Bibliography

Sources are grouped by confidence tier, following the book's citation-honesty policy (see _style-bible.md §7). Tier 1 are works we are confident exist — NIST publications, MITRE ATT&CK, CIS Controls, OWASP, RFCs, vendor and government reports; Tier 2 are real ideas whose exact publication we have not pinned down; Tier 3 are constructed teaching examples, labeled where they appear.

Tier 1 — Verified canonical sources (standards, frameworks, primary docs)

  • (ISC)², CISSP, SSCP, and CCSP certification information and the (ISC)² Code of Ethics (isc2.org).
  • SLSA (Supply-chain Levels for Software Artifacts) framework (slsa.dev).
  • AICPA, Trust Services Criteria for SOC 2 (Security, Availability, Processing Integrity, Confidentiality, Privacy).
  • Anderson, R., Security Engineering, 3rd ed., Wiley.
  • Anderson, R., Security Engineering: A Guide to Building Dependable Distributed Systems, 3rd ed., Wiley (access-control chapter: DAC/MAC, reference monitor, ACLs vs. capabilities).
  • Apache Software Foundation / NVD, CVE-2021-44228 (Log4Shell) advisory; and CISA guidance issued in response (December 2021).
  • Apache Software Foundation, security advisory for CVE-2021-44228 (Apache Log4j 2 JNDI remote code execution).
  • AppArmor project / Ubuntu Server hardening documentation.
  • Apple, Apple Platform Security guide (SIP, Gatekeeper, FileVault, XProtect, secure boot).
  • Aumasson, J.-P., Serious Cryptography, No Starch Press.
  • Aumasson, J.-P., Serious Cryptography: A Practical Introduction to Modern Encryption, 2nd ed., No Starch Press.
  • AWS documentation — Secrets Manager, Key Management Service (KMS), IAM roles, and IAM Roles Anywhere / workload identity federation (Amazon Web Services).
  • AWS, Shared Responsibility Model, Amazon Web Services documentation.
  • AWS, Well-Architected Framework — Security Pillar, Amazon Web Services.
  • Bejtlich, R., The Practice of Network Security Monitoring, No Starch Press.
  • Brown, R., & Roberts, S., Intelligence-Driven Incident Response, O'Reilly.
  • Center for Internet Security, CIS Amazon Web Services Foundations Benchmark.
  • Center for Internet Security, CIS Benchmarks (platform-specific secure-configuration guides; Level 1 / Level 2 profiles), cisecurity.org.
  • Center for Internet Security, CIS Controls v8 (esp. Control 1 — Inventory of Enterprise Assets; Control 12 — Network Infrastructure Management) and CIS Benchmarks.
  • Center for Internet Security, CIS Critical Security Controls, Version 8.
  • Center for Internet Security, CIS Google Cloud Platform Foundation Benchmark.
  • Center for Internet Security, CIS Microsoft Azure Foundations Benchmark.
  • Certificate Transparency project documentation (certificate.transparency.dev).
  • Chantzis, F., Stais, I., et al., Practical IoT Hacking, No Starch Press (read as a defender's threat model).
  • Chapple, M., & Seidl, D., CompTIA Security+ Study Guide, Sybex.
  • Chapple, M., Stewart, J., & Gibson, D., (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide, Sybex.
  • Chio, C., & Freeman, D., Machine Learning and Security, O'Reilly Media.
  • Chris Sanders & Jason Smith, Applied Network Security Monitoring, Syngress.
  • Cialdini, R., Influence: The Psychology of Persuasion.
  • CIS Controls v8 — Control 5 (Account Management) and Control 6 (Access Control Management), Center for Internet Security.
  • CIS Controls v8, Center for Internet Security — Control 5 (Account Management) and Control 6 (Access Control Management).
  • CIS Controls v8, Control 13 (Network Monitoring and Defense), Center for Internet Security.
  • CIS Controls v8, Control 6 (Access Control Management), Center for Internet Security.
  • CIS Controls v8, Control 7, Continuous Vulnerability Management, Center for Internet Security.
  • CIS Critical Security Controls v8, Control 8 (Audit Log Management) and Control 17 (Incident Response Management), Center for Internet Security.
  • CIS Critical Security Controls, Version 8, Center for Internet Security.
  • CISA & MS-ISAC, #StopRansomware Guide, Cybersecurity and Infrastructure Security Agency.
  • CISA (Cybersecurity and Infrastructure Security Agency), advisories, emergency directives, and mitigation guidance on the SolarWinds/Orion supply-chain compromise (2020–2021).
  • CISA (Cybersecurity and Infrastructure Security Agency), advisories, the Known Exploited Vulnerabilities (KEV) catalog, and coordinated vulnerability-disclosure guidance (cisa.gov).
  • CISA / FBI joint advisories on DarkSide ransomware (the family behind the Colonial Pipeline incident).
  • CISA / federal, Cybersecurity Incident & Vulnerability Response Playbooks.
  • CISA / NSA, identity and access management guidance, and CISA Cross-Sector Cybersecurity Performance Goals (CPGs).
  • CISA and U.S. government joint advisories on the SolarWinds Orion (Sunburst / Solorigate) supply chain compromise, December 2020 onward.
  • CISA, Avoiding Social Engineering and Phishing Attacks and related phishing guidance, Cybersecurity and Infrastructure Security Agency.
  • CISA, Binding Operational Directive 22-01 (Reducing the Significant Risk of Known Exploited Vulnerabilities), the directive establishing the KEV catalog.
  • CISA, Cybersecurity Advisories (cisa.gov) — operational, ATT&CK-mapped advisories (model for Case Study 2).
  • CISA, Implementing Phishing-Resistant MFA and More Than a Password guidance, Cybersecurity and Infrastructure Security Agency.
  • CISA, Incident Response resources and the joint #StopRansomware guide, Cybersecurity and Infrastructure Security Agency.
  • CISA, Industrial Control Systems advisories, alerts, and resources, Cybersecurity and Infrastructure Security Agency (cisa.gov/topics/industrial-control-systems).
  • CISA, Known Exploited Vulnerabilities (KEV) Catalog, Cybersecurity and Infrastructure Security Agency.
  • CISA, Protective DNS guidance and related advisories, Cybersecurity and Infrastructure Security Agency.
  • CISA, Secure Cloud Business Applications (SCuBA) project and cloud security guidance.
  • CISA, Securing the Software Supply Chain guidance and SBOM resources, Cybersecurity and Infrastructure Security Agency.
  • CISA, Software Bill of Materials (SBOM) resources, Cybersecurity and Infrastructure Security Agency.
  • CISA, Tabletop Exercise Packages (CTEPs).
  • CISA, Zero Trust Maturity Model, Cybersecurity and Infrastructure Security Agency.
  • CISA, advisories and alerts on the SolarWinds / Orion supply-chain compromise, Cybersecurity and Infrastructure Security Agency.
  • CISA, advisories and guidance on phishing-resistant MFA and privileged-access hardening, Cybersecurity and Infrastructure Security Agency.
  • CISA, advisories and guidance on securing IoT and network devices, Cybersecurity and Infrastructure Security Agency.
  • CISA, advisories and secure-configuration / known-exploited-vulnerability guidance, Cybersecurity and Infrastructure Security Agency.
  • CISA, advisories and the Known Exploited Vulnerabilities (KEV) Catalog.
  • CISA, guidance and alerts on Apache Log4j (CVE-2021-44228), and the Known Exploited Vulnerabilities (KEV) Catalog entry.
  • CISA, network segmentation and secure remote access guidance, Cybersecurity and Infrastructure Security Agency.
  • Cloud Security Alliance, Consensus Assessments Initiative Questionnaire (CAIQ) and Cloud Controls Matrix (CCM).
  • Cloud-provider zero-trust reference architectures (AWS, Microsoft, Google Cloud security documentation).
  • Collins, M., Network Security Through Data Analysis, O'Reilly.
  • CompTIA, official certification objectives for Security+, Network+, and CySA+ (comptia.org); confirm current exam codes and requirements with the issuing body.
  • DISA, Security Technical Implementation Guides (STIGs), Defense Information Systems Agency, public.cyber.mil.
  • Elastic, Elastic Common Schema (ECS) documentation, https://www.elastic.co.
  • European Union, General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
  • Executive Order 14028, Improving the Nation's Cybersecurity (2021), software-supply-chain provisions — U.S. Federal Register.
  • FBI Internet Crime Complaint Center (IC3), Business Email Compromise public service announcements and annual reports.
  • Federal Financial Institutions Examination Council (FFIEC), IT Examination Handbook.
  • Ferguson, N., Schneier, B., & Kohno, T., Cryptography Engineering: Design Principles and Practical Applications, Wiley.
  • FFIEC, IT Examination Handbook — Outsourcing Technology Services / Architecture, Infrastructure, and Operations booklets.
  • FIDO Alliance, FIDO2 / CTAP specifications and passkeys resources, fidoalliance.org.
  • FIRST, Common Vulnerability Scoring System (CVSS) specification, Forum of Incident Response and Security Teams.
  • FIRST, Exploit Prediction Scoring System (EPSS) model documentation, Forum of Incident Response and Security Teams.
  • FIRST, Traffic Light Protocol (TLP) version 2.0 (first.org/tlp) — handling markings for shared intelligence.
  • Freund, J., & Jones, J., Measuring and Managing Information Risk: A FAIR Approach, Butterworth-Heinemann.
  • FTC, Standards for Safeguarding Customer Information (GLBA Safeguards Rule), 16 CFR Part 314.
  • Garfinkel, S., Spafford, G., & Schwartz, A., Practical UNIX and Internet Security, O'Reilly.
  • GIAC/SANS, GSEC/GCIH/GCIA and related certification information (giac.org).
