Reference
Cybersecurity Wiki
In-depth articles on cybersecurity topics.
Articles
Identity & Access Management
Access Control models: DAC, MAC, RBAC, ABAC and Zero Trust
Access control models DAC, MAC, RBAC and ABAC explained, plus how Zero Trust hardens your systems against unauthorized access.
Offensive Security
Active Directory Attacks: Kerberoasting, Golden Ticket
Learn the most common Active Directory attack techniques - Kerberoasting, Pass-the-Hash, Golden Ticket - and how to defend your Windows infrastructure.
Windows Security
Active Directory Domain Controller: Architecture and Hardening
Secure your Active Directory domain controller: understand the architecture, Kerberos, group policies, hardening measures and attack vectors.
Anwendungssicherheit
API Security: OWASP API Top 10, Authentication and Best Practices
API Security guide: OWASP API Top 10 (2023), authentication (API Keys, JWT, OAuth 2.0, mTLS), REST/GraphQL testing, Burp, Postman, jwt_tool.
Endpoint Security
Application Allowlisting: Windows Defender Application Control Guide
Application allowlisting with WDAC and AppLocker: create policies, block malware, integrate into CI/CD, and migrate from deny-all environments.
Anwendungssicherheit
Application Security Testing (AST): SAST, DAST, IAST and SCA
Application security testing with SAST, DAST, IAST and SCA: compare methods, see how each finds vulnerabilities, and pick tools that fit your CI/CD.
Security Operations
Attack Surface Management: Know and Reduce Your External Exposure
Attack Surface Management (ASM) is the ongoing process of discovering, assessing, and monitoring all of an organization’s externally accessible assets.
Business Continuity
Backup and disaster recovery: ransomware-proof data backup
A ransomware-proof data backup and disaster recovery approach protects business data from ransomware, deletion, and data loss.
Netzwerksicherheit
Bluetooth Security: Attacks and Protective Measures
Security considerations for wireless Bluetooth connections. Bluetooth attacks such as BlueBorne, BIAS, and BLUFFS enable data extraction and device control w...
Compliance & Standards
BSI IT-Grundschutz: Framework and Implementation
The BSI IT-Grundschutz is a framework developed by the Federal Office for Information Security that provides companies and government agencies with a systematic methodology for implementing information security - featuring highly detailed, practical components.
Schwachstellenklassen
Buffer Overflow - Stack and Heap Overflow Explained
A buffer overflow occurs when a program writes more data to a buffer than it can hold, causing adjacent memory areas to be overwritten. Buffer overflows enab...
Risikomanagement
Business continuity management (BCM): making companies crisis-proof
Business Continuity Management (BCM) is the organizational framework for maintaining critical business processes during and after crises.
PKI & Kryptographie
Certificate Transparency (CT) - Public Certificate Audit Log
Certificate Transparency (RFC 6962) is an open framework that records all issued TLS certificates in publicly verifiable, append-only logs. It was developed ...
Compliance & Governance
Cloud compliance: SOC 2, ISO 27017, ISO 27018, CSA STAR and FedRAMP
Cloud compliance standards compared: SOC 2, ISO 27017/27018, CSA STAR, FedRAMP, BSI C5 and EUCS - requirements and certification paths.
Cloud Security
Cloud detection engineering: attack detection in AWS, Azure and GCP
Cloud Detection Engineering focuses on the development, testing, and maintenance of detection rules for attacks on cloud infrastructures (AWS, Azure, GCP).
Cloud Security
Cloud IAM security: securing AWS, Azure and GCP properly
Cloud IAM Security in AWS, Azure Entra ID and GCP: Least Privilege, Permission Boundaries, Conditional Access, Federation, CSPM.
Cloud Security
Cloud Key Management: AWS KMS, Azure Key Vault and HashiCorp Vault
Cloud Key Management compared: AWS KMS, Azure Key Vault, HashiCorp Vault. CMK/DEK/KEK, envelope encryption, HSM, BYOK, key rotation.
