Appendix G: Book Statistics and Word Counts#
This page reports the size of each chapter and of each section within it, measured in markdown words (the prose; code and figures are additional and reported separately per chapter). It is generated automatically from the book source. Approximate pages assume about 500 words per page.
Last generated: 2026-10-22.
Summary by Chapter#
Chapter |
Markdown words |
Code words |
Approx. pages |
|---|---|---|---|
Introduction |
1,814 |
0 |
3.6 |
Preface |
433 |
0 |
0.9 |
Chapter 1: Introduction to Cybersecurity |
16,783 |
403 |
33.6 |
Chapter 2: Cryptography |
37,913 |
3,066 |
75.8 |
Chapter 3: Networking and Network Attacks |
17,033 |
374 |
34.1 |
Chapter 4: Social Engineering and the Human Element |
7,647 |
203 |
15.3 |
Chapter 5: Risk Management |
17,001 |
696 |
34.0 |
Chapter 6: Penetration Testing Methodology |
9,787 |
265 |
19.6 |
Chapter 7: Reconnaissance and Open-Source Intelligence |
7,605 |
464 |
15.2 |
Chapter 8: Scanning and Enumeration |
7,242 |
816 |
14.5 |
Chapter 9: Exploitation and Post-Exploitation |
22,438 |
587 |
44.9 |
Chapter 10: Web Application Security |
8,526 |
372 |
17.1 |
Chapter 11: Network Defense and Hardening |
22,325 |
258 |
44.6 |
Chapter 12: Intrusion Detection and Prevention Systems |
10,100 |
1,114 |
20.2 |
Chapter 13: Digital Forensics |
10,469 |
875 |
20.9 |
Chapter 14: Incident Response |
9,786 |
828 |
19.6 |
Chapter 15: Malware Analysis |
42,883 |
423 |
85.8 |
Chapter 16: Capture the Flag and Competitive Security |
8,120 |
366 |
16.2 |
Chapter 17: Emerging Threats and Future Challenges |
21,802 |
1,573 |
43.6 |
Chapter 18: Privacy, Law, and Information Governance |
7,069 |
387 |
14.1 |
Chapter 19: Security Governance, Policy, and Culture |
15,865 |
482 |
31.7 |
Chapter 20: Industrial Control Systems and OT Security |
13,679 |
442 |
27.4 |
Appendix A: Security Command Reference |
1,681 |
0 |
3.4 |
Appendix B: Glossary |
5,659 |
0 |
11.3 |
Appendix C: Certification Mapping |
1,861 |
0 |
3.7 |
Appendix D: ABET Outcomes and Bloom’s Taxonomy Mapping |
775 |
0 |
1.6 |
Appendix E: Selected Works by the Author |
1,583 |
0 |
3.2 |
Appendix F: Companion Code and Repositories |
1,284 |
0 |
2.6 |
Appendix H: Capstone and Group Project Ideas |
2,765 |
0 |
5.5 |
Appendix I: Protocol Security Reference |
4,073 |
0 |
8.1 |
Appendix J: Adversary Models |
3,794 |
0 |
7.6 |
Appendix K: Course Materials and Sample Assignments |
2,408 |
0 |
4.8 |
TOTAL |
342,203 |
13,994 |
684 |
Detailed Word Count by Section#
Introduction#
1,814 markdown words (3.6 pages); 0 code words.
Section |
Words |
|---|---|
Course Mapping |
560 |
Adapting the Reading Load |
559 |
What Every Chapter Contains |
64 |
How to Cite This Book |
181 |
Accessibility |
310 |
License |
27 |
Preface#
433 markdown words (0.9 pages); 0 code words.
Section |
Words |
|---|---|
About This Textbook |
38 |
Who This Book Is For |
49 |
How This Book Is Organized |
145 |
Ethical Commitment |
65 |
Using This Book in a Course |
83 |
A Note on Currency |
53 |
Chapter 1: Introduction to Cybersecurity#
16,783 markdown words (33.6 pages); 403 code words.
Section |
Words |
|---|---|
Learning Objectives |
229 |
Key Terms |
418 |
1.1 What Is Cybersecurity? |
636 |
1.2 The CIA Triad and Its Extensions |
792 |
The DIE Model: A Modern Complement to CIA |
254 |
1.3 The Anatomy of an Attack |
594 |
A Concept Map of the Core Terms |
130 |
1.4 Threat Actors and the Adversary Model |
591 |
1.5 Defense in Depth and Security Controls |
655 |
1.6 Hardware Foundations: Rings, Modes, and the Trusted Computing Base |
1,133 |
What Runs at Each Level |
569 |
Why Rings 1 and 2 Were Meant for Device Drivers |
936 |
Beneath Ring 0: The Hypervisor, System Management Mode, and the Security Processor |
703 |
The Trusted Platform Module Up Close |
565 |
Trusted Execution Environments: Enclaves, Secure Worlds, and Confidential Virtual Machines |
978 |
The Trusted Computing Base and the Reference Monitor |
170 |
1.7 The NIST Cybersecurity Framework |
403 |
1.8 Quantifying Risk in Monetary Terms |
534 |
1.9 The Saltzer and Schroeder Design Principles |
641 |
The Principle of Least Privilege (PoLP) |
249 |
1.10 The Security Mindset, Ethics, and the Law |
369 |
1.11 A Taxonomy of Threats and a Roadmap to This Book |
547 |
1.12 Classic Security Models |
96 |
Confidentiality: Bell-LaPadula |
230 |
Integrity: Biba and Clark-Wilson |
306 |
Hybrid and Specialized Models |
175 |
Foundational System Models |
189 |
Security Models versus Cryptographic Security Definitions |
224 |
1.13 Security versus Resilience |
214 |
Chapter Summary |
307 |
Why This Matters |
133 |
News in Focus: The Colonial Pipeline Ransomware Incident (2021) |
215 |
A Second Case: The SolarWinds Supply-Chain Compromise (2020) |
266 |
News in Focus: Cyber Warfare and the US-Iran Cyber Conflict |
535 |
Review Questions (MCQ) |
558 |
Answer Key |
45 |
Lab Assignment |
248 |
References |
907 |
Chapter 2: Cryptography#
37,913 markdown words (75.8 pages); 3,066 code words.
Section |
Words |
|---|---|
Learning Objectives |
185 |
Key Terms |
775 |
2.1 What Cryptography Is and What It Promises |
387 |
Encoding versus Encryption versus Hashing |
876 |
2.2 Classical Ciphers and Why They Fall |
730 |
Classical versus Modern Ciphers |
295 |
A Classification of Ciphers |
226 |
Classical Ciphers in Code |
294 |
2.3 Perfect Secrecy and the One-Time Pad |
828 |
XOR, the One-Time Pad, and Perfect Secrecy, Formally |
694 |
From Information-Theoretic to Computational Security |
311 |
Game-Based (Provable) Security and Ciphertext Indistinguishability |
2,316 |
Real-World Case: The ANC’s One-Time Pad and Operation Vula |
441 |
2.4 Randomness: True, Pseudo, and Cryptographically Secure |
570 |
Insecure versus Cryptographically Secure Randomness in Code |
168 |
2.5 Symmetric Encryption: Stream and Block Ciphers |
1,007 |
The Feistel Network: A Blueprint for Block Ciphers |
223 |
2.6 Block Cipher Modes of Operation |
688 |
AES Modes in Code: ECB versus CTR |
327 |
2.7 Cryptographic Hash Functions |
803 |
The Length Extension Attack, and Why MAC Construction Is Not Obvious |
466 |
The Merkle-Damgard Construction |
215 |
Hashing in Code, and Why a CRC (Cyclic Redundancy Check) Is Not a Hash |
213 |
Error Detection versus Error Correction: CRC and Hamming Codes |
205 |
2.8 Message Authentication Codes and Authenticated Encryption |
596 |
Hash, MAC, and Digital Signature Compared |
729 |
Wrong-Key Behavior: Garbage Output versus Null Rejection |
531 |
The Three-Behavior Hierarchy of Incorrect Decryption |
2,301 |
Computing an HMAC in Code |
98 |
Authenticated Encryption in Practice: Encrypt-then-MAC |
190 |
2.9 Key Derivation and Password Storage |
654 |
2.10 Public-Key Cryptography and RSA |
847 |
2.11 Diffie-Hellman Key Exchange |
798 |
ElGamal Encryption |
277 |
ElGamal in Code |
266 |
2.12 Elliptic-Curve Cryptography |
495 |
Elliptic Curves Up Close: Group Law, the ECDLP, and the Curve Zoo |
776 |
2.13 Digital Signatures, Certificates, and PKI |
792 |
Generating a Digital Signature in Code |
145 |
2.14 Putting It Together: The TLS Handshake |
498 |
2.15 Advanced and Emerging Cryptography |
841 |
Computing Paradigms: Mainframes, Classical, DNA, and Quantum |
395 |
Searchable, Deniable, and Functional Encryption |
341 |
The Algebra Beneath Cryptography: Finite Fields, Abelian and Non-Abelian Groups |
470 |
Quantum Cryptography: What Quantum Mechanics Offers the Defender |
277 |
Lattice-Based Cryptography: The Hard Problems Behind Post-Quantum Schemes |
356 |
The Mathematics of Lattices |
315 |
Three Families by Underlying Structure: Abelian, Non-Abelian, and Lattice |
298 |
2.15a Privacy-Preserving Cryptography and the Wider Toolbox |
116 |
Anonymous Credentials and Selective Disclosure |
1,420 |
The Signature Zoo: Variants Beyond Sign-and-Verify |
694 |
Primitives Beyond Encryption and Signatures |
924 |
2.16 Key Management |
714 |
Key Management Services and Key Escrow |
347 |
2.17 A Taxonomy of Cryptographic Attacks |
348 |
2.18 Applied Cryptographic Systems |
399 |
2.19 Practical Guidance: Choosing and Using Cryptography |
383 |
2.19a Protecting Data in All Three States |
289 |
2.19b Tamper-Evident and Tamper-Proof Mechanisms |
207 |
2.20 Formal Security Analysis and Provable Security |
206 |
The Anatomy of a Security Definition |
331 |
Hardness Assumptions and the Random Oracle Model |
234 |
The Zoo of Security Notions |
252 |
Simulation-Based Security and Universal Composability |
234 |
Symbolic Models: Dolev-Yao and Automated Verification |
322 |
A Taxonomy of Security Properties |
326 |
Writing a Security Analysis: Proof Sketches and Experimental Evaluation |
374 |
2.21 Post-Quantum Standards and the Migration Timeline |
284 |
Worked Example: Toy Ring-LWE Encryption |
60 |
Chapter Summary |
149 |
Why This Matters |
161 |
News in Focus: Heartbleed (2014) |
202 |
Review Questions (MCQ) |
503 |
Answer Key |
36 |
Lab Assignment |
387 |
References |
1,444 |
Chapter 3: Networking and Network Attacks#
17,033 markdown words (34.1 pages); 374 code words.
