Cybersecurity Month 2026 by O'Reilly

With their rapidly changing architecture and API-driven automation, cloud platforms come with unique security challenges and opportunities. This hands-on book guides you through security best practices for multivendor cloud environments, whether your company plans to move legacy on-premises projects to the cloud or build a new infrastructure from the ground up. Developers, IT architects, and security professionals will learn cloud-specific techniques for securing popular cloud platforms such as Amazon Web Services, Microsoft Azure, and IBM Cloud. Chris Dotson—an IBM senior technical staff member—shows you how to establish data asset management, identity and access management, vulnerability management, network security, and incident response in your cloud environment.

If you hope to outmaneuver threat actors, speed and efficiency need to be key components of your cybersecurity operations. Mastery of the standard command-line interface (CLI) is an invaluable skill in times of crisis because no other software application can match the CLI’s availability, flexibility, and agility. This practical guide shows you how to use the CLI with the bash shell to perform tasks such as data collection and analysis, intrusion detection, reverse engineering, and administration. Authors Paul Troncone, founder of Digadel Corporation, and Carl Albing, coauthor of bash Cookbook (O’Reilly), provide insight into command-line tools and techniques to help defensive operators collect data, analyze logs, and monitor networks. Penetration testers will learn how to leverage the enormous amount of functionality built into nearly every version of Linux to enable offensive operations. In four parts, security practitioners, administrators, and students will examine: Foundations: Principles of defense and offense, command-line and bash basics, and regular expressions Defensive security operations: Data collection and analysis, real-time log monitoring, and malware analysis Penetration testing: Script obfuscation and tools for command-line fuzzing and remote access Security administration: Users, groups, and permissions; device and software inventory

As the deployment of AI technologies surges, the need to safeguard privacy and security in the use of large language models (LLMs) is more crucial than ever. Professionals face the challenge of leveraging the immense power of LLMs for personalized applications while ensuring stringent data privacy and security. The stakes are high, as privacy breaches and data leaks can lead to significant reputational and financial repercussions. This book serves as a much-needed guide to addressing these pressing concerns. Dr. Baihan Lin offers a comprehensive exploration of privacy-preserving and security techniques like differential privacy, federated learning, and homomorphic encryption, applied specifically to LLMs. With its hands-on code examples, real-world case studies, and robust fine-tuning methodologies in domain-specific applications, this book is a vital resource for developing secure, ethical, and personalized AI solutions in today's privacy-conscious landscape. By reading this book, you'll: Discover privacy-preserving techniques for LLMs Learn secure fine-tuning methodologies for personalizing LLMs Understand secure deployment strategies and protection against attacks Explore ethical considerations like bias and transparency Gain insights from real-world case studies across healthcare, finance, and more

As cyberthreats grow and infrastructure evolves, organizations must prioritize effective, dynamic, and adaptable incident response. Following the success of the original edition, Blue Team Handbook: Incident Response has been updated to reflect today's evolving cybersecurity landscape. This trusted and widely used field guide for cybersecurity incident responders, SOC analysts, and defensive security professionals distills incident response essentials into a concise, field-ready format. Author Don Murdoch draws on decades of real-world experience in incident response and cybersecurity operations to provide actionable guidance and sample workflows you can immediately apply in your own work. Whether you're investigating an alert, analyzing suspicious traffic, or strengthening your organization's IR capability, you'll find this field-tested edition an essential resource for hands-on practitioners. Understand how modern adversaries operate and recognize common indicators of compromise in networks Analyze network traffic with common tools to identify and investigate suspicious activity Execute structured incident response procedures and follow a clear response plan Conduct basic forensic analysis on both Windows and Linux systems Use proven methodologies and tools to carry out effective, dynamic incident response

With AI in the hands of cybercriminals, traditional security controls and response mechanisms are swiftly moving toward obsolescence. Intelligent Continuous Security (ICS) helps organizations stay toe-to-toe with adversaries, replacing outmoded defenses with a cohesive strategy that unifies security across the entire software lifecycle. Author Marc Hornbeek outlines the principles, strategies, and real-world implementations of ICS, including how to break down silos between DevSecOps and SecOps, how to measure and optimize security effectiveness, and how AI can transform everything from security operations to regulatory compliance. Security professionals, DevOps engineers, IT leaders, and decision-makers will learn how to move toward adaptive, self-healing defenses to keep pace with emerging risks. Align security strategies with organizational goals Implement AI-assisted Continuous Security across teams Select and integrate AI-powered tools for vulnerability detection, automated compliance checks, and real-time incident response Transition from reactive to proactive security to continuously adapt to emerging threats Apply best practices to mitigate risks and avoid breaches

