✳ Learn / All 60 lessons
Every lesson pairs first-principles architecture at Meridian Space & Robotics with concrete IC deliverables, exam mindset callouts, and a 4-choice scenario check.
New here? Start with Foundations → · Map lessons to CISSP & certification domains →
60 results
Identity & access · 10 min
Access control models govern how subjects receive permissions on objects. Compare Discretionary (DAC), Mandatory/Lattice (MAC), Role-Based (RBAC), Attribute-Based (ABAC / XACML), and Rule-Based access control, alongside Preventive/Detective/Corrective categories.
AI & agents · 8 min
When an AI agent calls internal APIs on behalf of a human engineer, whose credentials should it use? Compare ambient god-keys against scoped OAuth Token Exchange (RFC 8693).
AI & agents · 7 min
Index of how Atlas of Security organizes AI and agentic security across three distinct engineering lanes: AI application & agent runtime controls, Agentic SOC operations, and Agentic SDLC supply chain.
AI & agents · 8 min
AI coding agents accelerate authoring, refactoring, and dependency updates, but an agent is an untrusted author, never a self-approving reviewer or production deployer.
AI & agents · 10 min
AI agents in the Security Operations Center can accelerate log enrichment and timeline assembly, but untrusted telemetry can carry prompt injections and high-impact containment actions require deterministic policy gates.
Applications & software · 9 min
A Trust Boundary marks where execution crosses from untrusted caller input into privileged server state. Learn why hiding a button or validating in JavaScript fails and how server-side API gates enforce integrity.
Security basics · 8 min
Security engineering begins by naming the asset, its mission value, and how confidentiality, integrity, and availability fail in distinct operational ways.
Risk, privacy & standards · 10 min
Selecting a control from NIST SP 800-53 or ISO 27002 is only half the job. Pair every preventive, detective, or corrective control with durable operational evidence that proves it ran.
Applications & software · 9 min
A pull request from a developer laptop is untrusted input until reviewed, built in an isolated runner, and cryptographically attested. Separate source write access from production promotion.
Cloud security · 9 min
Moving to IaaS, PaaS, or SaaS shifts infrastructure maintenance to the provider, but the customer always retains ownership of data classification, identity governance, and configuration.
Security basics · 14 min
Recovery sites trade ongoing cost against activation speed. Full, differential, and incremental backups balance backup window duration against restoration complexity. RAID levels protect against disk failure, and five disaster recovery test levels validate restoration procedures.
Risk, privacy & standards · 10 min
Data moves through six lifecycle phases from creation to destruction. Classification labels drive baseline controls, while Data Owners, Controllers, Processors, and Custodians hold distinct accountabilities.
Security basics · 8 min
Protecting data requires pairing confidentiality controls (encryption at rest and in transit) with availability and integrity resilience (immutable offline backups and tested restores).
Risk, privacy & standards · 10 min
Deleting a file pointer leaves residual physical representation (data remanence). NIST SP 800-88 defines Clear, Purge, and Destroy across magnetic, SSD flash, and cloud storage, paired with legal retention and crypto-shredding.
Risk, privacy & standards · 10 min
Forensic investigations preserve and interpret evidence. Explore volatility, disk imaging, write protection, cryptographic comparisons, custody records, and the limits of technical and legal conclusions.
Applications & software · 9 min
Importing a single package pulls an entire tree of transitive dependencies into your build and runtime privilege boundary. Learn how lockfiles, hashes, and reachability govern supply-chain risk.
Networks & email · 8 min
Jumping straight to DMARC p=reject breaks legitimate business mail. Learn how domain operators use DMARC aggregate reports (rua) to inventory third-party senders, fix alignment, and safely ratchet to enforcement.
Networks & email · 8 min
SPF, DKIM, and DMARC verify three specific domain claims on an incoming email message. Learn how each check works in DNS and why a DMARC pass never guarantees that an email is safe or written by a trusted human.
Risk, privacy & standards · 10 min
Datacenter resilience depends on ASHRAE temperature and humidity ranges, hot/cold aisle containment, UPS and generator power conditioning, fire classes (A/B/C/D/K), pre-action sprinkler pipes, and clean-agent gas suppression.
AI & agents · 10 min
Giving an AI agent broad tools or ambient credentials can let prompt injection or model errors cause unauthorized changes. Learn how to separate model proposals from independent policy and approval gates.
Identity & access · 11 min
When a Relying Party skips a signature, issuer, audience, time, or account-link check, one forged or replayed assertion can sign an attacker in. Five failure modes cover those skipped checks.
