Bridgham home
Reference Library

Cybersecurity

Standards, frameworks, and research.

MediaResearch
Media

Podcasts and Talks

Podcasts

History and Foundational Talks

  1. "The History of Hacking" - DEF CON Documentary - DEF CON Conference
  2. "The Morris Worm: The First Major Internet Attack" - Computer History Museum - CHM
  3. "Kevin Mitnick: The Art of Deception" - RSA Conference - RSA
  4. "How Stuxnet Changed Cybersecurity Forever" - ColdFusion - ColdFusion
  5. "The ARPANET and Early Network Security" - Computer History Museum - CHM
  6. "Evolution of Malware: From Viruses to Ransomware" - Black Hat - Black Hat
  7. "Orange Book to Common Criteria: History of Security Evaluation" - IEEE - IEEE Security
  8. "The First Cyberwars: Estonia 2007" - DW Documentary - DW Documentary
  9. "Kevin Poulsen: The Hacker Who Hacked the Lottery" - Darknet Diaries Podcast - Jack Rhysider
  10. "Clifford Stoll: The Cuckoo's Egg Story" - TED Talk - TED

Major Incidents and Case Studies

  1. "Target Breach: Anatomy of a Hack" - 60 Minutes - CBS
  2. "Equifax: The Worst Data Breach in History" - CNBC - CNBC
  3. "SolarWinds: Supply Chain Attack Explained" - SANS Institute - SANS
  4. "WannaCry: How a Ransomware Attack Went Global" - Vox - Vox
  5. "NotPetya: The Costliest Cyberattack in History" - Darknet Diaries - Jack Rhysider
  6. "The Shadow Brokers and the NSA Leak" - Vice Motherboard - VICE
  7. "Heartbleed: The Internet's Worst Security Bug" - Computerphile - Computerphile
  8. "Meltdown and Spectre: CPU Vulnerabilities Explained" - Google Tech Talks - Google
  9. "Log4Shell: The Security Flaw That Broke the Internet" - LiveOverflow - LiveOverflow
  10. "Colonial Pipeline: Ransomware Takes Down Critical Infrastructure" - NBC News - NBC

DEF CON and Black Hat Classics

  1. "This is How They Tell Me the World Ends" - Nicole Perlroth - RSA Conference - RSA
  2. "The Untold Story of NotPetya" - Andy Greenberg - WIRED Event - WIRED
  3. "Hacking All The Cars" - DEF CON 23 - DEF CON - DEF CON
  4. "How to Hack a Satellite" - DEF CON 28 - DEF CON - DEF CON
  5. "Medical Device Security: A Complete Disaster" - Black Hat - Black Hat - Black Hat
  6. "Your $1000 Smartphone is Now $0" - Black Hat - Black Hat - Black Hat
  7. "The Internet of Unpatchable Things" - DEF CON - DEF CON - DEF CON
  8. "Hacking Democracy: Election Security" - DEF CON Voting Village - DEF CON - DEF CON
  9. "Breaking HTTPS in the 21st Century" - Black Hat - Black Hat - Black Hat
  10. "SCADA Security: Hacking Industrial Control Systems" - S4 Conference - S4x - S4 Events

Future Challenges and Trends

  1. "The Future of Cybersecurity: AI vs AI" - MIT CSAIL - MIT
  2. "Quantum Computing: The End of Encryption?" - World Economic Forum - WEF
  3. "Zero Trust Architecture: The Future of Security" - NIST - NIST
  4. "Securing the IoT: An Impossible Task?" - IEEE - IEEE
  5. "Deepfakes and Disinformation Warfare" - Council on Foreign Relations - CFR
  6. "5G Security: New Network, New Threats" - Mobile World Congress - GSMA
  7. "The Weaponization of AI in Cybersecurity" - RSA Conference - RSA
  8. "Supply Chain Security: The Invisible Threat" - CISA - CISA
  9. "Ransomware 2025: Where Are We Heading?" - Recorded Future - Recorded Future
  10. "Cloud Security: Shared Responsibility Model Failures" - AWS re:Inforce - AWS