Sicherheitsarchitektur
Cloud Security: Security in AWS, Azure and GCP - The complete guide
Cloud Security guide: Shared Responsibility Model, common misconfigurations, CSPM, IAM, encryption - for AWS, Azure and GCP.
Cloud Security
Container security and Kubernetes hardening: The complete guide
Container and Kubernetes security: 4C model, image hardening, RBAC, Pod Security Standards, NetworkPolicy, Falco, supply chain (Cosign/SLSA).
Schwachstellenklassen
CORS - Cross-Origin Resource Sharing Fehlkonfiguration
CORS misconfigurations with wildcard origins let attackers send cross-site requests with user credentials. How to detect and fix insecure CORS policies.
Compliance
Critical infrastructure (KRITIS): definition, protection and NIS2
KRITIS Critical Infrastructure in Germany: the sectors affected and the cybersecurity obligations NIS2 introduces for operators.
Kryptographie
Cryptography: encryption, algorithms, PKI and post-quantum
Cryptography fundamentals: AES, RSA, ECC, password hashing (bcrypt, Argon2), digital signatures, PKI, TLS 1.3, ML-KEM and ML-DSA.
Malware
Cryptojacking: How to Detect and Prevent Unauthorized Crypto Mining
Cryptojacking secretly uses victims' computing power to mine cryptocurrency via browser scripts or malware - how to detect and prevent unauthorized mining.
Governance, Risk & Compliance
Cybersecurity Frameworks: NIST CSF, ISO 27001, CIS Controls Compared
Compare NIST CSF, ISO 27001 and CIS Controls to choose the right cybersecurity framework for certifying and reducing risk in your organization.
Compliance & Governance
Data Governance: Managing Data as an Enterprise Asset Systematically
Data Governance: framework, roles (Data Owner, Steward, Custodian), classification, data catalog, lineage and quality.
Datenbank-Sicherheit
Database security: securing SQL Server, MySQL and PostgreSQL
Database Security for SQL Server, MySQL and PostgreSQL: hardening, least privilege, audit logging, encryption and SQL injection protection.
Bedrohungslandschaft
DDoS attacks: types, defenses and the current threat situation
Understand the types of volumetric, protocol and application layer DDoS attacks and how businesses can defend against them.
DevSecOps
DevSecOps tools comparison: SAST, DAST, SCA and Secrets Scanning
DevSecOps tools compared: Semgrep, SonarQube, Snyk, OWASP Dependency-Check and others for SAST, DAST, SCA and secrets scanning.
DevSecOps
DevSecOps: Integrating security into CI/CD pipelines
Integrate SAST, DAST, SCA, and container scanning into CI/CD pipelines with security gates and concrete GitLab CI and GitHub Actions examples.
E-Mail-Sicherheit
DKIM - DomainKeys Identified Mail
DKIM email authentication cryptographically signs outgoing emails, protecting messages from tampering in transit to the recipient.
E-Mail-Sicherheit
DMARC - Domain-based Message Authentication, Reporting and Conformance
DMARC is an email authentication protocol that builds on SPF and DKIM and enables domain owners to prevent email spoofing and phishing attacks.
Netzwerksicherheit
DMZ - Demilitarized zone in network security
Understand the DMZ (Demilitarized Zone) and how its architecture and best practices protect internal systems from Internet threats.
Compliance & Standards
DORA - Digital Operational Resilience Act
DORA, an EU regulation effective January 2025, sets requirements on financial firms for digital operational resilience and incident reporting.
Endpoint-Sicherheit
EDR in the company: Deployment, Tuning and Incident Response
Endpoint Detection and Response (EDR) deployment, tuning and incident response to detect threats and stop them spreading on company endpoints.
E-Mail-Sicherheit
Email Security Architecture: DMARC, SPF, DKIM, BIMI and MTA-STS
Email security architecture with SPF, DKIM and DMARC blocks spoofing and phishing by securing sender authentication and delivery for your domain.
