This page collects authoritative references and practical tools I recommend for Linux and Cloud Security. These resources align with industry standards and the domains covered in certifications such as CompTIA Security+ and CISSP.
🔐 Linux Security
- CIS Linux Benchmarks – Industry-recognised hardening guidance for multiple Linux distributions. Widely used in compliance audits.
- Lynis – Open-source auditing and hardening tool for Linux systems. Excellent for practical security checks.
- Red Hat Security Documentation – Official guidance for securing RHEL and related environments.
- LinuxSecurity.com – Security news, vulnerability updates, and resources for Linux administrators.
☁️ AWS Security
- AWS Security Hub Documentation – Centralised security monitoring and compliance in AWS.
- AWS Well-Architected Framework – Security Pillar – Core principles for secure cloud architecture.
- AWS IAM Best Practices – Practical guidance for designing secure IAM policies and roles.
- Cloud Security Alliance (CSA) – Independent research and frameworks for cloud security.
🎓 Security Frameworks and References
- NIST Cybersecurity Framework – Risk-based framework for managing cyber threats.
- MITRE ATT&CK Matrix – Adversary tactics and techniques, useful for threat modelling.
- OWASP Top 10 – Key web application security risks, updated regularly.
- CompTIA Security+ Objectives – Official outline of Security+ domains and topics.
- (ISC)² CISSP Exam Outline – Summary of CISSP domains, useful for mapping knowledge to certification requirements.
🛠️ Practical Tools and Utilities
- Shodan – Search engine for exposed devices and services. Demonstrates real-world attack surfaces.
- VirusTotal – Free service for analysing suspicious files and URLs.
- Qualys SSL Labs Test – Analyse and grade SSL/TLS configurations on public servers.
- Have I Been Pwned – Check if email addresses or credentials have been exposed in breaches.
Closing Note
These resources are not exhaustive, but they represent the most practical and widely respected references I use in my work. They reinforce the principles of system hardening, automation, identity management, and cloud security that I apply in consultancy engagements.