NIST Zero Trust Architecture

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207-draft2.pdf

Identity Defined Security Alliance

https://www.idsalliance.org

12 Threat Modelling Techniques

https://insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-methods.html

Zero Trust

https://www.ncsc.gov.uk/blog-post/zero-trust-architecture-design-principles

We the Sales Engineers

Interesting website / podcast etc. aimed specifically at sales engineers.

https://wethesalesengineers.com

OWASP Cyber Defence Matrix

https://www.owasp.org/index.php/OWASP_Cyber_Defense_Matrix

Open Source SOC Tools

https://information.rapid7.com/rs/411-NAK-970/images/building-powerful-security-arsenal.pdf

Tools to Implement SANS Top 20

A few years out of date, but very cool paper.

https://www.alienvault.com/blogs/security-essentials/free-and-commercial-tools-to-implement-the-sans-top-20-security-controls-part-1/

NIST standards

800-30 - Guide for Conducing Risk Assessments
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf

800-37: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final


800-39 - Managing Information Security Risk: Organization, Mission, and Information System View
https://csrc.nist.gov/publications/detail/sp/800-39/final

800-53 - Security and Privacy Controls for Information Systems and Organizations
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft


800-154 - Guide to Data-Centric System Threat Modeling

https://csrc.nist.gov/publications/detail/sp/800-154/draft

800-115 - Penetration Testing

800-60: Volume 1: Guide for Mapping Types of Information and Information Systems to Security Categories

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v1r1.pdf

NIST SP 800-53A,Guide for Assessing the Security

Controls in Federal Information Systems

MITRE ATT&CK Framework

Good overview by Varonis:
https://www.varonis.com/blog/mitre-attck-framework-complete-guide/

Information Commissioner's Office (ICO) Guide to GDPR

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/

NIST Cyber Threat Modelling

https://www.mitre.org/sites/default/files/publications/pr_18-1174-ngci-cyber-threat-modeling.pdf

ISACA State of Cybersecurity 2019 report

https://www.isaca.org/info/state-of-cybersecurity-2019/index.html

Microsoft STRIDE

This is a useful blog post for threat modelling.

https://www.microsoft.com/security/blog/2007/09/11/stride-chart/

IBM Buyer's Guide to MSSP

https://www.ibm.com/downloads/cas/KPEG6J8Q?cm_mc_uid=25953344701415679350681&cm_mc_sid_50200000=46230891567935068106

NIST 800-82 Industrial Control Systems

NIST 800-82:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf

NIST Cyber Security Framework

Good 2019 paper on the NIST CSF:

https://www.oas.org/en/sms/cicte/docs/OAS-AWS-NIST-Cybersecurity-Framework(CSF)-ENG.pdf

The US identified 16 critical infrastructure sectors: Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy; Financial Services; Food and Agriculture; Government Facilities; Healthcare and Public Health; Information Technology; Nuclear Reactors, Materials, and Waste; Transportation Systems; and Water and Wastewater Systems.

MITRE ATT&CK

High level overview of the MITRE ATT&CK model by Exabeam.
https://www.exabeam.com/information-security/what-is-mitre-attck-an-explainer/

SSL Inspection

The following gives a very good overview of the pros and cons of SSL inspection. Some I hadn't thought about.

https://www.helpnetsecurity.com/2017/03/08/https-interception-dilemma/


Good document from Symantec describing certificate pinning:

https://www.symantec.com/content/dam/symantec/docs/white-papers/certificate-pinning-en.pdf

Colbalt Strike Vulnerability used against the Hackers

https://hackercombat.com/vulnerability-helps-researchers-expose-malware-cc-servers/