118 resources
Cybersecurity
Standards bodies, threat frameworks, hands-on ranges, and courses covering both the defensive and offensive sides of security.
118 resources
Documents 66
OWASP Top 10
OWASP's standard awareness document listing the ten most critical web application security risks.
OWASP
OWASP Application Security Verification Standard (ASVS)
A framework of security requirements for testing and building secure web applications.
OWASP
OWASP Web Security Testing Guide
A comprehensive guide to methodology and techniques for testing web application security.
OWASP
OWASP SAMM (Software Assurance Maturity Model)
A measurable model for organizations to analyze and improve their software security posture.
OWASP
OWASP Dependency-Check
Documentation for OWASP's software composition analysis tool that detects known vulnerable dependencies.
OWASP
OWASP Cheat Sheet Series (Index)
Concise, practical security guidance covering dozens of specific application security topics.
OWASP
Authentication Cheat Sheet
Guidance on implementing secure authentication mechanisms in web applications.
OWASP
Cross Site Scripting Prevention Cheat Sheet
Techniques and coding practices to prevent XSS vulnerabilities in web applications.
OWASP
Input Validation Cheat Sheet
Best practices for validating untrusted input to reduce application attack surface.
OWASP
SQL Injection Prevention Cheat Sheet
Defensive coding techniques to prevent SQL injection attacks against applications.
OWASP
Session Management Cheat Sheet
Guidance on securely implementing web application session handling and cookies.
OWASP
Password Storage Cheat Sheet
Recommendations for securely storing user passwords using modern hashing algorithms.
OWASP
Access Control Cheat Sheet
Design principles for implementing robust authorization and access control in applications.
OWASP
Cross-Site Request Forgery Prevention Cheat Sheet
Methods for defending web applications against cross-site request forgery attacks.
OWASP
Transport Layer Security Cheat Sheet
Guidance for configuring TLS securely on servers to protect data in transit.
OWASP
Logging Cheat Sheet
Best practices for application event logging to support security monitoring and forensics.
OWASP
Error Handling Cheat Sheet
Guidance on handling application errors without leaking sensitive information.
OWASP
File Upload Cheat Sheet
Security controls for safely handling user-uploaded files in web applications.
OWASP
HTML5 Security Cheat Sheet
Security considerations specific to HTML5 features such as storage and web messaging.
OWASP
Clickjacking Defense Cheat Sheet
Techniques such as frame-busting and headers to defend against clickjacking attacks.
OWASP
Content Security Policy Cheat Sheet
Guidance for configuring Content Security Policy headers to mitigate injection attacks.
OWASP
Docker Security Cheat Sheet
Security recommendations for building and running Docker containers safely.
OWASP
Kubernetes Security Cheat Sheet
Guidance on securing Kubernetes cluster configuration, networking, and workloads.
OWASP
REST Security Cheat Sheet
Security design and implementation guidance for RESTful web services.
OWASP
XML External Entity Prevention Cheat Sheet
Defensive techniques to prevent XXE injection attacks in XML processing.
OWASP
Deserialization Cheat Sheet
Guidance on safely handling untrusted data during object deserialization.
OWASP
Multifactor Authentication Cheat Sheet
Guidance on implementing multi-factor authentication to strengthen login security.
OWASP
Authorization Cheat Sheet
Design guidance for implementing sound authorization checks throughout an application.
OWASP
SAML Security Cheat Sheet
Security considerations for implementing SAML-based single sign-on securely.
OWASP
Secrets Management Cheat Sheet
Guidance on securely storing, distributing, and rotating application secrets and credentials.
OWASP
Injection Prevention Cheat Sheet
General guidance on preventing injection flaws across different application contexts.
OWASP
Insecure Direct Object Reference Prevention Cheat Sheet
Techniques to prevent unauthorized access to objects referenced via user-supplied input.
OWASP
Vulnerable Dependency Management Cheat Sheet
Guidance for identifying and managing risk from vulnerable third-party software dependencies.
OWASP
Key Management Cheat Sheet
Best practices for generating, storing, and rotating cryptographic keys.
OWASP
Cryptographic Storage Cheat Sheet
Guidance on properly implementing cryptography to protect sensitive stored data.
OWASP
Threat Modeling Cheat Sheet
An introduction to threat modeling concepts and processes for application security.
OWASP
Zero Trust Architecture Cheat Sheet
Guidance on designing and applying zero trust principles to application architecture.
OWASP
JSON Web Token Cheat Sheet
Security guidance for creating and validating JSON Web Tokens safely.
OWASP
Server Side Request Forgery Prevention Cheat Sheet
Defensive techniques to prevent SSRF attacks against server-side request functionality.
OWASP
Secure Coding Practices Quick Reference Guide
A technology-agnostic checklist of secure coding practices organized by category.
OWASP
NIST Cybersecurity Framework
NIST's voluntary framework of standards and practices to help organizations manage cybersecurity risk.