What people are saying about Inside Cyber Warfare "The necessary handbook for the 21st century." --Lewis Shepherd, Chief Tech Officer and Senior Fellow, Microsoft Institute for Advanced Technology in Governments "A must-read for policy makers and leaders who need to understand the big-picture landscape of cyber war." --Jim Stogdill, CTO, Mission Services Accenture You may have heard about "cyber warfare" in the news, but do you really know what it is? This book provides fascinating and disturbing details on how nations, groups, and individuals throughout the world are using the Internet as an attack platform to gain military, political, and economic advantages over their adversaries. You'll learn how sophisticated hackers working on behalf of states or organized crime patiently play a high-stakes game that could target anyone, regardless of affiliation or nationality. Inside Cyber Warfare goes beyond the headlines of attention-grabbing DDoS attacks and takes a deep look inside multiple cyber-conflicts that occurred from 2002 through summer 2009. Learn how cyber attacks are waged in open conflicts, including recent hostilities between Russia and Georgia, and Israel and Palestine Discover why Twitter, Facebook, LiveJournal, Vkontakte, and other sites on the social web are mined by the intelligence services of many nations Read about China's commitment to penetrate the networks of its technologically superior adversaries as a matter of national survival Find out why many attacks originate from servers in the United States, and who's responsible Learn how hackers are "weaponizing" malware to attack vulnerabilities at the application level

Despite the increase of high-profile hacks, record-breaking data leaks, and ransomware attacks, many organizations don’t have the budget to establish or outsource an information security (InfoSec) program, forcing them to learn on the job. For companies obliged to improvise, this pragmatic guide provides a security-101 handbook with steps, tools, processes, and ideas to help you drive maximum-security improvement at little or no cost. Each chapter in this book provides step-by-step instructions for dealing with a specific issue, including breaches and disasters, compliance, network infrastructure and password management, vulnerability scanning, and penetration testing, among others. Network engineers, system administrators, and security professionals will learn tools and techniques to help improve security in sensible, manageable chunks. Learn fundamentals of starting or redesigning an InfoSec program Create a base set of policies, standards, and procedures Plan and design incident response, disaster recovery, compliance, and physical security Bolster Microsoft and Unix systems, network infrastructure, and password management Use segmentation practices and designs to compartmentalize your network Explore automated process and tools for vulnerability management Securely develop code to reduce exploitable errors Understand basic penetration testing concepts through purple teaming Delve into IDS, IPS, SOC, logging, and monitoring

As the transformation to hybrid multicloud accelerates, businesses require a structured approach to securing their workloads. Adopting zero trust principles demands a systematic set of practices to deliver secure solutions. Regulated businesses, in particular, demand rigor in the architectural process to ensure the effectiveness of security controls and continued protection. This book provides the first comprehensive method for hybrid multicloud security, integrating proven architectural techniques to deliver a comprehensive end-to-end security method with compliance, threat modeling, and zero trust practices. This method ensures repeatability and consistency in the development of secure solution architectures. Architects will learn how to effectively identify threats and implement countermeasures through a combination of techniques, work products, and a demonstrative case study to reinforce learning. You'll examine: The importance of developing a solution architecture that integrates security for clear communication Roles that security architects perform and how the techniques relate to nonsecurity subject matter experts How security solution architecture is related to design thinking, enterprise security architecture, and engineering How architects can integrate security into a solution architecture for applications and infrastructure using a consistent end-to-end set of practices How to apply architectural thinking to the development of new security solutions About the authors Mark Buckwell is a cloud security architect at IBM with 30 years of information security experience. Carsten Horst with more than 20 years of experience in Cybersecurity is a certified security architect and Associate Partner at IBM. Stefaan Van daele has 25 years experience in Cybersecurity and is a Level 3 certified security architect at IBM.

