Cybersecurity Engineering Handbook

Part 1

Part I - Orientation and Minimum Security Bar

How to use the handbook, apply security principles, and set the minimum production security bar.

3 entries

1. 01 How to Use This Handbook Choose the right security chapter, checklist, and evidence artifact for the engineering decision in front of …
2. 02 Security Principles Engineers Can Apply Turn durable security principles into design rules, implementation defaults, review questions, and operational …
3. 03 The Minimum Security Bar Define the non-negotiable controls, evidence, and exception rules every production system needs before launch.

Part 2

Part II - Govern and Identify

Ownership, decision rights, inventory, classification, and threat assumptions for security engineering work.

5 entries

1. 04 Security Ownership, Governance, and Decision Rights Define who owns security decisions, who can accept risk, and how gates turn concerns into remediation or …
2. 05 Asset, Data, and Dependency Inventory Build the inventories that make design review, vulnerability management, incident response, and audit evidence …
3. 06 Data Classification, Privacy, and Protection Requirements Map data sensitivity to storage, processing, transmission, access, logging, retention, analytics, AI, and …
4. 07 Threat Modeling for Engineers Turn threat modeling into a repeatable engineering activity that produces controls, tests, telemetry, and …
5. 08 Risk Rating and Security Requirements Translate security risk into consistent severity, engineering requirements, remediation timelines, and …

Part 3

Part III - Design Secure Systems

Architecture review, trust boundaries, identity, authorization, data flow, and secure design decisions.

13 entries

1. 09 Secure Architecture Review Process Define the security architecture review package, workflow, outcomes, and evidence required before production …
2. 10 Secure System Decomposition and Trust Boundaries Decompose systems into components, flows, identities, data classes, and enforcement points so controls land in …
3. 11 Identity and Authentication Architecture Choose authentication patterns for humans, administrators, workloads, devices, integrations, pipelines, and AI …
4. 12 Authorization and Access-Control Architecture Design authorization so every object, tenant, administrative action, export, and background job has an explicit …
5. 13 Secure API and Service Design Design APIs and services with explicit authentication, authorization, validation, output control, abuse …
6. 14 Cryptography and Key Management Architecture Apply safe cryptographic defaults and manage keys, certificates, password storage, randomness, rotation, …
7. 15 Secrets Management Control how secrets are created, stored, accessed, rotated, scanned, monitored, and retired, and how exposure …
8. 16 Network, Edge, and Zero-Trust Architecture Inventory, segment, protect, log, and own every external endpoint, administrative path, service path, and egress …
9. 17 Multi-Tenancy and Isolation Design and prove tenant isolation across data, compute, identity, logs, backups, support tooling, and AI …
10. 18 Secure Cloud Architecture Build a cloud baseline with separated accounts, least-privilege IAM, private workloads, protected storage, …
11. 19 Secure Kubernetes and Container Architecture Define a container and Kubernetes workload baseline that can be enforced by image, admission, RBAC, secrets, …
12. 20 Resilience, Availability, and Recovery Architecture Make resilience a security requirement with recovery objectives, protected backups, high availability, abuse …
13. 21 Secure Observability, Logging, and Audit Architecture Design security telemetry that supports detection, investigation, audit evidence, and accountability without …

Part 4

Part IV - Build Securely

Implementation rules for secure code, authentication, authorization, data storage, clients, dependencies, infrastructure, and delivery pipelines.

9 entries

1. 22 Secure Coding Foundations Trace hostile input through validation, authorization, side effects, errors, and evidence, then prove the path …
2. 23 Authentication Implementation Implement login, password handling, MFA, sessions, OAuth/OIDC, service authentication, and authentication tests …
3. 24 Authorization Implementation Carry authorization from the request to the final effect, then prove that every wrong actor, tenant, object, …
4. 25 Secure Data Storage, Databases, and Queries Keep authorization, query safety, integrity, encryption, and retention attached to data as it moves through …
5. 26 Secure Frontend and Client-Side Engineering Prevent client-side compromise by treating browser code as exposed code, controlling dangerous sinks, and …
6. 27 Secure CI/CD and Release Engineering Make releases trustworthy by protecting source, isolating builds, limiting pipeline identity, proving artifact …
7. 28 Dependency and Software Supply-Chain Security Choose, pin, verify, monitor, and remediate dependencies with controls that survive package compromise, …
8. 29 Infrastructure as Code and Configuration Security Make infrastructure changes reviewable, testable, reproducible, and resistant to drift through policy-as-code, …
9. 30 Secure AI, ML, and LLM Implementation Build AI systems that treat model output as untrusted, constrain tools to user authority, protect retrieval, and …

Part 5

Part V - Review and Assure

Security review, automated and manual testing, release readiness, and evidence practices that prove controls are working.

5 entries

1. 31 Security Code Review Review security-sensitive code by tracing input, authority, failure paths, tests, and evidence through the diff.
2. 32 Automated Security Testing Use automated security tests as owned signals with tuned gates, triage rules, suppressions, and evidence instead …
3. 33 Manual Testing, Penetration Testing, and Red Teaming Scope manual security testing so findings produce remediation, detection improvement, and risk decisions instead …
4. 34 Release Security Review and Production Readiness Define release gates, blockers, conditional approvals, evidence packages, and post-release validation for …
5. 35 Evidence, Assurance, and Audit Without Ceremony Produce security evidence from normal engineering systems so teams can prove controls without building …

Part 6

Part VI - Operate Securely

Production access, vulnerability management, configuration control, recovery operations, and alert handling for systems already in use.

