Security Engineering in Depth — Advanced Practice

Contents

97 chapters, one page each. Prefer one long page? Read the whole book on one page.

1. What you will be able to do at the end1 min
2. How this guide is organised1 min
3. Contents4 min
4. Part 0 — Start here
5. 0.1 Who this is for, and what the first guide assumed1 min
6. 0.2 The advanced learning flow: think in attack paths, assume breach1 min
7. 0.3 Three routes1 min
8. 0.4 The advanced lab2 min
9. 0.5 Ethics, cloud provider policy, and not setting money on fire1 min
10. 0.6 The running example grows up2 min
11. 0.7 The series: OS → networking → security → HTTPS2 min
12. 0.8 The Go labs: security mechanisms you can run1 min
13. Part 1 — Attack paths and adversary thinking
14. Chapter 1 — From vulnerabilities to attack paths9 min
15. Chapter 2 — Adversary emulation and purple teaming5 min
16. Chapter 3 — Assume breach: lateral movement, persistence, and containment by design5 min
17. Chapter 4 — Threat modeling at scale7 min
18. Part 2 — Cloud security foundations
19. Chapter 5 — The cloud security model and the identity plane6 min
20. Chapter 6 — Cloud IAM in depth: policy evaluation and privilege-escalation paths7 min
21. Chapter 7 — Organisation structure and guardrails6 min
22. Chapter 8 — Cloud network security6 min
23. Chapter 9 — Data security in the cloud: KMS and envelope encryption13 min
24. Chapter 10 — Hands-on: attack and defend a cloud account4 min
25. Part 3 — Infrastructure as Code and the deployment pipeline
26. Chapter 11 — IaC security5 min
27. Chapter 12 — CI/CD as an attack surface7 min
28. Chapter 13 — Securing the software factory: provenance and admission5 min
29. Chapter 14 — Hands-on: a supply-chain-hardened pipeline4 min
30. Part 4 — Container and Kubernetes security
31. Chapter 15 — Container internals and isolation7 min
32. Chapter 16 — Kubernetes architecture and its trust boundaries5 min
33. Chapter 17 — Kubernetes RBAC and identity5 min
34. Chapter 18 — Admission control and policy5 min
35. Chapter 19 — Kubernetes network security5 min
36. Chapter 20 — Runtime security and workload identity6 min
37. Chapter 21 — Multi-tenancy and isolation models5 min
38. Chapter 22 — Hands-on: attack a cluster, then harden it4 min
39. Part 5 — Microservices and distributed authorization
40. Chapter 23 — Service identity: SPIFFE and SPIRE9 min
41. Chapter 24 — Token exchange and delegation10 min
42. Chapter 25 — Distributed authorization: RBAC to ABAC to ReBAC/Zanzibar10 min
43. Chapter 26 — East-west security: internal APIs, gRPC, and event streams7 min
44. Chapter 27 — Multi-tenant data isolation7 min
45. Chapter 28 — Resilience as a security property7 min
46. Chapter 29 — Hands-on: end-to-end authorization for SecureShop4 min
47. Part 6 — Advanced web and API exploitation
48. Chapter 30 — HTTP request smuggling and desync5 min
49. Chapter 31 — Web cache poisoning and cache deception5 min
50. Chapter 32 — XXE and the XML attack surface7 min
51. Chapter 33 — SSRF mastery7 min
52. Chapter 34 — Prototype pollution, DOM clobbering, and mutation XSS5 min
53. Chapter 35 — Web race conditions9 min
54. Chapter 36 — Server-side template and expression-language injection4 min
55. Chapter 37 — Deserialization attacks6 min
56. Chapter 38 — File upload and parser attacks10 min
57. Chapter 39 — Federated identity attacks: SAML and advanced OAuth/OIDC8 min
58. Chapter 40 — Hands-on: chain bugs into account takeover or RCE4 min
59. Part 6A — API gateway and perimeter security
60. Chapter 40A — API payload security in depth10 min
61. Chapter 40B — API rate limiting in depth12 min
