Selective Reading Guide

Full-book reading is not required. Use NIST SP 800-63 for identity, protocol RFCs for exact behavior, OWASP ASVS for verification requirements, and Building Secure and Reliable Systems for operational controls.

Required evidence

Submit diagrams, versioned configuration, runnable positive and negative tests, audit events, one rejected design, remediation record, and residual-risk owner. Scanner output without mechanism-level triage does not pass.

Oral defense

Name the attacker and asset, explain the exact control property, demonstrate a denied misuse case, and execute revocation or safe recovery.

Source backbone

Use NIST SP 800-63, OWASP ASVS, relevant RFCs, and Building Secure and Reliable Systems.