Section |
Words |
|---|---|
Learning Objectives |
152 |
Key Terms |
461 |
3.1 Why Networking Is the Battleground |
359 |
3.2 The OSI Model |
550 |
Mapping the OSI and TCP/IP Models |
276 |
3.3 The TCP/IP Model and Encapsulation |
293 |
Network Devices and Segments |
194 |
Routing and the Route Table |
254 |
3.4 IP Addressing: IPv4 and IPv6 |
508 |
Subnetting, CIDR, and Network versus Host Addresses |
332 |
Network Scopes and Hardware: NIC, LAN, WLAN, and WAN |
410 |
Special and Reserved Addresses |
233 |
IP Address Management and Internet Registries |
223 |
3.5 Ports and Common Protocols |
437 |
Application Protocols and Their Security Posture |
400 |
Secure versus Insecure Protocols |
319 |
3.6 The Core Protocols: TCP, UDP, ICMP, and Their Headers |
793 |
Sockets: Programming the Transport Layer |
216 |
Sockets in Code: A TCP Server, Client, and a Tiny Web Server |
586 |
3.7 ARP and DHCP: Convenience and Its Abuse |
472 |
The Domain Name System (DNS) |
847 |
3.8 Sniffing: Listening on the Wire |
530 |
Wireless Networking Fundamentals |
250 |
Traffic Analysis and Network Monitoring |
158 |
Syslog and Centralized Logging |
358 |
3.9 Spoofing, Man-in-the-Middle, and Session Hijacking |
613 |
Packet Capture, On-Path Attacks, and SSL Stripping |
315 |
Hands-On: Capturing a Plaintext Password, Then Encrypting It |
501 |
3.10 Denial-of-Service and Distributed Denial-of-Service Attacks |
1,210 |
Access Control Lists, NACLs, and Security Groups |
515 |
3.11 Securing the Network: A Preview |
173 |
Secure Network Protocols |
203 |
Going Deeper: Routing Security and BGP Hijacking |
180 |
Network Access Control |
144 |
3.12 QUIC, HTTP/3, and Encrypted Client Hello |
223 |
3.13 The Access Link: How a Network Connects to the Internet |
568 |
Exercises |
72 |
Answer Key |
149 |
3.14 Premises Wireless: Wi-Fi Generations, Extenders, and Mesh |
575 |
Exercises |
59 |
Answer Key |
145 |
Chapter Summary |
215 |
Why This Matters |
153 |
News in Focus: The Mirai Botnet and the Dyn Attack (2016) |
186 |
Review Questions (MCQ) |
384 |
Answer Key |
30 |
Lab Assignment |
393 |
References |
346 |
Chapter 5: Risk Management#
17,001 markdown words (34.0 pages); 696 code words.
Section |
Words |
|---|---|
Learning Objectives |
189 |
Key Terms |
198 |
5.1 Risk as the Organizing Principle of Security |
395 |
5.2 The Vocabulary of Risk |
607 |
5.3 The Risk-Management Lifecycle |
399 |
5.4 Risk Identification |
275 |
Asset and Data Classification |
239 |
A Worked Risk Register |
286 |
5.5 Qualitative Risk Assessment |
508 |
5.6 Quantitative Risk Assessment |
722 |
5.7 Risk Treatment |
928 |
A Worked Analogy: The Skateboard and the Scraped Knee |
2,852 |
5.8 Threat Modeling |
782 |
5.9 Risk Frameworks and Standards |
329 |
The NIST RMF Steps in Detail |
170 |
CSF Tiers and Profiles, and ISO/IEC 27001:2022 |
423 |
5.10 The Security Program: Policies, Standards, and Controls |
306 |
Control Catalogs and Foundational Control Principles |
500 |
5.11 Business Continuity and Disaster Recovery |
328 |
Resilience Engineering: Backups, Redundancy, and Plan Testing |
590 |
Redundancy Engineering: RAID, Replication, and the Difference From Backup |
459 |
5.12 Third-Party and Supply-Chain Risk |
460 |
5.13 Assurance Evaluation |
337 |
5.14 Security Roles, Responsibilities, and Accountability |
354 |
5.15 Measuring Risk: Metrics, Key Performance Indicators, and Key Risk Indicators |
236 |
5.16 Managing Risk Across the System Lifecycle |
244 |
5.17 Compliance as a Risk Driver |
303 |
5.18 Insider Risk and Human Factors |
279 |
5.19 Emerging Risks: AI, Quantum, and the Expanding Attack Surface |
293 |
5.20 Bringing It Together: An End-to-End Risk Scenario |
431 |
5.21 Common Pitfalls in Risk Management |
274 |
5.22 Comparing FAIR, NIST RMF, and ISO/IEC 27005 |
244 |
Chapter Summary |
242 |
Why This Matters |
164 |
News in Focus: Repeat Breaches at Neiman Marcus |
540 |
Review Questions (MCQ) |
436 |
Answer Key |
34 |
Lab Assignment |
210 |
References |
303 |
Chapter 6: Penetration Testing Methodology#
9,787 markdown words (19.6 pages); 265 code words.
Section |
Words |
|---|---|
Learning Objectives |
132 |
Key Terms |
147 |
6.1 Why Methodology Matters |
409 |
6.2 What Penetration Testing Is, and Is Not |
584 |
6.3 Hats and Team Colors |
273 |
6.4 Knowledge Levels: Black, Gray, and White Box |
284 |
6.5 The Phases of a Penetration Test |
650 |
6.6 Types of Penetration Tests |
409 |
6.7 Pre-Engagement: Scope and the Rules of Engagement |
520 |
6.8 The Legal Framework |
500 |
6.9 Ethics and Professional Conduct |
529 |
6.10 Vulnerability Disclosure |
725 |
Worked Example: CVE and CVSS in Practice (the Log4Shell case) |
524 |
6.11 The Test Environment and Toolkit |
494 |
6.12 Threat Modeling and Intelligence in the Engagement |
183 |
6.13 Post-Exploitation, Pivoting, and Operational Discipline |
470 |
6.14 Compliance-Driven and Standards-Based Testing |
232 |
6.15 Reporting |
530 |
6.16 Professional Certifications for Penetration Testers |
209 |
6.17 An End-to-End Engagement, Start to Finish |
354 |
6.18 Limitations, Pitfalls, and Misconceptions |
307 |
Chapter Summary |
227 |
Why This Matters |
156 |
Review Questions (MCQ) |
388 |
Answer Key |
30 |
Lab Assignment |
218 |
References |
177 |
Chapter 7: Reconnaissance and Open-Source Intelligence#
7,605 markdown words (15.2 pages); 464 code words.