Industry Perspectives and Panels

  1. "Trump's Unhackable Phone" - Veritasium - Veritasium
  2. "The NSA's Cybersecurity Mission" - Intelligence Squared - Intelligence Squared
  3. "Bug Bounties: Changing the Security Industry" - HackerOne - HackerOne
  4. "Red Team vs Blue Team: The Eternal War" - SANS Institute - SANS
  5. "The Economics of Cybercrime" - Freakonomics - Freakonomics Radio
  6. "State-Sponsored Hacking: The New Normal" - Aspen Security Forum - Aspen Institute
  7. "The CISO's Dilemma: Security vs Business" - Gartner - Gartner
  8. "Cybersecurity Skills Gap: A Crisis?" - (ISC)² - (ISC)²
  9. "The Dark Web: Myths and Reality" - Vice - VICE
  10. "From Hacker to CISO: Career Journeys" - RSA Conference - RSA
Research

Foundational Papers and Standards

1980s - Early Security Foundations

  1. Orange Book (TCSEC) - Trusted Computer System Evaluation Criteria, foundational computer security evaluation standard - DoD/NSA (1985)
  2. Red Book (TNI) - Trusted Network Interpretation, network security criteria - NCSC (1987)
  3. ISO 7498-2 - OSI Security Architecture, security framework for network protocols - ISO (1989)
  4. Computer Security Act - Federal computer security standards requirement - U.S. Congress (1987)
  5. Morris Worm Analysis - First major internet worm technical analysis - CERT/CC (1988)
  6. TEMPEST Standards (NSTISSAM) - Electromagnetic emanation security - NSA (1980s)

1990s - Internet Security Era

  1. Common Criteria v1.0 - International IT security evaluation standard - ISO/IEC 15408 (1999)
  2. BS 7799 - Information security management (predecessor to ISO 27001) - BSI (1995)
  3. ITSEC - Information Technology Security Evaluation Criteria - EU (1991)
  4. RFC 1244: Site Security Handbook - Network security best practices - IETF (1991)
  5. GAO FISCAM - Federal Information System Controls Audit Manual - GAO (1999)
  6. COBIT 1.0 - Control Objectives for Information Technology - ISACA (1996)
  7. Rainbow Series - Complete DoD computer security standards collection - NSA (1990s)
  8. ISO/IEC 13335 - IT Security Management Guidelines - ISO (1996)
  9. OCTAVE - Operationally Critical Threat, Asset, and Vulnerability Evaluation - SEI/CMU (1999)
  10. Common Vulnerabilities and Exposures (CVE) - Standardized vulnerability naming - MITRE (1999)

2000-2005 - Compliance and Standards

  1. ISO/IEC 27001:2005 - Information Security Management Systems - ISO (2005)
  2. ISO/IEC 27002:2005 - Information security controls - ISO (2005)
  3. NIST SP 800-53 Rev 1 - Security controls for federal systems - NIST (2005)
  4. NIST SP 800-30 - Risk Management Guide - NIST (2002)
  5. NIST SP 800-37 - Risk Management Framework - NIST (2004)
  6. COBIT 3.0 - Enhanced IT governance framework - ISACA (2000)
  7. HIPAA Security Rule - Healthcare information security standards - HHS (2003)
  8. Sarbanes-Oxley (SOX) IT Controls - Financial systems security - SEC (2002)
  9. PCI DSS v1.0 - Payment card data security standard - PCI SSC (2004)
  10. FISMA Implementation - Federal information security framework - OMB (2002)
  11. ISO/IEC 21827 (SSE-CMM) - Systems Security Engineering Capability Maturity Model - ISO (2002)
  12. OWASP Top 10 (First Edition) - Web application security risks - OWASP (2003)
  13. CIS Controls v1 - Critical security controls - CIS (2004)
  14. ITIL v2 Security Management - IT service security - OGC (2000)

2006-2010 - Framework Maturity

  1. NIST Cybersecurity Framework Draft - Risk-based security framework development - NIST (2010)
  2. ISO/IEC 27005:2008 - Information security risk management - ISO (2008)
  3. NIST SP 800-53 Rev 3 - Updated security controls - NIST (2009)
  4. COBIT 4.1 - IT governance maturity - ISACA (2007)
  5. PCI DSS v1.2 - Enhanced payment security - PCI SSC (2008)
  6. NERC CIP v1-v3 - Critical infrastructure protection for energy - NERC (2006-2010)
  7. FedRAMP Initial Guidance - Cloud security for federal agencies - GSA (2010)
  8. ISO/IEC 27006 - Accreditation requirements for certification bodies - ISO (2007)
  9. NIST SP 800-115 - Technical security testing guide - NIST (2008)
  10. NIST SP 800-137 - Continuous monitoring guide - NIST (2011)
  11. SANS Top 20 Critical Controls - Essential cybersecurity controls - SANS (2009)
  12. Cloud Security Alliance CCM v1 - Cloud controls matrix - CSA (2010)
  13. ENISA Cloud Security Guide - European cloud security - ENISA (2009)
  14. ISO/IEC 27799 - Health informatics security - ISO (2008)

