Research
Standards, frameworks and deeper reading.
Original summaries of the standards, frameworks and research that shape networking and security today: what each one is, the key ideas, what changed recently and how practitioners use it. Each article links to the official sources.
- NIST Cybersecurity Framework 2.0: what changed and how to use itCSF 2.0 added a Govern function and widened the framework from critical infrastructure to every organisation. Here is how its Core, Profiles and Tiers fit together in practice. 8 min · Intermediate
- Post-quantum cryptography: FIPS 203, 204, 205 and the migration aheadNIST’s first post-quantum standards are final and browsers already use hybrid key exchange. What ML-KEM, ML-DSA and SLH-DSA are, and how organisations should plan their migration. 9 min · Advanced
- NIST SP 800-207: the reference model for zero trust architectureSP 800-207 defines zero trust in terms of a policy engine, a policy administrator and enforcement points. This summary explains the model, its tenets and how SP 1800-35 turned it into working builds. 8 min · Intermediate
- MITRE ATT&CK in 2026: tactics, techniques and the new detection modelATT&CK is the shared vocabulary for adversary behaviour. Version 18 replaced data sources with detection strategies, and version 19 split Defense Evasion in two. What that means for defenders. 8 min · Intermediate
- MITRE D3FEND: a knowledge graph of defensive techniquesD3FEND does for defence what ATT&CK does for attack: it gives countermeasures precise names and links them to the artefacts they act on. A practical summary of D3FEND 1.0 and the CAD tool. 7 min · Intermediate
- OWASP Top 10:2025 for web applications: what moved and whyThe eighth OWASP Top 10 adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, folds SSRF into access control, and raises misconfiguration to second place. 8 min · Intermediate
- OWASP Top 10 for LLM applications (2026 edition) and agentic AI risksPrompt injection is still first, but Excessive Agency has jumped to third as AI agents gain tools and permissions. A summary of the 2026 LLM list and the companion Top 10 for agentic applications. 8 min · Advanced
- CIS Critical Security Controls v8.1: a prioritised baselineThe CIS Controls turn security into 18 prioritised controls and 153 safeguards, grouped so small teams know where to start. What v8.1 changed and how to use Implementation Groups well. 8 min · Intermediate
- ISO/IEC 27001:2022: the new Annex A and what certification now meansThe 2022 edition cut Annex A from 114 to 93 controls in four themes and added 11 new ones. The transition period ended in October 2025, so every valid certificate now uses the new version. 8 min · Intermediate
- NIST SP 800-61 Rev. 3: incident response rebuilt around CSF 2.0After 12 years, NIST replaced its classic four-phase incident response lifecycle with guidance built on the CSF 2.0 Functions. What changed, why, and how to update your playbooks. 8 min · Intermediate
- RPKI, route origin validation and ASPA: securing BGP routingBGP still trusts what neighbours announce. RPKI lets networks publish signed statements about who may originate their prefixes, and ASPA now extends this to the AS path. Here is how it fits together. 9 min · Advanced
- DNSSEC, DNS over TLS and DNS over HTTPS: integrity versus privacyDNSSEC proves DNS answers are authentic; DoT and DoH hide queries from eavesdroppers. They solve different problems. A clear comparison, plus the October 2026 root key rollover. 9 min · Intermediate
- TLS 1.3 (RFC 8446): the design choices that made it faster and saferTLS 1.3 removed whole classes of weak options, cut the handshake to one round trip and encrypted more of it. Now it is also the place where post-quantum key exchange and Encrypted Client Hello arrive. 9 min · Advanced
- Passkeys, FIDO2 and WebAuthn: how phishing-resistant sign-in worksPasskeys replace passwords with key pairs bound to a website’s origin, so they cannot be phished. WebAuthn Level 3 became a W3C Recommendation in 2026 and NIST now accepts synced passkeys. 8 min · Intermediate
- SBOMs and SLSA: making the software supply chain verifiableAn SBOM lists what is inside software; SLSA proves how it was built and from which source. Together with new rules such as the EU Cyber Resilience Act, they are becoming expected practice. 9 min · Advanced
- CISA Secure by Design: shifting security responsibility to software makersSecure by Design argues that customers should not have to bolt security on. Its principles, the voluntary pledge and the concrete goals it sets for manufacturers, summarised for engineers. 8 min · Intermediate
- IEC 62443: security for industrial automation and control systemsIEC 62443 is the main international series for securing industrial control systems. It splits responsibility between asset owners, integrators and product suppliers, and uses zones, conduits and security levels. 9 min · Advanced
- ETSI EN 303 645: the baseline for consumer IoT securitySmart cameras, speakers and doorbells used to ship with shared default passwords and no updates. ETSI EN 303 645 set a baseline that is now reflected in UK law and EU rules. 8 min · Intermediate
- Cloud Security Alliance Cloud Controls Matrix (CCM v4.1)The CCM is a cloud-specific control framework that also says who is responsible for each control, provider or customer. Version 4.1 arrived in January 2026 with new controls and a STAR transition plan. 8 min · Intermediate
- NIST AI Risk Management Framework: Govern, Map, Measure, ManageThe NIST AI RMF gives organisations a structured way to manage risks from AI systems, from bias to security. Its four functions, the Generative AI Profile, and the new Cyber AI Profile draft. 8 min · Intermediate
- The EU NIS2 Directive: scope, duties and where implementation standsNIS2 widened EU cybersecurity law to 18 sectors, made management personally accountable and set tight incident reporting deadlines. Most member states have now transposed it, and amendments were proposed in 2026. 9 min · Intermediate