Risk, privacy & standards · 11 min
State machine models enforce security invariants across every transition. Bell-LaPadula protects confidentiality, Biba and Clark-Wilson protect integrity, and Brewer-Nash dynamically prevents conflict of interest.
Risk, privacy & standards · 11 min
Governance is not a binder written once a year. See how NIST CSF 2.0’s Govern (GV) function runs as a monthly and quarterly rhythm of risk appetite, roles, supply chain, and continuous review.
Risk, privacy & standards · 11 min
Cryptographic hashes (SHA-2, SHA-3) compare integrity against a trusted digest, HMAC adds shared-secret authenticity, and digital signatures provide integrity and source authentication while supporting non-repudiation decisions. Public Key Infrastructure (PKI) binds identities to public keys via X.509 certificates; certificate validation also requires trust, time, usage, and applicable revocation policy.
AI & agents · 12 min
A rubber-stamp "Approve" button does not make an AI system safe. Learn how to design meaningful Human-in-the-Loop (HITL) gates bound to immutable parameters and map controls to NIST AI RMF 1.0.
Identity & access · 11 min
When an anomalous login or privilege alert fires, SOC analysts pivot across IdP, device posture, and API telemetry to separate benign automation from active credential compromise.
Identity & access · 9 min
A login flow actually performs four distinct security jobs. Separating directory identity, authentication proof, authorization policy, and account recovery prevents catastrophic bypasses.
Detection & response · 10 min
A click on "Disable User" or a webhook call does not end incident response. NIST SP 800-61 Rev. 3 (April 2025) maps incident response to the CSF 2.0 Functions, and each containment action needs a read-back of live state.
Networks & email · 11 min
IPsec secures Layer 3 traffic via IKE Phase 1/2, AH (integrity only) vs ESP (confidentiality + integrity), and Transport vs Tunnel mode. Wireless networks progress from broken WEP/TKIP to WPA2-AES (CCMP) and WPA3 (SAE/GCMP) with 802.1X Enterprise auth.
Identity & access · 11 min
Identity assurance spans biometric accuracy (FRR/Type I, FAR/Type II, CER), NIST SP 800-63-4 assurance levels (IAL, AAL, FAL), Kerberos ticket exchange (AS, TGS, KDC), and identity lifecycle provisioning (SCIM, PAM, JIT).
Risk, privacy & standards · 10 min
Criminal, civil, and administrative law set external boundaries. The ISC2 Code of Ethics orders four mandatory canons. Personnel controls govern hiring, onboarding, rotation, and termination.
Identity & access · 8 min
Flat networks and standing admin credentials turn a single compromised endpoint into a total breach. Combine least-privilege permissions with independent identity and network trust boundaries.
Detection & response · 8 min
A log records an event, an alert flags a condition for review, and evidence supports or challenges an investigative conclusion. Assess source integrity, completeness, clock uncertainty, and corroboration.
Identity & access · 10 min
Flat networks can broaden an attacker’s reach from one compromised laptop. Compare packet filters, stateful firewalls, NGFWs, WAFs, forward/reverse proxies, microsegmentation, Zero Trust SDP, SASE, and 802.1X Network Access Control.
Networks & email · 10 min
One HTTPS request runs through DNS, TCP, TLS, and HTTP. Change the viewpoint, compare two traces, and repair a failure at each stage.
Identity & access · 8 min
Why does OAuth 2.0 deliver a short-lived authorization code through the browser instead of the access token? Trace state, issuer, redirect URI, client authentication, and PKCE.
Identity & access · 11 min
An OpenID Connect ID Token or SAML 2.0 assertion proves that an Identity Provider authenticated a subject. It does not automatically make that subject an administrator.
Networks & email · 11 min
The 7-layer OSI model and 4-layer TCP/IP stack isolate networking jobs. Each layer has a distinct Protocol Data Unit (PDU), addressing scheme, attack surface (ARP spoofing, VLAN hopping, SYN floods, DNS poisoning), and hardware/software defense.
Risk, privacy & standards · 8 min
Frameworks are not competing checklists. Learn how security architects start from a measurable risk outcome and map across NIST CSF 2.0, ISO/IEC 27001, NIST SP 800-53, CIS Controls, OWASP, and MITRE ATT&CK.
Detection & response · 10 min
Vulnerability scans find potential weaknesses; penetration tests safely chain and exploit them under written authorization. Master NIST SP 800-115 phases, Black/Gray/White-box testing, Rules of Engagement (RoE), and Red/Blue/Purple teaming.