E-Mail-Sicherheit
Email security gateway: stopping phishing and malware
Deploy an email security gateway to enforce SPF, DKIM and DMARC, block phishing and malware, and detect business email compromise.
E-Mail-Sicherheit
Email security: SPF, DKIM, DMARC, BIMI and MTA-STS in detail
Practical guide to SPF, DKIM and DMARC setup with DNS examples, phased DMARC rollout and debugging tools to stop email spoofing.
Security Operations
Endpoint Security: EDR, EPP and holistic device protection
Endpoint security with EDR and EPP protects your laptops, servers and mobile devices against malware, ransomware and advanced attacks.
Security Operations
Enterprise Patch Management: Systematic Vulnerability Remediation
Patch management is the structured process of identifying, assessing, testing, and installing software updates.
Netzwerksicherheit
Firewall and NGFW: Understanding Next-Generation Network Protection
From the classic packet-filter firewall to the next-generation firewall (NGFW) with deep packet inspection, IPS, SSL inspection, and application control.
Compliance & Recht
GDPR and IT security: technical requirements, TOMs and implementation
GDPR Article 32 requires technical security measures. This guide explains how to implement TOMs to meet compliance and protect personal data.
Compliance
GRC: Governance, risk management and compliance for companies
GRC (Governance, Risk Management, and Compliance) explained: define a framework, choose supporting tools, and align with ISO 27001, NIS2, and GDPR.
Schutzmechanismen
HSTS - HTTP Strict Transport Security
HSTS forces browsers to use HTTPS exclusively after the first connection. How to configure HSTS headers, preloading and common implementation pitfalls.
Schwachstellenklassen
HTTP Parameter Pollution (HPP) - Parameter-Verschmutzung
HTTP Parameter Pollution sends duplicate parameter names to exploit inconsistent backend parsing. How HPP enables security bypass and WAF evasion attacks.
Identitätsschutz
Identity & Access Management (IAM): Managing Identities Securely
IAM is the foundation of any zero-trust architecture. This article explains identity lifecycle management, RBAC vs.
Identity & Access Management
Identity Governance (IGA): Joiner-Mover-Leaver and Access Certs
Identity Governance and Administration (IGA) software automates access lifecycle and certifications to enforce least privilege and reduce permission creep.
Identity Security
Identity theft and account takeover: attacks and protective measures
Account Takeover attacks: credential stuffing, password spraying, SIM swapping, MFA bypass. Protections via Conditional Access and FIDO2.
Web-Sicherheit
IDOR - Insecure Direct Object Reference
Insecure Direct Object Reference (IDOR) is an access control vulnerability in which an application uses direct references to internal objects (user IDs, file...
Mobile Security
IMSI catcher: How it works, legal situation and protective measures
IMSI catchers are devices that force mobile phones to connect to them, thereby capturing call data and locations.
Security Operations
Incident Response: Detecting, Containing and Recovering from Cyber Incidents
Incident Response: structured process for detecting, containing, resolving and following up on cybersecurity incidents. Determines damage extent.
Compliance & Recht
Information Security Officer (ISB)
Information Security Officer (ISB): responsibilities for ISMS, risk analyses and compliance. Qualifications, NIS2 obligations, internal vs external.
Compliance & Standards
ISO 27001 - Information Security Management System (ISMS)
ISO 27001 is the international ISMS standard for establishing, operating and continually improving information security.
Grundlagen
IT Asset Management (ITAM) and Cybersecurity: Inventory Everything
IT asset management builds a complete hardware and software inventory to close security gaps and support ISO 27001 and NIS2 compliance.
Security Operations
IT emergency management: incident response and crisis management
IT emergency management: incident response plans, crisis communication and BSI 200-4 practice to keep your business running during cyberattacks.
Sicherheitsberatung
IT security concept: structure, content and implementation
An IT security policy systematically documents all measures taken to protect information security within the organization.