Large language models (LLMs) are not just shaping the trajectory of AI, they're also unveiling a new era of security challenges. This practical book takes you straight to the heart of these threats. Author Steve Wilson, chief product officer at Exabeam, focuses exclusively on LLMs, eschewing generalized AI security to delve into the unique characteristics and vulnerabilities inherent in these models. Complete with collective wisdom gained from the creation of the OWASP Top 10 for LLMs list—a feat accomplished by more than 400 industry experts—this guide delivers real-world guidance and practical strategies to help developers and security teams grapple with the realities of LLM applications. Whether you're architecting a new application or adding AI features to an existing one, this book is your go-to resource for mastering the security landscape of the next frontier in AI. You'll learn: Why LLMs present unique security challenges How to navigate the many risk conditions associated with using LLM technology The threat landscape pertaining to LLMs and the critical trust boundaries that must be maintained How to identify the top risks and vulnerabilities associated with LLMs Methods for deploying defenses to protect against attacks on top vulnerabilities Ways to actively manage critical trust boundaries on your systems to ensure secure execution and risk minimization

DevOps engineers, developers, and security engineers have ever-changing roles to play in today's cloud native world. In order to build secure and resilient applications, you have to be equipped with security knowledge. Enter security as code. In this book, authors BK Sarthak Das and Virginia Chu demonstrate how to use this methodology to secure any application and infrastructure you want to deploy. With Security as Code, you'll learn how to create a secure containerized application with Kubernetes using CI/CD tooling from AWS and open source providers. This practical book also provides common patterns and methods to securely develop infrastructure for resilient and highly available backups that you can restore with just minimal manual intervention. Learn the tools of the trade, using Kubernetes and the AWS Code Suite Set up infrastructure as code and run scans to detect misconfigured resources in your code Create secure logging patterns with CloudWatch and other tools Restrict system access to authorized users with role-based access control (RBAC) Inject faults to test the resiliency of your application with AWS Fault Injector or open source tooling Learn how to pull everything together into one deployment

With the rise of the cloud, every aspect of IT has been shaken to its core. The fundamentals for building systems are changing, and although many of the principles that underpin security still ring true, their implementation has become unrecognizable. This practical book provides recipes for AWS, Azure, and GCP to help you enhance the security of your own cloud native systems. Based on his hard-earned experience working with some of the world's biggest enterprises and rapidly iterating startups, consultant Josh Armitage covers the trade-offs that security professionals, developers, and infrastructure gurus need to make when working with different cloud providers. Each recipe discusses these inherent compromises, as well as where clouds have similarities and where they're fundamentally different. Learn how the cloud provides security superior to what was achievable in an on-premises world Understand the principles and mental models that enable you to make optimal trade-offs as part of your solution Learn how to implement existing solutions that are robust and secure, and devise design solutions to new and interesting problems Deal with security challenges and solutions both horizontally and vertically within your business

Serverless computing now serves as a strategic backbone of modern cloud architectures, helping teams move faster and operate at scale. However, many still struggle to understand the security model of serverless computing. As more organizations migrate critical systems and sensitive data to the cloud using serverless architectures, this gap in serverless security knowledge increasingly exposes them to serious security incidents and data breaches. This practical guide covers offensive and defensive security techniques to audit and secure serverless applications running on AWS, Azure, and Google Cloud. You'll explore how to attack and defend vulnerable serverless applications using step-by-step instructions. By the end of this book, you'll understand how to prevent various serverless application attacks and privilege escalation techniques. Author Joshua Arvin Lat, chief technology officer at NuWorks Interactive Labs and an AWS AI Hero, shows you how to: Identify and address vulnerabilities within modern serverless applications Dive deeper into serverless security risks and threats Explore privilege escalation techniques in vulnerable-by-design serverless lab environments Configure authentication and identity services properly on AWS, Azure, and Google Cloud Implement security strategies and best practices to prevent serverless application attacks Audit serverless function code using security tools and strategies

