Summary

# Security track summary

You can now:

- Reason about threats using STRIDE / LINDDUN and trust boundaries
- Apply least-privilege IAM across cloud, identity, and apps
- Harden endpoints with EDR + Sysmon + tuned policies
- Build secure baselines (SCPs, NetworkPolicy, secure headers)
- Write detections tied to MITRE ATT&CK techniques
- Run a tabletop and an Atomic Red Team test in a lab
- Triage an incident through the NIST 800-61 lifecycle
- Participate in bug bounty + CVD ethically and professionally
- Differentiate sanctioned testing from criminal activity

Next steps:

- Pick one specialty (detection engineering, IR, cloud security, AppSec) and go deep
- Contribute to open-source defender tooling (Sigma rules, Sysmon configs, IR playbooks)
- Pair certifications with portfolio work; do not collect certs without applied projects
- Mentor someone starting out - teaching reveals gaps

Career mindset:

- Always authorised testing only; ethics outlast any role
- Document your work - your write-ups are your portfolio
- Stay humble in IR; the system you do not understand will surprise you
- Pair every offensive insight with a defensive recommendation

Recommended reading:

- Tanya Janca - 'Alice and Bob Learn Application Security'
- Lance Spitzner - SANS reading lists
- The DFIR Report's threat intel writeups
- Microsoft + AWS + GCP security best practice docs (live, free, updated)
- MITRE ATT&CK and the D3FEND knowledge bases

Final note on ethics:

- Test only systems you own or have written authorisation for
- Preserve evidence; protect privacy; reduce harm
- Report responsibly via coordinated disclosure
- The defender's job is to make the next attack harder

# Next: cloud red-team (AWS / Azure / GCP), AD attack paths, container escape, mobile / IoT depth.