Getting Started

• Using this website

• Starting Up Security

• FTC - Start with Security

• Cybersecurity Campaign Playbook

• NIST Cybersecurity Framework

Risk Management

• Quantifying your unknowns: A case for estimation in cyber security

• Releasing: Simple Risk measurement

• Lessons learned in Risk Measurement

• The next 50 years of cyber security

• Communicating risk across complex teams

• The “five factors” used to secure systems.

• A risk assessment from scratch

• Evidence of Absence

• Securing Customer Support

• Decomposing security risk into scenarios

• Minimalist Risk Management

• Risk for Engineers

• How to measure risk with a better OKR

• Simple Risk Measurement

Forecasting

• Prediction of Adversarial Risk

• Scoring a risk forecast

• Revisiting the Bluekeep Forecast

• Measuring "In The Wild" Exploitation

• Quantifying your unknowns: A case for estimation in cyber security

• Forecasting techniques and measurement

• Forecasting Supply Chain Compromise

• Forecasting NPM Security Advisories

• Forecasting Netspectre

• Measuring a red team or penetration test.

• Attribution: Avoiding "We got 'em"

• Describing Vulnerability Risks

• Valuation of Non-Monetary Penalties

• Enigma Forecasting Follow Up

• A probabilistic risk model (AWS)

• Forecasting BlueKeep

Organization

• A key performance indicator for infosec organizations

• Who Fixes That Bug? (Part One: Them!)

• Who Fixes That Bug? (Part Two: Us!)

• Hiring the CSO

• You don’t need a Chief Security Officer.

Post-mortem Review

• Reference Breach Blog Posts

• Cloudbleed Retrospective

• OneLogin Breach (2017) Retrospective

• Learning From Security Breaches in 2017

• Learning from California’s Data Breaches

• Learning From A Year of Security Breaches

• Learning from the Expedia Heist

• Blockchain Graveyard

• Learning From Cryptocurrency Breaches

• Debriefing Facilitation Guide

• Postmortem Culture: Learning from Failure

• Verizon Data Breach Report

Incident Response

• Security Breach 101

• Security Breach 102

• Phishing Incident 101

• @BadThingsDaily: Tabletop Scenarios

• Writing a Playbook

Policy and Compliance

• An Information Security Policy for the Startup

• An Incident Response Plan for Startups

• Understanding the Security Questionnaire

Detection

• Red Teams

• Lessons Learned in Detection Engineering

• Alerting and Detection Strategy Framework

• How to Write Security Alerts

Product Security

• Tabletops for Bug Bounty

• Bounty Launch Lessons

• Building a Product Security Team

• The Black Market Lie

• Vulnerability Disclosure

• Getting Product Security Engineering Right

• Setting up bug bounties for succcess

• Modern Application Security

AWS Specific

• Securing Local AWS Credentials

• Investigating CloudTrail Logs

• Responding to typical breaches on AWS

• An Infrastructure Guide for Founders

• Multiple Account Security Strategy

Abuse, Fraud, Spam

• Preventing Account Takeover

• Investigating Account Takeover

• The Account Takeover Runbook