This practical book provides a detailed explanation of the zero trust security model. Zero trust is a security paradigm shift that eliminates the concept of traditional perimeter-based security and requires you to "always assume breach" and "never trust but always verify." The updated edition offers more scenarios, real-world examples, and in-depth explanations of key concepts to help you fully comprehend the zero trust security architecture. Examine fundamental concepts of zero trust security model, including trust engine, policy engine, and context aware agents Understand how this model embeds security within the system's operation, with guided scenarios at the end of each chapter Migrate from a perimeter-based network to a zero trust network in production Explore case studies that provide insights into organizations' zero trust journeys Learn about the various zero trust architectures, standards, and frameworks developed by NIST, CISA, DoD, and others

Are you an experienced cloud security professional looking to upskill or take your career to the next level? There's a growing demand for cloud security practitioners, and the Certified Cloud Security Professional (CCSP) exam provides a vendor-agnostic framework for exploring the breadth of topics a cloud security professional should understand. Industry expert Ric Messier uses the CCSP as a guide to lay out all the domains a certification candidate should learn to successfully prepare for the exam. Using clear and engaging explanations of essential concepts, this comprehensive and empowering book will help you to ably meet the challenges of certification—or simply boost your skills for the workplace. Uncover different approaches to cloud security architectures Understand risk management and compliance with cloud environments Learn essential security controls for cloud platforms and infrastructure Discover emerging trends including zero trust architecture

In the first edition of this critically acclaimed book, Andrew Hoffman defined the three pillars of application security: reconnaissance, offense, and defense. In this revised and updated second edition, he examines dozens of related topics, from the latest types of attacks and mitigations to threat modeling, the secure software development lifecycle (SSDL/SDLC), and more. Hoffman, senior staff security engineer at Ripple, also provides information regarding exploits and mitigations for several additional web application technologies such as GraphQL, cloud-based deployments, content delivery networks (CDN) and server-side rendering (SSR). Following the curriculum from the first book, this second edition is split into three distinct pillars comprising three separate skill sets: Pillar 1: Recon--Learn techniques for mapping and documenting web applications remotely, including procedures for working with web applications Pillar 2: Offense--Explore methods for attacking web applications using a number of highly effective exploits that have been proven by the best hackers in the world. These skills are valuable when used alongside the skills from Pillar 3. Pillar 3: Defense--Build on skills acquired in the first two parts to construct effective and long-lived mitigations for each of the attacks described in Pillar 2.

Maintaining secrets, credentials, and nonhuman identities in secure ways is an important, though often overlooked, aspect of secure software development. Cloud migration and digital transformation have led to an explosion of nonhuman identities—like automation scripts, cloud native apps, and DevOps tools—that need to be secured across multiple cloud and hybrid environments. DevOps security often addresses vulnerability scanning, but it neglects broader discussions like authentication, authorization, and access control, potentially leaving the door open for breaches. That's where an identity security strategy focused on secrets management can help. In this practical book, authors John Walsh and Uzi Ailon provide conceptual frameworks, technology overviews, and practical code snippets to help DevSecOps engineers, cybersecurity engineers, security managers, and software developers address use cases across CI/CD pipelines, Kubernetes and cloud native, hybrid and multicloud, automation/RPA, IOT/OT, and more. You'll learn: The fundamentals of authentication, authorization, access control, and secrets management What developers need to know about managing secrets and identity to build safer apps What nonhuman identities, secrets, and credentials are—and how to secure them How developers work with their cross-function peers to build safer apps How identity security fits into modern software development practices

Trillions of lines of code help us in our lives, companies, and organizations. But just a single software cybersecurity vulnerability can stop entire companies from doing business and cause billions of dollars in revenue loss and business recovery. Securing the creation and deployment of software, also known as software supply chain security, goes well beyond the software development process. This practical book gives you a comprehensive look at security risks and identifies the practical controls you need to incorporate into your end-to-end software supply chain. Author Cassie Crossley demonstrates how and why everyone involved in the supply chain needs to participate if your organization is to improve the security posture of its software, firmware, and hardware. With this book, you'll learn how to: Pinpoint the cybersecurity risks in each part of your organization's software supply chain Identify the roles that participate in the supply chain—including IT, development, operations, manufacturing, and procurement Design initiatives and controls for each part of the supply chain using existing frameworks and references Implement secure development lifecycle, source code security, software build management, and software transparency practices Evaluate third-party risk in your supply chain