NIST
NIST SP 800-53 Rev. 5: Security and Privacy Controls
Catalog of security and privacy controls for federal information systems and organizations.
NIST
NIST SP 800-171 Rev. 3: Protecting Controlled Unclassified Information
Requirements for protecting controlled unclassified information in nonfederal systems.
NIST
NIST SP 800-63-4: Digital Identity Guidelines
NIST's guidelines for digital identity, authentication, and federation practices.
NIST
NIST SP 800-61 Rev. 3: Incident Response Recommendations
Guidance for organizations on cybersecurity incident response and risk management.
NIST
NIST SP 800-207: Zero Trust Architecture
NIST's definitional guidance on zero trust architecture concepts and deployment models.
NIST
NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
Guidance for sanitizing media to protect the confidentiality of information.
NIST
NIST SP 800-115: Technical Guide to Information Security Testing
Technical guidance on planning and conducting information security assessments.
NIST
NIST SP 800-190: Application Container Security Guide
Guidance on securing application container platforms and the container lifecycle.
NIST
MITRE ATT&CK
A globally accessible knowledge base of adversary tactics and techniques based on real observations.
MITRE
MITRE CWE (Common Weakness Enumeration)
A community-developed list of common software and hardware weakness types.
MITRE
CVE Program
The official catalog of publicly disclosed cybersecurity vulnerabilities and exposures.
MITRE / CVE.org
MITRE D3FEND
A knowledge graph of cybersecurity countermeasures mapped against adversary techniques.
MITRE
MITRE CAPEC (Common Attack Pattern Enumeration and Classification)
A comprehensive dictionary of known attack patterns used by adversaries.
MITRE
MITRE ATLAS
A knowledge base of adversary tactics and techniques targeting AI-enabled systems.
MITRE
MITRE Engage
A framework for planning and discussing adversary engagement, deception, and denial operations.
MITRE
CISA Known Exploited Vulnerabilities Catalog
CISA's authoritative catalog of vulnerabilities known to be actively exploited in the wild.
CISA
CISA Cybersecurity Advisories
CISA's published advisories on active threats, vulnerabilities, and mitigation guidance.
CISA
CISA Secure by Design
CISA's guidance urging technology manufacturers to build security into products by default.
CISA
CISA Free Cybersecurity Services and Tools
A CISA-curated catalog of free services and tools to help organizations reduce cyber risk.
CISA
CISA Cyber Essentials
A guide helping small organizations and leaders start implementing basic cybersecurity practices.
CISA
SANS Reading Room (White Papers)
SANS Institute's large free library of research papers on cybersecurity topics.
SANS Institute
ENISA Publications
The EU Agency for Cybersecurity's repository of reports and guidance documents.
ENISA
CIS Critical Security Controls
A prioritized set of safeguards to mitigate the most prevalent cyberattacks.
Center for Internet Security
CIS Benchmarks
Consensus-based secure configuration guidelines for a wide range of technologies.
Center for Internet Security
EFF Surveillance Self-Defense
EFF's expert guide to protecting yourself and others from online surveillance and spying.
Electronic Frontier Foundation
Videos 52
NetworkChuck (Channel)
Beginner-friendly IT and cybersecurity tutorials including ethical hacking and networking basics.
NetworkChuck
John Hammond (Channel)
Malware analysis, CTF walkthroughs, and cybersecurity tool demonstrations.
John Hammond
IppSec (Channel)
In-depth Hack The Box machine walkthroughs teaching practical penetration testing techniques.
IppSec
LiveOverflow (Channel)
Binary exploitation, reverse engineering, and hacking concept explainers.
LiveOverflow
TCM Security / The Cyber Mentor (Channel)
Practical ethical hacking, penetration testing, and career advice videos.
TCM Security
David Bombal (Channel)
Networking and cybersecurity interviews, tutorials, and hacking demonstrations.
David Bombal
HackerSploit (Channel)
Penetration testing, Linux, and open-source cybersecurity tool tutorials.
HackerSploit
Professor Messer's CompTIA Security+ (SY0-701) Course
Free full video course covering every objective of the CompTIA Security+ SY0-701 exam.
Professor Messer
Professor Messer's CompTIA A+ Core 1 (220-1101) Course
Free video training course for the CompTIA A+ Core 1 hardware and networking exam.
Professor Messer
Professor Messer's CompTIA A+ Core 2 (220-1102) Course
Free video training course for the CompTIA A+ Core 2 operating systems and security exam.
Professor Messer
HTB Academy Free Tier 0 Modules
Free interactive cybersecurity training modules covering networking, Linux, and web fundamentals.
Hack The Box Academy
OverTheWire Bandit Wargame
Free hands-on Linux and command-line security wargame for absolute beginners.
OverTheWire
OverTheWire Natas Wargame
Free hands-on web application security wargame teaching common web vulnerabilities.