Section |
Words |
|---|---|
Learning Objectives |
93 |
Key Terms |
173 |
7.1 Why Reconnaissance Comes First |
501 |
7.2 Footprinting: Passive and Active |
338 |
7.3 Open-Source Intelligence (OSINT) |
612 |
7.4 Search-Engine Reconnaissance (“Google Dorking”) |
416 |
7.5 WHOIS and the Regional Internet Registries |
455 |
7.6 DNS Reconnaissance |
436 |
7.7 Email Harvesting, Metadata, and Social-Media Profiling |
211 |
7.8 Reconnaissance of Cloud and Modern Infrastructure |
349 |
7.9 The Intelligence Cycle and Organizing Findings |
377 |
7.10 Reconnaissance Tools |
388 |
7.11 Passive Fingerprinting |
265 |
7.12 Defending Against Reconnaissance |
485 |
7.13 AI-Assisted Reconnaissance and Modern WHOIS |
232 |
Lab: Reading Exposure Data the Way Shodan and Censys Present It |
72 |
7.14 Network Analysis Tools, and Reading a Tool’s License |
279 |
Chapter Summary |
232 |
Why This Matters |
132 |
News in Focus: Mass Scraping of Public Profiles (2021) |
215 |
Finding Exposed Devices with Shodan, and Defending Them |
448 |
Review Questions (MCQ) |
372 |
Answer Key |
30 |
Lab Assignment |
185 |
References |
189 |
Chapter 8: Scanning and Enumeration#
7,242 markdown words (14.5 pages); 816 code words.
Section |
Words |
|---|---|
Learning Objectives |
152 |
Key Terms |
180 |
8.1 From Reconnaissance to Active Probing |
301 |
8.2 The Scanning Taxonomy and the Tyranny of Time |
168 |
Why Scanning Time Dominates Planning |
304 |
8.3 A TCP/IP Refresher for Scanners |
214 |
The Six Nmap Port States |
284 |
8.4 Host Discovery and Network Sweeps |
164 |
What Nmap Probes by Default |
134 |
8.5 Network Mapping: Traceroute, Firewalking, and Nmap |
209 |
Firewalking, Layer Four Traceroute (LFT), and Nmap’s Smarter Traceroute |
219 |
8.6 Port Scanning with Nmap |
132 |
TCP Scan Types |
288 |
UDP Scanning, Timing, and Output |
355 |
8.7 hping3: Crafting Packets by Hand |
289 |
8.8 Always Sniff the Wire |
176 |
8.9 Operating-System Fingerprinting |
205 |
8.10 Service and Version Scanning, and Enumeration |
231 |
8.11 Vulnerability Scanning |
316 |
8.12 The Nmap Scripting Engine (NSE) |
160 |
8.13 Detection and Evasion |
309 |
8.14 Scanning Safely, Legally, and Within Scope |
195 |
Automated Discovery and Mapping Tools |
142 |
Scanning IPv6 |
143 |
The Pentester’s Toolkit: Kali and BackTrack |
262 |
8.15 Attack Surface Management and Continuous Exposure Management |
203 |
Chapter Summary |
119 |
Why This Matters |
125 |
News in Focus: Internet-Scale Scanning as an Early-Warning Signal |
253 |
Review Questions (MCQ) |
310 |
Answer Key |
82 |
Lab Assignment |
315 |
References |
187 |
Chapter 9: Exploitation and Post-Exploitation#
22,438 markdown words (44.9 pages); 587 code words.
Section |
Words |
|---|---|
Learning Objectives |
91 |
Key Terms |
166 |
9.1 What Exploitation Is (and Is Not) |
0 |
In a Penetration Test |
53 |
Ethical Boundaries |
64 |
9.2 Common Vulnerability Classes |
0 |
Injection Vulnerabilities |
123 |
Memory Corruption |
161 |
Authentication and Session Vulnerabilities |
33 |
9.3 From Source to Machine Code: The Compilation Pipeline |
247 |
9.4 Memory Corruption: The Stack, the Heap, and Buffer Overflows |
608 |
Stack Exhaustion and Heap Problems |
249 |
9.5 From Stack Smashing to Return-Oriented Programming |
647 |
9.6 Programming Survival Skills for Exploitation |
302 |
9.7 Shellcode and Shellcode Strategies |
277 |
9.8 The Exploit-Development Workflow |
414 |
Inside the Metasploit Framework |
281 |
9.9 Passive and Static Analysis: Reverse Engineering for Exploitation |
215 |
Privilege Escalation in Depth |
196 |
Post-Exploitation, Lateral Movement, and Defense Evasion |
391 |
Software Design Patterns and Security |
402 |
9.10 Metasploit Framework |
0 |
Structure |
51 |
Responsible Use |
46 |
9.11 Privilege Escalation |
0 |
Linux Privilege Escalation |
142 |
Windows Privilege Escalation |
85 |
9.12 Lateral Movement |
0 |
Pass-the-Hash |
61 |
Pass-the-Ticket |
62 |
9.13 Persistence |
0 |
Common Persistence Mechanisms and Their Detection Signatures |
93 |
9.14 Privilege Escalation Paths: Windows, Linux, and Active Directory |
303 |
9.15 A Worked Stack Buffer Overflow, Start to Finish |
388 |
9.16 Format-String and Heap Vulnerabilities |
186 |
9.17 Defeating Mitigations: Return-Oriented Programming |
258 |
Exercises |
78 |
Answer Key |
129 |
9.18 Linux Privilege Escalation in Depth |
267 |
9.19 Windows Exploitation Specifics |
143 |
9.20 Command-and-Control and Post-Exploitation Frameworks |
182 |
Exercises |
92 |
Answer Key |
101 |
9.21 Finding Vulnerabilities: Fuzzing in Depth |
174 |
9.22 From Crash to Exploit: Reliability and Weaponization |
208 |
Exercises |
84 |
Answer Key |
131 |
9.23 Case Study: Chaining Vulnerabilities into a Full Compromise |
341 |
9.24 Defending Against Exploitation |
235 |
Exercises |
87 |
Answer Key |
140 |
9.25 Shellcode in Practice |
270 |
9.26 The Metasploit Workflow, End to End |
226 |
Exercises |
63 |
Answer Key |
108 |
9.27 The Machine Underneath: Registers, the Stack, and Calling Conventions |
779 |
The Prologue and Epilogue, Instruction by Instruction |
1,150 |
Worked Examples: Registers and the Stack, Step by Step |
1,656 |
Exercises |
249 |
Answer Key |
408 |
9.28 A Debugger Session, Step by Step |
491 |
Exercises |
73 |
Answer Key |
116 |
9.29 Return-Oriented Programming, Worked |
445 |
Exercises |
64 |
Answer Key |
120 |
9.30 Heap Exploitation Internals |
648 |
Exercises |
65 |
Answer Key |
141 |
9.31 Defeating Modern Mitigations: Information Leaks and Canary Bypasses |
456 |
Exercises |
60 |
Answer Key |
142 |
9.32 Windows Exploitation: Structured Exception Handler Overwrites |
383 |
Exercises |
58 |
Answer Key |
113 |
9.33 Patch Diffing and N-Day Exploitation |
420 |
Exercises |
60 |
Answer Key |
127 |
9.34 Toward Automated Vulnerability Discovery: Symbolic Execution |
383 |
Exercises |
49 |
Answer Key |
140 |
9.35 A Field Guide to Bug Classes |
474 |
Exercises |
76 |
Answer Key |
125 |
9.36 Password Cracking and Credential Attacks |
565 |
Exercises |
57 |
Answer Key |
119 |
9.37 Lab: Memory-Corruption Bugs in C |
585 |
Exercises |
66 |
Answer Key |
131 |
9.38 How Kerberos Works, and Where Each Attack Breaks In |
45 |
The problem single sign-on solves |
184 |
The three exchanges |
256 |
Where each attack breaks in |
314 |
Chapter Summary |
121 |
Why This Matters |
62 |
News in Focus: The Ransomware Post-Exploitation Playbook |
78 |
Review Questions (MCQ) |
285 |
Lab Assignment |
189 |
References |
237 |
Chapter 10: Web Application Security#
8,526 markdown words (17.1 pages); 372 code words.
Section |
Words |
|---|---|
Learning Objectives |
109 |
Key Terms |
153 |
10.1 How the Web Works: HTTP, Sessions, and the Same-Origin Policy |
237 |
10.2 The OWASP Top 10 |
62 |
Broken Access Control |
169 |
The OWASP Top 10:2025 |
428 |
10.3 Injection Attacks |
0 |
Introducing SQL Injection |
179 |
Cross-Site Scripting |
154 |
Cross-Site Request Forgery |
99 |
Server-Side Request Forgery |
65 |
10.4 SQL Injection in Depth |
0 |
Database Models: Traditional and Modern |
763 |
10.5 Cross-Site Scripting (XSS) |
378 |
10.6 Broken Access Control, CSRF, SSRF, and Other High-Impact Flaws |
214 |
Insecure Direct Object References in Depth |
1,166 |
10.7 Authentication and Session Management |
0 |
Broken Authentication |
165 |
Authentication, Sessions, and the Insufficient-Session-Expiration Flaw |
145 |
10.8 Security Misconfigurations |
51 |
Security Headers |
69 |
10.9 The Web-Application Testing Toolkit |
355 |
10.10 Application Security Testing: Static, Dynamic, Interactive, and DevSecOps |
433 |
10.11 Web Application Firewalls and Their Limits |
40 |
WAF Bypass Techniques |
76 |
10.12 The OWASP API Security Top 10 |
332 |
10.13 Database Systems in Depth: Engines, Replication, and Security |
41 |
Relational Database Management Systems |
247 |
Non-Relational, In-Memory, and Graph Databases |
197 |
Schemas: Schema-on-Write versus Schema-on-Read |
137 |
Database Kernels and Engines |
150 |
Replication: Synchronous versus Asynchronous |
159 |
Read (Only) Replicas |
100 |
Cloud Database Instance Classes |
561 |
Attacks and Defenses |
263 |
Chapter Summary |
130 |
Why This Matters |
79 |
News in Focus: SQL Injection Breaches That Persist |
78 |
Review Questions (MCQ) |
314 |
Lab Assignment |
154 |
References |
55 |
Chapter 11: Network Defense and Hardening#
22,325 markdown words (44.6 pages); 258 code words.
