Foray / SecuritySecurity roadmap Protect systems end to end: hosts, networks, identities, secrets and cryptography, applications, containers and clouds, the pipeline that ships them, and how to detect, respond and prove it. A broader map than DevSecOps, with the gaps shown.
15 topics · 75 nodes · 56 covered · 2 partly · 17 planned · updated 2026-10-17
Sign in with your Mycelium account to see which nodes you have finished.
Show Whole map Gaps only 1. Core
Security thinking Models and habits before tools: who attacks what, and what you are protecting.
3 / 4 covered
Security as part of engineering Covered Least privilege and defence in depth Partly covered Threat modelling Covered Security culture and metrics Covered 2. Core
Linux and host security Every workload runs on a host. Harden it and watch it.
6 / 7 covered
Accounts and privilege Covered Auditing and log hygiene Covered Namespaces and cgroups Covered Hardening baselines (CIS) Planned SELinux and AppArmor Covered Kernel parameters Covered Patching and updates Covered 3. Core
Network security Control and protect what crosses the wire.
5 / 6 covered
Network security fundamentals Covered TLS and certificates Covered Hardening web servers and proxies optional Covered Host firewalls and stateful filtering Covered VPNs and WireGuard Covered IDS/IPS, WAFs and DDoS protection Planned 4. Core
Secure remote access SSH is the front door to most servers.
5 / 5 covered
Keys instead of passwords Covered Key rotation and lifecycle Covered Bastions and tunnels in production Covered Hardening sshd Covered SSH certificates and hardware keys Covered 5. Core
Identity and access management Who is asking, and what may they do?
4 / 7 covered
Identity and access Covered RBAC in Kubernetes Covered SSO, OIDC and SAML Planned Directory services optional Planned Cloud IAM Covered Workload identity and mutual TLS Covered MFA and passkeys Planned 6. Core
Secrets and cryptography Keep credentials out of the wrong hands, and encrypt what matters.
4 / 6 covered
Secrets management Covered Secrets in Kubernetes and GitOps Covered Cryptography fundamentals Planned Secrets in scripts, Terraform and Ansible Covered Encryption and key management in the cloud Covered PKI and running a certificate authority optional Planned 7. Core
Application security Most breaches start in code or in what the code depends on.
3 / 4 covered
Secure coding and the OWASP Top 10 Covered SAST and DAST in practice Covered Dependencies and known vulnerabilities Covered API and authentication security Planned 8. Core
Containers and Kubernetes security Secure the images, the runtime and the cluster.
5 / 5 covered
Container image security Covered Network policies Covered Runtime security and detection Covered Pod security and security contexts Covered Kubernetes security Covered 9. Core
Cloud security Misconfiguration, not exploits, causes most cloud incidents.
4 / 6 covered
AWS security services Covered Infrastructure as code security Covered Cloud security posture management optional Planned Multi-account strategy Covered The Well-Architected security pillar Covered Azure and GCP security pick one Planned 10. Core
Pipeline and supply-chain security The pipeline holds the keys to production. Protect it, and know what you ship.
5 / 5 covered
Securing the pipeline Covered Software supply chain security Covered Securing automation and GitOps Covered Securing workflows Covered Signed commits and tags Covered 11. Core
Detection and incident response Assume breach: see it, contain it and learn from it.
4 / 6 covered
Incident response for cloud-native systems Covered Investigating with telemetry Covered Forensics and threat hunting optional Planned Incident management Covered SIEM and detection engineering Planned Game days and readiness optional Covered 12. Recommended
Vulnerability management Find, prioritise and fix, continuously.
2 / 3 covered
Vulnerability management Covered Patching process Partly covered Scanning images and dependencies Covered 13. Recommended
Resilience against attack Be able to recover even if prevention fails.
3 / 3 covered
Ransomware and immutable backups Covered Business continuity optional Covered Recovery runbooks and DR Covered 14. Recommended
Compliance and governance Prove that the controls exist and work.
3 / 5 covered
Compliance as code Covered Retention and data lifecycle Covered Privacy and data protection (GDPR) optional Planned Paved roads and guardrails Covered SOC 2, ISO 27001 and PCI DSS Planned 15. Optional
Offensive security Thinking like an attacker makes defences better.
0 / 3 covered
Penetration testing basics Planned CTFs and bug bounties Planned Red teaming and adversary simulation Planned © 2026 Konstantinos Maglaras