  • Goodfellow, I., Bengio, Y., & Courville, A., Deep Learning, MIT Press.
  • Google Cloud documentation — Secret Manager, Cloud KMS, and Workload Identity Federation (Google).
  • Google Cloud, Shared responsibility and shared fate on Google Cloud, GCP documentation.
  • Google, BeyondCorp: A New Approach to Enterprise Security (and subsequent BeyondCorp papers), Google, 2014 onward.
  • Google, Site Reliability Engineering (freely available) — postmortem-culture chapter on blameless postmortems.
  • Harris, S., & Maymí, F., CISSP All-in-One Exam Guide, McGraw-Hill.
  • HashiCorp Vault documentation — concepts, leases, and dynamic secrets (HashiCorp).
  • Hoffman, A., Web Application Security, O'Reilly.
  • Hu, V. C., et al. (NIST), Attribute-Based Access Control, Artech House (book-length ABAC treatment).
  • Hutchins, E. M., Cloppert, M. J., & Amin, R. M., Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, Lockheed Martin.
  • Hutchins, E., Cloppert, M., & Amin, R., Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, Lockheed Martin.
  • IEC 62443 series, Security for Industrial Automation and Control Systems, International Electrotechnical Commission.
  • IEEE 802.11i (RSN/WPA2) and IEEE 802.11w (Protected Management Frames), IEEE 802.11 standard amendments.
  • IEEE 802.1X, Port-Based Network Access Control, Institute of Electrical and Electronics Engineers.
  • IEEE Standard 802.1X-2020, IEEE Standard for Local and Metropolitan Area Networks — Port-Based Network Access Control, IEEE.
  • IETF BCP 38 / RFC 2827, Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing.
  • IETF RFC 3227, Guidelines for Evidence Collection and Archiving, Internet Engineering Task Force.
  • IETF RFC 6749, The OAuth 2.0 Authorization Framework; and IETF RFC 6750, OAuth 2.0 Bearer Token Usage.
  • IETF RFC 7011, Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information.
  • IETF RFC 7644, System for Cross-domain Identity Management (SCIM): Protocol; and IETF RFC 7643, SCIM: Core Schema.
  • IETF, RFC 5280 — Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.
  • IETF, RFC 6960 — X.509 Internet Public Key Infrastructure Online Certificate Status Protocol (OCSP).
  • IETF, RFC 6962 — Certificate Transparency.
  • IETF, RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3, Internet Engineering Task Force, 2018.
  • IETF, RFC 8659 — DNS Certification Authority Authorization (CAA) Resource Record.
  • International Organization for Standardization, ISO/IEC 27001 (Information Security Management Systems — Requirements) and ISO/IEC 27002 (control catalog).
  • ISACA, COBIT (Control Objectives for Information and Related Technologies) — enterprise governance of IT; the governance-vs-management distinction.
  • ISACA, Risk IT Framework, ISACA.
  • ISACA, CISA, CRISC, and CISM certification information and the ISACA Code of Professional Ethics (isaca.org).
  • ISO/IEC 27001, Information security management systems — Requirements, and ISO/IEC 27002, Information security controls. (The certifiable ISMS view of a program and its control catalog.)
  • ISO/IEC 27001, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, International Organization for Standardization.
  • ISO/IEC 27002, Information security controls (the control catalog companion to 27001).
  • ISO/IEC 27002, Information security, cybersecurity and privacy protection — Information security controls.
  • ISO/IEC 27005, Information security, cybersecurity and privacy protection — Guidance on managing information security risks, International Organization for Standardization.
  • Katz, J., & Lindell, Y., Introduction to Modern Cryptography, CRC Press.
  • Kim, D., & Solomon, M., Fundamentals of Information Systems Security, Jones & Bartlett.
  • Kim, G., Humble, J., Debois, P., & Willis, J., The DevOps Handbook, IT Revolution Press.
  • Knapp, E., & Langill, J., Industrial Network Security, Syngress.
  • Kozierok, C., The TCP/IP Guide, No Starch Press.
  • Kurose, J., & Ross, K., Computer Networking: A Top-Down Approach, Pearson.
  • Liska, A., & Stowe, G., DNS Security: Defending the Domain Name System, Syngress.
  • Macaulay, T., & Singer, B., Cybersecurity for Industrial Control Systems, CRC Press.
  • Microsoft documentation — Azure Key Vault and Microsoft Entra Workload ID (Microsoft).
  • Microsoft, Kusto Query Language (KQL) documentation, https://learn.microsoft.com.
  • Microsoft, Local Administrator Password Solution (LAPS) / Windows LAPS documentation.
  • Microsoft, Microsoft Defender for Endpoint — Attack Surface Reduction (ASR) rules documentation.
  • Microsoft, Privileged Identity Management (PIM), Microsoft Entra documentation.
  • Microsoft, Securing privileged access and the Enterprise Access Model (formerly the Active Directory administrative tier model), Microsoft Learn documentation.
  • Microsoft, Security baselines and the Security Compliance Toolkit documentation.
  • Microsoft, Shared responsibility in the cloud, Azure documentation.
  • Microsoft, Entra ID (Azure AD) documentation — Conditional Access, hybrid identity (Entra Connect / directory synchronization), and application provisioning.
  • Microsoft, guidance on credential theft, pass-the-hash, and Credential Guard, Microsoft Learn documentation.
  • MITRE / NIST, CVE-2021-44228 (Apache Log4j "Log4Shell"), CVSS 10.0 (Critical); and CVE-2022-42889 (Apache Commons Text "Text4Shell").
  • MITRE / NVD, CVE record for CVE-2021-44228 (Log4Shell), CVSS base score 10.0.
  • MITRE ATT&CK (attack.mitre.org) and its coverage-mapping tooling — the basis for detection-coverage metrics (the fraction of relevant adversary techniques for which a working detection exists).
  • MITRE ATT&CK (attack.mitre.org) — Execution, Lateral Movement, Defense Evasion, and Persistence tactics, used to map hardening controls to the techniques they defeat/record.
  • MITRE ATT&CK (used for technique mapping during triage and scoping, e.g., "Inhibit System Recovery").
  • MITRE ATT&CK for Cloud (IaaS / SaaS / Identity Provider matrices), MITRE Corporation.
  • MITRE ATT&CK for ICS, MITRE Corporation (attack.mitre.org/matrices/ics).
  • MITRE ATT&CK knowledge base (attack.mitre.org), for living-off-the-land and exfiltration techniques.
  • MITRE ATT&CK knowledge base, The MITRE Corporation, attack.mitre.org (Enterprise matrix; Tactics, Techniques, and Groups).
  • MITRE ATT&CK Navigator, The MITRE Corporation, mitre-attack.github.io/attack-navigator.
  • MITRE ATT&CK — Command and Control (TA0011) and Exfiltration (TA0010) tactics and techniques, MITRE Corporation.
  • MITRE ATT&CK — Lateral Movement (TA0008) and Command and Control (TA0011) tactics, MITRE Corporation.
  • MITRE ATT&CK — tactics TA0006 (Credential Access) and TA0008 (Lateral Movement); techniques T1003 (OS Credential Dumping), T1550.002 (Pass-the-Hash), T1078 (Valid Accounts).
  • MITRE ATT&CK — technique taxonomy used for the kill-chain mapping (T1190 exploit public-facing app; T1078 valid accounts; T1071 application-layer C2).
  • MITRE ATT&CK — techniques T1078 (Valid Accounts) and T1098 (Account Manipulation).
  • MITRE ATT&CK, Enterprise Matrix — Discovery and Lateral Movement tactics (attack.mitre.org).
  • MITRE ATT&CK, Indicator Removal (T1070), including sub-techniques for Clear Windows Event Logs and Timestomp; Defense Evasion tactic.
  • MITRE ATT&CK, https://attack.mitre.org — adversary tactics and techniques (cited: T1110 Brute Force, T1078 Valid Accounts, T1070.001 Indicator Removal: Clear Windows Event Logs, T1556 Modify Authentication Process, T1098 Account Manipulation, T1071 Application Layer Protocol, T1486 Data Encrypted for Impact).
  • MITRE ATT&CK, Lateral Movement tactic (TA0008), MITRE Corporation.
  • MITRE ATT&CK, techniques for rogue/evil-twin access points and network sniffing, attack.mitre.org.
  • MITRE, ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems), MITRE Corporation.
  • MITRE, ATT&CK Navigator (mitre-attack.github.io/attack-navigator) — tool for building coverage heatmaps.
  • MITRE, ATT&CK framework (attack.mitre.org) — the adversary-behavior taxonomy underpinning purple teaming and detection-coverage measurement.
  • MITRE, ATT&CK knowledge base (attack.mitre.org) — tactics, techniques, and the Detection/Data Sources fields used throughout the chapter. Technique IDs cited (T1003.001, T1018, T1021.002, T1053, T1059.001, T1059.003, T1071.001, T1195.002, T1218.011, T1486, T1547.001, T1548.002, T1562.001, T1566.001, T1573) are real ATT&CK identifiers.
  • MITRE, ATT&CK, MITRE Corporation (behavioral techniques for mapping anomalies; see also Chapter 22).
  • MITRE, Common Attack Pattern Enumeration and Classification (CAPEC) and Common Weakness Enumeration (CWE), The MITRE Corporation.
  • MITRE, Common Weakness Enumeration (CWE) (cwe.mitre.org), including the CWE Top 25 Most Dangerous Software Weaknesses.
  • MITRE, Common Weakness Enumeration (CWE): CWE-89 (SQL Injection), CWE-79 (Cross-site Scripting), CWE-352 (CSRF), CWE-918 (SSRF), CWE-384 (Session Fixation), CWE-78 (OS Command Injection).
