security-architecture

How to systematically secure anything: a repository about security engineering

📚【更新中】AISecOps: AI-Driven Enterprise Security｜AI 驱动的安全体系。一套将 AI 能力嵌入企业安全体系的方法论框架，以及支撑它落地的完整工程实践——从安全架构、GRC、云原生、数据隐私到 SOC 运营、身份治理与 AI 系统安全。开源中文技术专著，CC BY-NC-SA 4.0。/*⚡🌊🛡️*/

《数据安全架构设计与实战》：本书系统性地介绍数据安全架构的设计与实践，融入了作者多年在安全领域积累的实践经验。全书分四大部分，共20章。 第一部分介绍安全架构的基础知识，内容包括安全、数据安全、安全架构、5A方法论、CIA等基本概念,为后续论述奠定基础。 第二部分介绍产品安全架构，内容包括：身份认证、授权、访问控制、审计、资产保护等，讲解如何从源头设计来保障数据安全和隐私安全，防患于未然。 第三部分介绍安全技术体系架构，内容包括：安全技术架构、网络和通信层安全架构、设备和主机层安全架构、应用和数据层安全架构、安全架构案例分析等。 第四部分介绍数据安全与隐私保护治理，内容包括：数据安全治理、数据安全政策文件体系、隐私保护基础与增强技术、GRC治理框架、数据安全与隐私保护的统一等。

AITIR 2.0: evidence-grounded, authorized identity-threat response reference architecture.

Hack23 Public Information Security Management System:Security Through Transparency and Open Documentation Demonstrating Security Excellence Through Public ISMS Disclosure

Your internal mediocrity is the moment when you lost the faith of being excellent. Just do it.

Security architecture patterns and NIST 800-53 controls from opensecurityarchitecture.org

The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths.

Certified Cybersecurity Consultant (CCC) Program - A comprehensive 4-month, 320-hour training curriculum for experienced cybersecurity professionals. Developed by Aminu Idris, AMCPN | International Cybersecurity and Digital Forensics Academy (ICDFA)

A walkthrough of security controls for a serverless architecture via a demo application

Open security architecture for autonomous AI agents - extending Zero Trust principles

Excalidraw library for threat modeling diagrams

Notes and practice exam analysis I completed when preparing for my CompTIA Security+ exam

Common (and Advanced) Information Security Questions. Questions you should know the answer to for your information security career.

An attempt at creating a unifying Threat Model Definition Language using a declarative syntax with cuelang

Production-validated detection queries and hunting artifacts across 9 platforms (KQL, Sigma, Splunk, Athena, PowerShell, Velociraptor, YARA, Suricata, osquery). Each with triggers, false positives, tuning guidance, and validation steps.

Offline-first threat modeling and architecture diagram editor with AI-powered security analysis, MITRE ATT&CK/NIST mapping, local Ollama support, and integrated GRC attack-path workflows.

An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about The Open Group Architecture Framework (TOGAF) in Cybersecurity.

Pragmatic security operating model for engineering-driven organizations. Strategic docs, governance templates, and decision frameworks for Security Directors and Architects.