Cyber Security

Learning paths

• Cybersecurity (14 steps)

  Start with networks and security thinking, then learn cryptography, web application flaws, vulnerability catalogs and system hardening through free hands-on labs and official references.

Curated Resources (31)

Tools (5)

• OWASP ZAP (Zed Attack Proxy) owasp.orgfree

  A widely used open-source web application security scanner for finding vulnerabilities during testing and development.

• Wireshark wireshark.orgfree

  A free and open-source network protocol analyzer used for network traffic analysis and security troubleshooting.

• PortSwigger Web Security Academy portswigger.netfree

  A hands-on training platform and laboratory environment for learning and practicing modern web application penetration testing.

• Center for Internet Security (CIS) Benchmarks cisecurity.orgfree

  Consensus-developed, secure configuration guidelines and hardening benchmarks for operating systems, clouds, and databases.

• Postmark DMARC Monitoring dmarc.postmarkapp.comfree

  Free service that collects DMARC aggregate reports and sends weekly digests, helping domain owners check email authentication and detect spoofing of their domain.

Databases (4)

• National Vulnerability Database (NVD) nvd.nist.govfree

  The U.S. government repository of standards-based vulnerability management data, security checklists, and impact metrics.

• MITRE ATT&CK attack.mitre.orgfree

  A globally accessible knowledge base of adversary tactics and techniques based on real-world cybersecurity observations.

• CVE Program cve.orgfree

  A global standard catalog identifying and indexing publicly disclosed cybersecurity vulnerabilities.

• CISA Known Exploited Vulnerabilities Catalog cisa.govfree

  An authoritative list of vulnerabilities confirmed by CISA to have been actively exploited by threat actors in the wild.

Learn (9)

• PortSwigger Web Security Academy portswigger.netfree

  Free interactive online training and vulnerability labs covering web application security and penetration testing concepts.

• OWASP Top Ten owasp.orgfree

  A standard awareness document and educational guideline outlining the most critical security risks to web applications.

• NIST Computer Security Resource Center csrc.nist.govfree

  Official repository of cryptographic standards, guidelines, and Special Publications (SP 800-series) from NIST.

• Professor Messer professormesser.comfree

  Free video training courses, study groups, and resources covering CompTIA Security+ and cybersecurity fundamentals.

• Encryption with GPG Tutorial hashrocket.comfree

  Narrative tutorial explaining public key encryption with GnuPG, from generating keys to encrypting, signing and exchanging files, for newcomers to secure communication.

• SameSite Cookies Explained web.devfree

  Article explaining how the SameSite cookie attribute separates first-party and third-party use and how Strict and Lax values reduce cross-site request risks.

• AI Red Teaming Roadmap (roadmap.sh) roadmap.shfree

  Interactive roadmap on testing AI systems for security risks: topics laid out in a suggested study order, each linking to further reading.

• Cyber Security Roadmap (roadmap.sh) roadmap.shfree

  Interactive roadmap on cybersecurity careers: topics laid out in a suggested study order, each linking to further reading.

• DevSecOps Roadmap (roadmap.sh) roadmap.shfree

  Interactive roadmap on security in DevOps pipelines: topics laid out in a suggested study order, each linking to further reading.

Publications (6)

• ACM Transactions on Privacy and Security (TOPS) dl.acm.orgfree

  An open-access peer-reviewed academic journal publishing research in information security, cryptography, and privacy.

• IEEE Security & Privacy Magazine computer.orgpaid

  A bimonthly publication by IEEE Computer Society offering articles, case studies, and research on security and privacy engineering.

• IEEE Transactions on Information Forensics and Security ieeexplore.ieee.orgpaid

  A premier monthly scientific journal publishing peer-reviewed research on computer forensics, malware analysis, and information protection.

• CISA Cybersecurity Advisories cisa.govfree

  Official timely alerts and threat analyses published by CISA regarding current security issues and active cyber threats.

• Compromising LLM-Integrated Applications with Indirect Prompt Injection arxiv.orgfree

  Research paper showing how instructions hidden in retrieved web content can hijack applications built on language models, and classifying the resulting threats.

• Universal and Transferable Attacks on Aligned Language Models llm-attacks.orgfree

  Project site for research demonstrating automatically generated adversarial suffixes that bypass safety training across many language models, with paper and code.

Blogs and sites (4)

• Krebs on Security krebsonsecurity.comfree

  An investigative journalism blog by Brian Krebs dedicated to in-depth reporting on cybercrime, data breaches, and security vulnerabilities.

• Schneier on Security schneier.comfree

  A widely read security blog and essay archive by Bruce Schneier covering cryptography, privacy, and security technology policy.

• OWASP Community owasp.orgfree

  A global non-profit community and website offering open-source application security standards, tools, and local chapters.

• SANS Internet Storm Center isc.sans.edufree

  A community monitoring network providing daily security podcasts, threat diary updates, and analysis of active internet attack trends.

Events and conferences (4)

• IEEE Symposium on Security and Privacy ieee-security.orgpaid

  The premier annual research conference for developments in computer security and electronic privacy sponsored by IEEE.

• USENIX Security Symposium usenix.orgpaid

  An annual technical conference bringing together researchers, practitioners, and system administrators to discuss computer security.

• DEF CON defcon.orgpaid

  One of the world's oldest and largest hacker conventions featuring research presentations, capture-the-flag competitions, and villages.

• Black Hat USA blackhat.compaid

  A major annual information security conference providing technical briefings, applied security research, and hands-on trainings.

Other subcategories

Artificial Intelligence · Machine Learning · Big Data · Computer Information Systems · Computer Science · Computer Vision · Data Science · Databases · Distributed Computing · Hardware · Human-Computer Interaction · IT Certification · Natural Language Processing · Networking · Operating Systems · Robotics · Software Engineering

Part of Computing