A curated list of resources for Chief Security Officers and aspiring security leaders spanning both cyber and physical security domains.
- Cyber Security
- Cyber & Physical Threat Intelligence
- Physical Security Threat Assessments
- Facilities Security
- Executive/Dignitary Protection
- Insider Threat & Insider Risk
- Leadership & Management
- Governance & Compliance
- Incident Response
- Conferences & Communities
- NIST Cybersecurity Framework - Guidelines for mitigating organizational cybersecurity risks
- ISO/IEC 27001 - Information security management systems standard
- CIS Controls - Prescriptive, prioritized set of cybersecurity best practices
- MITRE ATT&CK - Globally-accessible knowledge base of adversary tactics and techniques
- OWASP Top 10 - Standard awareness document for developers and web application security
- Factor Analysis of Information Risk (FAIR) - Framework for understanding, analyzing and measuring information risk
- Risk Management Framework (RMF) - NIST's structured process that integrates security and risk management activities
- SecurityScorecard - Security ratings platform
- BitSight - Security ratings for managing third-party risk, underwriting cyber insurance
- Recorded Future - Security intelligence platform
- Splunk - Platform for machine data analytics
- IBM QRadar - Security information and event management (SIEM) solution
- The CISO Handbook - A practical guide to securing your company
- How to Measure Anything in Cybersecurity Risk - By Douglas W. Hubbard and Richard Seiersen
- CISO Desk Reference Guide - A practical guide for CISOs
- Security Metrics: Replacing Fear, Uncertainty, and Doubt - By Andrew Jaquith
- Certified Information Systems Security Professional (CISSP) - Advanced-level security certification
- Certified Information Security Manager (CISM) - Management-focused security certification
- Certified Chief Information Security Officer (CCISO) - Certification for information security executives
- GIAC Security Leadership (GSLC) - Certification validating knowledge of security leadership
- Intelligence Cycle - Traditional framework for intelligence collection and analysis
- Diamond Model of Intrusion Analysis - Framework for analyzing intrusions
- ThreatConnect - Intelligence platform with analytics and automation
- MISP - Open-source threat intelligence platform
- Anomali - Threat intelligence platform
- EclecticIQ - Threat intelligence platform
- Flashpoint - Business risk intelligence platform
- US-CERT - US Computer Emergency Readiness Team
- CISA Alerts - Cybersecurity alerts from the Cybersecurity and Infrastructure Security Agency
- FBI InfraGard - Partnership between the FBI and the private sector
- OSAC - Overseas Security Advisory Council for international security information
- DSAC - Domestic Security Alliance Council
- Intelligence-Driven Incident Response - By Scott J. Roberts and Rebekah Brown
- The Tao of Open Source Intelligence - By Stewart K. Bertram
- Open Source Intelligence Techniques - By Michael Bazzell
- Certified Threat Intelligence Analyst (CTIA) - EC-Council certification
- SANS FOR578: Cyber Threat Intelligence - Training course for CTI professionals
- CARVER Matrix - Target analysis and vulnerability assessment technique
- RAMCAP - Risk Analysis and Management for Critical Asset Protection
- FEMA Risk Assessment - Methodology for assessing risks to critical infrastructure
- Crime Prevention Through Environmental Design (CPTED) - Multi-disciplinary approach to deterring criminal behavior
- DHS Infrastructure Survey Tool (IST) - Web-based security survey
- Facility Security Plan Template - Template from the Interagency Security Committee
- Physical Security: 150 Things You Should Know - By Lawrence Fennelly and Marianna Perry
- The Design and Evaluation of Physical Protection Systems - By Mary Lynn Garcia
- Introduction to Security: Operations and Management - By P.P. Purpura
- Physical Security Professional (PSP) - ASIS certification
- Certified Protection Professional (CPP) - ASIS certification
- Certified Security Consultant (CSC) - IAPSC certification
- ISC Security Design Criteria - Federal facility security standards
- ASIS Facilities Physical Security Measures Guideline - Comprehensive guidelines for facility protection
- NFPA 730: Guide for Premises Security - Guidelines for physical security of buildings
- Access Control Systems - Guidelines for implementing access control
- Video Surveillance Systems - Best practices for CCTV implementation
- Alarm Systems - UL standards for alarm systems
- Perimeter Security - Modern approaches to perimeter protection
- High-Rise Security and Fire Life Safety - By Geoff Craighead
- Security Supervision and Management - By IFPO
- Building Security: Handbook for Architectural Planning and Design - By Barbara A. Nadel