Section |
Words |
|---|---|
Learning Objectives |
178 |
Key Terms |
363 |
11.1 Firewalls |
161 |
Firewall Types and Evolution |
144 |
Writing Firewall Rules |
154 |
11.2 Firewall Types and Topologies |
399 |
Physical and Virtual Firewalls |
174 |
Stateless and Stateful Packet Filtering |
514 |
11.3 Network Segmentation |
0 |
DMZ Architecture |
200 |
VLAN and Micro-Segmentation |
198 |
11.4 Zero-Trust Architecture |
0 |
The Zero-Trust Principle |
498 |
11.5 DNS Security |
20 |
DNSSEC |
44 |
DNS over HTTPS and DNS over TLS |
53 |
DNS Sinkholing |
57 |
NXDOMAIN and the DNS_PROBE_FINISHED_NXDOMAIN Error |
252 |
11.6 VPNs and Remote Access |
140 |
IPsec and WireGuard |
57 |
Split Tunneling and Its Risks |
64 |
11.7 Proxies, VPNs, and Tor |
284 |
11.8 Network Access Control and 802.1X |
49 |
802.1X Operation |
59 |
11.9 DDoS and Mitigation |
0 |
DDoS Attack Categories |
73 |
DDoS Mitigation |
60 |
11.10 Authentication, Identity, and Access |
355 |
Biometrics and the Reality of False Positives and Negatives |
392 |
Identity Providers, Identity Management, and Who Does What |
1,212 |
11.11 Network Monitoring and Visibility |
365 |
11.12 Deception: Honeypots, Honeynets, and Honeytokens |
175 |
11.13 Network Forensics in Defense |
159 |
11.14 CVE Case Study: When the Firewall Is the Door (CVE-2024-3400) |
242 |
11.15 Operating System and Host Hardening |
436 |
Mobile Devices, Bring Your Own Device (BYOD), and the Hardware Root of Trust |
478 |
11.16 Network Device Hardening: Switches and Routers |
327 |
11.17 Software-Defined Networking, Virtualization, and Clustering |
332 |
11.18 Asset, Configuration, Change, and Patch Management |
653 |
11.19 Capstone and Group Project Ideas (Network Defense) |
269 |
11.20 How a Firewall Decides, and the Four Ways a Ruleset Lies |
78 |
The evaluation model is not universal, and the default is the part people get wrong |
289 |
A ruleset with three defects |
376 |
The four anomalies, named |
181 |
Why this is a tool problem |
163 |
Exercises |
147 |
Answer Key |
212 |
11.21 What Connection State Costs |
104 |
How big the table is |
149 |
How long an entry lives |
152 |
How fast an attacker fills it |
188 |
What happens when it is full |
49 |
What state buys, and the honest trade |
264 |
Exercises |
122 |
Answer Key |
217 |
11.22 Network Address Translation, and the Security It Does Not Provide |
128 |
What the standard actually says |
256 |
A column-by-column answer |
219 |
Carrier-grade NAT, and the arithmetic that broke attribution |
227 |
11.23 A Worked Segmentation of a Small Enterprise |
69 |
Step one: inventory, grouped by who owns the risk |
97 |
Step two: addresses and VLANs |
141 |
Step three: the decision count, which is the real cost |
103 |
Step four: the matrix, written as permitted flows only |
587 |
Step five: micro-segmentation, and why it is a different kind of problem |
115 |
Exercises |
90 |
Answer Key |
156 |
11.24 The 802.1Q Tag, and the Two Ways Out of a VLAN |
78 |
What a VLAN is, on the wire |
520 |
The native VLAN, which is the exception that the attacks live in |
76 |
Way out one: become a trunk |
101 |
Way out two: two tags, one strip |
216 |
The configuration that closes both |
245 |
Exercises |
92 |
Answer Key |
201 |
11.25 Egress Filtering, and the Price of Seeing Inside TLS |
118 |
Restrict the destinations |
162 |
Or inspect the contents, and pay for it |
339 |
11.26 SMB File Sharing on Windows and macOS, and How to Secure It |
200 |
How SMB works |
439 |
Turning sharing on in Windows |
356 |
Turning sharing on in macOS |
216 |
What the defaults do not protect: a measured example |
307 |
What attackers do with SMB |
430 |
Hardening Windows |
625 |
Hardening macOS |
267 |
Exercises |
231 |
Answer Key |
451 |
Chapter Summary |
204 |
Why This Matters |
72 |
News in Focus: Flat Networks and Nation-State Lateral Movement |
64 |
Review Questions (MCQ) |
299 |
Lab Assignment |
159 |
References |
1,355 |
Chapter 12: Intrusion Detection and Prevention Systems#
10,100 markdown words (20.2 pages); 1,114 code words.
Section |
Words |
|---|---|
Learning Objectives |
97 |
Key Terms |
156 |
12.1 Detection System Types |
127 |
Network-Based IDS and IPS |
141 |
Host-Based IDS |
49 |
Intrusion Detection Systems: What They Watch |
216 |
Intrusion Prevention Systems: From Alert to Action |
242 |
12.2 Detection Methods |
159 |
Signature-Based Detection |
133 |
Anomaly-Based Detection |
173 |
Stateful Protocol Analysis |
50 |
Detection Methods: Signature, Heuristic, and Anomaly |
466 |
12.3 SIEM and Log Aggregation |
123 |
SIEM Architecture |
110 |
SIEM Challenges |
59 |
SIEM, SOAR, XDR, and EDR: The Detection Stack |
269 |
12.4 UEBA and Threat Hunting |
0 |
User and Entity Behavior Analytics |
58 |
Threat Hunting |
189 |
Detection Engineering, Threat Hunting, and Deception |
350 |
12.5 The Cyber Kill Chain and MITRE ATT&CK |
616 |
12.6 Modern SOC Operations: EDR, XDR, SOAR, and Detection Engineering |
220 |
12.7 Writing Detection Rules: Snort, YARA, and Sigma |
341 |
12.8 SIEM Correlation and Tuning |
190 |
Exercises |
102 |
Answer Key |
121 |
12.9 Network Security Monitoring |
177 |
12.10 Host Telemetry and EDR Internals |
164 |
12.11 Threat Hunting |
178 |
Exercises |
88 |
Answer Key |
124 |
12.12 Deception: Honeypots and Honeytokens |
190 |
12.13 Log Sources, Normalization, and the SOC Workflow |
115 |
Log Management: Retention, Integrity, and the Questions Logs Must Survive |
676 |
12.14 Evading Detection |
159 |
Exercises |
97 |
Answer Key |
129 |
12.15 Case Study: Detecting an Intrusion Across the Kill Chain |
279 |
12.16 Measuring and Maturing Detection |
181 |
Exercises |
100 |
Answer Key |
130 |
12.17 A Detection Content Library |
294 |
12.18 Lab: A Mini Detection Pipeline |
63 |
Exercises |
84 |
Answer Key |
127 |
12.19 Packet Analysis for Detection |
418 |
Exercises |
66 |
Answer Key |
122 |
12.20 Building and Tuning a Detection, End to End |
363 |
Exercises |
53 |
Answer Key |
116 |
Chapter Summary |
91 |
Why This Matters |
85 |
News in Focus: Breaches That Were Detectable but Missed |
69 |
Review Questions (MCQ) |
306 |
Lab Assignment |
183 |
References |
97 |
Chapter 13: Digital Forensics#
10,469 markdown words (20.9 pages); 875 code words.