62. Chapter 40C — WAF: architecture, rules, and bypasses11 min
63. Chapter 40D — WAAP: bots, API discovery, and edge enforcement10 min
64. Chapter 40E — Implementing the OWASP API Security Top 10 (2023)12 min
65. Part 7 — Data protection and privacy engineering
66. Chapter 41 — Data classification, inventory, and data-flow mapping6 min
67. Chapter 42 — Encryption at rest, done properly6 min
68. Chapter 43 — Tokenization, FPE, and PCI scope reduction6 min
69. Chapter 44 — Key management lifecycle9 min
70. Chapter 45 — De-identification and privacy-preserving analytics9 min
71. Chapter 46 — The right to erasure across a distributed system9 min
72. Chapter 47 — Data residency, sovereignty, and transfer7 min
73. Chapter 48 — Database security in depth8 min
74. Chapter 49 — Data-access governance and insider risk9 min
75. Chapter 50 — Hands-on: build SecureShop's data-protection layer5 min
76. Part 8 — Detection engineering and response at scale
77. Chapter 51 — The detection-engineering lifecycle12 min
78. Chapter 52 — Telemetry architecture11 min
79. Chapter 53 — Threat hunting and threat intelligence6 min
80. Chapter 54 — Detecting the attack paths from Part 17 min
81. Chapter 55 — Incident response for cloud and containers9 min
82. Chapter 56 — Ransomware and destructive-attack resilience10 min
83. Chapter 57 — Hands-on: build and validate a detection suite4 min
84. Part 9 — The security program
85. Chapter 58 — Building an SSDLC / product-security program8 min
86. Chapter 59 — Vulnerability management at scale9 min
87. Chapter 60 — The offensive program: pentest, red team, bug bounty, VDP10 min
88. Chapter 61 — Compliance and assurance without theater9 min
89. Chapter 62 — Risk, metrics, and communicating with leadership9 min
90. Chapter 63 — Enterprise identity and access11 min
91. Part 10 — Capstone projects
92. Chapter 64 — Project 1: cloud-native SecureShop — model, build, attack, defend3 min
93. Chapter 65 — Project 2: distributed authorization with proven tenant isolation3 min
94. Chapter 66 — Project 3: an advanced web assessment to ATO/RCE3 min
95. Chapter 67 — Project 4: emulate an intrusion, detect every stage, run the IR3 min
96. Chapter 68 — Project 5: the data-protection and privacy layer, productionised4 min
97. Part 11 — Expert breadth: adjacent domains senior security engineers must understand
98. Chapter 69 — AI, LLM, and agentic-system security3 min
99. Chapter 70 — Mobile application security1 min
100. Chapter 71 — Endpoint, Active Directory, Entra ID, and EDR realities1 min
101. Chapter 72 — Email security, phishing resilience, and BEC1 min
102. Chapter 73 — Secrets management and credential lifecycle1 min
103. Chapter 74 — Abuse, fraud, bots, and business-logic defense1 min
104. Chapter 75 — Digital forensics and malware triage1 min
105. Chapter 76 — IoT, OT, embedded, and physical-world security1 min
106. Chapter 77 — Security architecture review: the senior-engineer playbook1 min
107. Chapter 78 — Capstone: a board-to-packet security review1 min
108. Part 12 — Where to go next
109. Chapter 79 — Deep specialisation tracks and the research frontier4 min
110. Chapter 80 — Staying current at the advanced level, and contributing back3 min
111. Continue the series1 min
112. Appendix A — Advanced glossary
113. Appendix B — Cloud attack-path reference (AWS / GCP / Azure)
114. Appendix C — Kubernetes security checklist
115. Appendix D — Distributed authorization patterns reference
116. Appendix E — Data-protection decision tables
117. Appendix F — Detection coverage map (ATT&CK technique → data source → rule idea)
118. Appendix G — Answers to "Check yourself"