Reading list

• SandwormAndy Greenberg · 2019 · Cyber warfare & conflictRead this first if you want to understand how a state cyber unit turns network access into physical and economic damage. Use it as the baseline case study for every Russian destructive-attack assessment on this platform.Foundational
• This Is How They Tell Me the World EndsNicole Perlroth · 2021 · Cyber warfare & conflictRead this to understand the zero-day market that supplies both United States offensive programs and their adversaries. It reframes vulnerability equities as a policy choice with direct defensive cost.Foundational
• Countdown to Zero DayKim Zetter · 2014 · Cyber warfare & conflictThis is the definitive open-source reconstruction of Stuxnet and the clearest account of a cyber operation with a kinetic effect. Treat it as the reference model for operational-technology targeting analysis.Intermediate
• The Perfect WeaponDavid E. Sanger · 2018 · Policy & strategyRead this for how United States decision makers actually weigh cyber options against diplomatic and military ones. Use it to interpret why response to a major intrusion is often slower and quieter than the reporting suggests.Foundational
• Dark Territory: The Secret History of Cyber WarFred Kaplan · 2016 · Policy & strategyThis traces how United States cyber authorities, the National Security Agency and United States Cyber Command arrived at their current shape. Read it before forming judgments about which organization owns a given mission.Intermediate
• Cyber War Will Not Take PlaceThomas Rid · 2013 · Policy & strategyRead this as the strongest counterargument to cyber-war maximalism, arguing most activity is sabotage, espionage or subversion. Use its categories to keep assessments precise about what an incident actually is.Advanced
• Active MeasuresThomas Rid · 2020 · Threat actors & espionageThis is the history of disinformation as a professional intelligence discipline, from forged documents to hack-and-leak. Read it before analyzing any influence operation touching United States networks or elections.Intermediate
• The Cuckoo's EggCliff Stoll · 1989 · Threat actors & espionageThe first documented counterintelligence hunt for a state-sponsored intruder, and still the best teaching text on patient detection work. Read it to internalize how anomaly, logging and persistence beat tooling.Foundational
• Psychology of Intelligence AnalysisRichards J. Heuer Jr. · 1999 · Analytic thinkingThis is the source text for the analytic standards this platform writes to, including Analysis of Competing Hypotheses. Read it before you write a single assessment with a confidence level attached.Foundational
• Structured Analytic Techniques for Intelligence AnalysisRandolph H. Pherson and Richards J. Heuer Jr. · 2020 · Analytic thinkingUse this as the working handbook once you accept Heuer's diagnosis of bias. Pick one technique per assessment and apply it deliberately rather than reading the book end to end.Intermediate
• SuperforecastingPhilip E. Tetlock and Dan Gardner · 2015 · Analytic thinkingRead this to make probabilistic judgments that can actually be scored. Adopt its habit of numeric estimates and post-event review for your own cyber forecasts.Foundational
• The Art of DeceptionKevin D. Mitnick · 2002 · Technical & defensiveSocial engineering remains the highest-yield initial access vector, and this is the clearest catalog of the techniques. Read it to design awareness controls that target process, not just user behavior.Foundational
• Practical Malware AnalysisMichael Sikorski and Andrew Honig · 2012 · Technical & defensiveThis is the standard lab-based introduction to reverse engineering hostile code. Work the exercises rather than reading it if you want the capability to stick.Advanced
• Intelligence-Driven Incident ResponseRebekah Brown and Scott J. Roberts · 2023 · Technical & defensiveThis is the operational bridge between intelligence analysis and incident response, built around the F3EAD cycle. Read it to make your threat reporting actually change defensive action.Intermediate
• Rise of the MachinesThomas Rid · 2016 · Cyber warfare & conflictRead this for the intellectual history behind the word cyber and the machine-control ideas that produced current doctrine. It explains why so much strategy language rests on metaphors that were never tested.Advanced
• @War: The Rise of the Military-Internet ComplexShane Harris · 2014 · Threat actors & espionageThis documents how United States military and intelligence cyber missions fused with private-sector capability. Read it to understand why so much national defense now depends on vendor telemetry.Intermediate
• Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SISTyson Macaulay and Bryan Singer · 2011 · Technical & defensiveRead this before assessing any claim about grid, water or manufacturing intrusions, because it explains why operational technology cannot be defended like information technology. Use it to judge whether reported access actually translates into physical effect.Advanced
• Cyber Security: Power and TechnologyMartti Lehto and Pekka Neittaanmaki, editors · 2018 · Policy & strategyUse this edited volume when you need the link between national cyber power and the technical capability that underwrites it. Read selected chapters rather than cover to cover, matching the chapter to the assessment you are writing.Advanced
• Analytics and Modern Warfare: Dominance by the NumbersMichael Taillard · 2014 · Analytic thinkingRead this to put quantitative structure behind judgments that are usually made on narrative alone. Apply its models to force, cost and incentive questions before you assign confidence to a strategic assessment.Intermediate

All entries are publicly published books. Nothing on this page draws on classified or non-public material.