2011-2015 - Cloud and Mobile Era

  1. NIST Cybersecurity Framework v1.0 - Risk management framework for critical infrastructure - NIST (2014)
  2. ISO/IEC 27001:2013 - Updated ISMS standard - ISO (2013)
  3. ISO/IEC 27017 - Cloud security controls - ISO (2015)
  4. ISO/IEC 27018 - Cloud privacy protection - ISO (2014)
  5. NIST SP 800-53 Rev 4 - Comprehensive security controls update - NIST (2013)
  6. COBIT 5 - Integrated IT governance - ISACA (2012)
  7. PCI DSS v3.0 - Major payment security revision - PCI SSC (2013)
  8. FedRAMP Authorization - Operational cloud security program - GSA (2012)
  9. NIST SP 800-171 - Protecting CUI in nonfederal systems - NIST (2015)
  10. CIS Controls v6 - Updated critical security controls - CIS (2015)
  11. NIST Privacy Framework Draft - Privacy risk management - NIST (2015)
  12. ISO/IEC 27032 - Cybersecurity guidelines - ISO (2012)
  13. NIST Cloud Computing Standards - SP 800-145, 500-291, 500-292 - NIST (2011)
  14. IEC 62443 - Industrial automation and control systems security - IEC (2013)
  15. NERC CIP v5 - Enhanced critical infrastructure protection - NERC (2013)
  16. OWASP Mobile Top 10 - Mobile application security risks - OWASP (2014)
  17. NIST Big Data Security and Privacy - SP 1500 series - NIST (2015)
  18. ISO/IEC 29100 - Privacy framework - ISO (2011)
  19. GDPR Preparatory Guidelines - EU data protection - EU (2015)

2016-2020 - Modern Security

  1. NIST Cybersecurity Framework v1.1 - Updated framework with authentication, self-assessment - NIST (2018)
  2. GDPR (Final) - General Data Protection Regulation - EU (2018)
  3. ISO/IEC 27701 - Privacy Information Management System - ISO (2019)
  4. NIST SP 800-53 Rev 5 - Major security controls overhaul - NIST (2020)
  5. NIST Privacy Framework v1.0 - Privacy risk management framework - NIST (2020)
  6. CIS Controls v7 - Streamlined critical controls - CIS (2016)
  7. CIS Controls v8 - Cloud and mobile integrated controls - CIS (2021)
  8. NIST SP 800-207 - Zero Trust Architecture - NIST (2020)
  9. NIST SP 800-63-3 - Digital Identity Guidelines - NIST (2017)
  10. PCI DSS v3.2.1 - Payment security refinement - PCI SSC (2018)
  11. CCPA - California Consumer Privacy Act guidelines - California AG (2019)
  12. ISO/IEC 27001:2022 - Latest ISMS standard - ISO (2022)
  13. MITRE ATT&CK Framework - Adversary tactics and techniques - MITRE (2018)
  14. NIST AI Risk Management Framework (Draft) - AI security and trustworthiness - NIST (2020)
  15. CMMC v1.0 - Cybersecurity Maturity Model Certification - DoD (2020)
  16. ISO/IEC 27005:2018 - Updated risk management - ISO (2018)
  17. ENISA Threat Landscape - Annual European threat analysis - ENISA (2016-2020)
  18. NIST IoT Cybersecurity - SP 800-213, NISTIR 8259 series - NIST (2019-2020)
  19. Cloud Security Alliance STAR - Security, Trust, Assurance and Risk program - CSA (2016)
  20. OWASP Top 10 2017 - Updated web vulnerabilities - OWASP (2017)
  21. NIST Secure Software Development Framework (SSDF) - SP 800-218 - NIST (2020)