  • MITRE, D3FEND (d3fend.mitre.org) — defensive technique knowledge graph mapped to ATT&CK.
  • MITRE, Eleven Strategies of a World-Class Cybersecurity Operations Center — comprehensive freely available reference on building and running a SOC.
  • Mozilla, MDN Web Docs — Content Security Policy; Same-origin policy; HTTP cookies (SameSite, HttpOnly, Secure).
  • Mozilla, Server Side TLS configuration guidance (Modern/Intermediate/Old profiles), Mozilla wiki.
  • NIST Computer Forensics Tool Testing (CFTT) program (validation of forensic tools, including write blockers).
  • NIST National Cybersecurity Center of Excellence (NCCoE), Migration to Post-Quantum Cryptography project.
  • NIST National Vulnerability Database (NVD) — CVE-2021-44228 (Log4Shell) and CVE-2017-5638 (Apache Struts 2 / Equifax) records.
  • NIST SP 800-161, Cybersecurity Supply Chain Risk Management Practices — supply-chain guidance relevant to the SolarWinds lesson.
  • NIST SP 800-61, Computer Security Incident Handling Guide — IR lifecycle framing for the response/disclosure phases.
  • NIST Special Publication 1800-16, Securing Web Transactions: TLS Server Certificate Management, National Institute of Standards and Technology.
  • NIST Special Publication 1800-35, Implementing a Zero Trust Architecture, NIST National Cybersecurity Center of Excellence.
  • NIST Special Publication 800-101 Rev. 1, Guidelines on Mobile Device Forensics, National Institute of Standards and Technology.
  • NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices.
  • NIST Special Publication 800-123, Guide to General Server Security, National Institute of Standards and Technology.
  • NIST Special Publication 800-124, Guidelines for Managing the Security of Mobile Devices in the Enterprise.
  • NIST Special Publication 800-144, Guidelines on Security and Privacy in Public Cloud Computing.
  • NIST Special Publication 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs).
  • NIST Special Publication 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, National Institute of Standards and Technology.
  • NIST Special Publication 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations, National Institute of Standards and Technology.
  • NIST Special Publication 800-167, Guide to Application Whitelisting (application allowlisting).
  • NIST Special Publication 800-177 Rev. 1, Trustworthy Email.
  • NIST Special Publication 800-207, Zero Trust Architecture, 2020.
  • NIST Special Publication 800-210, General Access Control Guidance for Cloud Systems.
  • NIST Special Publication 800-213 and the NISTIR 8259 family, IoT Device Cybersecurity guidance (device cybersecurity capabilities; baseline for federal and enterprise IoT).
  • NIST Special Publication 800-218, Secure Software Development Framework (SSDF) Version 1.1, National Institute of Standards and Technology.
  • NIST Special Publication 800-30 Rev. 1, Guide for Conducting Risk Assessments.
  • NIST Special Publication 800-30, Guide for Conducting Risk Assessments, and the broader NIST risk-management materials — underpin the risk-vs-appetite framing carried over from Chapter 27.
  • NIST Special Publication 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, National Institute of Standards and Technology.
  • NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, National Institute of Standards and Technology.
  • NIST Special Publication 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology.
  • NIST Special Publication 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy, National Institute of Standards and Technology.
  • NIST Special Publication 800-50, Building an Information Technology Security Awareness and Training Program (and its current modernized revision), National Institute of Standards and Technology.
  • NIST Special Publication 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.
  • NIST Special Publication 800-53 (security and privacy controls; CM-7 Least Functionality, AC-3 Access Enforcement) — referenced for the control families behind hardening.
  • NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations.
  • NIST Special Publication 800-53 Rev. 5, control families SI (System and Information Integrity, incl. SI-10 input validation) and SC (System and Communications Protection).
  • NIST Special Publication 800-53, Security and Privacy Controls (CM, AC, SC control families relevant to inventory, access, and segmentation).
  • NIST Special Publication 800-55, Measurement Guide for Information Security (the Performance Measurement Guide for Information Security) — the authoritative U.S. government treatment of selecting, defining, and using security measures so they inform decisions; the conceptual basis of §36.1's "useful vs. vanity" distinction.
  • NIST Special Publication 800-57 Part 1 Rev. 5, Recommendation for Key Management: Part 1 — General.
  • NIST Special Publication 800-57, Recommendation for Key Management (Part 1, General).
  • NIST Special Publication 800-61, Computer Security Incident Handling Guide, National Institute of Standards and Technology.
  • NIST Special Publication 800-63 (suite), Digital Identity Guidelines (overview; 63A identity proofing, 63C federation).
  • NIST Special Publication 800-63 series, Digital Identity Guidelines (800-63A Identity Proofing; 800-63B Authentication and Lifecycle Management; 800-63C Federation and Assertions), National Institute of Standards and Technology.
  • NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management.
  • NIST Special Publication 800-77 Rev. 1, Guide to IPsec VPNs.
  • NIST Special Publication 800-81-2, Secure Domain Name System (DNS) Deployment Guide.
  • NIST Special Publication 800-82, Guide to Operational Technology (OT) Security, National Institute of Standards and Technology.
  • NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, National Institute of Standards and Technology.
  • NIST Special Publication 800-92, Guide to Computer Security Log Management, National Institute of Standards and Technology.
  • NIST Special Publication 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS), National Institute of Standards and Technology.
  • NIST, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST AI 100-2.
  • NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, 2023.
  • NIST, Cybersecurity Framework (CSF) 2.0 — the Detect function (continuous monitoring, adverse event analysis), National Institute of Standards and Technology, 2024.
  • NIST, Cybersecurity Framework (CSF) 2.0, 2024 — "Govern" function and supply chain risk management category.
  • NIST, Cybersecurity Framework (CSF) 2.0, 2024 — DETECT (DE) function (DE.CM continuous monitoring, DE.AE adverse event analysis).
  • NIST, Cybersecurity Framework (CSF) 2.0, 2024 — Functions used to classify which failed in each case.
  • NIST, Cybersecurity Framework (CSF) 2.0, 2024 — the DETECT function (continuous monitoring; adverse event analysis).
  • NIST, Cybersecurity Framework (CSF) 2.0, 2024 — the six Functions (Govern, Identify, Protect, Detect, Respond, Recover) used to structure a board scorecard, and the four Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) used as a maturity scale.
  • NIST, Cybersecurity Framework (CSF) 2.0, 2024.
  • NIST, Cybersecurity Framework (CSF) 2.0, Govern (GV) and Respond (RS) Functions, National Institute of Standards and Technology, 2024.
  • NIST, Cybersecurity Framework (CSF) 2.0, National Institute of Standards and Technology, 2024.
  • NIST, Cybersecurity Framework (CSF) 2.0, the Protect (PR) Function — awareness and training.
  • NIST, FIPS 180-4: Secure Hash Standard (SHS), National Institute of Standards and Technology.
  • NIST, FIPS 186: Digital Signature Standard (DSS), National Institute of Standards and Technology.
  • NIST, FIPS 197: Advanced Encryption Standard (AES), National Institute of Standards and Technology.
  • NIST, FIPS 198-1: The Keyed-Hash Message Authentication Code (HMAC), NIST.
  • NIST, FIPS 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions, NIST.
  • NIST, National Vulnerability Database (NVD) (nvd.nist.gov).
  • NIST, Post-Quantum Cryptography standardization project, National Institute of Standards and Technology.
  • NIST, FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM), 2024.
  • NIST, FIPS 204, Module-Lattice-Based Digital Signature Standard (ML-DSA), 2024.
  • NIST, FIPS 205, Stateless Hash-Based Digital Signature Standard (SLH-DSA), 2024.
  • NIST, Role-Based Access Control (RBAC) model — Ferraiolo, D. F., & Kuhn, D. R., and the formal standard ANSI/INCITS 359 (American National Standard for Role-Based Access Control).
  • NTIA, The Minimum Elements For a Software Bill of Materials (SBOM), U.S. National Telecommunications and Information Administration, 2021.
  • OASIS / CISA, Vulnerability Exploitability eXchange (VEX) — minimum requirements and use cases.
  • OASIS, Security Assertion Markup Language (SAML) v2.0 — Assertions and Protocols, and the SAML 2.0 Technical Overview.
  • OASIS, STIX and TAXII specifications (oasis-open.org/committees/cti) — structured threat-intel language and transport.
  • OCSF, Open Cybersecurity Schema Framework, https://ocsf.io.
  • OffSec, OSCP certification information (offsec.com).
  • Open Policy Agent (OPA) and the Rego policy language, official documentation, openpolicyagent.org (Cloud Native Computing Foundation).
  • OpenID Foundation, OpenID Connect Core 1.0.
  • OpenSSF, Supply-chain Levels for Software Artifacts (SLSA) framework.
  • OWASP Cheat Sheet Series — Authentication, SAML Security, and Access Control cheat sheets.
  • OWASP Cheat Sheet Series, Content Security Policy and Session Management cheat sheets.
  • OWASP CycloneDX specification, cyclonedx.org.
  • OWASP Foundation, OWASP IoT Top 10 (Internet of Things Project) — the canonical list of critical IoT weaknesses; weak/default/hardcoded passwords rank first.
  • OWASP Foundation, OWASP Mobile Top 10 and Mobile Application Security Verification Standard (MASVS).
  • OWASP Secrets Management Cheat Sheet (OWASP Cheat Sheet Series).
  • OWASP Secure Headers Project, Open Worldwide Application Security Project.
  • OWASP Top 10 (current edition), category A06 Vulnerable and Outdated Components, Open Worldwide Application Security Project.
  • OWASP Top 10 CI/CD Security Risks (OWASP).