6 entries

1. 36 Secure Production Access and Administration Control who can access production, for what purpose, for how long, with what monitoring and revocation evidence.
2. 37 Vulnerability Management and Patching Prioritize, remediate, verify, and report vulnerabilities by actual exposure and exploit path rather than raw …
3. 38 Configuration, Hardening, and Drift Management Keep production configuration secure by making baselines, changes, exceptions, and runtime drift observable and …
4. 39 Secure Backup, Restore, and Disaster Recovery Operations Make recovery from cyber incidents and operational failures measurable through protected backups, clean-room …
5. 40 Security Monitoring and Alert Operations Design, own, triage, tune, and retire security alerts through a measurable detection lifecycle.
6. 41 Secure Change Management and Operational Safety Classify operational changes by security risk, require the right review path, and verify safety after execution.

Part 7

Part VII - Defend and Recover

Threat-informed defense, detection engineering, incident coordination, playbooks, evidence handling, and recovery improvement.

6 entries

1. 42 Threat-Informed Defense Strategy Translate likely adversary behavior into measurable prevention, detection, response, recovery, and exercise …
2. 43 Detection Engineering Design, test, deploy, tune, and maintain detections as versioned security products tied to response decisions.
3. 44 Incident Response Operating Model Define incident roles, severity, evidence handling, communication cadence, and decision records before a crisis …
4. 45 Incident Playbooks Use scenario-specific response playbooks that preserve evidence, contain harm, validate recovery, and guide …
5. 46 Digital Forensics and Evidence Preservation Preserve security evidence during incidents without destroying the facts investigators need.
6. 47 Recovery, Eradication, and Lessons Learned Close incidents with validated recovery, removed attack paths, and engineering improvements that prevent …

Part 8

Part VIII - Domain Playbooks

Concentrated security playbooks for web, API, mobile, cloud-native, Kubernetes, AI, data, SaaS, OT, IoT, and enterprise environments.

10 entries

1. 48 Web Application Security Playbook Secure web applications by mapping browser-facing risks to controls, implementation rules, and tests.
2. 49 API Security Playbook Secure REST, GraphQL, gRPC, event-driven APIs, and webhooks with object authorization, schema validation, abuse …
3. 50 Mobile Application Security Playbook Secure mobile applications by treating the device as untrusted while protecting local data, sessions, API …
4. 51 Cloud-Native Service Playbook Ship cloud-native services through account boundaries, workload identity, exposure review, data controls, …
5. 52 Kubernetes Platform Playbook Secure Kubernetes by separating platform responsibilities from application workload duties across cluster …
6. 53 Data Platform and Analytics Playbook Secure data lakes, warehouses, pipelines, analytics tools, notebooks, and exports by controlling classification, …
7. 54 AI/ML and LLM Application Playbook Secure AI-enabled features by preserving authority across retrieval, model context, tool calls, outputs, …
8. 55 Enterprise SaaS and Third-Party Integration Playbook Secure SaaS and vendor integrations through inventory, data-flow review, least-privilege authentication, webhook …
9. 56 Corporate IT and Endpoint Playbook Control workforce identity, managed devices, email, browsers, collaboration tools, SaaS administration, …
10. 57 OT, IoT, and Embedded Systems Playbook Secure OT, IoT, and embedded systems by respecting safety constraints, device identity, secure boot, signed …

Part 9

Part IX - Templates, Matrices, and Appendices

Reusable security engineering templates, requirement catalogs, decision records, scenarios, evidence matrices, and visual guidance.

11 entries

1. 58 Normative Requirement Style Write security requirements that are specific, testable, scoped, and tied to evidence.
2. 59 Security Requirement Catalog Taxonomy Organize security requirements into stable domains that engineers can find, apply, test, and map to evidence.
3. 60 System Security Profile Template Create a compact system security profile that connects architecture, data, identity, controls, threats, …
4. 61 Threat Scenario Template Describe attacker paths in a form that connects threats to controls, verification, detection, response, …
5. 62 Security Architecture Decision Record Template Record security architecture decisions with threats, assumptions, options, controls, residual risk, evidence, …
6. 63 Security Exception Template Record security exceptions with ownership, risk analysis, compensating controls, detection, remediation, …
7. 64 Release Security Review Template Run a release security review that turns design, test, vulnerability, logging, recovery, and risk evidence into …
8. 65 Incident Timeline Template Build an incident timeline that preserves events, observations, evidence, uncertainty, actions, and the reasons …
9. 66 Detection Specification Template Turn a threat scenario into a maintained detection claim with dependable evidence, end-to-end tests, accountable …
10. 67 Control-to-Evidence Matrix Template Connect a scoped security requirement to its implementation, verification, operating evidence, ownership, …
11. 68 Illustration and Visual Design Guide Specify and review security engineering visuals that make decisions, boundaries, controls, evidence, and …