Cybersecurity: Theory, Practice, and Ethics

Cybersecurity: Theory, Practice, and Ethics#

A hooded figure at a laptop against a circuit-board background, the cover art for this textbook

A free, open-source textbook for university courses and professional certifications

Devharsh Trivedi, Ph.D., CISSP
City University of New York
ORCID: https://orcid.org/0000-0001-6374-7249

Last updated on 10/22/2026 at 14:22:14 EDT

This open educational resource bridges rigorous theory and hands-on practice across cybersecurity, cryptography, networking, offensive and defensive security, digital forensics, incident response, governance, privacy and law, and emerging topics. It is layered to serve readers from high school through postdoctoral level and is mapped to the CISSP, Security+, CEH, CISA, and CGRC certifications.

Start Here#

  • Introduction – course mapping, what every chapter contains, how to cite this book, and the license.

  • Preface – about this book and how to use it.

  • Begin the material with Part I: Foundations (Chapter 1: Introduction to Cybersecurity).

Use the sidebar to navigate the twenty chapters and the appendices (command reference, glossary, certification mapping, ABET and Bloom’s mapping, and companion publications and code).

How the Field Is Taught#

Cybersecurity education joins foundational computer science to hands-on work on systems that are deliberately broken, and the chapters that follow are ordered to match that progression.

Core curriculum. Three strands recur across programs. Foundations supply the prerequisites everything else rests on: discrete mathematics, computer networks, operating systems, and programming in languages close enough to the machine that memory layout and protocol behavior stay visible, usually Python, C, and assembly. Defensive and offensive skills are taught together, because each explains the other: cryptography (Chapter 2), secure software development and web security (Chapter 10), penetration testing (Chapters 6 through 9), network monitoring and defense (Chapters 11 and 12), and digital forensics (Chapter 13). Policy and ethics frame both: data protection law such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) in Chapter 18, governance frameworks from the National Institute of Standards and Technology (NIST) and ISO/IEC 27001:2022 in Chapters 5 and 19, and the authorization boundary that separates lawful security testing from unlawful intrusion, in Chapter 6.

Teaching methods. Practical work belongs inside an isolated environment, whether a local virtual machine, a container, or an instructor-provisioned cloud account, so that a student can run malware or misconfigure a firewall without touching a production network. Capture the flag competitions turn exercises into timed puzzles in which a hidden token, the flag, proves that a vulnerability was found and exploited (Chapter 16). Cyber range exercises scale the same idea to a whole class: a red team of attackers works against a blue team of defenders in a simulated security operations center, which lets incident response (Chapter 14) be rehearsed under time pressure rather than only read about. Appendix H collects capstone and group project ideas, and Appendix K collects sample assignments and course materials.

A live, continuously updated web version of this book is available at https://book.com.puter.tips/

This textbook is released under the Creative Commons Attribution 4.0 International (CC BY 4.0) license.

Readers around the world

Flag Counter