2021-2025 - Current Active Resources

  1. NIST Cybersecurity Framework v2.0 - Expanded framework with governance focus - NIST (2024)
  2. CMMC v2.0 - Streamlined defense contractor security - DoD (2021)
  3. NIST AI Risk Management Framework v1.0 - AI trustworthiness framework - NIST (2023)
  4. ISO/IEC 27002:2022 - Modernized information security controls - ISO (2022)
  5. PCI DSS v4.0 - Major payment security update with customization - PCI SSC (2022)
  6. Executive Order 14028 Implementation - Improving the Nation's Cybersecurity - White House (2021)
  7. NIST Post-Quantum Cryptography Standards - SP 800-208, FIPS 203-205 - NIST (2024)
  8. SEC Cybersecurity Disclosure Rules - Public company incident reporting - SEC (2023)
  9. EU NIS2 Directive - Network and Information Security Directive 2 - EU (2023)
  10. DORA - Digital Operational Resilience Act - EU (2023)
  11. NIST SP 800-53B - Control baselines for information systems - NIST (2024)
  12. CISA Known Exploited Vulnerabilities (KEV) Catalog - Active threat database - CISA (2021-present)
  13. NIST SP 800-161 Rev 1 - Cybersecurity supply chain risk management - NIST (2022)
  14. ISO/IEC 42001 - AI management system - ISO (2023)
  15. OWASP Top 10 2021 - Current web security risks - OWASP (2021)
  16. OWASP API Security Top 10 - API-specific vulnerabilities - OWASP (2023)
  17. NIST Quantum-Resistant Cryptography - Post-quantum migration guidance - NIST (2024)
  18. MITRE ATT&CK v14 - Latest adversary framework - MITRE (2024)
  19. CISA Zero Trust Maturity Model v2 - Federal zero trust guidance - CISA (2023)
  20. NSA Cybersecurity Advisories - Ongoing threat intelligence - NSA (2021-2025)
  21. ENISA Threat Landscape 2024 - Current European threat analysis - ENISA (2024)

Endpoint Security and User Guides (Active 2025)

  1. Microsoft Security Baselines - Windows/Office security configurations - Microsoft
  2. CIS Benchmarks (All Platforms) - Hardening guides for OS, databases, cloud - CIS
  3. NIST SP 800-70 Rev 4 - Security configuration checklists - NIST
  4. Apple Platform Security Guide - iOS, macOS, iPadOS security - Apple
  5. Google Android Enterprise Security - Mobile device security - Google
  6. DISA STIGs - Security Technical Implementation Guides for endpoints - DISA
  7. NSA/CISA Kubernetes Hardening Guide - Container security - NSA/CISA
  8. SANS Securing Windows - Windows endpoint hardening - SANS
  9. Linux Security Hardening (CIS/DISA) - Linux endpoint security - CIS/DISA
  10. AWS Security Best Practices - Cloud endpoint security - AWS
  11. Azure Security Baseline - Cloud security controls - Microsoft
  12. GCP Security Best Practices - Google Cloud security - Google
  13. Endpoint Detection and Response (EDR) Buyer's Guide - EDR selection criteria - Gartner/NIST
  14. NIST SP 800-167 - Guide to Application Whitelisting - NIST
  15. NIST SP 800-124 Rev 2 - Guidelines for Mobile Device Management - NIST
  16. SANS Top 25 Software Errors - Common coding vulnerabilities - SANS/CWE
  17. Verizon Data Breach Investigations Report (DBIR) 2024 - Annual breach analysis - Verizon
  18. Mandiant M-Trends 2024 - Threat intelligence report - Mandiant/Google
  19. Crowdstrike Global Threat Report 2024 - Annual threat landscape - Crowdstrike
  20. CISA Cybersecurity Performance Goals (CPGs) - Baseline security practices - CISA
  21. NIST Cybersecurity Guide - Security resources for businesses - NIST
  22. FTC Safeguards Rule - Financial institution security - FTC (2023)
  23. HIPAA Security Guidance - Healthcare security implementation - HHS/OCR
  24. PCI Secure Software Standard - Secure development lifecycle - PCI SSC
  25. OWASP Software Assurance Maturity Model (SAMM) - Secure development framework - OWASP

Key Resource Repositories

Request an Introduction