A curated personal knowledge base of core cybersecurity concepts, industry frameworks, and real-world breach case studies — written and organized while studying for a transition from IT help desk support into cybersecurity.
This is: a set of personal study notes and reflections — rewritten, organized, and polished from earlier coursework and independent reading into standalone reference material. It reflects how I currently understand these topics and is meant to demonstrate active, self-directed learning and the ability to synthesize lessons from real security incidents.
This is not:
- Original security research or a novel contribution to the field.
- A record of professional incident response, penetration testing, or security consulting work.
- A certification study guide or exam-prep material.
- An exhaustive or authoritative reference — for anything cited here, the linked primary sources should be treated as authoritative, not this repository.
I'm sharing this publicly because I think showing how I think through security concepts and incidents is a more honest and useful signal, at this stage of my career, than claiming hands-on experience I don't yet have.
- Cyber Kill Chain — the Lockheed Martin attack-lifecycle model and stage-by-stage defenses.
- CIS Controls — applied scenario analysis mapping real failure patterns to specific CIS Controls.
- OWASP Top 10 — Secure Development Concepts — XSS and Broken Authentication explored through a hypothetical application-security scenario.
- Zero Trust — the "never trust, always verify" model, IAM fundamentals, and modern phishing-resistant authentication.
- Red Team vs. Blue Team — offensive vs. defensive security roles, and vulnerability assessments vs. penetration tests.
- Equifax (2017) — an unpatched Apache Struts vulnerability and the governance failures around it.
- Target (2013) — third-party vendor compromise, POS malware, and ignored security alerts.
- Uber MFA Bypass (2022) — MFA fatigue, social engineering, and the limits of push-based authentication.
- Cryptographic Failures — Heartbleed, Apple's "goto fail" bug, and the DROWN attack.
- Pen Test Scope and Authorization Lessons — a reflection on the Coalfire/Dallas County courthouse case and what it teaches about authorization chains in security testing.
- Security Monitoring During Mergers — a hypothetical scenario on integrating two organizations' security infrastructure during an M&A event.
- Botnets: A Defensive Overview — how botnets work conceptually and how to defend against them, framed strictly as educational/defensive content.
- Frameworks give structure to otherwise-overwhelming topics. The Kill Chain, CIS Controls, OWASP Top 10, and Zero Trust all show up repeatedly because they're the mental models I actually reach for when thinking through a new scenario.
- Most real breaches trace back to a small number of repeating root causes — unpatched known vulnerabilities, third-party/vendor access, ignored alerts, and social-engineering-assisted authentication bypass — rather than exotic, novel attack techniques.
- Governance and process failures are as consequential as technical ones. Several notes here (Equifax's patch process, Target's alert triage, the Coalfire authorization gap, and the M&A governance scenario) are really stories about process and communication breakdowns, not missing technology.
- Defensive framing, always. Every note in this repository is written from a defender's perspective — understanding how an attack or failure happened in order to build better detection, response, and hygiene practices, never as a how-to for causing harm.
- Applied understanding of major security frameworks (Cyber Kill Chain, CIS Controls, OWASP Top 10, Zero Trust)
- Breach root-cause analysis and critical reading of security incident reporting
- Comfort with core AppSec and authentication concepts (XSS, broken authentication, MFA bypass techniques, FIDO2)
- GRC/planning thinking applied to a realistic infrastructure-integration scenario
- Mature judgment about legal and ethical boundaries in security testing
- Clear, structured technical writing aimed at a non-specialist audience — a skill directly relevant to help desk and support work
If you're a recruiter or hiring manager skimming this repository, here's the fastest path through it:
- Start with the Cyber Kill Chain and Zero Trust notes for a sense of how I approach foundational frameworks.
- Read the Equifax and Uber MFA Bypass case studies for root-cause analysis style and citation practices.
- Read the Pen Test Scope and Authorization Lessons note for a sense of judgment and ethical reasoning — this is the note I'd point to first if asked "how do you think about risk and legal boundaries?"
- If you want a sense of GRC/planning thinking rather than pure technical analysis, read Security Monitoring During Mergers.
Every note ends with a Source note identifying what is personal analysis versus what is drawn from and attributed to external, publicly available sources. Where a source's exact statistics could not be independently re-verified at the time of writing, the note says so explicitly rather than repeating an unverified figure.
Case studies referencing real security incidents (Equifax, Target, Uber) are cross-checked against publicly available reporting and cite those sources inline. Where public sources reported differing exact figures (e.g., slightly different counts of affected records), this repository presents the commonly cited approximate figures rather than asserting a single unverifiable number. No statistics are fabricated, and no claim is presented as more precise or more certain than its underlying source supports.
This repository's original written content is licensed under the MIT License. See CONTRIBUTING.md for the curation policy this repository follows, and SECURITY.md for how to report an issue with this repository's content.