OverTheWire
OverTheWire Leviathan Wargame
Free hands-on wargame for beginners practicing basic exploitation and Linux skills.
OverTheWire
OverTheWire Krypton Wargame
Free hands-on wargame introducing classical and modern cryptography concepts.
OverTheWire
OverTheWire Narnia Wargame
Free hands-on wargame focused on basic binary exploitation techniques.
OverTheWire
OverTheWire Behemoth Wargame
Free hands-on wargame teaching intermediate binary exploitation on Linux.
OverTheWire
OverTheWire Utumno Wargame
Free hands-on advanced wargame for practicing binary exploitation skills.
OverTheWire
OverTheWire Vortex Wargame
Free hands-on wargame covering a range of Linux binary exploitation challenges.
OverTheWire
OverTheWire Manpage Wargame
Free hands-on wargame teaching effective use of Linux manual pages for security tasks.
OverTheWire
PicoCTF Platform
Free beginner-friendly hands-on cybersecurity capture-the-flag platform with guided challenges.
Carnegie Mellon University
Google Cybersecurity Certificate
Free-to-audit video course series covering foundational cybersecurity analyst skills.
Google / Coursera
IBM Security Learning Academy
Free official IBM video courses covering security products, threat detection, and operations.
IBM
AWS Security Learning Plan
Free AWS Skill Builder video curriculum guiding learners through cloud security fundamentals.
Amazon Web Services
AWS Skill Builder Security Training
Free official AWS digital training videos covering cloud security topics and services.
Amazon Web Services
Computerphile (Channel)
Academic explainer videos covering computer science topics including cryptography and security.
Computerphile / University of Nottingham
Hak5 (Channel)
Hacking hardware demos, network security tutorials, and penetration testing tool reviews.
Hak5
STÖK (Channel)
Bug bounty hunting tutorials and interviews with security researchers.
STÖK
NahamSec (Channel)
Bug bounty hunting streams, tutorials, and web application security walkthroughs.
NahamSec
PwnFunction (Channel)
Animated explainer videos on web security vulnerabilities and exploitation techniques.
PwnFunction
InsiderPhD (Channel)
Bug bounty and web hacking tutorials aimed at beginners entering security research.
InsiderPhD
The XSS rat (Channel)
Web application penetration testing and bug bounty tutorial videos.
The XSS rat
Loi Liang Yang (Channel)
Ethical hacking, Kali Linux, and cybersecurity certification prep tutorials.
Loi Liang Yang
Seytonic (Channel)
Cybersecurity news analysis and hacking technique explainer videos.
Seytonic
SANS Institute (Channel)
Free webcasts and talks from SANS security experts on threats and defense techniques.
SANS Institute
freeCodeCamp (Channel)
Full-length free cybersecurity, ethical hacking, and networking course videos.
freeCodeCamp.org
Simply Cyber with Gerald Auger (Channel)
Cybersecurity career advice, news, and beginner-friendly training videos.
Simply Cyber
13Cubed (Channel)
Digital forensics and incident response tutorials and home lab walkthroughs.
13Cubed
Black Hills Information Security (Channel)
Free webcasts and talks covering penetration testing and security operations.
Black Hills Information Security
Motasem Hamdan (Channel)
CTF walkthroughs and cybersecurity certification study videos.
Motasem Hamdan
Bugcrowd (Channel)
Bug bounty education, hacker interviews, and vulnerability research content.
Bugcrowd
Null Byte (Channel)
Hacking tutorials covering Wi-Fi security, Kali Linux tools, and penetration testing.
Null Byte / WonderHowTo
Cisco Networking Academy Skills for All
Free official Cisco video courses covering networking basics and introductory cybersecurity.
Cisco
Cisco Introduction to Cybersecurity Course
Free official Cisco video course introducing cybersecurity concepts and career paths.
Cisco Networking Academy
MIT OCW Computer Systems Security
Free full lecture video series from MIT covering computer systems security fundamentals.
MIT OpenCourseWare
Josh Madakor (Channel)
Cybersecurity home lab projects and career transition tutorials.
Josh Madakor
Cyberspatial (Channel)
CTF walkthroughs and hands-on cybersecurity concept tutorials.
Cyberspatial
TCM Security Practical Ethical Hacking Free Course
Free 15-hour full course teaching practical ethical hacking and penetration testing skills.
TCM Security / freeCodeCamp
Cybrary Free Introduction to IT and Cybersecurity
Free official video course introducing IT and cybersecurity fundamentals for beginners.
Cybrary
Google Cybersecurity Certificate - Foundations Course
Free-to-audit video module introducing the cybersecurity analyst role and core concepts.
Google / Coursera
IBM Cybersecurity Fundamentals Free Course
Free official IBM video-based courses covering cybersecurity fundamentals and career skills.
IBM SkillsBuild
OverTheWire Wargames Overview
Free hands-on wargame collection teaching hacking concepts through progressive levels.
OverTheWire