- ASIS Facilities Physical Security Council - Professional council focused on facility security
- GSA Security Standards - Federal standards for facility security
- Protective Intelligence - Threat assessment approach for VIP protection
- Advance Work - Pre-event security planning
- US Secret Service Best Practices - Overview of protection methodologies
- Close Protection Protocols - Industry standard protection protocols
- Travel Risk Management - Best practices for executive travel security
- Introduction to Executive Protection - By Dale L. June
- The Protected - By Christopher Falkenberg
- Confessions of a Protection Officer - By Timothy Spratt
- Executive Protection Institute - Training programs for executive protection
- Certified Protection Professional (CPP) - ASIS certification
- Executive Protection Specialist (EPS) - Specialist certification
- NITTF Insider Threat Program - National Insider Threat Task Force resources
- CERT Insider Threat Center - Research and resources from Carnegie Mellon
- CISA Insider Threat Mitigation - Government resources for insider threat programs
- User and Entity Behavior Analytics (UEBA) - Technology for detecting anomalous behavior
- Data Loss Prevention (DLP) - Technologies to prevent data exfiltration
- Privileged Access Management (PAM) - Tools to control privileged access
- Insider Threat: Prevention, Detection, Mitigation, and Deterrence - By Michael G. Gelles
- Managing the Insider Threat: No Dark Corners - By Nick Catrantzos
- The CERT Guide to Insider Threats - By Dawn M. Cappelli, Andrew P. Moore, and Randall F. Trzeciak
- PERSEREC Espionage and Insider Threat Research - Research on espionage cases
- Insider Threat Case Studies - Real-world examples and analysis
- Certified Insider Threat Program Manager - Specialized certification
- SANS FOR554: Insider Threat Management - Training course for insider threat professionals
- Security Strategic Planning Framework - Framework for security strategy development
- Balanced Scorecard for Security - Performance measurement framework
- Security Leadership Competency Model - Skills and competencies for security leaders
- Managing Security Teams - Harvard Business Review insights applicable to security
- Executive Communication for Security Leaders - Strategies for effective communication
- Building a Security Culture - ISACA guide to security culture
- The Art of the CISO - By Allan Alford
- How to Become a CISO - By Christophe Foulon
- CISO Leadership: Essential Principles for Success - By Todd Fitzgerald
- COBIT - Framework for governance and management of enterprise IT
- NIST Privacy Framework - Tool for improving privacy protections
- Payment Card Industry Data Security Standard (PCI DSS) - Information security standard for organizations that handle credit cards
- HIPAA - Healthcare privacy and security regulations
- GDPR - EU data protection regulation
- Compliance Program Assessment Framework - DOJ framework for evaluating compliance programs
- ISACA Control Objectives - Guide for control objectives
- Corporate Governance of Cybersecurity - Guide for board-level cybersecurity governance
- IT Governance: Policies & Procedures - By Michael Wallace and Larry Webber
- NIST Computer Security Incident Handling Guide - Comprehensive incident handling guide
- SANS Incident Response Process - Industry standard IR methodology
- ISO/IEC 27035 - Information security incident management standard
- MITRE ATT&CK for ICS - Knowledge base of adversary tactics for industrial control systems
- TheHive - Open-source incident response platform
- CISA Incident Response Playbooks - Federal playbooks for incident response
- Blue Team Handbook: Incident Response Edition - By Don Murdoch
- Computer Incident Response and Product Security - By Damir Rajnovic
- Security Operations Center Guidebook - By Greg Farnham, et al.
- RSA Conference - Major cybersecurity conference
- Black Hat - Information security conference
- GSX (Global Security Exchange) - ASIS International's annual security conference
- Executive Security Council - Community for strategic security executives
- ASIS International - Professional organization for security professionals
- ISACA - Professional association focused on IT governance
- (ISC)² - International Information System Security Certification Consortium
- CSO Roundtable - ASIS resource for CSOs
- Executive Security Council - Peer network for security executives
- Security Weekly - Podcast and community for security professionals
- SANS Reading Room - Free security resources
- CSO Online - News and information for security executives
- Reddit r/SecurityCareerAdvice - Community for security career discussions
- LinkedIn Security Groups - Various professional security groups on LinkedIn
This list is maintained as a community resource. Contributions are welcome!