Section |
Words |
|---|---|
Learning Objectives |
99 |
Key Terms |
244 |
13.1 Forensic Principles |
0 |
The Locard Exchange Principle |
69 |
Forensic Soundness |
125 |
The Forensic Process, Order of Volatility, and Chain of Custody |
234 |
13.2 Evidence Acquisition |
0 |
Write Blockers |
64 |
Forensic Imaging |
107 |
Hash Verification |
62 |
13.3 File System Forensics |
0 |
NTFS Artefacts |
125 |
Deleted Files and Unallocated Space |
60 |
Disk, Memory, and Mobile Forensics in Practice |
289 |
13.4 Memory Forensics |
0 |
Why Memory Matters |
54 |
Acquiring Memory |
56 |
Analyzing Memory with Volatility |
91 |
13.5 Network Forensics |
0 |
PCAP Analysis |
98 |
13.6 Anti-Forensics |
85 |
Countermeasures |
55 |
13.7 Artificial Intelligence in Digital Evidence Triage |
224 |
13.8 IoT Forensics and Explainable AI |
244 |
13.9 AI-Driven Cybercrime Analytics and Attribution |
374 |
13.10 Legal Admissibility and Reporting |
285 |
13.11 Cloud Forensics |
223 |
13.12 Disk Imaging and File Carving in Practice |
344 |
13.13 Memory Forensics with Volatility |
289 |
13.14 Timeline Analysis |
183 |
13.15 Windows Forensic Artifacts |
237 |
13.16 File System Internals for Investigators |
299 |
13.17 Mobile Device Forensics |
201 |
13.18 Email, Log, and Cloud-Account Forensics |
183 |
13.19 The Forensic Report and Expert Testimony |
139 |
Exercises |
105 |
Answer Key |
143 |
13.20 Acquisition in Practice: Live versus Dead, and Verification |
221 |
13.21 Anti-Forensics in Depth |
234 |
13.22 From Artifact to Narrative |
259 |
Exercises |
97 |
Answer Key |
117 |
13.23 Case Study: Reconstructing an Intrusion |
359 |
13.24 The Forensic Toolkit |
245 |
Exercises |
81 |
Answer Key |
131 |
13.25 Windows Event Log Reference for Investigators |
351 |
13.26 Lab: Parsing Artifacts at Scale |
50 |
Exercises |
91 |
Answer Key |
136 |
13.27 A Disk Forensics Walkthrough with The Sleuth Kit |
403 |
Exercises |
73 |
Answer Key |
99 |
13.28 Windows Registry Forensics in Depth |
446 |
Exercises |
66 |
Answer Key |
118 |
13.29 Artificial Intelligence in Digital Forensics |
401 |
Exercises |
57 |
Answer Key |
121 |
Chapter Summary |
96 |
Why This Matters |
76 |
News in Focus: When Digital Forensic Evidence Decides a Case |
70 |
Review Questions (MCQ) |
298 |
Lab Assignment |
172 |
References |
177 |
Chapter 14: Incident Response#
9,786 markdown words (19.6 pages); 828 code words.
Section |
Words |
|---|---|
Learning Objectives |
115 |
Key Terms |
137 |
14.1 Incidents Versus Events |
63 |
Incident Severity Classification |
96 |
14.2 The NIST SP 800-61 Lifecycle |
13 |
Preparation |
123 |
Detection and Analysis |
163 |
Containment |
107 |
Eradication |
117 |
Recovery |
87 |
Post-Incident Activity |
111 |
NIST SP 800-61 Rev. 3 and the CSF 2.0 Framing |
139 |
14.3 Legal and Regulatory Obligations |
0 |
Breach Notification Laws |
60 |
Law Enforcement and Evidence Preservation |
68 |
14.4 The Assume-Breach Mindset |
133 |
14.5 Before, During, and After: An Operational IR Playbook |
375 |
14.6 Case Study: The Locky Ransomware Incident |
280 |
14.7 The CSIRT, Roles, and Communication |
152 |
14.8 Triage, Severity, Containment, and Recovery in Depth |
289 |
14.9 Postmortem, Metrics, and Exercises |
199 |
14.10 Playbooks, Ransomware Negotiation, and Executive Communication |
229 |
14.11 A Ransomware Incident, Hour by Hour |
473 |
14.12 Writing and Running Playbooks |
58 |
14.13 Evidence Handling and Communication Templates |
225 |
14.14 Tabletop Exercises and Purple Teaming |
119 |
Exercises |
116 |
Answer Key |
171 |
14.15 Threat Intelligence and Attribution in Response |
205 |
14.16 Cloud and SaaS Incident Response |
189 |
14.17 A Second Scenario: A Data-Breach Investigation |
253 |
14.18 Metrics and Continuous Improvement |
144 |
Exercises |
125 |
Answer Key |
158 |
14.19 Incident Response for Operational Technology |
181 |
14.20 Insider and Account-Compromise Incidents |
196 |
14.21 Building the Response Program |
199 |
Exercises |
101 |
Answer Key |
113 |
14.22 Case Study: Business Email Compromise and Wire Fraud |
385 |
14.23 Coordinating with Law Enforcement, Insurers, and Regulators |
210 |
Exercises |
74 |
Answer Key |
127 |
14.24 Communication Templates |
240 |
14.25 A Ransomware Readiness Checklist |
205 |
14.26 Breach Notification Quick Reference |
227 |
Exercises |
90 |
Answer Key |
124 |
14.27 An Incident Report, Annotated |
447 |
Exercises |
56 |
Answer Key |
111 |
14.28 Containment Decisions Under Uncertainty |
361 |
Exercises |
54 |
Answer Key |
123 |
Chapter Summary |
103 |
Why This Matters |
75 |
News in Focus: Attacker Dwell Time in Major Ransomware Incidents |
88 |
Review Questions (MCQ) |
320 |
Lab Assignment |
176 |
References |
90 |
Chapter 15: Malware Analysis#
42,883 markdown words (85.8 pages); 423 code words.
Section |
Words |
|---|---|
Learning Objectives |
127 |
Key Terms |
214 |
15.1 Malware Taxonomy |
0 |
Viruses and Worms |
81 |
Trojans and RATs |
53 |
Ransomware |
107 |
Rootkits |
65 |
Botnets and Command and Control |
75 |
15.2 Analysis Environment Setup |
123 |
Safe Lab Requirements |
101 |
REMnux and FlareVM |
41 |
15.3 Static Analysis |
0 |
File Identification |
86 |
PE Analysis |
93 |
YARA Rules |
76 |
Reverse Engineering Malware with Ghidra |
444 |
15.4 Dynamic Analysis |
0 |
Behavioral Monitoring Tools |
75 |
Common Malware Behaviors to Watch |
92 |
15.5 Anti-Analysis and Evasion Techniques |
0 |
VM and Sandbox Detection |
201 |
Packers and Obfuscators |
55 |
Fileless Malware |
44 |
15.6 Malware Analysis Report Structure |
130 |
15.7 Antivirus and Antimalware Defenses |
387 |
The Anti-* Family: Beyond Antivirus |
326 |
15.8 A Field Guide to Malware Types |
262 |
15.9 The Malware Lifecycle and a Ransomware Deep Dive |
250 |
Notable Ransomware Strains: LockBit 3.0 and Rorschach |
214 |
Free Recovery: The No More Ransom Project |
141 |
15.10 Software Reverse Engineering in Depth |
171 |
The Reverse-Engineering Workflow |
111 |
An x86 and x86-64 Assembly Primer |
343 |
The PE Format and the Windows API |
148 |
Disassemblers, Decompilers, and Debuggers |
115 |
Code Injection: DLL Injection and Process Injection |
199 |
Obfuscation and Deobfuscation |
156 |
Anti-Analysis: Anti-Disassembly, Anti-Debugging, and Anti-VM |
246 |
Packing and Unpacking |
145 |
Shellcode, Buffer Overflows, and Network Attacks |
334 |
Exercises |
140 |
Answer Key |
216 |
15.11 An End-to-End Analysis Walkthrough |
219 |
15.12 Extracting Indicators of Compromise |
196 |
Exercises |
89 |
Answer Key |
129 |
15.13 Ransomware Internals and the Criminal Economy |
258 |
15.14 Rootkits, Bootkits, and Firmware Malware |
306 |
15.15 Mobile and Cross-Platform Malware |
142 |
Exercises |
86 |
Answer Key |
151 |
15.16 Fileless and Living-off-the-Land Malware |
177 |
15.17 Worms, Botnets, and Supply-Chain Malware |
208 |
15.18 Threat Intelligence and Malware Families |
169 |
Exercises |
80 |
Answer Key |
419 |
15.19 Case Study: Dissecting a Ransomware Sample |
450 |
Exercises |
98 |
Answer Key |
136 |
15.20 A YARA Rule Cookbook |
292 |
15.21 Building and Operating an Analysis Lab |
231 |
Exercises |
77 |
Answer Key |
136 |
15.22 Reading x86-64 Disassembly |
492 |
How cmp and a Conditional Jump Build a Branch |
1,517 |
Exercises |
186 |
Answer Key |
286 |
15.23 Windows Internals for Malware Analysts |
746 |
Exercises |
64 |
Answer Key |
120 |
15.24 Obfuscation and Deobfuscation, Worked |
425 |
Exercises |
56 |
Answer Key |
117 |
15.25 A Dynamic Analysis Session |
369 |
Exercises |
69 |
Answer Key |
119 |
15.26 Analyzing Script and .NET Malware |
458 |
Exercises |
73 |
Answer Key |
133 |
15.27 Linux and ELF Malware Analysis |
412 |
Exercises |
61 |
Answer Key |
90 |
15.28 Extracting Malware Configuration at Scale |
406 |
Exercises |
53 |
Answer Key |
109 |
