Skip to content

Latest commit

 

History

History
executable file
·
1014 lines (928 loc) · 133 KB

Basic.md

File metadata and controls

executable file
·
1014 lines (928 loc) · 133 KB
Raw

Basic Security Principles/Information

Attention Economy https://www.gwern.net/docs/culture/2019-candia.pdf https://www.gwern.net/docs/sociology/1972-downs.pdf

CLI * MobaXterm

101 - Talks/Presentations/Videos

Basic Windows Tools

Basic Utilities

  • Beginner/'Starting out' Link Collections

BeyondCorp https://www.scaleft.com/blog/beyondcorp-outside-of-google/

Budget

Building a Team

Building Org/Security https://www.irongeek.com/i.php?page=videos/circlecitycon2019/track-3-14-inside-out-security-building-castles-not-warehouses-alyssa-miller https://www.irongeek.com/i.php?page=videos/showmecon2018/showmecon-2018-track-1-03-how-hyperbolic-discounting-is-keeping-your-security-program-from-succeeding-jon-clark https://www.irongeek.com/i.php?page=videos/bsidescleveland2018/c06-go-back-to-the-basics-with-your-processes-improving-operations-without-technology-mark-abrams https://www.irongeek.com/i.php?page=videos/converge2018/converge-2018-111-finding-the-money-to-run-an-effective-security-program-matt-topper https://www.irongeek.com/i.php?page=videos/bsidesnashville2018/bsides-nashville-2018-red-01-security-instrumentation-be-the-hero-getting-value-from-security-brian-contos https://frankmcg.com/2020/09/purchased-microsoft-365-e5-now-what/ * Starting Up Security: Guides for the growing security team - Ryan McGeehan * Series of articles aimed at security for Startups/new companies.

Business

Careers

CLI Awk Bash Git Grep sed Vim

Complexity

copy/paste code

Culture

Crypto

Grep

CMMI

Cognitive Bias

Databases

Data Manipulation

Decision Making

Distributed Computing

Enumeration

First Person/Starting a Security Team

Git

Hiring Security Services

Learning

Linux

Maturity https://owaspsamm.org/blog/2020/10/29/comparing-bsimm-and-samm/ * What steps can you take toward evolving your organization's security maturity? - Matt Atkinson(2020)

MDM

MacOS

Mentoring

Metrics

Open Source Projects - Maintaining & Running

Pentest vs Redteam https://tbgsecurity.com/pen-tests-and-red-teams-are-not-the-same/ * Red Team Assessment and Penetration Testing - Yash.com

Product Sec Testing

Problem Solving

Programming

Questions

Ransomware

Recon * Recon Rundown #1 : Attack Surface Basics - sshell(2022) Research

Risk Analysis

Scaling AppSec

Scaling Ops

Scaling

'Scene'

Scheduling

Scoping

Searching https://www.gwern.net/Search

Security 101

Security Questionaires

SecOps

Skills improvement

Statistics

Storytelling/Presenting

Strategy https://warontherocks.com/2020/08/distilling-the-essence-of-strategy/ https://strategy-madlibs.herokuapp.com/

TableTop

Technical Debt

Testing https://github.com/obheda12/JupyterPen https://www.youtube.com/watch?v=EY2mRlYkDBA&list=PL7D3STHEa66QvxwnM8MSf8tUq1Zkhoq4P&index=26&t=0s https://www.irongeek.com/i.php?page=videos/bsidestampa2018/courtroom00-cyber-assurance-testing-for-success-col-john-burger https://www.fedramp.gov/assets/resources/documents/CSP_Penetration_Test_Guidance.pdf https://pen-testing.sans.org/resources/downloads#scope https://twitter.com/StanTwinB/status/1336935368436797440 Performing a Pentest https://www.youtube.com/watch?v=Fahp8U1_JGY https://www.youtube.com/watch?v=23F8QKTu86U https://www.youtube.com/watch?v=LrGfhQpBibk https://www.youtube.com/watch?v=oyJ0atDagco

Zerotrust * NIST Special Publication 800-207 - Zero Trust Architecture - Scott Rose, Oliver Borchert, Stu Mitchell, Sean Connelly(2020)

