Appendix B — Further Reading

This is a route into primary guidance, not a list to memorise. Consult the source for the decision you are making. Standards, product behaviour and legal requirements can change; these links were selected in September 2026.

B.1 Foundations, identity and cryptography

The NIST Cybersecurity Framework organises outcomes and governance. ASD’s Essential Eight provides a different resource: mitigation strategies and maturity guidance. Neither removes the need to understand the organisation’s risks.

NIST SP 800-63B-4 distinguishes authenticators, password verifiers, recovery and sessions. OWASP’s password-storage guidance explains implementation choices. Read these when assessing a login design, rather than implementing a password store from a textbook sketch.

FIPS 186-5 covers digital signatures; TLS 1.3 shows authentication, key establishment and traffic protection as separate operations. They are references for checking explanations, not prerequisites for the paper exercises.

B.2 Software, networks and incidents

The CVE programme, CWE catalogue and CERT/CC disclosure guide help distinguish a vulnerability record, a recurring weakness and the process of coordinating disclosure.

OWASP’s access-control guidance and XSS prevention guidance expand the web chapter. Wireshark’s Ethernet capture guidance helps explain the limits of an observation point.

NIST SP 800-61 Rev. 3 connects incident response to risk management. CISA’s ransomware guide includes preparation, data theft and recovery. NIST’s contingency-planning resource supports recovery objectives and testing.

B.4 Learning beyond the book

The practice appendix explains the scope and safety checks for optional technical work. Incident Zero offers group practice. Its materials have their own licence; this book links them without incorporating them.

For the next security-track step, see Substantiate, Don’t Assume. For learning conversations, see Conversation, Not Delegation. Both are optional: the dossier is self-contained.