Guide · Starter · 20 min
Secure by Design
CISA
A short, practical case for making security a product requirement rather than an afterthought.
A public reading room
Learn the work, not the pitch.
A small, curated library for people learning to model, build, and operate secure systems. Primary sources, annotated. No products, no lead capture.
24 sources · 6 paths · Last reviewed 29 October 2026
Maintained by 210 Security as a public resource. No products, no lead forms, no analytics on this page.
01
Start here
The vocabulary and the habits that make the rest of the library legible.
Standard · Practitioner · Reference
Application Security Verification Standard (ASVS)
OWASP
A concrete way to describe what good looks like when you review a web application.
Framework · Starter · 1 h
Cybersecurity Framework 2.0
NIST
A shared vocabulary for cyber risk; useful for framing governance before choosing a method.
Community · Starter · 15 min
Threat Modeling Manifesto
Threat Modeling Manifesto community
Values and principles from practitioners, useful for aligning a team before choosing a tool.
02
Threat modeling
Methods, communities and reference material for asking what could go wrong.
Guide · Starter · 30 min
Threat Modeling Cheat Sheet
OWASP
A tool-agnostic summary of how to run threat modeling and what to produce.
Book · Practitioner · Reference
Threat Modeling: Designing for Security
Adam Shostack
The standard practitioner book, including the four-question framework.
Framework · Practitioner · 1 h
LINDDUN
LINDDUN community
Privacy threat modeling that complements STRIDE when personal data is in scope.
Community · Starter · 20 min
Threat Modeling Connect
Threat Modeling Connect
A community of practitioners, with talks and a public State of Threat Modeling report.
03
Design → develop → operate
Where security work lands in the lifecycle, from a first design decision to production.
Standard · Practitioner · 1 h
Secure Software Development Framework (SSDF)
NIST
Connects secure development practices to the engineering process rather than to a document.
Framework · Practitioner · 30 min
SLSA
Open Source Security Foundation
A way to reason about build provenance and supply-chain integrity.
Tool · Practitioner · 20 min
Sigstore
Open Source Security Foundation
One implementation of artifact signing and transparency; useful when provenance matters.
Guide · Practitioner · 30 min
Top 10 CI/CD Security Risks
OWASP
A taxonomy for the path from commit to deploy, where many designs are never modeled.
04
Post-quantum cryptography
What is standardized, what is still draft, and where to experiment safely.
Hub · Starter · 30 min
Post-Quantum Cryptography project
NIST
The standardization project itself; start here to separate final standards from drafts.
Standard · Deep · Reference
FIPS 203: ML-KEM
NIST
The key-encapsulation standard; read alongside FIPS 204 and FIPS 205 for the full set.
Standard · Practitioner · 30 min Draft
NIST IR 8547: Transition to Post-Quantum Cryptography
NIST
Draft transition guidance with deprecation timelines; treat its dates as proposed, not final.
Tool · Practitioner · 20 min
Open Quantum Safe
Open Quantum Safe project
Open-source implementations and test harnesses for experimenting with post-quantum algorithms.
05
Identity and agents
Non-human identity, LLM risk, and the threats that arrive with autonomous systems.
Guide · Starter · 30 min
OWASP Top 10 for LLM Applications
OWASP GenAI Security Project
A starting taxonomy for risks in applications built on large language models.
Guide · Practitioner · 30 min
OWASP Top 10 for Agentic Applications 2026
OWASP GenAI Security Project
Agent-specific risks, from goal hijack and tool misuse to identity abuse and rogue agents.
Framework · Practitioner · Reference
MITRE ATLAS
MITRE
A shared catalogue of adversary techniques against AI systems.
Framework · Practitioner · 1 h
AI Risk Management Framework
NIST
Governance and risk management for AI, best paired with a technical taxonomy such as ATLAS.
06
Standards and regulation
The obligations that shape the work, and the primary texts behind them.
Standard · Deep · Reference
SP 800-53 Rev. 5: Security and Privacy Controls
NIST
A control catalogue that is useful when a threat needs to become an auditable control.
Regulation · Practitioner · 1 h
EU Cyber Resilience Act (Regulation 2024/2847)
European Union
The regulation itself for products with digital elements; read the dates and scope carefully.
Regulation · Practitioner · 1 h
NIS2 Directive (Directive 2022/2555)
European Union
The EU directive for essential and important entities; national implementation determines the detail.
Regulation · Practitioner · 1 h
Digital Operational Resilience Act (Regulation 2022/2554)
European Union
Digital operational resilience for financial entities, including ICT risk and third-party oversight.
About this library
How it is maintained.
This is a curated shelf, not a course, an endorsement, or a substitute for reading the source. It is funded and maintained by 210 Security and published as a public resource.
Selection
Primary sources first: standards bodies, communities, and the people doing the work. No vendor content, no pay-to-list, no affiliate links.
Licence
Original annotations are CC BY 4.0. Linked works remain under their own terms; this library links to them rather than copying them.
Corrections
Every entry is reviewed, and the review date is at the foot of the page. Send a correction or a suggestion and we will check the source.
Independence
Sponsorship is disclosed, not hidden. The library has no products, no lead capture, and no analytics on this page.