IPv6 Troubleshooting https://theinternetprotocolblog.wordpress.com/2019/11/04/basic-ipv6-troubleshooting-commands-i-ipv6-rosetta-stone-2019/

https://newsroom.intel.com/wp-content/uploads/sites/11/2019/07/Intel-Safety-First-for-Automated-Driving.pdf https://www.dia.mil/News/DIA-Directors-Reading-List/

IACD https://www.iacdautomate.org/ https://www.iacdautomate.org/getting-ready-for-soar https://static1.squarespace.com/static/5a94b67ff93fd440f0516297/t/5d41000bc8f45f0001164c17/1564540939633/IACD+quickSTART_Final_optimized.pdf * Playbooks, Workflows, & Local Instance Examples - Integrated Adaptive Cyber Defense (IACD)

https://www.irongeek.com/i.php?page=videos/derbycon6/304-and-bad-mistakes-ive-made-a-few-jayson-e-street https://www.irongeek.com/i.php?page=videos/derbycon6/512-evolving-your-offices-security-culture-nancy-snoke https://www.irongeek.com/i.php?page=videos/derbycon4/t514-a-brief-history-of-exploitation-devin-cook https://www.irongeek.com/i.php?page=videos/derbycon4/t308-ethical-control-ethics-and-privacy-in-a-target-rich-environment-kevin-johnson-and-james-jardine https://www.irongeek.com/i.php?page=videos/derbycon4/t526-information-security-team-management-how-to-keep-your-edge-while-embracing-the-dark-side-stephen-c-gay https://www.irongeek.com/i.php?page=videos/derbycon4/t126-what-to-expect-when-youre-expectinga-pentest-martin-bos-and-eric-milam https://www.irongeek.com/i.php?page=videos/derbycon4/t534-what-dungeons-dragons-taught-me-about-infosec-joey-maresca-l0stkn0wledge https://www.irongeek.com/i.php?page=videos/louisvilleinfosec2019/track-2-01-common-observations-from-a-security-assessor-corey-shell%22 https://www.irongeek.com/i.php?page=videos/derbycon2/4-2-6-kellep-charles-security-vulnerablity-assessments-process-and-best-practices https://www.irongeek.com/i.php?page=videos/derbycon6/308-business-developement-the-best-non-four-letter-dirty-word-in-infosec-scott-lyons-and-joshua-marpet https://danielmiessler.com/blog/algorithmic-vs-faith-based-learning/ https://www.johndcook.com/blog/2020/07/25/worst-tool-for-the-job/ https://www.folklore.org/StoryView.py?project=Macintosh&story=Creative_Think.txt

