Practical guide
References to interactive visualization and command line with synthetic examples - intended for training, demonstration and certification.
Available materials
Docker and containers
Docker and containerization in simple language: what is container (and what differs from virtual machines), image vs container, path from code to running app, main commands with life cycle, Docker Compose environment and best practices and safety (OCI, NIST SP 800-190, CIS Docker Benchmark).
Open Guide → MethodologySystem analysis
System analysis with diagrams: SDLC and Agile, stakeholders, knowledge of claims and MoSCOW, abuse cases, BPPN processes, traceability and analysis of differences.
Open charts → DiagramsModelling systems
Seven modelling methods with SVG visualizations: ERD, UML, Conceptual→Physical layers, DFD, normalisation, C4 architecture and STRIDE three modeling.
Open charts → RoadmapAPI Guide
Application interfaces according to international practice: REST principles (Fielding), HTTP methods and status codes (RFC 9110), security (OWASP API Top 10, OAuth 2.0, JWT), API gateway vs reverse proxy vs load balancer, design practices (RFC 9457, OpenAPI 3.1) and standards references.
Open Guide → RoadmapSafe development
Development of secure software by international practice: Secure by Design and Secure by Default (CISA), Safe Life Cycle (Microsoft SDL, NIST SSDF, OWASP SAMM), Safe Code (OWASP Top 10, USS, CWE), CI/CD and DevSecOps with Shift-left gates, Automated Testing (SAST/DAST/IAST/SCA) and Supply Chain Integrity (SBOM, SLSA, Signature).
Open Guide → RoadmapDanger Modelling
How to find the weaknesses before they find the attacker: Three Modeling Manifesto four questions, data flow diagram with confidence limits, STRIDE by elements, attacks on the online store step by step, actions and methods (PASTA, LINDUN, ATT&CK).
Open Guide → RoadmapRisk analysis (ITRMS)
Information and IT risk analysis by international practice: risk management process (ISO 31000, ISO/IEC 27005), threat modelling (DFD, confidence limits, STRIDE), risk assessment (possibility × impact, risk matrix), quantitative analysis (SLE, ALE, ROSI, FAIR), risk treatment (4 T) and risk register, NIST SP 800-30 and RMF (SP 800-37) and relationship to Article 21 of the NIS2 and ISO 27001.
Open Guide → RoadmapCyber Kill Chain Guide
Anatomy of the attack in international practice: Lockheed Martin 7 phase (2011), MITRE ATT&CK 14 tactics, Unified Kill Chain (Paul Pauls), Diamond Model, D3FEND defense matrix and relation to reporting of NIS2 Article 23 incidents.
Open Guide → RoadmapZero Trust Guide
Zero confidence architecture according to international practice: seven NIST Guiding Principles (SP 800-207), PEP/PDP components, five CISA pillars, maturity levels, gradual transition model and relation to the requirements of Article 21 of the NIS2.
Open Guide → RoadmapOrganisational security
Organisational security by international practice: ISO/IEC 27001 management system (ISMs, PDCA), ISO 27002 Chapter 5 (37 organisational controls), risk management and application declaration (SoA), separation of roles and responsibilities, security policies, supplier management, incident management, continuity and compliance (NIS2, national and international legislation).
Open Guide → RoadmapSecurity of personnel
Security of staff by international practice: man as the weakest section and human firewall, ISO 27002 Chapter 6 (8 controls), employee life cycle (Joiner-Mover-Lever), personnel inspection and contracts, security awareness, education and culture, social engineering and internal threats (insider three), event reporting and disciplinary process (NIST SP 800-53 PS, NIS2).
Open Guide → RoadmapPhysical security
Physical security in the context of cyber security by international practice: why physical access bypass logic, protection at depth (safety zones), 5 D model, ISO 27002 Chapter 7, NIST SP 800-53 PE, threats (tabilizing, RFID, evil made, TEMPEST), environmental control and media destruction (NIST SP 800-88).
Open Guide → RoadmapTechnological security
Technological (technical) controls by international practice: classification of controls, protection at depth (technical layers), ISO 27002 Chapter 8 (34 controls), identity and access (IAM, MFA, PAM, Zero Trust), cryptographic and data protection, hardware of systems, logging and monitoring (NIST SP 800-53, CIS Controls v.8.1, NIS2).
Open Guide → RoadmapReduction of the attack surface
Less service, port and automatically run a task - fewer entry points. Windows, macOS and Linux teams with return path: equipment, redundant services, open ports and traffic, autostart and planned tasks, configuration baselines (CIS Benchmarks, Stig, mSCP).
Open Guide → RoadmapCryptography
Data protection in three situations (emergency, transmission, use): cryptographic primitives, each solves a problem, TLS 1.3, envelope encryption and key management (NIST SP 800-57), integrity against randomity and intent (parity, controls, CRC, control, MAC, signatures), Hamming, Reed-Solomon and post-quant standards (FIPS 203/204/205).
Open Guide → RoadmapLogfile (window) analysis
Analysis of logs by international practice: log management life cycle (NIST SP 800-92), sources and formats (syslog RFC 5424, JSON, EVTX), centralised collection and SIEM, analysis techniques (Sigma, baseline, correlation, Pyramid of Pain), attack signs (Windows Event ID, Linux auth.log) and standards (ISO 27001, OWASP A09, PCI DSS, CIS Control 8).
Open Guide → DFIRDigital Forensics
The most popular Windows, Linux and macOS teams for obtaining evidence, network traffic and magazines (dd, tcpdump, ss, journalctl, wevtutil, log show, launchctl...). Interactive diagrams: volatility sequence, incident cycle, evidence map, chain of customy, artefact pathways.
Open reference → RoadmapIncident response
Cyber incident management by international practice: response lifecycle (NIST SP 800-61, SANS PICERL, ISO/IEC 27035), detection and triage, containment, eradication and restoration, ENISA taxonomy, reporting deadlines (NIS2 24 h / 72 h, GDPR 33 p.) and metrics (MTTD, MTTR).
Open Guide → RoadmapContinuity and DR
Backup copies, business continuity and emergency recovery by international practice: strategy and non-variable copies of 32-1-1-0, business impact analysis (BIA), RTO/RPO, business continuity plan (BCP, ISO 22301), emergency recovery strategy (DR) and standards (ISO/IEC 27031, NIST SP 800-34, NIS2, DORA).
Open Guide → RoadmapThird parties and supply chains
Third party (TPRM) and supply chain risk management according to international practice: attack surface, TPRM life cycle, risk classification (tiering), software supply chain (SBOM, SLSA), standards (ISO 27036, NIST SP 800-161, NIS2, DORA, CRA) and controls.
Open Guide → RoadmapAudit guide
Audit in line with international practice: audit process (ISO 19011), Three Lines Model (IIA), audit types (steps 1/2/3), standard landscape (COBIT, SOC 2, NIST), evidence and selection, findings and opinion.
Open Guide →