15.29 Case Study: The WannaCry Worm |
450 |
Exercises |
62 |
Answer Key |
128 |
15.30 A Catalog of Anti-Analysis Techniques |
506 |
Exercises |
56 |
Answer Key |
141 |
15.31 Writing the Malware Analysis Report |
363 |
Exercises |
63 |
Answer Key |
128 |
15.32 Recognizing C++ in Disassembly |
500 |
Exercises |
72 |
Answer Key |
152 |
15.33 Covert and Stealthy Launching |
402 |
Exercises |
52 |
Answer Key |
155 |
15.34 Malware-Focused Network Signatures |
352 |
Exercises |
63 |
Answer Key |
149 |
15.35 Debuggers, Disassemblers, and Kernel Debugging |
439 |
Exercises |
56 |
Answer Key |
135 |
15.36 AI-Assisted Reverse Engineering |
1,042 |
Exercises |
119 |
Answer Key |
330 |
15.37 A Linux-Only Reverse Engineering Workflow |
1,200 |
Exercises |
128 |
Answer Key |
377 |
15.38 From Source Code to Binary: Toolchains, Artifacts, and What Separates Malware from Software |
1,497 |
Exercises |
231 |
Answer Key |
602 |
15.39 Reverse Engineering as a Discipline: Software, Hardware, AI, Law, and Careers |
748 |
What Reverse Engineering Is, and Why It Is Done |
551 |
Is It Reverse Engineering? Four Questions and Twelve Cases |
1,191 |
Three Domains |
399 |
Reverse Engineering in Cybersecurity |
225 |
Law and Ethics |
532 |
A Case Worth Knowing |
200 |
Learning It, and Being Paid For It |
216 |
Exercises |
446 |
Answer Key |
780 |
15.40 The Disassembler Landscape: Ghidra, radare2, Cutter, IDA, and Binary Ninja |
702 |
15.41 The User and Kernel Boundary, and What Crosses It |
464 |
15.41.1 Before the boundary exists: the initramfs and the boot chain |
686 |
15.42 Tool Hygiene: Where the Data Goes, and Whether the Project Is Alive |
622 |
15.43 Number Representation for the Analyst |
76 |
Two’s complement |
437 |
Endianness |
278 |
Reading a memory operand |
145 |
Exercises |
82 |
Answer Key |
109 |
15.44 Launching Versus Attaching: How a Debugger Takes Control |
136 |
15.44.1 The two control paths |
884 |
15.44.2 Linux: ptrace and the one-tracer rule |
507 |
15.44.3 Windows: DebugActiveProcess, kill on exit, and privilege |
316 |
15.44.4 macOS: task ports, entitlements, and System Integrity Protection |
126 |
15.44.5 IDEs and language runtimes: the cooperative attach |
333 |
15.44.6 Remote hosts and containers |
398 |
15.44.7 Why the distinction matters for analysis and security |
513 |
Exercises |
275 |
Answer Key |
625 |
15.45 Pointers and Process Memory for the Analyst |
512 |
Exercises |
76 |
Answer Key |
130 |
Chapter Summary |
137 |
Why This Matters |
61 |
News in Focus: WannaCry and the Worm That Used a Leaked Exploit (2017) |
286 |
News in Focus: Fileless and Living-off-the-Land Attacks |
68 |
Review Questions (MCQ) |
335 |
Lab Assignment |
176 |
References |
1,540 |
Chapter 16: Capture the Flag and Competitive Security#
8,120 markdown words (16.2 pages); 366 code words.
Section |
Words |
|---|---|
Learning Objectives |
89 |
Key Terms |
132 |
16.1 What Is a CTF? |
46 |
Jeopardy Format |
152 |
16.2 Category Deep Dives |
0 |
Web Challenges |
136 |
Forensics Challenges |
151 |
Cryptography Challenges |
128 |
Binary Exploitation (Pwn) |
97 |
Reverse Engineering |
74 |
Tooling, Chapter Mapping, and Workflow |
238 |
16.3 The National Cyber League (NCL) |
81 |
Structure of a Season |
146 |
Challenge Categories |
78 |
Scoring and the NICE Framework |
175 |
How to Prepare and Compete Well |
175 |
16.4 CTF Platforms for Learning |
84 |
16.5 CTF Skills and Professional Mapping |
103 |
16.6 Formats: Jeopardy, Attack-Defense, and King-of-the-Hill |
263 |
16.7 Why CTFs Build Real Skill |
280 |
16.8 Hosting a CTF and Competition Etiquette |
294 |
16.9 Notable Competitions: picoCTF, CyberPatriot, and the Collegiate Cyber Defense Competition |
230 |
Case Study Competitions: When the Deliverable Is a Recommendation |
362 |
16.10 A CTF Toolkit by Category |
550 |
16.11 Free Platforms and Cyber Ranges for Teaching |
367 |
16.12 The Reverse Engineering Category, End to End |
332 |
Eight Archetypes |
260 |
The Solve Loop |
324 |
A Worked Example |
414 |
The Write-Up |
95 |
Tooling, and One Constraint Worth Knowing |
157 |
Exercises |
201 |
Answer Key |
348 |
16.13 The Teaching and Research Toolkit: Cost and License |
562 |
Chapter Summary |
120 |
Why This Matters |
62 |
News in Focus: Government-Sponsored CTF Competitions |
58 |
Review Questions (MCQ) |
314 |
Lab Assignment |
164 |
References |
264 |
Chapter 17: Emerging Threats and Future Challenges#
21,802 markdown words (43.6 pages); 1,573 code words.
Section |
Words |
|---|---|
Learning Objectives |
109 |
Key Terms |
291 |
17.1 Post-Quantum Cryptography |
0 |
The Quantum Threat to Current Cryptography |
60 |
NIST PQC Standardization |
177 |
Quantum Key Distribution and the Quantum Horizon |
383 |
17.2 AI-Enabled Attacks and Defenses |
0 |
Offensive AI |
161 |
Defensive AI |
77 |
The OWASP Top 10 for LLM Applications (2026) |
392 |
Privacy in LLM Chat and AI Agents |
372 |
17.3 Pattern Matching, Machine Learning, and Deep Learning in Security |
63 |
Pattern Matching: Rules and Signatures |
123 |
Machine Learning: Learning Patterns from Data |
189 |
Deep Learning: Neural Networks at Scale |
229 |
Adversarial Machine Learning |
398 |
17.4 Privacy-Preserving and Collaborative Machine Learning |
338 |
Case Study: A Privacy-Preserving ML Research Program (SigML, SplitML, Fairis) |
2,448 |
Applied Privacy and Trust Systems |
851 |
17.5 Anomaly Detection Across Domains |
271 |
17.6 Modeling, Simulation, and Control for Security |
275 |
17.7 Probability Distributions in Security |
144 |
Four Distributions from Everyday Life |
3,303 |
A Specialized Case: Soliton Distributions in Fountain Codes |
178 |
Exercises |
236 |
Answer Key |
395 |
17.8 Supply Chain Attacks |
0 |
Why Supply Chain Is a High-Value Target |
32 |
Notable Supply Chain Attack Patterns |
98 |
SBOM and Dependency Management |
55 |
17.9 Cloud Security |
0 |
The Shared Responsibility Model |
94 |
Cloud-Native Threats |
34 |
Control Plane and Data Plane |
159 |
Static and Dynamic Stability |
165 |
Availability and Durability Risk |
205 |
Cloud Compute Audit and Security |
181 |
VPC and Cloud Network Isolation |
264 |
Cloud Compute Models: VMs, Containers, Serverless, and Edge |
348 |
Cloud Service Scope, Resiliency, and Data Protection |
304 |
Reliability Properties: Availability, Resiliency, Reliability, Scalability, Elasticity, Durability |
270 |
Cloud Storage Models: Object, Block, and File |
862 |
Storage Media: Solid-State versus Hard Disk Drives |
648 |
Load Balancers, Hypervisors, and Content Delivery |
253 |
Cloud Security Services and the Cost of DDoS |
230 |
Event-Driven Architecture: Queues, Pub/Sub, and Event Buses |
226 |
AI for Security and Security for AI |
269 |
17.10 Internet of Things Security |
0 |
The IoT Attack Surface |
51 |
Consequences |
57 |
Smart-Home Energy Data and Privacy-Preserving Forecasting |
234 |
17.11 Zero-Day Markets and Disclosure |
0 |
The Zero-Day Economy |
54 |
Responsible Disclosure and Bug Bounties |
48 |
17.12 Securing AI Systems: Agentic AI, Red Teaming, and the Model Supply Chain |
305 |
Lab: Crafting an Adversarial Example |
83 |
Lattice Cryptography Meets Large Language Models: A Systems View |
406 |
Lab: Recognizing Prompt Injection |
104 |
17.13 Big Data Security and Access Control |
397 |
17.14 Sandbox and Virtual-Machine Escape, and What “AI Escaped the Sandbox” Really Means |
1,139 |
Exercises |
92 |
Answer Key |
178 |
Election Security and Electronic Voting |
500 |
17.15 A Map of Open Research Problems |
451 |
Chapter Summary |
120 |
Why This Matters |
71 |
News in Focus: The Post-Quantum Migration Begins |
72 |
Review Questions (MCQ) |
416 |
Lab Assignment |
192 |
References |
656 |
Chapter 18: Privacy, Law, and Information Governance#
7,069 markdown words (14.1 pages); 387 code words.