General Information

  • Networking
    • The Bits and Bytes of Computer Networking - Google/Coursera
      • This course is designed to provide a full overview of computer networking. We’ll cover everything from the fundamentals of modern networking technologies and protocols to an overview of the cloud to practical applications and network troubleshooting. By the end of this course, you’ll be able to: describe computer networks in terms of a five-layer model; understand all of the standard protocols involved with TCP/IP communications; grasp powerful network troubleshooting tools and techniques; learn network services like DNS and DHCP that help make computer networks run; understand cloud computing, everything as a service, and cloud storage
    • Linux Network Administration - gnulinux.guru
      • One(really long) page reference
    • IPv4/v6 Subnet Mask cheatsheet - kthx.at
  • Normalization of Deviance
    • The normalization of deviance in healthcare delivery - John Hanja
      • Many serious medical errors result from violations of recognized standards of practice. Over time, even egregious violations of standards of practice may become “normalized” in healthcare delivery systems. This article describes what leads to this normalization and explains why flagrant practice deviations can persist for years, despite the importance of the standards at issue. This article also provides recommendations to aid healthcare organizations in identifying and managing unsafe practice deviations before they become normalized and pose genuine risks to patient safety, quality care, and employee morale.
  • Scheduling & Planning
    • Introducing the Eisenhower Matrix - eisenhower.me
      • "The Eisenhower Matrix, also referred to as Urgent-Important Matrix, helps you decide on and prioritize tasks by urgency and importance, sorting out less urgent and important tasks which you should either delegate or not do at all."
  • Securing yourself
  • Software Testing
    • Articles/Blogposts/Writeups
    • Talks/Presentations
      • When to Test and How to Test It - Bruce Potter - Derbycon7
        • “I think we need a penetration test” This is one of the most misunderstood phrases in the security community. It can mean anything from “Someone should run a vulnerability scan against a box” to “I’d like nation-state capable actors to tell me everything that wrong with my enterprise” and everything in between. Security testing is a complex subject and it can be hard to understand what the best type of testing is for a given situation. This talk will examine the breadth of software security testing. From early phase unit and abuse testing to late phase penetration testing, this talk will provide details on the different tests that can be performed, what to expect from the testing, and how to select the right tests for your situation. Test coverage, work effort, attack simulation, and reporting results will be discussed. Also, this talk will provide a process for detailed product assessments, i.e.: if you’ve got a specific product you’re trying to break, how do you approach assessing the product in a way that maximizes your chance of breaking in as well as maximizing the coverage you will get from your testing activity.
    • Having a Pentest Performed
    • Scoping
    • Shopping for Testing
      • Don’t end up with a pencil: Tips for shopping for pen tests. - Dmitry Zadadsky(BSidesBoston2020)
        • As a blue team, penetration tests are a critical part of your security program and finding a pen test company that can meet your needs is paramount. Unfortunately, there is no manual for hiring a pen tester. Sometimes you need to learn from mistakes and successes. This presentation will go over the experience of a penetration test from the customer’s perspective. You’ll hear stories of tests that were good, bad, and ugly. First, you need to determine what your goals are to pick the right kind of assessment. Then you can start looking at vendors. Asking some of the right questions beforehand can really set the stage for success. Contracts, scoping, and documentation can be a pain, but they are important. We will go over the things you want to cover. Afterward comes the report. What should you do if there are lots of findings? What if there aren’t any? We will cover answers to these and more to help make sure when you buy a pen test, you don’t end up with a pencil.
    • Vulnerability Assesssment
      • Vulnerability Assessment 2.0 - John Askew(Derbycon 2014)
        • What can you do to step up your game as a security analyst? Vulnerability scanners and other security assessment tools can be extremely useful for collecting information quickly and efficiently, but what are some good next steps for analyzing and using that information? How much value does a raw vulnerability scan report provide (hint: don’t just hand this to a client or supervisor), and how much more value can we get out of our tools with a little bit of effort? What do you do when you need data that an existing tool can’t provide? John will discuss some areas in the security asssessment process that are ripe for easy wins through custom scripting, including data aggregation, diffing, false,positive identification, and visualization. As an example, John will release a tool for slicing and dicing the results from assessment tools in interesting ways, based on various techniques used in previous consulting engagements.
  • Statistics
    • How to Lie with Statistics, Information Security Edition - Tony Martin-Vegue(Circle City Con2018)
      • Stiff statistics, prismatic pie charts, and questionable survey results drown the Information Security space in a sea of never-ending numbers that can be difficult to sift through. Have you ever finished reading a research institution's annual security report and felt your Spidey sense begin to tingle with doubt or disbelief? What you are probably sensing is a manipulation of statistics, an age-old hoodwink that has been occurring as long as numbers have been used to convey information. This critical subject was first examined over 60 years ago, when Darrell Huff first published the groundbreaking book "How to Lie with Statistics," over 60 years ago. This presentation takes the foundation Huff created and updates the core concepts for the contemporary Information Security field. Most people would be shocked to find that data is often manipulated to lead the reader to a particular conclusion. Several areas are examined: bias in vendor-sponsored security reports, data visualization misuse and common security fallacies. There is a silver lining - once you are aware of the subtle ways data is manipulated, it's easy to spot. Attendees will walk away with a new understanding of ways to identify and avoid unintentionally using some of the methods described.