  • OWASP Top 10 — "Broken Access Control" (A01) and the OWASP Access Control Cheat Sheet.
  • OWASP, Application Security Verification Standard (ASVS), Open Worldwide Application Security Project.
  • OWASP, Authentication Cheat Sheet, OWASP Cheat Sheet Series.
  • OWASP, Cheat Sheet Series (cheatsheetseries.owasp.org) — incl. Input Validation, Cross-Site Scripting Prevention, SQL Injection Prevention, and Secrets Management cheat sheets.
  • OWASP, Cheat Sheet Series (cheatsheetseries.owasp.org): SQL Injection Prevention; Query Parameterization; Cross Site Scripting Prevention; DOM based XSS Prevention; Content Security Policy; Cross-Site Request Forgery Prevention; Server Side Request Forgery Prevention; Session Management.
  • OWASP, Core Rule Set (CRS), coreruleset.org — the managed WAF rule set (ModSecurity).
  • OWASP, Credential Stuffing Prevention Cheat Sheet, OWASP Cheat Sheet Series.
  • OWASP, Cryptographic Storage Cheat Sheet, Open Worldwide Application Security Project.
  • OWASP, Dependency-Track and Dependency-Check (open-source software composition analysis tools).
  • OWASP, DevSecOps Guideline and DevSecOps Maturity Model (DSOMM), Open Worldwide Application Security Project.
  • OWASP, OWASP Top 10 (current edition), Open Worldwide Application Security Project — injection, XSS, CSRF/SSRF, and identification/authentication failures categories.
  • OWASP, OWASP Top 10: The Ten Most Critical Web Application Security Risks, Open Worldwide Application Security Project (owasp.org/Top10).
  • OWASP, Password Storage Cheat Sheet, Open Worldwide Application Security Project.
  • OWASP, Password Storage Cheat Sheet, OWASP Cheat Sheet Series.
  • OWASP, Top 10 for Large Language Model (LLM) Applications, Open Worldwide Application Security Project.
  • OWASP, Vulnerability Management Guide and OWASP Dependency-Check project.
  • OWASP, WebGoat and Juice Shop (deliberately vulnerable training applications; for authorized lab use only).
  • PCI Security Standards Council, Payment Card Industry Data Security Standard (PCI-DSS) v4.0 (Requirements 3 and 4, protection of stored and transmitted cardholder data).
  • PCI Security Standards Council, PCI-DSS v4.0 (network segmentation of the cardholder data environment; device security).
  • PCI Security Standards Council, PCI-DSS v4.0, Requirement 6 (secure development; protection of public-facing web applications).
  • PCI-DSS v4.0, network-monitoring requirements, PCI Security Standards Council.
  • PCI-DSS v4.0, Requirement 7 ("Restrict access to system components and cardholder data by business need to know").
  • Purdue Enterprise Reference Architecture (PERA) — the origin of the level 0–5 model adopted into ICS security practice.
  • Reason, J., Human Error (and the "Swiss cheese" model); Dekker, S., Just Culture — the aviation/medicine basis for no-blame reporting.
  • RFC 4033, DNS Security Introduction and Requirements, IETF (with RFC 4034 and RFC 4035).
  • RFC 6238, TOTP: Time-Based One-Time Password Algorithm, IETF.
  • RFC 6376, DomainKeys Identified Mail (DKIM) Signatures, IETF.
  • RFC 6797, HTTP Strict Transport Security (HSTS), IETF.
  • RFC 7208, Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1, IETF.
  • RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC), IETF.
  • RFC 8555, Automatic Certificate Management Environment (ACME), Internet Engineering Task Force.
  • Richard Bejtlich, The Practice of Network Security Monitoring, No Starch Press.
  • Ristić, I., Bulletproof TLS and PKI, 2nd ed., Feisty Duck.
  • Roberts, S. J., & Brown, R., Intelligence-Driven Incident Response, O'Reilly.
  • Saltzer, J. H., & Schroeder, M. D., "The Protection of Information in Computer Systems," Proceedings of the IEEE, vol. 63, no. 9, 1975 (origin of least privilege, fail-safe defaults, separation of privilege).
  • Sanders, C., & Smith, J., Applied Network Security Monitoring, Syngress.
  • Sanders, C., Practical Packet Analysis, No Starch Press.
  • SANS, Incident Handler's Handbook (PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).
  • Schneier, B., Secrets and Lies: Digital Security in a Networked World, Wiley.
  • Seacord, R., Secure Coding in C and C++ (and the CERT Secure Coding Standards), Addison-Wesley / SEI.
  • Shared Assessments, Standardized Information Gathering (SIG) Questionnaire.
  • Shostack, A., Threat Modeling: Designing for Security, Wiley.
  • SigmaHQ, Sigma — Generic Signature Format for SIEM Systems, https://github.com/SigmaHQ/sigma.
  • Sigstore project documentation (cosign artifact signing and provenance), sigstore.dev.
  • SLSA (Supply-chain Levels for Software Artifacts) Specification, slsa.dev (Open Source Security Foundation / OpenSSF).
  • SLSA (Supply-chain Levels for Software Artifacts) framework documentation, slsa.dev (Open Source Security Foundation / OpenSSF).
  • SPDX (Software Package Data Exchange) specification, ISO/IEC 5962, spdx.dev.
  • SPIFFE/SPIRE project documentation, including the SPIFFE Verifiable Identity Document (SVID) specification (spiffe.io).
  • Splunk, Search Reference and Common Information Model (CIM) documentation, https://docs.splunk.com.
  • Stallings, W., Network Security Essentials: Applications and Standards, Pearson.
  • Stuttard, D., & Pinto, M., The Web Application Hacker's Handbook, 2nd ed., Wiley (offensive reference, read for defensive understanding).
  • Thaler, R., & Sunstein, C., Nudge: Improving Decisions About Health, Wealth, and Happiness.
  • The Open Group, Open FAIR Body of Knowledge (Risk Taxonomy and Risk Analysis standards).
  • The SELinux Project documentation; Red Hat SELinux User's and Administrator's Guide.
  • The Sigma Project (github.com/SigmaHQ/sigma) — the vendor-agnostic detection-rule specification and rule library.
  • The Snort IDS/IPS engine documentation and rule-writing guide, Cisco/Snort project.
  • The Suricata IDS/IPS engine documentation, Open Information Security Foundation (OISF).
  • The White House, Executive Order 14028: Improving the Nation's Cybersecurity, May 12, 2021.
  • The Wireshark Project, documentation and sample captures (wireshark.org).
  • The Zeek Network Security Monitor project documentation.
  • The Zeek Project, Zeek Documentation (log reference: conn.log, dns.log, ssl.log), zeek.org.
  • U.S. Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 (named in general terms; described, not interpreted as legal advice).
  • U.S. congressional committee report(s) on the 2017 Equifax breach (e.g., House Oversight Committee majority staff report).
  • U.S. Cyber Safety Review Board (CSRB), Review of the December 2021 Log4j Event, 2022 — the flagship official post-incident review; concluded Log4j is an "endemic vulnerability."
  • U.S. Department of Energy, Cybersecurity Capability Maturity Model (C2M2) — a detailed domain-by-domain maturity model with concrete practice statements at each level; scaffolding for an evidence-based maturity self-assessment.
  • U.S. Department of Health and Human Services, HIPAA Breach Notification Rule (45 CFR §§ 164.400–414).
  • U.S. Federal Trade Commission / federal banking regulators, GLBA Safeguards Rule.
  • U.S. Government Accountability Office (GAO), report(s) on the 2017 Equifax data breach (basic-control-failure findings).
  • U.S. interagency Computer-Security Incident Notification rule for banking organizations (source of the 36-hour regulator-notification requirement).
  • U.S. Office of Management and Budget, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (OMB Memorandum M-22-09), 2022.
  • Vanhoef, M., & Piessens, F., "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2" (KRACK), ACM CCS 2017.
  • Verizon, Data Breach Investigations Report (DBIR), annual — evidence that the patterns (credentials, vuln exploitation, human element) generalize.
  • Verizon, Data Breach Investigations Report (DBIR), published annually.
  • VirusTotal / YARA, YARA documentation (yara.readthedocs.io) — file/memory pattern-matching rule language.
  • W3C, Web Authentication: An API for accessing Public Key Credentials (WebAuthn), World Wide Web Consortium Recommendation.
  • Wi-Fi Alliance, WPA3 Specification and Discover Wi-Fi: Security overview, Wi-Fi Alliance.
  • Wireshark Foundation, Wireshark User's Guide, wireshark.org.
  • Zalewski, M., The Tangled Web: A Guide to Securing Modern Web Applications, No Starch Press.

Tier 2 — Attributed (specifics unverified)

  • (ISC)² / ISC2, Cybersecurity Workforce Study (published annually) — most-cited source for the security staffing gap; precise figures vary by year/methodology and are used here only as a range.
  • Altheide, C., & Carvey, H., Digital Forensics with Open Source Tools, Syngress.
  • Anderson, R., Security Engineering, 3rd ed., Wiley (book is verifiable; specific claims about under-patching economics should be checked against the text).
  • Anti-Phishing Working Group (APWG) trend reports — phishing-volume and technique data (exact figures Tier 2).
  • Bianco, D. J., "The Pyramid of Pain" (Enterprise Detection & Response blog, ~2013) — the canonical articulation of the pyramid-of-pain model; widely cited, exact figures/wording attributed to the blog post.
  • Bird, J., DevSecOps and related O'Reilly reports on integrating security into CI/CD (practitioner guidance; specifics and tool recommendations vary by edition).
  • BlueBorne Bluetooth vulnerability class (2017) — vendor and research retrospectives vary; treat exact details as attributed, not pinned.
