-in-to-other-sites-b6827fdb1f21
• Researchers Find First Major Kubernetes Flaw: https://www.infosecurity-magazine.com/news/researchers-find-first-major/
• Kubernetes privilege escalation and access to sensitive information in OpenShift products and services - CVE-2018-1002105 : https://access.redhat.com/security/vulnerabilities/3716411
• Quora data breach exposes 100 million users' personal info: https://www.cbsnews.com/news/quora-data-breach-exposes-100-million-users-personal-info-2018-12-04/
• New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom: https://medium.com/bloomberg/new-evidence-of-hacked-supermicro-hardware-found-in-u-s-telecom-e1a4ac6dd400
• How to deliver security as code -- 11 tips to get started: https://techbeacon.com/how-deliver-security-code-11-tips-get-started
• Why 2-Factor Authentication Isn't Foolproof: https://www.avanan.com/resources/why-2-factor-authentication-isnt-foolproof
• DevSecOps, Threat Modelling and You - Get started using the STRIDE method: https://medium.com/@brunoamaroalmeida/devsecops-threat-modelling-and-you-get-started-using-the-stride-method-85d143ab86f4
• Microsoft Reports Hacking Of Email Accounts: https://www.mediapost.com/publications/article/334499/microsoft-reports-hacking-of-email-accounts.html
• Docker Hub Database Hack Exposes Sensitive Data of 190K Users: https://www.bleepingcomputer.com/news/security/docker-hub-database-hack-exposes-sensitive-data-of-190k-users/
• Ever Increasing Importance Of Website Security In 2019 & Beyond: https://medium.com/@ClickHere/ever-increasing-importance-of-website-security-in-2019-beyond-c73bfc73486c
• How a trivial cell phone hack is ruining lives: https://www.engadget.com/2019/06/28/cell-phone-hack-is-ruining-lives-identity-theft/
• Inserting Business Logic Security Checks into DevOps Pipelines (WEBINAR): https://www.youtube.com/watch?v=8e5DUCbhVKY

* Capital One Says Data On 106 Million People Was Stolen: https://www.mediapost.com/publications/article/338724/capital-one-says-data-on-106-million-people-was-st.html

• Preparing your enterprise to eliminate passwords: https://www.microsoft.com/security/blog/2019/07/11/preparing-your-enterprise-to-eliminate-passwords/
• Hackers Can Break Into an iPhone Just by Sending a Text: https://www.wired.com/story/imessage-interactionless-hacks-google-project-zero/
• July 2019 AppSec Intelligence Report: Attack Edition: https://www.contrastsecurity.com/security-influencers/july-2019-appsec-intelligence-report-attack-edition
• Sudo Vulnerability Cheat Sheet: Learn All About CVE-2019-14287: https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287
• US National Transportation Library -- Cybersecurity and Intelligent Transportation Systems - Best Practice Guide: https://rosap.ntl.bts.gov/view/dot/42461
• Multiple Git vulnerabilities in 2.24 and older: https://github.blog/2019-12-10-multiple-git-vulnerabilities-in-2-24-and-older/
• Suspicious crontab entry running 'xribfa4' every 15 minutes: https://unix.stackexchange.com/questions/544811/suspicious-crontab-entry-running-xribfa4-every-15-minutes (the signature of a rooted intrusion and "Cryptocurrency Mining Bot")
• API Security Weekly - Issue #64 (PlentyOfFish, Facebook, SonyLIV India, Microsoft Sharepoint): https://dzone.com/articles/api-security-weekly-issue-64
• What Is Taint Analysis and Why Should I Care?: https://dzone.com/articles/what-is-taint-analysis-and-why-should-i-care
• The Mathematics of (Hacking) Passwords: https://getpocket.com/explore/item/the-mathematics-of-hacking-passwords
• Comparison of WebEx Security Versus Zoom Shady Practices: https://securityboulevard.com/2020/04/comparison-of-webex-security-versus-zoom-shady-practices/
• Zoom Recordings exposed: https://securityboulevard.com/2020/04/zoom-recordings-exposed/
• Zoom Security Exploit – Cracking private meeting passwords: https://www.tomanthony.co.uk/blog/zoom-security-exploit-crack-private-meeting-passwords/