Section |
Words |
|---|---|
Learning Objectives |
129 |
Key Terms |
170 |
18.1 Foundational Privacy Principles |
0 |
The 1973 HEW Report and Fair Information Practice Principles |
91 |
The OECD Privacy Guidelines |
109 |
18.2 GDPR |
0 |
Scope and Jurisdiction |
75 |
Lawful Bases for Processing |
115 |
Data Subject Rights |
135 |
GDPR Breach Notification |
57 |
18.3 US Privacy Law |
0 |
HIPAA |
104 |
CCPA and the California Privacy Rights Act (CPRA) |
60 |
FERPA and COPPA |
45 |
18.4 PCI DSS |
0 |
Scope and Requirements |
73 |
Scoping and Cardholder Data Environment |
59 |
18.5 Privacy by Design |
0 |
The Seven Foundational Principles |
60 |
Data Protection Impact Assessments |
179 |
18.6 The Fourth Amendment and the Reasonable Expectation of Privacy |
54 |
The Katz Reasonable-Expectation-of-Privacy Test |
198 |
The Third-Party Doctrine and Its Erosion |
147 |
Current Issue: Geofence Warrants and Chatrie v. United States |
375 |
What the Chatrie Oral Argument Signaled, and How the Court Ruled |
661 |
18.7 Entrapment versus Enticement in Investigations |
482 |
18.8 Computer-Crime Law: CFAA, DMCA, and the Ethical Hacker |
232 |
18.9 The Global Privacy Landscape and Breach Notification |
222 |
18.10 Cryptography, Lawful Access, and Privacy-Enhancing Technologies |
330 |
18.11 Anonymity Networks and Privacy-Focused Operating Systems |
898 |
Exercises |
79 |
Answer Key |
154 |
18.12 Mass Surveillance and the Reasonable Expectation of Privacy: Automated License Plate Readers |
575 |
Exercises |
78 |
Answer Key |
182 |
Chapter Summary |
107 |
Why This Matters |
50 |
News in Focus: Billion-Euro GDPR Enforcement |
76 |
Review Questions (MCQ) |
328 |
Lab Assignment |
207 |
References |
68 |
Chapter 19: Security Governance, Policy, and Culture#
15,865 markdown words (31.7 pages); 482 code words.
Section |
Words |
|---|---|
Learning Objectives |
189 |
Key Terms |
256 |
19.1 What Security Governance Is |
48 |
Why Governance Matters |
50 |
19.2 The CISO Role |
0 |
Strategic Responsibilities |
44 |
Organizational Models |
89 |
Reporting Lines and Independence |
102 |
19.3 The Policy Hierarchy |
0 |
Policy |
92 |
Standard |
47 |
Process |
157 |
Procedure |
54 |
Guideline |
43 |
A Worked Example: When Claude Ends an Abusive Chat |
1,768 |
19.4 Board-Level Security Reporting |
0 |
Communicating Risk in Business Language |
68 |
Key Metrics for Board Reporting |
78 |
Key Risk Indicators |
47 |
19.5 Security Culture |
0 |
What Culture Is and Why It Matters |
89 |
Tone at the Top |
66 |
Building a Positive Security Culture |
115 |
19.6 Common Compliance Frameworks |
216 |
Frameworks, Methodologies, and Tools |
117 |
NIST CSF, the Risk Management Framework (RMF), ISO/IEC 27001, and the RMF Compared |
195 |
FISMA in Depth |
275 |
NIST SP 800-53 in Depth |
262 |
FedRAMP in Depth |
411 |
19.7 NIST Cybersecurity Framework 2.0 and the Govern Function |
268 |
The NIST AI Risk Management Framework (AI RMF 1.0) |
249 |
CSF 2.0 versus AI RMF 1.0 |
232 |
19.8 Cybersecurity Governance at the Municipal Level |
135 |
Benchmarking Readiness with Automated Policy Analytics |
305 |
Governance and Supply-Chain Gaps |
350 |
Compliance Reports, Certifications, and Agreements |
346 |
19.9 Governance, Risk, and Compliance (GRC) as an Integrated Discipline |
229 |
19.10 Audits, Assurance, and Security Maturity |
226 |
19.11 Third-Party Risk and the Human Layer of Governance |
344 |
19.12 What a Security Program Costs, and How It Gets Funded |
100 |
A build-up, with numbers |
190 |
Sticker price is not cost |
151 |
Exercises |
59 |
Answer Key |
43 |
19.13 Risk Appetite and Tolerance, Written So a Board Can Act on Them |
145 |
Writing appetite in numbers |
256 |
19.14 The Three Lines Model, and the Criticisms of It |
225 |
Where it breaks, and what its critics say |
186 |
19.15 One Control at Four Levels, and the Metadata That Makes It Auditable |
258 |
The verb decides everything, and the header block proves it |
179 |
19.16 Exceptions and Risk Acceptance, Where Governance Usually Fails |
218 |
The arithmetic that decides whether the register survives |
187 |
19.17 Metrics That Survive an Executive Audience |
62 |
Why the mean misleads, worked |
192 |
The vanity metric this field cannot let go of |
243 |
Exercises |
50 |
Answer Key |
72 |
19.18 Committees, Decision Rights, and Who Actually Decides |
175 |
Decision rights on one real decision |
204 |
19.19 Third-Party and Supply-Chain Governance |
236 |
What the artifacts prove, and which clauses work |
212 |
19.20 The CISO Reporting Line, and What the Evidence Actually Says |
135 |
What the data shows, and what it does not |
323 |
19.21 Duties That Reach Officers Personally |
46 |
The SEC cybersecurity disclosure rules |
316 |
SolarWinds, and what it established |
140 |
New York’s Part 500, where governance produces a signature |
182 |
One conviction, and two duties abroad |
260 |
Exercises |
78 |
Answer Key |
103 |
19.22 Tabletop Exercises at Board Level |
155 |
A worked inject |
225 |
19.23 Measuring Culture Instead of Asserting It |
270 |
What the evidence says about the standard intervention |
166 |
Exercises |
66 |
Answer Key |
101 |
Chapter Summary |
213 |
Why This Matters |
63 |
News in Focus: What the SolarWinds Case Did and Did Not Settle |
197 |
Review Questions (MCQ) |
691 |
Lab Assignment |
190 |
References |
642 |
Chapter 20: Industrial Control Systems and OT Security#
13,679 markdown words (27.4 pages); 442 code words.
Section |
Words |
|---|---|
Learning Objectives |
173 |
Key Terms |
299 |
20.1 IT Versus OT: A Fundamental Difference in Priorities |
75 |
Safety as the Overriding Priority |
57 |
20.2 ICS Components |
0 |
Programmable Logic Controllers |
72 |
SCADA Systems |
53 |
Human-Machine Interfaces |
60 |
20.3 The Purdue Model and Network Segmentation |
328 |
The Industrial DMZ |
57 |
Air Gaps and Their Limitations |
66 |
20.4 OT-Specific Security Challenges |
0 |
Legacy Equipment and Long Lifecycles |
69 |
Availability Requirements |
51 |
Protocol Insecurity |
65 |
20.5 ICS Malware Case Studies |
0 |
Stuxnet (2010) |
69 |
Industroyer/CRASHOVERRIDE (2016) |
93 |
TRITON/TRISIS (2017) |
56 |
20.6 IEC 62443 and NIST SP 800-82 |
0 |
IEC 62443 |
49 |
NIST SP 800-82 |
41 |
20.7 OT Defense-in-Depth |
350 |
20.8 OT Incident Response, Safety, and Resilience |
557 |
20.9 Why OT Networks Stay Flat |
97 |
Four reasons the flatness is load bearing |
307 |
What the Purdue model assumes, and what breaks it |
231 |
Where to start when you cannot re-architect |
77 |
20.10 The Protocols, and Why the Old Ones Cannot Authenticate Anything |
65 |
Modbus, byte by byte |
505 |
The rest of the family |
440 |
Why the old designs cannot simply be fixed |
160 |
Exercises |
88 |
Answer Key |
171 |
20.11 Safety Instrumented Systems, and Where Safety and Security Collide |
59 |
The problem an independent layer solves |
321 |
The arithmetic, with real numbers |
491 |
Five places the two disciplines actually collide |
322 |
Exercises |
122 |
Answer Key |
151 |
20.12 IEC 62443 in Practice: Zones, Conduits, and Security Levels |
67 |
Which part answers which question |
179 |
The seven foundational requirements |
118 |
Three different security levels, and why people confuse them |
178 |
The method: seven steps to a zone and conduit model |
344 |
A worked partition |
225 |
20.13 NERC CIP: What Happens When OT Security Is Mandatory |
228 |
The patch clock, worked |
200 |
The reporting clock |
109 |
What was added most recently |
128 |
Exercises |
94 |
Answer Key |
135 |
20.14 The Incidents That Changed Practice |
1,193 |
Cyber Warfare, Cyber Operations, and the Law of Armed Conflict |
491 |
20.15 Why Active Scanning Is Dangerous, and What Passive Monitoring Buys |
45 |
The mechanism of harm |
363 |
What passive monitoring sees, and what it misses |
237 |
Where active discovery is still appropriate |
78 |
20.16 Patching You Cannot Do, Access You Cannot Refuse, Response You Cannot Rush |
43 |
Vulnerability management without patching |
371 |
Remote access, which you cannot simply forbid |
308 |
Response you cannot rush |
300 |
Exercises |
96 |
Answer Key |
146 |
Chapter Summary |
176 |
Why This Matters |
81 |
News in Focus: Attacks on Water-Treatment Facilities |
314 |
Review Questions (MCQ) |
626 |
Lab Assignment |
193 |
References |
276 |
Appendix A: Security Command Reference#
1,681 markdown words (3.4 pages); 0 code words.
