Further reading and authoritative references

Prefer primary sources when they conflict with blogs. Access dates: 2026-08.

Foundations and risk

• NIST Cybersecurity Framework 2.0
• NIST SP 800-30 Rev. 1 Risk assessment
• CISA Secure by Design
• NIST SSDF SP 800-218

Identity

• NIST SP 800-63-4 Digital Identity (supersedes 800-63-3)
• RFC 6749 OAuth 2.0
• OpenID Connect Core
• OWASP Authentication / Authorization cheat sheets

Application security

• OWASP Top 10:2025
• OWASP API Security Top 10:2023
• OWASP ASVS
• CWE

Cryptography

• OWASP Password Storage Cheat Sheet
• RFC 8446 TLS 1.3
• RFC 8725 JWT BCP
• NIST PQC project

Cloud / containers

• Kubernetes RBAC
• Kubernetes Pod Security
• CISA Kubernetes hardening guidance
• SLSA

ATT&CK and AI-related knowledge bases

• MITRE ATT&CK
• MITRE D3FEND
• MITRE ATLAS

Operations and IR

• NIST SP 800-61 Rev. 3
• CISA incident response
• FIRST
• FIRST TLP
• Sigma

AI / agentic (emerging; lists will change)

• OWASP GenAI LLM Top 10 2026 — canonical files: GenAI-LLM-Top10 (2026/final)
• OWASP Top 10 for Agentic Applications 2026
• NIST AI RMF

Course lab code

In-tree: labs/. Dummy credentials are not valid outside the lab.