• (Ironically enough) "GDPR Compliance Site" Leaks Git Data, Passwords: https://threatpost.com/data-leak-gdpr-advice-site/155199/
• Can Lady Gaga and Madonna get people to take security seriously?: https://media.bitpipe.com/io_14x/io_148038/item_1970834/Can_Lady_Gaga_and_Madonna_get_people_to_take_security_seriously.pdf
• Secure Coding - A Practical Guide: https://resources.whitesourcesoftware.com/blog-whitesource/secure-coding
• FBI warns about attacks (aka. "WebSkimming/E-skimming/Magecart" in checkout process) on Magento online stores via old "Magento Mass Import" (MAGMI) plugin vulnerability: https://www.zdnet.com/article/fbi-warns-about-attacks-on-magento-online-stores-via-old-plugin-vulnerability/
• $100k bug bounty paid out in (JWT) Zero-day in "Sign in with Apple" service: https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/
• Hacking Starbucks and Accessing Nearly 100 Million Customer Records: https://samcurry.net/hacking-starbucks/
• Hardening Firefox against Injection Attacks – The Technical Details : https://blog.mozilla.org/attack-and-defense/2020/07/07/hardening-firefox-against-injection-attacks-the-technical-details/
• Hacking smart devices to convince dementia sufferers to overdose: https://www.pentestpartners.com/security-blog/hacking-smart-devices-to-convince-dementia-sufferers-to-overdose/
• 7 non-negotiable security practices for any Cloud/SaaS product: https://www.atlassian.com/blog/platform/cloud-security-practices
• Cyber Security Stories From 2018 You Should Know About: https://medium.com/threat-intel/cyber-security-stories-2018-5a12b2ff9b54
• US government pushed tech firms to hand over source code: https://www.zdnet.com/article/us-government-pushed-tech-firms-to-hand-over-source-code/
• 13 Security Tips for Front-End Apps: https://medium.com/better-programming/frontend-app-security-439797f57892
• APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations https://us-cert.cisa.gov/ncas/alerts/aa20-283a
• Trump Bans U.S. Transactions On Eight Chinese-Connected Apps, Including Alipay, WeChat: https://www.mediapost.com/publications/article/359265/trump-bans-us-transactions-on-eight-chinese-conn.html
• Should the U.S. Government Fight Back When Businesses Are Cyberattacked?: https://gen.medium.com/should-the-u-s-government-fight-back-when-businesses-are-cyberattacked-21c6a9542d2c
• 10 Java security best practices: https://snyk.io/blog/10-java-security-best-practices/
• Jackson Deserialization Vulnerability: https://snyk.io/blog/jackson-deserialization-vulnerability/
• Linux kernel team rejects University of Minnesota researchers’ apology: https://arstechnica.com/gadgets/2021/04/linux-kernel-team-rejects-university-of-minnesota-researchers-apology/
• Suspected Chinese Hackers Unleash Malware That Can Survive OS Reinstalls: https://medium.com/pcmag-access/suspected-chinese-hackers-unleash-malware-that-can-survive-os-reinstalls-a8b1baaba970
• The Principle of Least Privilege and How JEP 411 Will Have a Negative Impact on Java Security: https://foojay.io/today/why-jep-411-will-have-a-negative-impact-on-java-security/
• AFP used controversial encryption laws in its 'most significant operation in policing history': https://www.zdnet.com/article/australias-encryption-laws-used-by-afp-in-countrys-most-significant-operation-in-policing-history/
• Australian cops, FBI created backdoored "AN0M" chat app, told crims it was secure – then snooped on 9,000 users' plots: https://www.theregister.com/2021/06/08/operation_ironside_anom/
• Sequoia -- A Local Privilege Escalation Vulnerability in Linux’s Filesystem Layer (CVE-2021-33909): https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/sequoia-a-local-privilege-escalation-vulnerability-in-linuxs-filesystem-layer-cve-2021-33909
• Old Dogs, New Tricks - Attackers adopt exotic programming languages (for hacks, malware, ransomware, worms, etc): https://www.blackberry.com/us/en/forms/enterprise/report-old-dogs-new-tricks
• The FBI’s warning to Silicon Valley - China and Russia are trying to turn your employees into spies : https://www.protocol.com/fbi-delta-protocol-economic-espionage
• Critical Bug in "Kalay IoT Protocol" Threatens Millions of Devices: https://duo.com/decipher/critical-bug-in-kalay-iot-protocol-threatens-millions-of-devices
• Widespread credential phishing campaign abuses open redirector links : https://www.microsoft.com/security/blog/2021/08/26/widespread-credential-phishing-campaign-abuses-open-redirector-links/