  • Brotby, W. K., Information Security Governance: A Practical Development and Implementation Approach. (Practitioner text on aligning and governing a security program; treated as guidance, not authority.)
  • Carrier, B., File System Forensic Analysis, Addison-Wesley (filesystem internals, NTFS $MFT, deleted-file recovery).
  • Carvey, H., Windows Forensic Analysis and Windows Registry Forensics, Syngress (Windows artifacts: registry, event logs).
  • CISA/NCSC and partners, Guidelines for Secure AI System Development and related joint AI-security guidance (issuer/title pattern; verify the current document before citing).
  • Colonial Pipeline ~75 bitcoin ransom and partial DOJ recovery — widely reported; stated as reported, exact figures not over-specified.
  • Community Sysmon configuration files (widely used open configurations) for endpoint telemetry — referenced as a category; vet any specific config before deployment.
  • Conference talks and engineering retrospectives on the December 2021 Log4Shell response (timelines and specifics vary by account; cite reputable, well-sourced sessions).
  • Conference talks and write-ups on SAML service-provider validation flaws (signature/audience bypass class); specific talks vary by source — choose a reputable, well-sourced account.
  • Cross-industry MTTD/MTTR/coverage "benchmark" figures circulated by vendors and surveys — used in the chapter only as illustrative, directional comparisons (e.g., "~8-hour peer MTTD"). These are soft numbers; the chapter explicitly flags them as approximate and they should be verified against a named source before being presented as fact.
  • Current cloud-native security references (e.g., books on Kubernetes security) for workload-identity and service-account-token handling (pick a current, well-reviewed edition; the platform evolves quickly).
  • Davidoff, S., & Ham, J., Network Forensics: Tracking Hackers through Cyberspace, Prentice Hall.
  • Director-level cyber-oversight guidance of the kind issued by board associations (e.g., NACD/ISA cyber-risk handbooks for directors). (Attributed generally; the audience-side view of a board presentation. Emphases evolve by edition — not pinned to a specific figure.)
  • Discovering-firm public technical analyses of SUNBURST (the behavioral-detection / anomalous-MFA-enrollment discovery narrative) — read for the lesson; specific technical figures attributed, not pinned.
  • Ebbinghaus, H., foundational work on the forgetting curve and spaced repetition (1885); cited as the established memory-decay principle.
  • Eric Zimmerman's forensic tools and documentation (Windows artifact parsing) — widely used in the community.
  • Established CTF and hands-on practice platforms, and deliberately vulnerable practice VMs/applications published by security-training projects (specific platforms come and go; choose a reputable, currently active one that provides the targets).
  • Fogg, B. J., Tiny Habits and the Fogg Behavior Model (B = MAP); Tier 1 for the model itself, Tier 2 for its security-awareness application.
  • Freund, J., & Jones, J., Measuring and Managing Information Risk: A FAIR Approach, Butterworth-Heinemann — the book-length treatment of the FAIR model for quantifying risk; the rigorous version of the risk-vs-appetite / burn-down story. The FAIR Institute (fairinstitute.org) hosts related free material (vendor-adjacent community; read critically).
  • General business/product-analytics literature on "actionable vs. vanity metrics" (the distinction predates and is broader than security) — sharpens §36.1's core discriminator; the principle transfers cleanly though the sources are outside security.
  • General explanations of the base-rate fallacy as it applies to rare-event detection (standard probability result; many sources).
  • General industry observation that boards fund risk-and-return narratives over technical detail, and that security leaders commonly fail at executive translation (widely reported in CISO practitioner literature and conference talks; not a single citable statistic).
  • General industry reporting that financial motivation dominates breaches and that credential theft/phishing are leading vectors (as summarized in successive DBIR editions).
  • General industry reporting that weak or unsalted password hashing (MD5/SHA-1) has amplified the impact of several large credential breaches (pattern summarized across multiple public post-mortems, not attributed to a single named incident here).
  • General pattern of large healthcare data breaches over the past decade (months-long undetected access, external discovery, logging gaps inflating notification scope, HHS "wall of shame" listings) — informs Case Study 2; not a single named event.
  • General project-management / GRC references on the RACI matrix and its anti-patterns (the concept is standard; exact source varies).
  • General reporting that open-source components constitute the large majority of code in typical applications and that transitive dependencies dominate dependency trees (widely cited in software-composition surveys; specifics vary).
  • Gilman, E., & Barth, D., Zero Trust Networks: Building Secure Systems in Untrusted Networks, O'Reilly (practitioner build reference; specifics vary by edition).
  • Google, CSP Evaluator (csp-evaluator.withgoogle.com) — tool that flags weak CSP directives such as 'unsafe-inline'.
  • Google/USENIX Site Reliability Engineering literature on blameless postmortems and sustainable on-call rotations — cross-disciplinary practice transferred to the SOC.
  • Hadnagy, C., Social Engineering: The Science of Human Hacking — defender-relevant treatment of human manipulation.
  • Hardy, N., "The Confused Deputy" — the classic articulation that a service must check the caller's authority, not its own (widely cited; multiple accessible retellings exist).
  • Have I Been Pwned (haveibeenpwned.com) as a public index illustrating the scale of leaked credentials and credential-stuffing exposure.
  • Hayden, L., IT Security Metrics. (Choosing and presenting metrics for an executive audience; supports the board-metrics slide.)
  • Hubbard, D., & Seiersen, R., How to Measure Anything in Cybersecurity Risk, Wiley (a widely cited argument for quantitative over qualitative risk; treat its specific claims as the authors' position).
  • Independent retrospectives and timelines of the SolarWinds campaign from major incident-response firms and the affected vendor; specifics vary by retelling, so anchored on the CISA account above.
  • Industry and press retrospectives on publicly exposed cloud storage ("open S3 bucket") data-exposure incidents (the general pattern behind Case Study 2; specifics vary by source and should be verified against the primary report before citing a figure).
  • Industry phishing-simulation benchmark reports (click-rate-by-sector studies) — used only for RANGES of realistic click/report rates; methodologies vary widely, so all specific percentages are treated as Tier 2 and never invented.
  • Industry reporting (as summarized in successive DBIR editions and similar surveys) that leaked credentials, misconfiguration, and exposed secrets are among the most common breach causes — described qualitatively; no precise figure invented here.
  • Industry reporting and incident analyses describing privilege escalation from a low-privilege foothold to domain admin via credential harvesting and lateral movement as a common ransomware pattern (specific efficacy and frequency figures vary by source; treat platform-mitigation efficacy claims as unverified specifics).
  • Industry reporting and successive DBIR editions indicating that exploitation of known, unpatched vulnerabilities on internet-facing assets remains a leading breach pattern (general finding; exact figures vary by year and source).
  • Industry reporting and vendor analyses that business email compromise produces greater aggregate financial losses than ransomware (as summarized in successive IC3 reports and industry surveys); do not cite a precise figure without the primary report.
  • Industry reporting on the 2022 MFA-fatigue ("push bombing") breaches of large technology firms (specifics vary by account; used to motivate number matching and phishing-resistant MFA).
  • Industry reporting that command-and-control beaconing and slow ("low-and-slow") exfiltration are common across major intrusions, and that DNS is a frequently abused covert channel (as summarized across vendor threat reports and ATT&CK technique documentation).
  • Industry reporting that default/weak credentials and unpatched edge devices are among the most common footholds for compromise (as summarized across successive DBIR editions and CISA advisories).
  • Industry reporting that expired certificates and TLS misconfigurations (not algorithm breaks) cause most real-world TLS outages and findings.
  • Industry reporting that high-impact intrusions increasingly involve "living off the land" — stolen credentials and built-in tools rather than malware — and so evade signature-only detection (as summarized across vendor and incident-response reports).
  • Industry reporting that injection and XSS classes have remained on successive OWASP Top 10 editions for ~two decades (general, as summarized across OWASP releases; no single precise statistic claimed).
  • Industry reporting that insider-driven financial fraud commonly exploits weak separation of duties and accumulated (creeping) privileges (general pattern, as summarized across fraud and audit literature).
  • Industry reporting that known, patchable vulnerabilities and default/weak configurations (rather than zero-days) account for a large share of real intrusions (as summarized across successive Verizon DBIR editions and CISA advisories) — no precise figure asserted.
  • Industry reporting that leaked credentials in source repositories and misconfigured cloud infrastructure are among the leading causes of cloud breaches (as summarized across successive DBIR editions and cloud-security reports).
  • Industry reporting that modern applications are predominantly assembled from third-party and transitive dependencies, making software composition analysis essential (as summarized across vendor and OWASP guidance).
  • Industry reporting that rogue access points and evil twins remain common physical-access vectors in retail and enterprise environments (as summarized in successive security reports).
  • Industry reporting that stolen credentials and phishing are among the most common breach causes (as summarized in successive DBIR editions).
  • Industry reporting that the majority of significant breaches involve lateral movement from an initial foothold (as summarized across successive incident-investigation reports such as the Verizon DBIR).
  • Industry reporting that the SolarWinds Orion compromise affected on the order of thousands of organizations and a number of U.S. agencies (exact counts vary by source).
  • Industry reporting that third-party/vendor access and stale credentials are recurring root causes of healthcare and enterprise ransomware (pattern summarized across public breach reporting; no single figure pinned).
  • Industry surveys reporting that non-human/machine identities outnumber human identities by roughly 10:1 to 50:1 in cloud-heavy environments (the exact multiple varies by source; the order of magnitude is consistent).
  • Industry workforce studies repeatedly reporting a persistent cybersecurity talent gap (more open roles than qualified people); direction is durable across years, but specific figures vary by source and should not be pinned to a single number.