Netzwerksicherheit
Lateral Movement: Detection and defense in the corporate network
Lateral movement defense: Pass-the-Hash, Pass-the-Ticket, Kerberoasting, WMI/PSExec. Detection via event logs/EDR, protection with LAPS, Protected Users.
Server Security
Linux Server Hardening: CIS Benchmark, SSH, auditd and AppArmor
Linux server hardening using the CIS Benchmark: secure SSH, auditd, and AppArmor to protect a production host from common attacks.
Angriffstechniken
Living off the Land (LotL) - LOLBins and LOLBas
"Living off the Land" (LotL) refers to attack techniques in which attackers use only legitimate tools and utilities already present on the system (...
Bedrohungslandschaft
Malware: types, analysis and protective measures
Malware types explained: viruses, ransomware, spyware and trojans, plus analysis methods and proven protective measures for your company.
Angriffstechniken
Man-in-the-middle attacks: techniques, detection and protection
Man-in-the-middle (MITM) attacks position an attacker between communicating parties - silently, often invisibly.
Endpoint Security
Mobile Device Management (MDM): Managing Smartphones and Tablets
Mobile Device Management (MDM) enables the centralized management of smartphones, tablets, and laptops.
Endpoint Security
Mobile security: Android and iOS enterprise hardening, MDM and BYOD
Comprehensive Guide to Mobile Security for Businesses: Threat Profile (Malicious Apps, Smishing, Vishing, Network Risks), MDM vs.
Netzwerksicherheit
Network Access Control (NAC): 802.1X, RADIUS and Zero Trust
Network Access Control (NAC) guide: use 802.1X, RADIUS and posture assessment to keep unpatched devices off your network.
Netzwerksicherheit
Network Detection and Response (NDR): Threat Detection in Networks
Network Detection and Response (NDR): ML behavioral analysis detects C2 traffic, lateral movement and exfiltration. Darktrace, ExtraHop, Vectra AI.
Security Operations
Network Forensics: Reconstructing Attacks in Network Traffic
Network forensics: TAP/SPAN/NetFlow capture, analysis with Wireshark, Zeek, Suricata, NetworkMiner. Evidence preservation per ISO/IEC 27037.
Netzwerksicherheit
Network security: architectures, technologies and best practices
Corporate network security stops breaches, data loss, and tampering with firewalls, network segmentation, Zero Trust, and tested defenses.
Compliance & Standards
NIS2 Directive: Requirements and Implementation
The NIS2 Directive (Network and Information Security Directive 2) is an EU regulation that harmonizes and strengthens cybersecurity requirements for critical and important infrastructure.
Penetrationstest
OSINT Methods: Tools and Techniques for Open Source Intelligence
OSINT (Open Source Intelligence) refers to the systematic collection and analysis of publicly available information for security and reconnaissance purposes.
Offensive Security
OSINT: Open Source Intelligence in Cybersecurity
Learn how OSINT tools and techniques expand your attack surface, and how to reduce exposure with a practical OSINT assessment.
OT-Sicherheit
OT/ICS Industrial Security: Protection for Plants and KRITIS Operators
Operational Technology (OT) and Industrial Control Systems (ICS) protect physical processes - from power grids to manufacturing facilities.
Schwachstellenklassen
Path Traversal - Verzeichnisüberschreitung (Directory Traversal)
Path traversal (CWE-22, OWASP A01:2021) allows attackers to access files outside the permitted directory using ../ sequences. Objective: Reading sensitive fi...
Offensive Security
Penetration Test (Pentest): Methods, Process and Results Explained
Learn how a penetration test simulates real-world cyberattacks to expose exploitable vulnerabilities in your IT systems, networks, and applications.
Penetration Testing
Penetration Test Methodology: PTES, OWASP, OSSTMM and BSI Guidelines
Comparison of leading penetration testing methodologies: PTES, OWASP Testing Guide, OSSTMM, BSI Guidelines (BSI-CS 115), and TIBER-EU for the financial sector.