  • StoryTelling
    • Articles/Blogposts/Writeups
    • Talks/Presentations/Videos
      • The Power of Storytelling - David Shipley (BSides Halifax 2021)
        • During this keynote presentation, Beauceron CEO David Shipley will talk about the critical importance of leveraging storytelling as a framework to educate and to motivate. He’ll provide examples and a framework for how this practice can be used to move awareness programs into effective behaviour change initiatives that can tangibly reduce cyber risk in organizations.
      • How to Share Your Knowledge with Others – Jason Blanchard(2021)
        • "Have you ever seen a call for papers for a conference and thought to yourself that you’d like to submit a talk and then immediately thought, oh never mind? Have you ever been asked to present internally at your organization and immediately recommended someone else to do it? Was it because you didn’t know how to give a presentation, or because you were afraid of speaking in front of an audience, or because you didn’t know where to start? This Black Hills Information Security (BHIS) presentation on giving presentations the way people like to hear presentations will be based on Jason’s background as a video editor, story teller, comedian, and content creator. We will dive into structure, delivery, and how your audience perceives every single word and image you share. By the end of this most meta-presentation on presentations using science and stuff, you’ll be equipped with getting started sharing your knowledge with others in a way they will want to hear it."
  • System Design
    • The System Design Primer
      • Learning how to design scalable systems will help you become a better engineer. System design is a broad topic. There is a vast amount of resources scattered throughout the web on system design principles. This repo is an organized collection of resources to help you learn how to build systems at scale.
  • TableTop Exercises
    • Why Crisis management exercises (still) work - Mercedes M Diaz(2020)
    • Intro to Tabletop Exercises with Amanda Berlin & Jeremy Mio(2020)
      • When testing responses, defenses, and detections of an environment one of the main tools that can be used is a tabletop exercise. A tabletop exercise is a meeting of key stakeholders and staff who walk step by step through the mitigation of some type of disaster, malfunction, attack, or other emergency in a low stress situation. In this short training webinar, we walk through two basic exercises from beginning to end, covering what helpful structure, items, and activities should be included. We then follow up each exercise with an after action report to recap.
  • Task Automation
    • WALKOFF
      • WALKOFF is a flexible, easy to use, automation framework allowing users to integrate their capabilities and devices to cut through the repetitive, tedious tasks slowing them down,
    • StackStorm
    • Robot Framework
      • Robot Framework is a generic open source automation framework for acceptance testing, acceptance test driven development (ATDD), and robotic process automation (RPA). It has simple plain text syntax and it can be extended easily with libraries implemented using Python or Java. Robot Framework is operating system and application independent. The core framework is implemented using Python, supports both Python 2 and Python 3, and runs also on Jython (JVM), IronPython (.NET) and PyPy. The framework has a rich ecosystem around it consisting of various generic libraries and tools that are developed as separate projects. For more information about Robot Framework and the ecosystem, see http://robotframework.org.
  • Tools to Know About
  • Vendor Security
    • UC Berkely Vendor Security Assessment Program
    • VSAQ: Vendor Security Assessment Questionnaire
      • VSAQ is an interactive questionnaire application. Its initial purpose was to support security reviews by facilitating not only the collection of information, but also the redisplay of collected data in templated form. At Google, questionnaires like the ones in this repository are used to assess the security programs of third parties. But the templates provided can be used for a variety of purposes, including doing a self-assessment of your own security program, or simply becoming familiar with issues affecting the security of web applications.
  • The Web
    • Web Architecture 101 - Jonathan Fulton
    • The Tangled Web - Michal Zalewski(book)
      • "The Tangled Web is my second book, a lovingly crafted guide to the world of browser security. It enters an overcrowded market, but there are two reasons why you may want to care. First of all, where other books simply dispense old and tired advice on remediating common vulnerabilities, The Tangled Web offers a detailed and thoroughly enjoyable account of both the "how" and the "why" of the modern web. In doing so, it enables you to deal with the seedy underbelly of contemporary, incredibly complex web apps. The other reason is that it is based on years of original research - including, of course, my Browser Security Handbook (2008). I think it is simply unmatched when it comes to the breadth and the quality of the material presented. It outlines dozens of obscure but remarkably important security policies, governing everything from content rendering to frame navigation - and affecting your applications in more ways than you may expect."
    • Tools
      • Firefox Developer Tools - MDN
        • Firefox Developer Tools is a set of web developer tools built into Firefox. You can use them to examine, edit, and debug HTML, CSS, and JavaScript. This section contains detailed guides to all of the tools as well as information on how to debug Firefox for Android, how to extend DevTools, and how to debug the browser as a whole.
      • Chrome DevTools - developers.google
      • Discover DevTools
        • Learn how Chrome DevTools can sharpen your dev process and discover the tools that can optimize your workflow and make life easier.