Networks & email · 9 min
Social engineering attacks target human workflows, authority gradients, and time pressure. Defending against them requires pairing user awareness with phishing-resistant technical gates.
Risk, privacy & standards · 10 min
Physical security is the bedrock of logical security. Site selection, Crime Prevention Through Environmental Design (CPTED), layered perimeter controls, mantraps, Faraday cages, and visitor controls protect hardware and human life.
Risk, privacy & standards · 10 min
Security controls protect data from unauthorized outsiders, while privacy governance regulates whether the organization itself is collecting, using, and retaining personal data lawfully and Minimally.
AI & agents · 10 min
Large Language Models do not natively separate developer instructions from untrusted data in the context window. Learn how direct and indirect prompt injection exploit RAG pipelines and how to contain them.
Risk, privacy & standards · 11 min
Quantitative risk analysis calculates Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), Annualized Loss Expectancy (ALE), and safeguard value. Business Impact Analysis (BIA) pairs financial metrics with MTD, RTO, RPO, and WRT.
Applications & software · 7 min
A Software Bill of Materials (SBOM) is only useful when cryptographically bound to the exact artifact running in production. Separate advisory matching, build evidence, and owner decisions from deployed fixes.
Risk, privacy & standards · 11 min
Explore CPU and kernel isolation, platform-bound TPM keys, HSM key protection, memory mitigations, and virtualization boundaries. Distinguish these controls from mechanism-specific side-channel defenses.
Risk, privacy & standards · 10 min
Third-party assurance relies on independent audits. Master internal vs external audits, AICPA SOC 1 (financial ICFR), SOC 2 (Trust Services Criteria), and SOC 3 (public seal), and Type 1 (point-in-time design) vs Type 2 (period operating effectiveness).
Risk, privacy & standards · 9 min
Executive leadership sets risk appetite and signs the top-level security policy. Mandatory standards and baselines translate policy into rules, mandatory procedures spell out steps, and guidelines offer recommended advice.
Security basics · 7 min
Buying a SIEM, EDR, WAF, or CSPM does not mark a security function "done." Learn how to map vendor product acronyms to concrete technical capabilities, telemetry inputs, and operational owners.
Applications & software · 15 min
Security integrated at every SDLC phase prevents structural flaws. Database engines enforce ACID properties and prevent inference and aggregation leaks, while parameterized queries, context-aware encoding, and synchronization eliminate injection, XSS, buffer overflow, and TOCTOU vulnerabilities.
Applications & software · 10 min
Continuous software verification combines Static (SAST), Dynamic (DAST), Interactive (IAST), Software Composition Analysis (SCA), and Fuzzing (mutation vs generation). Master code coverage math (statement vs branch coverage) and synthetic monitoring.
Risk, privacy & standards · 11 min
Kerckhoffs’s principle holds that security resides in the key, not algorithm secrecy. Compare symmetric block/stream ciphers and AEAD modes (GCM vs ECB) with asymmetric RSA/ECC and post-quantum NIST standards.
Applications & software · 9 min
Before writing code or buying scanners, map how data crosses trust boundaries and apply STRIDE to uncover design flaws while architecture is still cheap to change.
Detection & response · 9 min
Separating threats, vulnerabilities, and business impact prevents security teams from treating every scanner finding or headline as an equal emergency.
Networks & email · 8 min
Why does TCP require three packets before entering ESTABLISHED? Trace sequence number synchronization, half-open SYN_RCVD state, and SYN flood defenses.
Networks & email · 8 min
How do two endpoints agree on an encryption key over an untrusted network without sending the secret on the wire? Trace ephemeral Diffie-Hellman, X.509 name binding, and what TLS leaves to the application.
Detection & response · 9 min
Sorting a patch queue strictly by base CVSS score wastes scarce maintenance windows. Learn how SOC and engineering teams combine CVSS severity, CISA KEV active exploitation, EPSS probability, and asset exposure.
Identity & access · 10 min
An OAuth 2.0 access token is a scoped capability ticket presented by a client to a resource server. Separate the four OAuth roles and trace how a resource server validates issuer, audience, and expiry.
Risk, privacy & standards · 9 min
Vague anxieties ("our cloud might get hacked") paralyze prioritization. Learn to write a falsifiable four-part risk statement that pairs threat cause, control gap, target asset, and bounded mission impact.
No matches. Try a broader search or clear the filters.