Bedrohungslandschaft
Phishing and Social Engineering: Attack Methods and Defense
Phishing and social engineering guide: mass, spear, whaling, BEC, smishing, vishing, QR and AiTM. Cialdini, DMARC, FIDO2 MFA, awareness.
Penetrationstest
Physical penetration testing: methodology, tools and legal principles
Physical penetration testing uncovers exploitable weaknesses in access control, tailgating, and lock picking to harden your facility against real attacks.
Grundlagen
Physical Security: Servers, Office and Access Control in IT Security
Physical security for servers, offices and access control: practical measures to protect hardware and data from physical threats.
Identity Security
Privileged Access Management (PAM): Protecting Privileged Accounts
Privileged Access Management (PAM) protects the most powerful accounts in an IT environment - domain administrators, root accounts, and service accounts.
Privilege Management
Privileged Access Workstation (PAW): Secure Admin Workstations Guide
Privileged Access Workstations (PAWs) are dedicated, hardened workstations used exclusively for administrative tasks.
Schwachstellenklassen
Prototype Pollution - JavaScript-Objekt-Manipulation
Prototype pollution modifies JavaScript's Object.prototype to affect all objects. How this enables code execution and how to prevent the attack.
Schwachstellenklassen
Race Condition (TOCTOU) - Timing-Based Security Vulnerability
Race conditions (CWE-362) occur when a system's security depends on two or more operations being executed in a specific order, but parallel execution vi...
Bedrohungslandschaft
Ransomware: Protection, Detection and Response to Encryption Attacks
Ransomware encrypts your data and systems and demands a ransom. Learn how AWARE7 detects, contains and recovers from attacks to minimize downtime.
Offensive Security
Red Teaming: Conducting Attack Simulations Professionally
Red Team operations: how they differ from pentests, TIBER-EU, phases from reconnaissance to reporting, C2 infrastructure, common TTPs.
Secure Development
Secure Coding Practices: Anchoring security in the development process
Secure Coding and SDLC: threat modeling, STRIDE, language patterns for Python/Java/Node/Go, SAST/DAST/SCA in CI/CD, SBOM, OWASP SAMM.
Strategie & Architektur
Security Architecture: Frameworks, Patterns and Implementation Guide
Security architecture guide: Zero Trust, Defense in Depth, NIST CSF, and how design decisions prevent or enable attacks.
Security Operations
Security awareness training: How the human firewall really works
Security awareness training that reduces cyber risk: why one-time sessions fail, what phishing simulations measure, how to build a sustainable program.
Governance
Security Maturity Models: CMMI, C2M2, BSIMM and OpenSAMM in comparison
Security maturity models help organizations measure the current maturity level of their cybersecurity capabilities and improve them systematically.
Security Operations
Security metrics and KPIs: making security measurable
Security metrics let you prove your security program reduces risk, justify investments, and track measurable improvement over time.
Security Operations
Security Operations Center (SOC) and SIEM: monitor cybersecurity 24/7
Build a professional SOC with SIEM to detect cybersecurity threats 24/7, cut response time, and protect your organization.
Schwachstellenklassen
Server-Side Template Injection (SSTI) - Template Engine Attacks
SSTI occurs when user input is inserted into template engines without escaping. How attackers exploit template syntax for remote code execution.
Schwachstellenklassen
Session Fixation - How Attackers Hijack Sessions via Preset IDs
Session fixation attacks provide victims with a pre-set session ID before login. How attackers hijack authenticated sessions and how to prevent it.
Security Operations
SOAR: Security Orchestration, Automation and Response implementieren
Security Orchestration, Automation, and Response (SOAR) automates repetitive SOC tasks and reduces the Mean Time to Respond (MTTR) from hours to minutes.
Bedrohungslandschaft
Social engineering: psychological manipulation tactics in IT security
Identify social engineering attacks such as pretexting and baiting, understand the psychological tactics behind them, and apply proven countermeasures.
