Security from Zero — A Practical Guide for Engineers

Contents

69 chapters, one page each. Prefer one long page? Read the whole book on one page.

1. What you will be able to do at the end1 min
2. Contents2 min
3. Part 0 — Start here
4. 0.1 Who this guide is for1 min
5. 0.2 The learning flow1 min
6. 0.3 The roadmap1 min
7. 0.4 Build your lab (30 minutes)1 min
8. 0.5 The little bit of maths you need2 min
9. 0.6 Ethics and the law — read this before Part 21 min
10. 0.7 How not to get stuck1 min
11. 0.8 The series: OS → networking → security → HTTPS2 min
12. Part 1 — Foundations
13. Chapter 1 — What "security" actually means3 min
14. Chapter 2 — Thinking like an attacker4 min
15. Chapter 3 — The vocabulary that trips everyone up3 min
16. Chapter 4 — Our running example: SecureShop2 min
17. Part 2 — Encoding: the thing that is not security
18. Chapter 5 — How text becomes bytes2 min
19. Chapter 6 — Base64, hex, and URL encoding: none of them protect anything4 min
20. Chapter 7 — Unicode, normalisation, and the bugs they cause4 min
21. Part 3 — Hashing: fingerprints for data
22. Chapter 8 — What a hash function is4 min
23. Chapter 9 — The real hash functions, and which are broken4 min
24. Chapter 10 — Password storage is a completely different problem6 min
25. Chapter 11 — HMAC: proving a message wasn't tampered with4 min
26. Part 4 — Symmetric encryption
27. Chapter 12 — The idea, and what "perfect secrecy" costs4 min
28. Chapter 13 — Block ciphers and AES3 min
29. Chapter 14 — Modes of operation (and why ECB is a meme)5 min
30. Chapter 15 — AEAD: encryption and authentication together5 min
31. Chapter 16 — Hands-on: symmetric encryption with OpenSSL3 min
32. Part 5 — Asymmetric cryptography
33. Chapter 17 — The key-distribution problem and the big idea4 min
34. Chapter 18 — Diffie–Hellman key exchange5 min
35. Chapter 19 — RSA7 min
36. Chapter 20 — Elliptic curve cryptography7 min
37. Chapter 21 — Digital signatures6 min
38. Chapter 22 — Hands-on: keys, signatures, and key exchange with OpenSSL5 min
39. Part 6 — Post-quantum cryptography
40. Chapter 23 — Why quantum computers break today's public-key crypto5 min
41. Chapter 24 — The post-quantum algorithms5 min
42. Chapter 25 — Hybrid mode, crypto-agility, and how to migrate5 min
43. Chapter 26 — Hands-on: post-quantum with OpenSSL and liboqs5 min
44. Part 7 — TLS and HTTPS
45. Chapter 27 — What HTTPS actually guarantees (and what it doesn't)4 min
46. Chapter 28 — The TLS 1.3 handshake, step by step5 min
47. Chapter 29 — Certificates and how validation works6 min
48. Chapter 30 — PKI: certificate authorities, transparency, revocation, ACME6 min
49. Chapter 31 — TLS in production6 min
50. Chapter 32 — Hands-on: inspecting and testing TLS5 min
51. Part 8 — SSH
52. Chapter 33 — What SSH is, and the connection protocol4 min
53. Chapter 34 — Keys, agents, and host verification5 min
54. Chapter 35 — SSH certificates, hardening, and bastions5 min
55. Chapter 36 — Hands-on: SSH keys, tunnels, config, and signing5 min
56. Part 9 — Network security
57. Chapter 37 — The network attacker: sniffing, spoofing, MITM6 min
58. Chapter 38 — DNS security6 min
59. Chapter 39 — Firewalls, segmentation, zero trust, and VPNs7 min
60. Chapter 40 — Hands-on: seeing the network5 min
61. Part 10 — Web and HTTP security
62. Chapter 41 — How the web decides what to trust4 min
63. Chapter 42 — Injection: when data becomes code4 min
64. Chapter 43 — Cross-site scripting (XSS)4 min
65. Chapter 44 — Request forgery: CSRF, SSRF, clickjacking4 min
66. Chapter 45 — Broken access control4 min
67. Chapter 46 — Authentication, sessions, and federated identity6 min
68. Chapter 47 — Supply chain and the code you didn't write5 min
69. Chapter 48 — Hands-on: testing a web application4 min
70. Part 11 — Operating securely
71. Chapter 49 — Secrets management5 min
72. Chapter 50 — Logging, detection, and monitoring5 min
73. Chapter 51 — Incident response5 min
74. Chapter 52 — Threat modeling and secure design7 min
75. Part 12 — Projects
76. Chapter 53 — Project 1: your own CA, plus mutual TLS3 min
77. Chapter 54 — Project 2: harden a server end to end3 min
78. Chapter 55 — Project 3: break and fix a vulnerable application3 min
79. Chapter 56 — Project 4: a post-quantum readiness audit4 min
80. Part 13 — Where to go next
81. Chapter 57 — Honest gaps, and a six-month plan3 min
82. Chapter 58 — Specialisations, certifications, and staying current4 min
83. Continue the series1 min
84. Appendix A — Glossary (plain language)
85. Appendix B — The OpenSSL cookbook
86. Appendix C — Command cheat sheet
87. Appendix D — What to use in 2026 (algorithm reference)
88. Appendix E — Reading list, and how the facts here were checked
89. Appendix F — Answers to "Check yourself"