• The hacker who stole and gave back $600M has been offered a job and reward from the company he stole from: https://www.pcgamer.com/uk/the-hacker-who-stole-and-gave-back-dollar600m-has-been-offered-a-job-and-reward-from-the-company-he-stole-from/
• Microsoft consumers can now completely remove passwords from their accounts: https://sdtimes.com/msft/microsoft-consumers-can-now-completely-remove-passwords-from-their-accounts/
• New security feature in September 2021 Cumulative Update for MS Exchange Server: https://techcommunity.microsoft.com/t5/exchange-team-blog/new-security-feature-in-september-2021-cumulative-update-for/ba-p/2783155
• Undetected Azure Active Directory Brute-Force Attacks: https://www.secureworks.com/research/undetected-azure-active-directory-brute-force-attacks
• Fortinet, Shopify and more report issues after root CA certificate from Lets Encrypt expires: https://www.zdnet.com/article/fortinet-shopify-others-report-issues-after-root-ca-certificate-from-lets-encrypt-expires/
• NCSC under the MOND -- Innovation and Training Division - Assessment of cybersecurity of mobile devices supporting 5G technology sold in Lithuania: https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysis_env3.pdf

• Attacks by Prolific APT41 Tied to Chinese Government: https://securityboulevard.com/2021/10/attacks-by-prolific-apt41-tied-to-chinese-government/
• Russia’s Nobelium Supply Chain Attacks Force U.S. Government’s Hand : https://securityboulevard.com/2021/10/russias-nobelium-supply-chain-attacks-force-u-s-governments-hand/
• I Was Hacked. The Spyware Used Against Me (Pegasus) Makes Us All Vulnerable: https://www.nytimes.com/2021/10/24/insider/hacking-nso-surveillance.html
• FTC -- ISPs are Spying on You, Deal With It: https://securityboulevard.com/2021/10/ftc-isps-are-spying-on-you-isps-deal-with-it/
• CISA, FBI Advise Vigilance as Ukraine Conflict Continues: https://securityboulevard.com/2022/02/cisa-fbi-advise-vigilance-as-ukraine-conflict-continues/
• New API Research Shows 62% Growth in ATOs Targeting Login APIs: https://securityboulevard.com/2022/02/new-api-research-shows-62-growth-in-atos-targeting-login-apis/
• Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure: https://www.cisa.gov/uscert/ncas/alerts/aa22-110a
• US Passes Law Requiring Better Cybercrime Data Collection: https://www.govinfosecurity.com/us-passes-law-requiring-better-cybercrime-data-collection-a-19028
• United States Government (USG), the Department of Homeland Security (DHS), and the Cybersecurity and Infrastructure Security Agency (CISA) -- National Cyber Awareness System - Weak Security Controls and Practices Routinely Exploited for Initial Access: https://www.cisa.gov/uscert/ncas/alerts/aa22-137a
• Elon Musk - Russian efforts to jam Starlink are 'ramping up': https://www.zdnet.com/article/elon-musk-says-russian-efforts-to-jam-starlink-are-ramping-up/
• FBI and NSA say - Stop doing these 10 things that let the hackers in: https://www.zdnet.com/article/fbi-and-nsa-say-stop-doing-these-10-things-that-let-the-hackers-in/ | DOC
• Botnets, Telegram Helped Criminals Steal $163B in COVID Aid: https://securityboulevard.com/2022/05/botnets-telegram-helped-criminals-steal-163b-in-covid-aid/
• State-Backed Hacker Believed to Be Behind Follina Attacks on EU and US: https://www.infosecurity-magazine.com/news/statebacked-hacker-follina-attacks/

See Also

WebApp | Web Service | Penetration Testing | Surveillance | Identification | Authentication | Authorization | Encryption | HTTPS | SSL | TLS | XSS | PGP | VPN | P2P | Network Firewall | TechDebt | DarkWeb | Quantum Computing