DevSecOps
Software Supply Chain Security: SLSA, Sigstore and Dependencies
Learn how software supply chain security stops attacks like SolarWinds and XZ Utils and how to protect your builds and dependencies.
E-Mail-Sicherheit
SPF - Sender Policy Framework: Prevent Email Spoofing with DNS Records
Learn how SPF DNS records authenticate email senders, preventing spoofing while improving your domain's email deliverability and reputation.
Bedrohungslandschaft
Supply chain attacks: SolarWinds, Log4Shell and the invisible threat
Understand how SolarWinds, Log4Shell and XZ Utils attacks work and how your company can secure its software supply chain.
Security Operations
Threat Intelligence: Understanding Attackers Before They Strike
Threat Intelligence: systematic collection of threat actor data, attack methods and IoCs. OSINT to commercial feeds, operational use.
Security Architecture
Threat Modeling Frameworks: STRIDE, PASTA, LINDDUN and MITRE ATT&CK
Threat Modeling: STRIDE, PASTA, LINDDUN, DREAD and MITRE ATT&CK integration with DFD and tools (Threat Dragon, Microsoft TMT).
Compliance & Standards
TISAX (Trusted Information Security Assessment Exchange)
TISAX is the automotive-industry security standard based on the VDA ISA questionnaire and managed by the ENX Association - required for OEM suppliers.
Hardware-Sicherheit
TPM (Trusted Platform Module): Hardware-Based Security for Enterprises
TPM (Trusted Platform Module): dedicated security chip on the motherboard for key storage, boot integrity and hardware root of trust.
Security Operations
UEBA (User and Entity Behavior Analytics)
UEBA detects insider threats and compromised accounts by baselining normal behavior and alerting on statistical anomalies across users and systems.
Vulnerability Management
Vulnerability Disclosure: CVD, VDP, Bug Bounty and Responsible Disc.
Vulnerability Disclosure: CVD process, VDP vs bug bounty, Security.txt (RFC 9116), responsible disclosure with safe harbor clauses.
Security Operations
Vulnerability Management: Systematic Approach in Practice
Vulnerability management guide covering detection, prioritization, patching, and verification for a continuous security program.
Security Operations
Vulnerability management: The complete guide
Implementing systematic vulnerability management: from detection and prioritization to remediation - using CVSS, EPSS, and patching strategies.
Secure Development
Web application security: OWASP Top 10, security testing and WAF
Web App Security: OWASP Top 10, WSTG methodology, Burp Suite, Nuclei scanning, security headers, WAF - PCI DSS, ISO 27001, NIS2 compliance.
Angriffstechniken
Web Cache Poisoning - Cache-Based Attack
Web cache poisoning uses unkeyed HTTP headers to inject malicious content into caches. How attackers exploit this to serve harmful responses to all users.
Offensive Security
Web scraping: techniques, legal situation and defensive measures
Understand automated extraction of web content, the legal situation for web scraping, and practical defensive measures to protect your site.
Endpoint-Sicherheit
Windows Server Hardening: CIS Benchmark and Security Baseline
Step-by-step Windows Server hardening to CIS Benchmark Levels 1/2 and Microsoft Security Baseline with ready-to-run PowerShell scripts.
Netzwerksicherheit
WLAN security in the company: From WPA3 to 802.1X
Enterprise Wi-Fi Security: WPA3-Enterprise vs. WPA3-SAE, 802.1X Authentication (RADIUS + EAP-TLS/PEAP), SSID Segmentation (Corporate vs. BYOD vs.
Web-Sicherheit
XXE - XML External Entity Injection
XXE Injection exploits XML parsers to read local files, perform SSRF or execute code. How the attack works and how to disable external entity processing.
Sicherheitsarchitektur
Zero Trust - Modern Security Architecture Principle
Zero Trust security architecture: verify every access request, apply least privilege, and reduce the impact of network breaches.