  • Industry/practitioner literature on risk-based alerting (RBA) and detection engineering as a remedy for alert fatigue (widely discussed in vendor and SOC writing; treat specific figures as illustrative).
  • Jaquith, A., Security Metrics: Replacing Fear, Uncertainty, and Doubt, Addison-Wesley — the classic professional argument for measuring outcomes over activity and against vanity metrics; foundational to the modern discipline. A well-known practitioner text; treat specific figures as illustrative.
  • Kindervag, J., No More Chewy Centers: Introducing the Zero Trust Model of Information Security (originating analyst research, 2010 onward; exact publication details vary).
  • Luttgens, J. T., Pepe, M., & Mandia, K., Incident Response & Computer Forensics, McGraw-Hill.
  • Major-provider security "Learning Center" educational articles on DDoS, SYN floods, and reflection/amplification (e.g., Cloudflare/Akamai) — accurate on fundamentals; vendor educational material, read for concepts not product claims.
  • Malware-Traffic-Analysis.net — a community library of constructed/teaching PCAPs and exercises (excellent for lab skill-building; not a formal citation).
  • Mandiant / Google Cloud threat-intelligence reporting (e.g., the M-Trends annual report); named reputable source, but treat specific year-over-year figures as reported, not independently verified here.
  • Maslach, C., & Leiter, M. P., burnout research (e.g., The Truth About Burnout and the Areas of Worklife model) — the established framing of burnout as an organizational phenomenon; the SOC-specific application is the author's.
  • Microsoft Sysinternals Sysmon documentation — confident it exists; cited at the level of capability (process/network/image-load logging) without pinning a version.
  • MITRE, Caldera and the adversary-emulation/purple-teaming tooling ecosystem — open-source operationalization of the purple-team loop (use only in authorized environments).
  • MITRE, TTP-Based Hunting and ATT&CK-driven detection guidance (behavior-over-indicator detection; specifics vary by publication).
  • Murdoch, D., Blue Team Handbook: Incident Response Edition — a practitioner field reference.
  • Murdoch, D., Blue Team Handbook: SOC, SIEM, and Threat Hunting — widely used practical SOC field guide.
  • NIST and academic work on synthetic/AI-generated content detection and provenance (a fast-moving area; detailed claims should be treated as Tier 2 pending verification of the specific publication).
  • NIST guidance on network security and segmentation/zero-trust networking (e.g., the SP 800-series on virtualization/network security and SP 800-207 on zero trust) — cited for framing internal trust boundaries; specific document numbers to be confirmed before final compile.
  • Open FAIR / FAIR (Factor Analysis of Information Risk) as a named method for quantifying risk in dollars (Freund, J., & Jones, J., Measuring and Managing Information Risk: A FAIR Approach). (Cited as a real, named quantification approach that strengthens an ALE-based business case; specific figures not relied upon.)
  • Open-source PAM and secrets-management project documentation (e.g., HashiCorp Vault) as illustrations of vaulting, brokering, and short-lived credentials (one vendor's model among several).
  • OWASP, Security by Design Principles (community-maintained restatement of least privilege, fail-safe defaults, defense in depth; exact wording varies).
  • PortSwigger, Web Security Academy (portswigger.net/web-security) — free interactive labs on injection, XSS, CSRF, SSRF (teaches attacks for defensive understanding; use only in its sandbox).
  • Post-incident technical analyses of the SolarWinds / Sunburst compromise from multiple vendor and government sources (the public facts are well established; technical details and attribution specifics vary by report). The control-by-control "what would have prevented/detected it" framing in Case Study 2 is this chapter's defensive interpretation, not a claim about SolarWinds' internal decisions.
  • Public DMARC-report analyzers and "spoofability" checkers (reputable, well-reviewed services) used for hands-on practice on owned domains.
  • Public reporting of the first practical SHA-1 collision ("SHAttered", 2017) demonstrating that SHA-1 is unsafe for collision-dependent uses such as signatures (specifics per the published research and reputable accounts).
  • Public retrospectives on SaaS support-account / over-privileged-access breaches in which one compromised internal or support credential exposed many customers' data (the pattern behind Case Study 2; specifics vary by incident and reporting — attribute carefully and treat figures cautiously).
  • Public technical reporting on the Triton/Trisis malware targeting a safety instrumented system (2017) — vendor and researcher analyses; specifics treated carefully and at public-fact level only.
  • Published post-incident retrospectives of CI/CD secret-harvesting and leaked-cloud-key breaches, illustrating the secret-harvesting cascade pattern (the class of incident is well documented; specifics vary by retelling — favor primary vendor/CISA post-mortems).
  • Published regulatory enforcement actions and breach post-mortems (HHS OCR resolution summaries; EU data-protection-authority decisions; FTC actions) as sources of "compliant but breached" lessons — read the specific published case before citing any detail.
  • Red Canary, Atomic Red Team (github.com/redcanaryco/atomic-red-team) — ATT&CK-mapped safe test library.
  • Reference-monitor concept (always-invoked, tamper-proof, verifiable) — originating in the Anderson report on computer security (1972) and standard in security-architecture texts (used here at the level of the concept, not a specific edition/figure).
  • Regulatory moves to ban universal default passwords on consumer connected devices and require basic security properties before sale (several jurisdictions; specifics vary — attribute carefully and verify the regime before citing a particular law).
  • Reporting and retrospectives on the 2021 Colonial Pipeline ransomware incident, used as the generalized model behind the Meridian tabletop (specifics vary by source; the recovered-ransom detail and the single-credential initial access are widely reported).
  • Reporting on real deepfake-enabled fraud incidents, including the synthetic-CFO video-call wire-fraud cases (the mechanism is well established; specific amounts and companies vary by retelling — treat as illustrative unless independently verified).
  • Reporting on real deepfake-fraud incidents (2023–2024) in which finance employees were tricked by deepfaked voice/video calls into authorizing multi-million-dollar transfers (well-sourced press coverage; specifics vary by retelling).
  • Reporting on SIM-swap account-takeover cases against banking and cryptocurrency accounts (illustrates the weakness of phone-number-based possession).
  • Reporting that cloud-security and detection/blue-team skills are among the most in-demand in the field (durable industry direction, not a precise statistic).
  • Reputable post-incident analyses of identity-provider token-theft / token-forgery breaches illustrating that SSO concentrates risk at the IdP (treat single-source specifics cautiously; do not cite precise unverified figures).
  • Reputable retrospectives of the Target (2013, HVAC-vendor + flat-network) and NotPetya (2017, supply-chain + destructive blast radius) incidents — used as optional "Your Turn" cases.
  • Retrospective accounts of the 1988 Morris Worm as the first internet-scale security incident (specifics vary by source).
  • Retrospective accounts of the 2008 Kaminsky DNS cache-poisoning vulnerability disclosure and the resulting industry response (source-port randomization; accelerated DNSSEC adoption); specifics vary by source.
  • Retrospective accounts of the WannaCry and NotPetya (2017) outbreaks spreading via SMBv1 (specifics and attribution vary by source); used to motivate disabling SMBv1 / attack-surface reduction.
  • Retrospective accounts of TLS/SSL downgrade and padding-oracle attacks (POODLE, BEAST, FREAK, Logjam, Sweet32, ROBOT, Lucky 13) — read well-sourced write-ups; technical specifics vary by retelling.
  • SANS / E-ISAC analysis of the December 2015 Ukraine power-grid attack (widely cited public post-incident report; specifics summarized consistently across reputable accounts).
  • SANS DFIR posters and cheat sheets (Windows Forensic Analysis; Hunt Evil) — widely used quick references for artifacts and event IDs.
  • SANS Institute, annual SOC survey and SOC-management resources — practitioner data on SOC staffing, automation, tooling, and burnout (framework Tier 1; specific figures Tier 2).
  • SANS reading-room papers and SOC survey material on alert fatigue, false-positive rates, and SOC staffing (attributed; exact statistics vary by edition and year).
  • SANS Security Awareness, Security Awareness Maturity Model and the annual Security Awareness Report — framework Tier 1; specific benchmark figures Tier 2 (directional, not precise).
  • SANS security policy templates / policy library (useful as structural templates; some samples are mislabeled across tiers, which is itself instructive).
  • Sector information-sharing (ISAC) and vendor threat reports for financial services; quality varies by source, used as illustrative of sector-specific threat intelligence.
  • Sector ISAC threat-sharing reporting (e.g., a financial-services ISAC), membership-dependent.
  • Security Onion and SiLK/nfdump as widely used open-source NSM/flow tooling (project documentation; specifics vary by version).
  • Security-operations adage "two kinds of organizations: those that patch and those that get patched" (widely repeated; origin uncertain — used as an epigraph only, not a sourced claim).
  • Sommer, R., & Paxson, V., "Outside the Closed World: On Using Machine Learning for Network Intrusion Detection," IEEE Symposium on Security and Privacy, 2010 (venue/year as commonly cited; confirm before formal citation).
  • Sqrrl, "A Framework for Cyber Threat Hunting" and the associated Hunting Maturity Model — industry white paper popularizing hypothesis-driven hunting; specific maturity levels widely reproduced.
  • Stillions, R., "The DML (Detection Maturity Level) Model" (blog) — complementary model on the abstraction level of detections.
  • SwiftOnSecurity, sysmon-config (github.com/SwiftOnSecurity/sysmon-config) — widely used Sysmon configuration baseline.
  • The "diceware" passphrase method and its entropy rationale (widely described; word-list and per-word entropy figures referenced approximately).
  • The broader SANS 504/508 incident-handling and digital-forensics course body of knowledge (attributed; specific materials vary).
  • The Cryptopals Crypto Challenges (cryptopals.com) as a hands-on resource for understanding cryptographic misuse (ECB detection, bad randomness, missing integrity); community-maintained, technically sound.
  • The DFIR Report (thedfirreport.com) — public, ATT&CK-mapped intrusion analyses with detection guidance.
  • The Emerging Threats (ET) open Suricata/Snort ruleset (community-maintained; specific rules evolve over time).
  • The FAIR Institute (fairinstitute.org) — community articles and reference material on quantitative risk analysis.
  • The Mirai botnet (2016) and its record-setting DDoS attacks built from default-credentialed IoT devices — widely reported; the academic measurement study "Understanding the Mirai Botnet" (USENIX Security 2017) is the primary technical source. Treat any specific device-count or bandwidth figure as approximate and cite the study.
  • The Volatility Foundation documentation (memory forensics framework).
  • The widely repeated maxim "amateurs hack systems, professionals hack people" (used as the epigraph); attribution is uncertain and contested — treated as folklore, not a sourced quotation.
  • The ~76-day Equifax undetected-exfiltration window and the expired-certificate detail — from official investigations and reporting; stated at public-fact level.
  • U.S. CISA/FBI joint advisories and congressional testimony on the May 2021 Colonial Pipeline ransomware incident and the DarkSide ransomware-as-a-service operation (initial access via a VPN account lacking MFA; ransom paid, partially recovered; pipeline shut ~5 days). Public-record facts; some operational internals not public and flagged as such.
  • Vanhoef, M., & Ronen, E., "Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd" (2019) — read a well-sourced summary; implementation flaws were subsequently patched.
  • Vendor and CERT threat-intelligence reporting on ransomware-as-a-service affiliate models and initial access broker markets (ecosystem details vary by source; attribute carefully, do not treat one report's figures as canonical).
  • Vendor next-generation-firewall and NAC architecture guides (capabilities described generically; specific product claims vary and should be verified against NIST guidance).
  • Vendor security-blog guidance on specific cloud features (S3 Block Public Access, service control policies, IMDSv2); cloud features change, so any specific feature detail should be confirmed against current provider documentation.
  • Vendor WAF and web-security engineering blogs (e.g., Cloudflare, major cloud providers) — current web-attack and WAF-tuning writeups; vendor perspective, read critically.
  • Verizon, Data Breach Investigations Report (DBIR) — third-party and supply chain breach patterns (cite the pattern, not a precise figure that shifts year to year).
  • Widely reported figure of ~18,000 organizations downloading the trojanized SolarWinds Orion update (reported by SolarWinds) — stated as reported.
  • Widely reported observation that secrets pushed to public code repositories are scraped and abused by automated tooling within minutes (as summarized across security-vendor and platform reporting).
  • WireGuard protocol whitepaper and documentation (wireguard.com) — specific performance/design claims attributed to the project's own materials.
  • Zetter, K., Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, Crown — a journalistic reconstruction of the Stuxnet operation (well-sourced narrative, not a primary technical document).

Tier 3 — Illustrative / constructed (labeled in text)

  • "BorderTrust Financial" (Exercise 32) — a constructed org for the CTF challenge.
  • "Folio" social platform and its 120-million-account password-dump analysis (Case Study 2) — a constructed composite, assembled from the documented general pattern of real megabreaches rather than any single named company.
  • Aldridge Robotics, "R. Vance," "Marcus Webb," and the insider data-theft investigation (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported insider/trade-secret cases.
  • All artifact excerpts, log lines, hashes (labeled illustrative placeholders), and timelines in this chapter — constructed for teaching.
  • All bluekit code outputs in this chapter (defender_checkpoint.py, example-01..03, exercise-solutions.py) — hand-traced, illustrative, never executed.
  • All configuration excerpts, audit outputs, IP addresses (documentation ranges only), and .example domains — illustrative.
  • All hashes, keys, certificates, IVs, nonces, and identifiers shown in code and figures — illustrative documentation placeholders, never real values or real computed digests.
  • All illustrative scan outputs, exception registers, CVSS/EPSS values in example tables (except the real CVE-2021-44228 figures), and SLA numbers — constructed for teaching.
  • All illustrative scanner findings, pipeline YAML, policy-as-code rules, CVE-in-context examples, and metrics in this chapter — constructed for teaching and labeled as illustrative (real CVE IDs such as CVE-2021-44228 / Log4Shell are cited only where confidently known and used illustratively in policy examples).
  • All in-chapter campaign numbers (e.g., the 400-recipient retail-division simulation: 48 clicked, 96 reported) — illustrative figures for teaching the metrics.
  • All policy-decision logs, access requests, and microsegmentation flows shown in code and exercises — illustrative, using documentation IP ranges and example identities.
  • All sample authentication logs, hashes, IP addresses (documentation ranges), and the illustrative SHA-1 prefix ABF0F — constructed for teaching; the hash digest is fake and not verified.
  • All sample BSSIDs, SSIDs, passphrases, IP ranges (documentation/RFC1918/TEST-NET), and the wifiaudit.py output — constructed/illustrative, never real credentials or live targets.
  • All sample flow records, Zeek log lines, beacon timestamps, and storage figures throughout the chapter — illustrative values, hand-traced, not measured.
  • All sample IP addresses, log lines, signature IDs (9000xxx), and numeric figures throughout the chapter — illustrative values using documentation ranges only.
  • All sample logs, alerts, certificate inventories, and placeholder secret values (AKIA...EXAMPLE, ghp_EXAMPLE...) — illustrative and constructed; never real credentials.
  • All sample logs, detection rules, account inventories, and the bluekit/pam.py output — constructed and hand-traced; documentation values only.
  • All sample logs, IP addresses (documentation/RFC 1918 ranges), firewall rulesets, and traffic figures — illustrative and constructed.
  • All sample logs, the crypto-inventory tables, and the resilience-score figures throughout the chapter — illustrative, with documentation-range IPs (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24).
  • All sample/illustrative log lines, alert volumes, false-positive rates, and query results in this chapter — constructed for teaching.
  • All SBOM excerpts, questionnaire scores, log lines, and contract-clause text in the chapter — illustrative, using documentation values only.
  • All staffing/SLA, escalation-routing, build-vs-buy scoring, and purple-team coverage figures in the code/ examples — illustrative and hand-traced; never executed.
  • Brightwater Health Systems and the eighteen-day double-extortion campaign, all logs, timelines, and the deepfake-CFO call (Case Study 2) — a constructed teaching scenario whose patterns mirror widely reported real-world ransomware tradecraft.
  • Brightwater Logistics and the deepfake-CFO incident (Case Study 2) — a constructed teaching scenario, grounded in the general pattern of widely reported deepfake-fraud cases.
  • Cedar Hollow Water District (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported small-utility incidents.
  • CIS Controls v8 control NUMBERS (4, 7, 2, 10, 8) are mapped from memory of the v8 control set — high confidence but spot-check the exact numbering before publishing the crosswalk in key-takeaways.md.
  • Colonial Pipeline initial access via a single legacy VPN account without MFA, password in a breach dataset; ransomware affected IT (not OT) and Colonial proactively shut the pipeline — stated per public reporting; confirm phrasing against CISA/company statements.
  • CorePoint Systems (Case Study 1) — a constructed core-banking vendor for teaching.
  • CVE-2017-5638 is the Apache Struts 2 RCE associated with the Equifax breach (CONFIDENT at public-fact level); confirm the exact disclosure month (March 2017) against NVD.
  • CVE-2021-44228 (Log4Shell): CVSS 10.0 Critical, disclosed December 2021 (CONFIDENT). The CSRB report title/year ("Review of the December 2021 Log4j Event", 2022) should be confirmed.
  • Eastfield State University (Case Study 2) — a constructed teaching scenario; the breach shape (stale federated account plus loose SAML assertion validation) reflects a real, recurring class of incident, but all specifics, logs, names, and figures are invented for teaching.
  • Equifax exposure figure (~147 million people) and the ~76-day undetected window: widely reported and in official reports; confirm exact numbers against the GAO/congressional reports.
  • Harborview Construction and Coastal Steel, the $1.2M BEC wire-fraud incident, and all associated figures and headers — a constructed teaching scenario informed by the general pattern of reported BEC incidents (Case Study 2).
  • HelixCare (Case Study 2) — a constructed health-tech SaaS teaching scenario; the tenant counts, log excerpts, and figures are illustrative, informed by the general pattern of reported over-privileged-access breaches but tied to no specific real company.
  • Lakeshore Regional Health (Case Study 2) and its 600,000-patient data breach — a constructed teaching scenario, informed by the general pattern of reported healthcare breaches.
  • Lakeshore Regional Health (Case Study 2) and its account-takeover incident — a constructed teaching scenario, informed by the general pattern of reported healthcare account-takeover incidents.
  • Lakeshore Regional Health and its full-disk-encryption rollout, device counts, wave metrics, and incidents (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported lost-device health-data breaches.
  • Lakeshore Regional Health System (Case Study 2) — a constructed teaching scenario depicting a silent risk-acceptance failure, informed by the general pattern of reported healthcare PHI breaches; no real institution or incident is depicted.
  • Lakeside Health Network (Case Study 2) — a constructed teaching scenario informed by the general, widely-reported pattern of healthcare ransomware via unowned/stale vendor access; all figures (9-day outage, costs) are illustrative.
  • Lakeside Regional Health (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported insider accounts-payable fraud.
  • Lakeside State University (Case Study 2) and its credential-based intrusion, anomaly alert, and detection telemetry — a constructed teaching scenario, informed by the general pattern of reported research-network intrusions.
  • Lumadyn Health (Case Study 2) and its public-bucket exposure, escalation chain, and figures — a constructed teaching scenario informed by the general pattern of reported public-storage incidents.
