A hands-on guide for Engineering Teams and Security Specialists

Cybersecurity is no longer just a “feature” — it is a fundamental requirement of modern engineering. In an era of escalating threats and rigorous new regulations, building software that is secure by design and by default is not just a best practice; it is a necessity for business success.

This book, part of “The Defender’s Mindset” series, provides a practical roadmap to professional-grade security. Moving beyond abstract theory, it offers a hands-on exploration of real-world attack patterns and the concrete strategies needed to mitigate them.

Whether you are an architect securing industrial automation systems or a developer building cloud APIs, this guide equips you with the “The Defender’s Mindset” required to transform potential vulnerabilities into robust, resilient, and high-quality software.

The volume is composed by 4 main sections:

• Section 1: Cybersecurity Fundamentals → A simplified, bare-bone version of central cybersecurity topics. It covers the concept of Cybersecurity Posture, the Defense in Depth principle, and international standards such as:
  • CWE – Common Weaknesses Enumeration (https://cwe.mitre.org/)
  • CVE – Common Vulnerabilities and Exposures (https://www.cve.org/)
  • CVSS – Common Vulnerability Scoring System (https://www.first.org/cvss/)
  • IEC 62443 (https://www.isa.org/)
    
• Section 2: Quality Assurance Fundamentals → Focuses on the most useful and practical methodologies and tools required for secure development. Topics include SAST, DAST, and the Secure Software Development Lifecycle (SSDLC).
  
• Section 3: Hall of Fame → An exploration of high-impact flaws and scenarios.
  It covers the following scenarios:
  • ReDoS (Regular Expression Denial of Service)
  • Direct SQL Injection
  • Indirect SQL injection (via number format)
  • Indirect SQL injection (via number separators)
  • Path traversal / Directory traversal
  • Command injection & remote execution
  • Deserialization of Untrusted Data
  • TOCTOU (Time-of-Check to Time-of-Use)
  • NOP Sled / NOP Slide
  • Reverse Shell / Bind Shell
  • Cross-Site Scripting (XSS)
    
• Section 4: Vulnerabilities & Mitigations → The core of the book, which applies the previously discussed principles to demonstrate specific ways to mitigate dangerous defects and vulnerabilities that could be exploited by malicious actors. Its contents are organized in eight subsections:
  • Memory & Resource Management
    • CWE-125: Out-of-bounds Read
    • CWE-787: Out-of-bounds Write
    • CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
    • CWE-416: Use After Free (UAF)
    • CWE-459: Incomplete Cleanup
    • CWE-476: NULL Pointer Dereference
    • CWE-400: Uncontrolled Resource Consumption
    • CWE-770: Allocation of Resources Without Limits or Throttling
    • CWE-1333: Inefficient Regular Expression Complexity
    • CWE-190: Integer Overflow or Wraparound
  • Injection & Data Neutralization
    • CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
    • CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
    • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (‘Expression Language Injection’)
    • CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)
    • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)
    • CWE-94: Improper Control of Generation of Code (‘Code Injection’)
    • CWE-913: Improper Control of Dynamically-Managed Code Resources
    • CWE-611: Improper Restriction of XML External Entity Reference
    • CWE-776: Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)
    • CWE-611 vs CWE-776
    • CWE-502: Deserialization of Untrusted Data
    • CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
    • CWE-434: Unrestricted Upload of File with Dangerous Type
  • Authentication & Authorization
    • CWE-287: Improper Authentication
    • CWE-306: Missing Authentication for Critical Function
    • CWE-798: Use of Hard-coded Credentials
    • CWE-284: Improper Access Control
    • CWE-862: Missing Authorization
    • CWE-863: Incorrect Authorization
    • CWE-639: Authorization Bypass Through User-Controlled Key
    • CWE-732: Incorrect Permission Assignment for Critical Resource
    • CWE-269: Improper Privilege Management
    • CWE-384: Session Fixation
    • CWE-613: Insufficient Session Expiration
  • Cryptography & Data Protection
    • CWE-295: Improper Certificate Validation
    • CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    • CWE-326: Inadequate Encryption Strength
    • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
    • CWE-312/316: Cleartext Storage of Sensitive Information
    • CWE-319: Cleartext Transmission of Sensitive Information
    • CWE-522: Insufficiently Protected Credentials
  • Information Disclosure & Logging
    • CWE-200/209/532: Exposure of Sensitive Information to an Unauthorized Actor
    • CWE-525: Use of Web Browser Cache Containing Sensitive Information
    • CWE-117: Improper Output Neutralization for Logs
  • Concurrency & (Multi)Threading
    • CWE-362/367: Race Condition: Concurrent Execution using Shared Resource with Improper Synchronization / Time-of-check Time-of-use (TOCTOU)
    • CWE-667: Improper Locking
    • CWE-412: Unrestricted Externally Accessible Lock
  • Logic Design, Control Flow, Supply Chain
    • CWE-426/427: Untrusted Search Path / Uncontrolled Search Path Element
    • CWE-601: URL Redirection to Untrusted Site (‘Open Redirect’)
    • CWE-918: Server-Side Request Forgery (SSRF)
    • CWE-352: Cross-Site Request Forgery (CSRF)
    • CWE-829: Inclusion of Functionality from Untrusted Control Sphere
    • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (“Prototype Pollution”)
    • CWE-942: Permissive Cross-domain Policy with Untrusted Domains
    • CWE-598: Use of GET Request Method with Sensitive Query Strings
    • CWE-233: Improper Handling of Parameters
    • CWE-345: Insufficient Verification of Data Authenticity
    • CWE-385/1281: Covert Timing Channel

Each section analyses multiple vulnerabilities and their possible mitigations from the point of view of the CWEs that best fit their patterns. Along with the code samples, you will also find:

• A list of related CVEs of known exploitable vulnerabilities along with their CVSS.
• Regulatory and standard violations, mainly in the context of the IEC 62443 and in some instances, also EU NIS2 and EU Cyber Resilience Act.

The following images are screenshots from the book pages: