Brian Greenberg

Resources · maintained, not linked-and-forgotten

A working library for students & practitioners

These are the ten guides I keep current for my students and for peers building security and technology programs. Each is a curated, opinionated list — if it's here, I'd stake a recommendation on it. External links open in a new tab.

52 entries

Tools

Secure Operating Systems & VMs

  • TailsThe Amnesic Incognito Live System: a portable OS you boot from a USB stick that protects against surveillance and censorship. All traffic routes through Tor, and it leaves no trace when you shut down—every session starts clean.
  • QubesOSA “reasonably secure operating system” built on security through compartmentalization: everything runs in isolated virtual machines, so a compromise of one—your browser, an email attachment—can’t reach the rest of your digital life.
  • WhonixAn anonymous operating system that runs like an app and routes all Internet traffic through the Tor anonymity network. Available for all major operating systems.
  • Oracle VM VirtualBoxA free, open-source platform that lets users run multiple operating systems on a single device. Supports Windows, Linux, Solaris, and macOS guests; free for personal, educational, or evaluation use.

Encryption

  • OpenPGPA non-proprietary format for authenticating or encrypting data using public key cryptography, based on the original PGP software. The standard for nearly all of the world’s signed or encrypted email.
  • VeraCryptFree, open-source disk encryption for Windows, macOS, and Linux. The successor to TrueCrypt: whole disks, partitions, or portable containers, with hidden volumes for plausible deniability.
  • CryptsetupAn open-source utility that conveniently sets up disk encryption based on the dm-crypt kernel module.
  • LUKS (Linux Unified Key Setup)The standard on-disk format for Linux disk encryption, managed through cryptsetup — what LUKS is and how to implement full-disk encryption with it.

DNS & Public Resolvers

Email Authentication Toolkits

Email was designed without a way to prove who sent a message — exactly what phishing exploits. These four DNS standards close the gap; if you own a domain, publish all four.

DKIM cryptographically signs each message, proving the domain owner sent it and nothing was altered in transit.

DKIMmxToolbox EasyDmarc DNS Checker

SPF lists the servers authorized to send mail for your domain — the oldest of the standards; a domain without one is trivially spoofable.

SPFmxToolbox Kitterman SPF Tools EasyDmarc SPF Check Online

DMARC is the enforcement layer: it ties SPF + DKIM together, tells receivers to reject failures, and reports abuse of your domain back to you.

DMARCmxToolbox DMARC Tags Dmarcian Fortra (Agari) DMARC tools DMARC XML Analyzer

BIMI displays your logo in the inbox — but only for domains that already enforce SPF, DKIM, and DMARC, so it doubles as visible proof of good email hygiene.

BIMIRed Sift DNS Checker

Utilities

  • PuTTYAn SSH and telnet client developed originally by Simon Tatham for the Windows platform. Open-source, with source code available, developed and supported by a group of volunteers.
  • Google Admin ToolboxGoogle’s free diagnostic suite: Dig for DNS lookups, HAR analyzer for browser traffic, MX checks, message-header analysis, and more. Useful well beyond Workspace administration.
  • ShodanThe IoT Search Engine for the Internet of Everything — the world’s first search engine for Internet-connected devices.
  • Microsoft PowerToysA set of utilities for power users to tune and streamline their Windows experience for greater productivity.
  • chezmoiManage your dotfiles and app settings across machines with git as the source of truth — templates for per-machine differences, password-manager integration for secrets. Replaced Mackup in my toolkit.
  • have i been pwned?Troy Hunt’s free service aggregating billions of breached records so victims can learn of account compromises. Check every address you own and subscribe to notifications.
  • VMware Workstation Pro & FusionDesktop hypervisors used by millions to run virtual machines on Windows, Linux, and Mac — now free for personal use.
  • Cloud Latency Map by KentikA free public tool exploring measured latencies between 100+ cloud regions worldwide — spot recent changes between clouds, cities, or continents.
  • DLP TestA free testing site for Data Loss Prevention deployments: safe sample PII/PCI data plus HTTP, HTTPS, and FTP endpoints — prove your DLP controls actually block sensitive data in motion.
  • Wayback MachineThe Internet Archive’s time machine for the web: 900+ billion captures since 1996. Indispensable for investigations (what did that page say before it changed?), dead-link rescue, and institutional memory.

Security References & Investigation

  • MITRE ATT&CKThe knowledge base of adversary tactics and techniques from real-world observations — the common language of modern defense. If you learn one framework taxonomy, learn this one.
  • ANY.RUN Threat IntelligenceThreat-intel lookup built on ANY.RUN’s interactive malware sandbox: search hashes, IPs, and domains across millions of live analysis sessions.
  • Decent Security: Investigation GuideA practical, step-by-step guide to investigating suspicious files, links, and emails with free tools — written for working admins, not just researchers.
  • Knock-KnockA live honeypot dashboard of real break-in attempts against SSH, RDP, Telnet, and FTP — where the bots come from and what credentials they try, with free blocklists.
  • Zero Day ClockA data visualization of how the disclosure-to-exploitation window has collapsed — from years to days, and with AI, heading toward minutes.

Live Threat Maps — cyber weather

SpamHausLive view of spam and botnet activity from the Spamhaus feeds. KasperskyThe classic spinning-globe cyberthreat map. BitDefenderReal-time attack, spam, and infection tracker. CheckpointThreatCloud live cyber attack map. RadwareLive DDoS and web-attack telemetry. FortinetFortiGuard real-time threat intelligence map. NetScoutHorizon — global DDoS attack visibility. SonicWallLive worldwide attack telemetry from SonicWall sensors. Digital Attack MapTop daily DDoS attacks worldwide (Google + Arbor). TalosCisco Talos email & spam reputation world view.

↑ Back to top

25 entries

Standards & Controls

Cybersecurity Frameworks

  • NIST Cybersecurity Framework 2.0The most widely adopted security framework in the world and where most organizations should start: six functions — Govern, Identify, Protect, Detect, Respond, Recover — free, outcome-based, and mapped to nearly everything else on this page.
  • CISThe Center for Internet Security — the community-driven nonprofit behind the CIS Controls® and CIS Benchmarks™, globally recognized best practices for securing IT systems and data.
  • CIS Controls v8 → SOC 2 MappingMapping between AICPA Trust Services Criteria (SOC 2) and the CIS Critical Security Controls v8.
  • NIST ITLThe Information Technology Laboratory — NIST’s globally trusted source of independent research, measurements, and standards for IT.
  • NIST CybersecurityNIST’s cybersecurity standards, guidelines, and best practices for U.S. industry, federal agencies, and the public.
  • NIST SP 800-53The exhaustive security & privacy control catalog behind U.S. federal systems (and FedRAMP) — the authoritative, granular definition of every control.
  • NIST SP 800-61 (Incident Response)Incident-response recommendations aligned with CSF 2.0 — build the capability to detect, respond, and recover before you need it.
  • NIST AI Risk Management FrameworkAI RMF 1.0: the voluntary framework for identifying, measuring, and governing AI risk — the emerging baseline for AI governance programs.
  • The Secure Controls Framework (SCF)A comprehensive internal-controls catalog spanning cybersecurity and data privacy — a long-term tool for compliance efforts across People, Processes, Technology, and Data.
  • Cyber EssentialsThe UK standard organizations can be assessed and certified against to protect against the most common cyber attacks.
  • OWASPThe Open Worldwide Application Security Project: open community, 250+ chapters, and the definitive free resources for building software that can be trusted.
  • CSA Cloud Controls MatrixThe Cloud Security Alliance’s control framework purpose-built for cloud: ~200 controls across 17 domains, mapped to ISO 27001, NIST, and PCI-DSS. The de facto standard for assessing cloud providers.

Industry Standards

  • IEC 62443The leading standard for industrial cybersecurity, covering all kinds of facilities and systems across myriad industries.
  • ISO 27000 familyThe family of information-security standards providing end-to-end security guidance for an organization.
  • ISO 27001The certifiable core of the family: implement and operate an Information Security Management System (ISMS). The certification most often requested in vendor due diligence worldwide.
  • ISO 27002The companion code of practice to 27001 — detailed implementation guidance for each ISMS control.
  • ISO 27032Guidelines for Internet security (2023 revision): managing the Internet-facing threats — phishing, malware, cross-organization attacks — that fall between cybersecurity, network security, and information security.
  • ISO 27701The privacy extension to 27001: a Privacy Information Management System (PIMS) for personal data, mapped to GDPR obligations — the bridge between your security and privacy programs.
  • ISO 22301The international standard for Business Continuity Management Systems: plan for, survive, and recover from disruption. Security keeps the bad guys out; 22301 keeps the business running when something gets through.
  • ISO 31000The umbrella risk-management standard — principles and process for treating risk of any kind, in the language the rest of the enterprise uses.
  • ITILThe Information Technology Infrastructure Library — the framework for standardizing the selection, planning, delivery, and lifecycle of IT services.
  • COBITISACA’s framework for governance and management of enterprise IT — the board-level answer to whether IT is delivering value, managing risk, and staying aligned with the business.
  • SOC 2The AICPA’s compliance framework for service organizations handling customer data: reports evaluate security, availability, processing integrity, confidentiality, and privacy against the Trust Services Criteria.
  • CMMCThe U.S. DoD’s Cybersecurity Maturity Model Certification — the tiered certification (built largely on NIST SP 800-171) required of defense contractors handling controlled unclassified information.

Reference Architectures

  • Microsoft Cybersecurity Reference Architectures (MCRA)Microsoft’s freely published architecture diagrams showing how identity, endpoint, network, SecOps, and zero-trust capabilities fit together across a modern enterprise — an excellent way to see the whole security estate on one canvas.

↑ Back to top

20 entries

Software Development

Version Control

  • GitThe free, open-source distributed version control system — fast, tiny footprint, cheap local branching. It outclasses SCM tools like Subversion, CVS, Perforce, and ClearCase.
  • GitHubThe developer platform on top of Git: access control, issues, pull requests, CI, and wikis for every project.
  • GitLabThe other major Git platform — a complete single-application DevSecOps platform, hosted or self-managed, with a generous open-source tier.

Development Environments

  • Visual Studio CodeThe free, open-source code editor supporting most languages, for macOS, Linux, and Windows.
  • HomeBrewThe Missing Package Manager for macOS (or Linux) — install and manage developer tools from the command line, reproducibly.
  • Oh My Zsh!A delightful, community-driven framework for your Zsh configuration, bundled with thousands of functions, plugins, and themes.

AI-Assisted Development

  • Claude CodeAnthropic’s agentic coding tool: Claude working in your terminal, editor, or CI — reading the codebase, writing and testing changes, opening pull requests. The tool this site is built and maintained with.
  • Google AntigravityGoogle’s agent-first development platform (public preview, free for individuals): a full IDE plus a manager surface for supervising multiple coding agents working asynchronously.
  • GitHub CopilotThe most widely deployed AI pair programmer — inline completions, chat, and code review across the GitHub platform and major editors.

Practices & Documentation

  • Keep a ChangelogThe simple, sane convention for CHANGELOGs humans can read: what changed, for whom, and when. If your project ships versions, keep one.
  • Conventional CommitsA lightweight commit-message convention (feat:, fix:, docs:…) that makes history readable and lets tooling automate versioning and release notes.
  • MermaidDiagrams as code: flowcharts, sequence and ER diagrams from plain text that lives in the repository and renders on GitHub — reviewable, diffable, and current.
  • Google FontsGoogle’s open-source font library: 1,500+ typefaces, free to use and self-host — the default first stop for web typography.

Security in Development

  • Source Code Security AnalyzersNIST’s guide to analyzers that examine source code for weaknesses leading to vulnerabilities — one of the last lines of defense during development.
  • Source Code Analysis ToolsOWASP on Static Application Security Testing (SAST) tools: analyze source or compiled code for security flaws, in your IDE, before they get expensive.

Open-Source Projects Worth Knowing

  • senior-engineering-partnerMy own open-source Claude Code skill — a strict senior engineer that reviews your code, insists on tests, blocks hardcoded secrets, and enforces a security-and-backup floor across the whole build, from throwaway prototype to production. Apache-2.0.
  • CodeBurnA free, open-source tracker for AI-coding spend: reads the session files on your machine across 36 AI tools and agents and breaks the cost down by model, project, task, and tool — so you can see where the budget actually goes.
  • release-pleaseGoogle’s release automation: it reads your Conventional Commits, bumps the semver, updates the CHANGELOG, tags, and opens a GitHub Release — the tool that cuts releases so you never hand-tag one that drifts from its notes.
  • OWASP Secure Agent PlaybookOWASP’s open collection of structured security “plays” that let AI agents run security-engineering tasks systematically — evidence-based findings across code, APIs, AI apps, and infrastructure, mapped to industry standards.
  • ScubaGoggles (CISA)CISA’s tool to check a Google Workspace tenant against the SCuBA Secure Configuration Baselines — automated posture assessment with compliance reports. (Its Microsoft 365 sibling is ScubaGear.)

↑ Back to top

21 entries

AI

The AI landscape, curated: the labs that matter, the products they ship, and where to build. This section changes more often than any other — the field moves that fast.

The Major Labs

  • AnthropicThe AI safety company behind the Claude model family. Research-first culture; notable for Constitutional AI, interpretability research, and the strongest models for agentic and coding work.
  • OpenAIThe company that brought generative AI mainstream with ChatGPT: the GPT model family plus image, video (Sora), and voice models, and the largest consumer AI product in the world.
  • Google DeepMindGoogle’s consolidated AI lab: the Gemini family, AlphaFold, and the deepest research bench in the industry, distributed through Google’s consumer and cloud products.
  • PerplexityThe AI-native answer engine: conversational search with inline citations — the clearest glimpse of what search looks like after ten blue links.
  • Meta AI / LlamaMeta’s Llama family made open-weight frontier-class models a reality and seeded much of today’s open-model ecosystem.
  • MistralThe leading European lab: efficient open and commercial models and the Le Chat assistant — significant technically and for European AI sovereignty.
  • xAIElon Musk’s lab behind the Grok models, integrated with X.
  • Hugging FaceNot a lab but the town square of open AI: the hub where models, datasets, and demos are shared. If a model has open weights, it lives here.

Assistants & Products

  • ClaudeAnthropic’s assistant: chat with projects, artifacts, file analysis, and connected tools. (What I use daily.)
  • Claude CodeClaude as an agentic software engineer — in your terminal, editor, and CI. Also on the Software Development guide.
  • Claude CoworkClaude Code’s agentic architecture pointed at knowledge work: reads and writes real files, works across connected apps, and carries multi-step office tasks through to finished deliverables.
  • ChatGPTOpenAI’s assistant and the most-used AI product on earth: chat, voice, vision, custom GPTs, and agent modes.
  • GeminiGoogle’s assistant, woven through Search, Workspace, and Android, with industry-leading long-context and multimodal abilities.
  • NotebookLMGoogle’s research notebook: ground the model in YOUR sources and get answers, study guides, and generated audio overviews — strictly from what you gave it. Superb for students.
  • OllamaRun open models locally with one command — private, offline, free. The easiest on-ramp to local AI on a laptop.
  • LM StudioA polished desktop app for discovering, downloading, and chatting with local open models — the GUI counterpart to Ollama.
  • Open WebUIThe leading self-hosted AI interface: a full ChatGPT-style web UI you run yourself, on your own hardware, entirely offline if you like — front-ending Ollama or any OpenAI-compatible API, with users, RAG, and tools built in.

Developer Platforms

  • Anthropic API / ConsoleBuild with the Claude models: developer console, workbench, and usage management. Documentation at docs.claude.com.
  • OpenAI PlatformAPI access to the GPT, image, video, and voice model families, with playground and evals tooling.
  • Google AI StudioFree playground and API keys for the Gemini models; graduate to Vertex AI for enterprise deployment.
  • Hugging FaceHost, fine-tune, and serve open models; the transformers library is the lingua franca of applied ML.

↑ Back to top

14 entries

Training

Email Security & Phishing Awareness

  • PhishingUses email to trick victims into sharing personal information via deceptive emails and websites. Never click unsolicited links or attachments.
  • SmishingPhishing over text messages. Never respond to requests for personal information and never click the links — go to the company’s website yourself.
  • VishingFraud over phone calls, voicemail, or VoIP. Don’t answer unknown callers; send them to voicemail and call back. Be wary of AI voice impersonation — silencing instructions for Apple (linked) and Android.
  • Jigsaw Phishing QuizGoogle’s free phishing test: can you spot when you’re being phished? Harder than you think.
  • More Free Phishing ResourcesA roundup of additional free phishing-awareness tools.

Cybersecurity Platforms

  • SANS TrainingThe SANS Institute specializes in comprehensive cyber security education, resources, and training programs for individual practitioners and cyber teams worldwide.
  • Hack The BoxA leading gamified cybersecurity upskilling, certification, and talent assessment platform for individuals, businesses, governments, and universities.
  • TryHackMeA gamified, hands-on cyber security training platform in your browser, with blue, red, and purple team content for all skill levels.
  • WarGamesOffered by the OverTheWire community — learn and practice security concepts through fun-filled games.

AI Training — free from the labs

  • Anthropic AcademyAnthropic’s free course catalog with completion certificates: AI fluency for non-technical learners, Claude product training, and developer deep-dives on the API, MCP, and Claude Code.
  • OpenAI AcademyOpenAI’s free learning hub: live and on-demand courses on ChatGPT and the OpenAI platform, from beginner AI literacy to building with the API.
  • Google AI EssentialsGoogle’s self-paced AI fundamentals course (part of Grow with Google): practical instruction in using generative AI effectively and responsibly at work.
  • Google Cloud Skills BoostGoogle’s official training hub for Google Cloud: hands-on labs, learning paths, and skill badges across GCP, data, security, and the Gemini/AI stack — many paths free.

Professional Development

  • Your Public LibraryThe most underused training benefit in America: most public library cards unlock LinkedIn Learning and other course platforms completely free. Linked here: Chicago Public Library’s online learning portal — check your own library’s ‘online resources’ page.
  • LinkedIn LearningVideo courses taught by industry experts across Business, Creative, Technology, and Certification tracks.

Computing History

  • ARPANET InteractiveAn interactive recreation of the ARPANET, the 1969 research network the Internet grew out of — explore the historical map and log in to simulated hosts of the era. History you can telnet into.

↑ Back to top

33 entries

Publications & Podcasts

Publications

  • TechTargetData-driven publisher network of 140+ technology sites — including the Storage channel and the channels below.
  • Software QualityTechTarget’s software quality & testing channel.
  • SecurityTechTarget’s enterprise security channel.
  • IoTTechTarget’s Internet of Things channel.
  • ArsTechnicaTechnology news for “alpha geeks”: technically savvy, up-to-date coverage of tech news, policy, science, and hardware.
  • IDCThe premier global market intelligence provider for IT, telecom, and consumer technology — 1,300+ analysts across 110 countries.
  • GartnerResearch and consulting on technology strategy: planning, architecture, product evaluation, and market analysis.
  • ForbesSelf-promotional plug for my articles. 😉
  • Informa TechTargetThe combined Informa Tech + TechTarget company: B2B technology media, research, and intelligence across 220+ digital properties.
  • OMDIAA global analyst and advisory leader connecting the dots across the technology ecosystem.
  • AI BusinessInforma’s news site on enterprise AI adoption.
  • SecurityWeekCybersecurity news, analysis, and insight for information security professionals, plus well-run virtual events and the ICS Cybersecurity Conference. One of the feeds I actually read daily.
  • Dark ReadingCybersecurity news and a trusted online community for security professionals — CISOs, technology specialists, and researchers.
  • The New StackContext and explanation of at-scale technologies — modern architectures, the software development life cycle, and operations culture.
  • The RegisterThe leading and trusted global online enterprise technology news publication, reaching roughly 40 million readers worldwide.
  • CSOServes enterprise security decision-makers with critical information across risk management, network defense, fraud, and data loss prevention.
  • The EU Artificial Intelligence Act🇪🇺 Up-to-date developments and analyses of the EU AI Act, maintained by the Future of Life Institute.
  • The InterceptInvestigative journalism with strong surveillance and privacy coverage.
  • CyberCrime MagazineCybersecurity Ventures — cyber economic market data, insights, and predictions; Page ONE for the global cyber economy.
  • SemaforSmart, distilled news with journalistic transparency and competing perspectives across borders.
  • The VergeTechnology and how it makes us feel — breaking news, reviews, and award-winning features since 2011.
  • tl;dr secKeep up with cybersecurity in 7 min/week — the best tools, talks, and resources, free, for 50,000+ security professionals.

Podcasts

  • IT Ops QueryDistills the signal from the noise on enterprise IT transformation and operations, hosted by TechTarget’s Beth Pariseau.
  • DarkNet DiariesHackers, breaches, shadow government activity, hacktivism, and cybercrime — the things that dwell on the hidden parts of the network.
  • The Backup Wrap-upTurns unappreciated backup admins into cyber recovery heroes — each episode dives deep into protecting your organization from data loss and ransomware.
  • CISO SeriesA media network delivering the most fun in cybersecurity: 9-10 weekly episodes across five programs, plus live events.
  • CyberCrime Magazine PodcastsPage ONE for cybersecurity podcasts.

Articles & Reports

↑ Back to top

9 entries

Movies & Videos

Educational & Informative Films

  • The Company Man: Protecting America’s SecretsFrom the FBI 🇺🇸: based on an actual case, this short film shows how one company was targeted by foreign actors for economic espionage — and what the FBI did to help.
  • Game of PawnsFBI/ONCIX film educating American academia on how foreign intelligence services target and attempt to recruit American students studying abroad.
  • Made in Beijing: The Plan for Global Market DominationThe FBI’s 30-minute film on the PRC’s sustained industrial-espionage campaign — helping private-sector partners protect their crown jewels.
  • MindwalkThe systems-thinking film (1990, free on YouTube): a physicist, a politician, and a poet spend a day at Mont Saint-Michel arguing about why the mechanistic worldview fails — and what a systems view offers. Based on Fritjof Capra’s The Turning Point; it shaped how I think about technology and organizations.
  • Coded BiasInvestigates algorithmic bias after MIT Media Lab researcher Joy Buolamwini uncovered flaws in facial recognition technology.
  • The Social DilemmaDocumentary-drama on the dangerous human impact of social networking, with tech experts sounding the alarm on their own creations.
  • The Tinder SwindlerPosing as a wealthy diamond mogul, he wooed women online and conned them out of millions via romance scams. Some victims plan payback.

Cybersecurity Media

↑ Back to top

20 entries

Privacy

Anonymity Tools

  • The Tor ProjectThe US nonprofit advancing human rights and privacy online through free software and open networks. The Tor Browser routes and encrypts web traffic through three layers of international nodes (onion routing).
  • TailsA complete anonymous operating system on a USB stick: boot any computer, work through Tor, shut down — nothing is written to the machine. What journalists and sources use when the computer itself can’t be trusted.
  • WhonixAn anonymous operating system that runs like an app and routes all Internet traffic through the Tor anonymity network. Available for all major operating systems.
  • QubesOSThe compartmentalized OS: everything runs in isolated virtual machines, so no single compromise exposes your whole digital life. Runs Whonix built-in.

Network Privacy

  • TailscaleA private, encrypted mesh network (built on WireGuard) connecting your own devices wherever they are — zero open ports, no traffic through anyone else’s servers. Not an anonymity tool: it’s how you reach your own machines privately instead of exposing them to the internet. Free personal tier.
  • Cloudflare 1.1.1.1 + WARPCloudflare’s free app: private DNS (1.1.1.1) plus WARP, a WireGuard-based tunnel that encrypts your device’s traffic so your ISP and the coffee-shop Wi-Fi can’t see it. Not anonymity (Cloudflare can see the traffic) — but a huge privacy upgrade on untrusted networks.
  • Cloudflare OneThe enterprise sibling: Cloudflare’s SASE / zero-trust platform — the same WARP agent plus identity-aware access, secure web gateway, and network firewall for organizations replacing VPNs.

Privacy Advocacy

  • EFF PrivacyEFF fights in the courts and Congress to maintain your privacy rights in the digital world, and works with partners around the globe to support privacy-protecting technologies.

Secure Messaging

  • SignalEnd-to-end encrypted messaging and calls; the reference standard. Open-source, nonprofit-run, and collects essentially no metadata.
  • TelegramCloud messaging with optional end-to-end “secret chats.” Note the default: ordinary chats are encrypted to Telegram’s servers, not end-to-end.
  • ElementMatrix-protocol client for decentralized, federated encrypted chat — run your own server or pick one you trust.

Credit Freeze & Identity Lock-Down

For students and readers: the complete identity lock-down. Freezing your credit is free, takes about half an hour, and closes the door most identity theft walks through. Do all of it — the secondary agencies are the gaps thieves actually use. Background: my identity-theft essay.

  • EquifaxBig-three bureau #1 — freeze and unfreeze online, free.
  • ExperianBig-three bureau #2 — decline the paid “lock” upsell; the free freeze is the legal protection.
  • TransUnionBig-three bureau #3 — free freeze, ignore the paid monitoring offers.
  • ChexSystemsThe agency banks use when opening checking/savings accounts — freezing it blocks fraudulent bank accounts in your name.
  • NCTUEThe telecom & utilities exchange, used for phone/cable/utility applications — a favorite bypass when the big three are frozen. Online or 1-866-349-5355.
  • InnovisThe “fourth bureau.” Less used, still worth closing off.
  • Social Security: block electronic accessCall the SSA at 1-800-772-1213 (or visit a local office) to block electronic and phone access to your record, so no one can hijack or redirect benefits online.
  • Create your mySSA accountClaim your own account before someone else does; review your earnings record yearly.
  • myE-Verify Self LockLocks your SSN in E-Verify so it can’t pass employment-eligibility checks — blocking employment fraud with your number.
  • OptOutPrescreenThe official bureau-run opt-out from pre-screened credit offers — removes the “pre-approved” mail that makes mailbox theft profitable. Choose the permanent option.

