20 practical guides
Cybersecurity and Privacy Guides
Learn how to design safeguards, verify them on systems you own, prepare recovery, and escalate security concerns responsibly.
Built for developers, IT professionals, and teams protecting systems and data through authorized, evidence-based work.
Web application threat modeling
Map assets, trust boundaries, abuse cases, and proportionate controls before changing an owned web application.
OWASP Top 10 development guide
Use the OWASP Top 10 as a review lens while building specific, testable application safeguards.
SQL injection prevention
Separate SQL structure from untrusted values, constrain database privileges, and verify query paths safely.
Cross-site scripting prevention
Keep untrusted browser content in data contexts through framework defaults, encoding, sanitization, and safe DOM APIs.
CSRF protection
Authenticate state-changing browser requests with framework controls, tokens, cookie policy, and origin checks.
Password storage and hashing
Store password verifiers with current adaptive hashing, unique salts, protected peppers, and tested upgrades.
MFA design
Choose phishing-resistant factors, protect enrollment and recovery, and test an accessible MFA rollout.
Development secrets management
Inventory, store, deliver, rotate, and retire application secrets through controlled identities and audited systems.
Least privilege in practice
Reduce standing access for people, workloads, data, and tools through scoped roles and regular review.
Role-based access control
Build roles from job actions, enforce permissions server-side, and govern assignment and change.
Employee phishing detection
Verify unusual requests through trusted channels, report quickly, and respond without investigating alone.
Small-organization ransomware preparation
Reduce ransomware impact through access controls, isolated backups, response roles, and practiced restoration.
Incident response planning
Define incident roles, evidence, containment authority, recovery criteria, and practiced communications.
Security log prioritization
Triage security events by asset, identity, behavior, evidence quality, and business consequence.
Cloud storage bucket security
Control bucket identities, public access, encryption, retention, logs, and recoverable deletion.
Software supply chain security
Protect source, dependencies, builds, artifacts, and releases with verified identities and provenance.
Dependency vulnerability management
Inventory software dependencies, assess reachable risk, prioritize updates, and verify remediation without disrupting owned applications.
Privacy by design
Turn a product idea into minimized data flows, explicit user choices, protected access, and testable privacy requirements.
Data retention and deletion
Set evidence-based retention periods and build deletion across primary stores, copies, vendors, logs, and backups.
Practical security review
Scope an authorized review, gather architecture evidence, test safeguards safely, and track findings through verified closure.