Section |
Words |
|---|---|
Network Scanning and Enumeration |
0 |
Nmap |
80 |
DNS Enumeration |
39 |
Web Enumeration |
37 |
Password and Credential Tools |
54 |
Forensics |
82 |
Network Analysis |
49 |
Cryptography |
72 |
Python One-Liners |
42 |
Security Tools Reference |
30 |
Metasploit Framework (exploitation – Chapter 9) |
39 |
Wireshark / tshark (packet analysis – Chapters 3, 8) |
36 |
hping3 (packet crafting / testing – Chapters 3, 8) |
40 |
LOIC (Low Orbit Ion Cannon) (DoS demonstration – Chapter 3) |
27 |
Nmap (scanning and mapping – Chapters 7, 8) |
36 |
John the Ripper (password cracking – Chapters 2 and 9) |
22 |
Hashcat (GPU password cracking – Chapters 2 and 9) |
31 |
Aircrack-ng (wireless auditing – Chapters 3, 16) |
40 |
Snort (intrusion detection/prevention – Chapters 12, 17) |
50 |
Zeek (network security monitoring – Chapters 12, 17) |
54 |
pfSense (firewall / router – Chapters 11, 17) |
103 |
OWASP Tools and Projects |
43 |
ZAP (Zed Attack Proxy) (web app testing – Chapter 10) |
74 |
OWASP WebGoat (deliberately vulnerable app – Chapters 6, 10) |
43 |
OWASP Juice Shop (deliberately vulnerable app – Chapter 10) |
27 |
OWASP Amass (attack-surface discovery – Chapter 7) |
33 |
OWASP Dependency-Check (software composition analysis – Chapters 5, 10) |
80 |
Reverse Engineering with Ghidra |
388 |
Appendix B: Glossary#
5,659 markdown words (11.3 pages); 0 code words.
Section |
Words |
|---|---|
Acronyms Used in More Than One Chapter |
1,403 |
Cloud and Infrastructure Terminology |
1,490 |
Adversary and Threat-Model Terminology |
579 |
Reverse Engineering Acronyms and Notation |
54 |
Executable formats and file structure |
241 |
Processor and architecture |
93 |
Windows internals |
111 |
Tools and projects |
247 |
Standards, law and certification |
116 |
Notation that is not an acronym |
102 |
Appendix C: Certification Mapping#
1,861 markdown words (3.7 pages); 0 code words.
Section |
Words |
|---|---|
C.1 (ISC)2 CISSP - 8 Domains |
177 |
C.2 CompTIA Security+ SY0-701 - 5 Domains |
129 |
C.3 EC-Council CEH v13 - 9 Domains |
175 |
C.4 ISACA CISA - 5 Domains |
140 |
C.5 (ISC)2 CGRC / CAP - 7 Job Practice Areas (the NIST Risk Management Framework, RMF) |
167 |
C.6 (ISC)2 SSCP - 7 Domains |
132 |
C.7 (ISC)2 Certified in Cybersecurity (CC) - 5 Domains |
147 |
C.8 GIAC GREM (Reverse Engineering Malware) - Topic Areas |
147 |
C.9 Chapter-to-Certification Coverage Matrix |
408 |
Appendix D: ABET Outcomes and Bloom’s Taxonomy Mapping#
775 markdown words (1.6 pages); 0 code words.
Section |
Words |
|---|---|
ABET Student Outcomes (computing programs, Criterion 3) |
99 |
Bloom’s Revised Cognitive Taxonomy (lowest to highest order) |
93 |
Chapter Mapping |
382 |
Coverage Summary |
137 |
Appendix F: Companion Code and Repositories#
1,284 markdown words (2.6 pages); 0 code words.
Section |
Words |
|---|---|
Worked Code Examples in This Book |
477 |
Author Repositories (github.com/devharsh) |
191 |
Computer Tips Organization (github.com/com-puter-tips) |
192 |
Companion Blog Tutorials (com.puter.tips) |
350 |
Appendix H: Capstone and Group Project Ideas#
2,765 markdown words (5.5 pages); 0 code words.
Section |
Words |
|---|---|
H.1 Deliverables and Scholarly Lifecycle |
85 |
H.2 Track 1: Advanced Research, Innovation, and Privacy-Preserving Systems |
170 |
H.3 Track 2: Autonomous Threats, AI Security, and Offensive Security |
77 |
H.4 Track 3: Specialized Technical Tools and Ethical Hacking |
156 |
H.5 Track 4: Defensive Security, Detection, and Digital Forensics |
88 |
H.6 Track 5: Penetration Testing, Governance, Privacy, and Society |
208 |
H.7 Track 6: Encoding, Provenance, and Data Integrity |
816 |
H.8 GitHub Submission Standards |
71 |
H.9 Approved Preprint Servers for DOI Generation |
34 |
H.10 Where to Publish Each Type of Research Output (Free Platforms) |
671 |
H.11 Example Completed Student Projects (Spring 2026) |
195 |
Appendix I: Protocol Security Reference#
4,073 markdown words (8.1 pages); 0 code words.
Section |
Words |
|---|---|
I.1 Internet and Transport Layer |
278 |
I.2 Naming and Address Assignment |
270 |
I.3 Web, Transport Security, and Identity |
392 |
I.4 Email |
128 |
I.5 File Transfer, Remote Access, and Sharing |
338 |
I.6 Management, Authentication, Time, and Logging |
296 |
I.7 VPN and Tunneling |
240 |
I.8 Routing, Switching, and Redundancy |
197 |
I.9 Wireless |
139 |
I.10 Multimedia, Messaging, IoT, and Discovery |
337 |
I.11 Industrial Control Systems and Operational Technology |
192 |
I.12 Storage Interfaces |
152 |
I.13 How to Use This Reference |
127 |
Appendix J: Adversary Models#
3,794 markdown words (7.6 pages); 0 code words.
Section |
Words |
|---|---|
J.1 The Three Layers of an Adversary Model |
160 |
J.2 Layer 1: Behavioral Models |
75 |
Fully Honest |
22 |
Semi-Honest (Honest-but-Curious, Passive) |
80 |
Honest-but-Lazy (Lazy) |
125 |
Fail-Stop, Fail-Corrupt, and Omission |
33 |
Honest-Looking |
28 |
Semi-Malicious |
61 |
Covert |
91 |
Rational |
78 |
Malicious (Active, Byzantine) |
21 |
Mixed Adversaries |
60 |
Friends-and-Foes (FaF) |
256 |
J.3 Layer 2: Corruption Modifiers |
189 |
J.4 Layer 3: Single-Key Game Models |
304 |
J.5 Extended Single-Key Models |
192 |
J.6 Adversary Models for Homomorphic Encryption |
333 |
J.7 Multi-Key Settings |
418 |
J.8 Composing a Complete Threat Model |
190 |
J.9 Worked Numerical Examples |
413 |
J.10 Exercises |
238 |
Answer Key |
270 |
Appendix K: Course Materials and Sample Assignments#
2,408 markdown words (4.8 pages); 0 code words.
Section |
Words |
|---|---|
K.1 Source-Materials Coverage Map |
611 |
K.1.1 Software Reverse Engineering: A Malware-Analysis Course Map |
312 |
K.1.2 Three Systems- and Network-Security Course Maps |
509 |
K.2 Sample Lecture Modules |
28 |
K.2.1 Social Engineering and the Human Attack Surface (pairs with Chapter 4) |
180 |
K.2.2 Ethical Hacking Foundations (pairs with Chapters 1, 5, and 6) |
131 |
K.2.3 Intrusion Detection and Prevention Systems (pairs with Chapters 11 and 12) |
139 |
K.3 Sample Assignments and Group Projects |
321 |
K.4 Adapting These Materials |
102 |