↑ Back to top

44 entries

Organizations & Conferences

Professional Associations

  • CompTIAThe Computing Technology Industry Association — the non-profit trade association behind the IT industry’s best-known professional certifications.
  • AITPThe Association of Information Technology Professionals — founded in Chicago in 1949, focused on education for business professionals in IT, with 62 local and 286 student chapters.
  • EFFThe Electronic Frontier Foundation — the leading nonprofit defending civil liberties in the digital world since 1990: user privacy, free expression, and innovation through litigation, policy, and technology.
  • DAMAData Management Association International — a vendor-independent global association advancing information and data management practice.
  • ASISASIS International — a global community of security practitioners protecting assets: people, property, and information.
  • ACMThe Association for Computing Machinery — the world’s largest educational and scientific computing society, with the field’s premier Digital Library, publications, and conferences.
  • InfraGard🇺🇸 The FBI/private-sector partnership protecting U.S. critical infrastructure: education, information sharing, networking, and workshops on emerging threats.
  • InfraGard: become a memberMembership is free, vetted by the FBI, and open to U.S. persons working in or with critical infrastructure.
  • SNIAThe Storage Networking Industry Association — vendor-neutral standards, education, and certification for data infrastructure.
  • IAPPThe International Association of Privacy Professionals — the largest global information privacy community, defining and improving the privacy profession.
  • ISAThe International Society of Automation — the globally trusted provider of foundational standards-based resources for industrial automation.

Industry & Business Networks

  • ACGThe Association for Corporate Growth — since 1954, serving 90,000 investors, executives, lenders, and advisers to growing middle-market companies.
  • TMAThe Turnaround Management Association — the most professionally diverse organization in corporate restructuring, renewal, and corporate health; ~10,000 members in 54 chapters.
  • CampITSince 1984, CAMP IT Conferences help IT leaders make critical strategic decisions — over 50,000 enterprise IT executives have attended.

Government Agencies

Conferences & Events

  • DEF CONThe world’s largest and longest-running hacker conference (Las Vegas, every August since 1993): villages, CTFs, lockpicking, and the talks everyone else quotes for the rest of the year. If you attend one security conference, make it this one.
  • Black HatThe most technical information-security research event series, held annually in the US, Europe, and Asia — DEF CON’s corporate sibling, run the same week in Las Vegas.
  • RSA ConferenceThe security industry’s biggest business gathering (San Francisco each spring) — where vendors, CISOs, and policymakers meet.
  • THOTCONChicago’s own hacking conference: non-profit, low-cost, no-frills, genuinely excellent talks. Tickets sell out fast.
  • Security BSidesThe global framework for community-organized security conferences — hundreds of volunteer-run, low-cost events where first-time speakers and local communities get their stage.
  • BSides ChicagoChicago’s BSides.
  • BSides312The Loop’s newer BSides, named for the area code.
  • HOPEHackers On Planet Earth — the biennial New York conference from the 2600 community: hacking in its broadest civic sense.
  • Chaos Communication CongressThe Chaos Computer Club’s legendary end-of-year congress — Europe’s largest hacker gathering, deeply technical and deeply political (streamed and archived free).
  • Enterprise ConnectThe leading conference for enterprise communications and collaboration technology.
  • Infosec Conferences DirectoryA maintained directory of upcoming security conferences worldwide — the answer to “what’s happening near me?”

Chicago InfoSec Community

The community I’m part of. Chicago has one of the strongest regional security scenes in the country — here’s where to plug in:

  • Chicago InfoSec Events CalendarThe community-maintained calendar of every security meetup, conference, and gathering in Chicagoland. Start here.
  • BurbsecThe long-running suburban Chicago security meetup family — multiple monthly gatherings, no membership, just show up.
  • Chicago Code & CoffeeCasual weekend co-working and networking for developers and technologists of all levels.
  • Chi Hack NightChicago’s weekly civic-technology night — volunteers using data and code for the public good, and the best on-ramp into Chicago’s tech community.

Community chat — the Discord servers and Slack workspaces where these communities live day to day:

DiscordBurbsec Hack The Box TryHackMe Google Labs WiCyS DePaul Proton Secure Controls Framework DePaul Security Daemons (signup) DePaul CS Society /r/sysadmin
SlackMac Admins Chicago Tech

↑ Back to top

Something missing?

These lists improve when readers argue with them. If a tool or course belongs here — or has rotted — tell me.

Suggest a resource →