  • Lumen Forge and its 200 GB exfiltration via cloud bucket and DNS tunneling, all hosts, baselines, and figures (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported IP-theft and low-and-slow exfiltration incidents.
  • Meridian Regional Bank and all its personnel, figures, and incidents — a constructed teaching scenario.
  • Meridian Regional Bank branch-wireless redesign (Case Study 1) — a constructed teaching scenario; all configurations, branch counts, and figures are illustrative.
  • Meridian Regional Bank online-banking portal review and all its findings, code, logs, and personnel — a constructed teaching scenario.
  • Meridian Regional Bank — its AD/Entra hybrid environment, the orphaned-contractor finding, the eight-week identity-governance cleanup, and all account names, counts, and access-review reports — a constructed teaching scenario.
  • Meridian Regional Bank — its enterprise risk assessment, register, appetite statement, personnel, and all SLE/ARO/ALE figures (DDoS, credential attack, etc.) are constructed teaching scenarios with illustrative numbers.
  • Meridian Regional Bank — its network, addresses, firewall rulesets, IDS signatures, the branch-jack penetration-test finding, and all personnel — a constructed teaching scenario.
  • Meridian Regional Bank — the hard-coded AWS backup key discovered on a contractor's laptop, the svc-statements over-privileged service account, the secrets-management discovery scan, and the nine-rule secrets-management standard — all a constructed teaching scenario.
  • Meridian Regional Bank's AWS footprint, the posture review, all CSPM figures, ACLs, IAM policies, security-group rules, and CloudTrail events in this chapter and Case Study 1 — a constructed teaching scenario.
  • Meridian Regional Bank's network-monitoring deployment, the C2 beaconing hunt, all addresses, beacon scores, and the cdn-sync.example C2 (Case Study 1) — a constructed teaching scenario.
  • Meridian Regional Bank's security awareness program, personnel, simulation results, and all figures (Case Study 1) — a constructed teaching scenario.
  • Meridian Regional Bank's TLS estate, the forgotten marketing microsite, the audit, and all figures/grades (Case Study 1) — a constructed teaching scenario.
  • Meridian Regional Bank, its board Audit Committee, the Q1 metrics pack, the four named incidents (phishing/creds, malware, data egress, admin login) with their timestamps, the coverage counts (220 servers / 48 admin accounts / 60 critical systems), the maturity table, and all figures in this chapter and Case Study 1 — a constructed teaching scenario; the MTTD/MTTR/coverage/maturity numbers are illustrative.
  • Meridian Regional Bank, its branch IoT, its ~200 ATMs, the lobby-camera incident, and all per-device logs, IP addresses, and figures in this chapter and Case Study 1 — a constructed teaching scenario.
  • Meridian Regional Bank, its building management system (BuildControl controllers, the facilities HMI/SCADA, the vendor remote-access path), Sam Whitfield's engagement, and all associated figures — a constructed teaching scenario.
  • Meridian Regional Bank, its encryption standard, cardholder-data-environment design, and all personnel and figures (Case Study 1) — a constructed teaching scenario.
  • Meridian Regional Bank, its loan-origination pipeline, security team (Okafor/Whitfield/Vasquez et al.), figures, and the secure-pipeline build narrative (Case Study 1) — a constructed teaching scenario.
  • Meridian Regional Bank, its personnel (Okafor, Vasquez, Whitfield, Reyes, etc.), and all its vendor scenarios, figures, and findings — a constructed teaching scenario.
  • Meridian Regional Bank, its team, documents, policy set, RACI, and the examination scenario — a constructed teaching scenario.
  • Meridian Regional Bank, the "LoanFlow" loan-origination application, and all associated personnel, code, figures, and findings — a constructed teaching scenario.
  • MidStream Credit Union (Exercise 12) — a constructed organization for the build-vs-buy analysis exercise.
  • No CVE IDs asserted in this chapter (WannaCry/NotPetya referenced by name/behavior, not by CVE). All standard document numbers above are real to the best of the author's knowledge; where uncertain, the chapter text describes them generically.
  • No precise dollar amounts, exact victim lists, or exploit details fabricated. Where a number is approximate it is labeled "~" / "reported".
  • Northbridge State University and the graduate-student "Dani" server compromise (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported unhardened-host/internet-exposed-SSH compromises; no real institution depicted.
  • NorthField Outfitters retail rogue-AP incident (Case Study 2) — a constructed teaching scenario, informed by the documented pattern of real retail wireless intrusions; all logs, addresses, and figures are illustrative.
  • NorthFlow Analytics (Case Study 2) and its Log4Shell incident specifics — a constructed teaching scenario built on the real, widely-documented shape of the global Log4Shell response.
  • Northgate Industrial and its breach timeline (Case Study 2) — a constructed teaching scenario whose pattern (a known, KEV-listed, internet-facing vulnerability left unpatched under a drifted exception) mirrors several well-documented real breaches, but whose specific figures and entities are invented.
  • NorthLine Commerce (Case Study 2) and all its facts, certificates, and the 4.2-million-record breach — a constructed teaching scenario, informed by the general pattern of reported compliant-but-breached incidents and leaked-API-key breaches.
  • NorthRiver Logistics, its all-green pre-breach dashboard, its breach narrative, and the reconstructed "honest scorecard" in Case Study 2 — a fully constructed teaching scenario; the company is fictional, while the failure mode (activity-only dashboards hiding real risk) is a real, recurring pattern.
  • Northvale Health System (Case Study 2), its SOC, advisory AA-2026-HC-09, and all indicators/figures — a constructed teaching scenario informed by the general pattern of reported healthcare ransomware intrusions.
  • Northwind Analytics (Case Study 2) — a constructed SaaS company and CI/CD secret-harvesting incident, a composite informed by the general (well-documented) pattern of pipeline/secret breaches.
  • Northwind Health Systems (Case Study 2), CISO Ravi Desai, the two board presentations, and the ransomware outcome — a constructed teaching scenario, informed by the general pattern of reported healthcare ransomware incidents and unsegmented medical-device risk; not a specific real organization or breach.
  • Northwind Logistics (Case Study 2) and its breach timeline — a constructed teaching scenario, informed by the general pattern of reported lateral-movement breaches.
  • Northwind Logistics (Case Study 2) — a constructed Orion-customer defender for analyzing SolarWinds from the blue-team seat; all internal telemetry, scores, and timelines are illustrative.
  • Pinewood Regional Medical Center (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported healthcare/flat-network intrusions; no specific real incident is depicted.
  • Pinnacle Ridge Construction and the $312,000 BEC/vishing incident (Case Study 2) — a constructed teaching scenario, informed by the general pattern of widely reported BEC losses; no specific real incident.
  • Renata Cabrera and her career-change path (Case Study 2) — a constructed teaching scenario informed by the general pattern of reported career-changer entries into GRC.
  • ShopVerse (Case Study 2) e-commerce SQL-injection breach — a constructed teaching scenario, informed by the general pattern of reported web-application breaches; no real company, data, or exploit reproduced.
  • SolarWinds attribution to a Russian state-sponsored group (publicly associated with the SVR) and the ~18,000 download figure — stated as publicly reported/attributed, not as independently verified here.
  • SP 800-167 title is given as "Guide to Application Whitelisting" — confident the SP number and topic are correct; the historical title uses "whitelisting." Verify exact current title/revision.
  • SP 800-40 cited as Rev. 4 with the patch-management-planning title — confident; confirm the revision number at compile.
  • StreamHarbor (Case Study 2) — a constructed consumer-streaming-service scenario, informed by the general pattern of reported credential-stuffing/account-takeover waves.
  • Tellaro Components (Case Study 2) — a constructed teaching scenario, informed by the general pattern of reported manufacturing-sector ransomware intrusions; all hosts, accounts, timestamps, and events are illustrative.
  • The "misattributed intrusion" CTF scenario (Exercise 29) — constructed for teaching.
  • The "two intrusions at a manufacturer" War Story (§2.2) — a constructed composite illustrating how motivation shapes behavior.
  • The "war story" of the CISO whose all-green deck collapsed after a third-party breach (§36.5) — a constructed, representative vignette, labeled illustrative.
  • The CISSP_MIN_YEARS = 5 threshold and all CPE credit values in the code examples — illustrative numbers, not official requirements; confirm with the issuing body.
  • The constructed war stories in §40.2 and §40.4 (the vendor-agent telemetry near-miss; the "stop trying to fix it, tell me where we have it" Log4Shell moment) — illustrative, labeled.
  • The defender's reading of SolarWinds in Case Study 2 presents the campaign analytically; the high-level facts are from public reporting (Tier 1/2 above), but the framing, tables, and any rounded characterizations are constructed for teaching and avoid claiming non-public detail.
  • The insurer war story in §10.3 — a constructed, representative vignette.
  • The peer-institution breach referenced in Case Study 1 — a constructed composite.
  • The reconstructed Mirai per-device egress logs and target/edge telemetry in Case Study 2 — illustrative reconstructions for teaching; the underlying event is real (see Tier 1/2), the specific log lines are not.
  • The SolarWinds/Sunburst behavioral details used in worked examples are described generically and at a defensive level; specific Meridian instantiations are constructed.
  • The water-utility scan/RTU-crash "War Story" (§33.4) and the small-utility flat-network scenario (Exercise 23) — constructed composites informed by the general pattern of reported small-utility OT incidents.
  • Theo Brandt, Marcus Reyes, and all Meridian Regional Bank personnel, dialogue, and figures (Case Study 1) — a constructed teaching scenario.
  • Vantage Logistics (Case Study 2) — a constructed analytical failure case; the burnout-to-breach pattern reflects a common reported failure mode but the company, people, and incident are invented for teaching.