Security
The protection of systems, information, resources, and operations against unauthorized access, use, disclosure, alteration, disruption, or destruction.
AI for Everyday IT
Cybersecurity is the practice of protecting digital systems, networks, applications, and data from threats and unauthorized activity.
- How it is used
- Applies security controls to AI document handling, email analysis, generated code, and function-calling applications.
- How deep it goes
- Explains practical controls, verification, logging, and adversarial testing, while stopping short of detailed security theory.
- Examples
- Uses sensitive-document handling, document anonymization, suspicious-email analysis, AI-generated code review, and database query assistants.
- What you can do after
- Operate AI-assisted workflows safely by restricting access, validating outputs, logging activity, and testing defenses.
Build AI-Enhanced Web Apps
Protection of generative AI capabilities, application resources, and their outputs against unauthorized access, malicious misuse, and harmful exploitation.
- How it is used
- Protects publicly accessible AI features, paid API capacity, user data, and generated outputs from unauthorized access and misuse.
- How deep it goes
- Develops layered request controls and deployment checks, while identifying malware scanning and encrypted document storage as further improvements.
- Examples
- Uses an AI interview assistant’s middleware and a RAG application’s document-upload pipeline to illustrate distinct security controls.
- What you can do after
- Apply it via middleware, authentication, rate limiting, secret management, and upload validation when preparing an AI web application for public use.
The Art of AI Product Development
Cybersecurity is the practice of protecting computer systems, networks, software, and data from unauthorized access, disruption, alteration, or attack.
- How it is used
- Protects sensitive assets and customer trust as AI products move from development into production.
- How deep it goes
- Develops a three-level threat frame and procedural data safeguards, while directing readers elsewhere for a detailed CIA-triad explanation.
- Examples
- Uses exfiltration through a recommendation feature and the resulting review of data flows, access controls, monitoring, and audits.
- What you can do after
- Practice/perform security governance by tracing sensitive data flows, restricting access, and arranging monitoring and audits.
Read how The Art of AI Product Development explains security →
Effective Data Analysis
Data protection is the safeguarding of personal information through controls on its collection, access, processing, storage, sharing, retention, and deletion.
- How it is used
- Frames responsible analytics practice around protecting personal and sensitive data while honoring individual rights.
- How deep it goes
- Defines regulatory expectations and practical safeguards, but stops short of detailed implementation procedures or technical security architecture.
- Examples
- Uses PII, PHI, financial information, authentication credentials, sector-specific laws, and product-analytics consent documents as concrete cases.
- What you can do after
- Operate/configure data practices by limiting access, reducing collection, protecting storage, explaining use, and supporting deletion or withdrawal.
Introduction to Generative AI, Second Edition
Security is the protection of an AI system, its data, and its interactions from unauthorized access, manipulation, disruption, or attack.
- How it is used
- Frames security as both a defensive use of AI agents and a responsibility when deploying systems vulnerable to misuse.
- How deep it goes
- Surveys threats, defensive workflows, oversight, and governance without giving implementation steps or security configuration instructions.
- Examples
- Uses security-center alert triage, PentestGPT penetration testing, and Cortex XSOAR containment workflows as concrete cases.
- What you can do after
- Evaluate/understand defensive agent roles and why automated security actions still require human oversight.
Read how Introduction to Generative AI, Second Edition explains security →
Delivering Machine Learning Projects: From design to deployment
Data security is the protection of data from unauthorized access, disclosure, alteration, loss, or destruction.
- How it is used
- Frames security as a pre-project requirement that affects risk, resourcing, and the viability of ML delivery.
- How deep it goes
- Identifies requirements and governance checks but does not specify technical security controls or an implementation procedure.
- Examples
- Uses personal data of unknown origin to illustrate a sourcing and privacy risk.
- What you can do after
- Evaluate/understand security and privacy requirements before committing resources, including their potential costs and governance implications.
Read how Delivering Machine Learning Projects: From design to deployment explains security →
Think Like a CTO
An operational setting in which systems, data, and activities are protected against unauthorized access, misuse, disruption, or compromise.
- How it is used
- Frames security as a continuing executive responsibility across systems, development, backups, and communication.
- How deep it goes
- Sets out identify, protect, and monitor as guiding actions, with concrete build and archive precautions rather than implementation-level instructions.
- Examples
- Uses the SolarWinds update attack, exposed cloud file storage, and accessible backup archives to show how protections can fail.
- What you can do after
- Practice/perform a recurring security review that includes development and backup access, not just production defenses.
Machine Learning System Design
Security is the protection of a system, its models, data, and interfaces from unauthorized access, misuse, or compromise.
- How it is used
- Frames security as a serving and inference design requirement shaped by deployment platform, data exposure, and model accessibility.
- How deep it goes
- Identifies platform risks and practical controls but defers detailed security treatment beyond protocols, isolation, credentials, and deployment tradeoffs.
- Examples
- Uses mobile model deployment, large language model jailbreaks, and isolated AWS batch forecasting for sensitive retail data.
- What you can do after
- Operate/configure serving systems with platform-appropriate protections, secured infrastructure, access controls, and explicit security tradeoffs.
Spring Security in Action, Second Edition
Software security is the protection of software applications and their data against unauthorized access, misuse, disruption, and other security threats.
- How it is used
- Protects applications and data by treating security as an early, cross-cutting concern applied through multiple layers.
- How deep it goes
- Surveys data, memory, communication, and system layers, but focuses on Spring Security rather than every security layer.
- Examples
- Uses DDoS participation, heap dumps, intercepted messages, impersonation, and exposed logs or errors as vulnerability examples.
- What you can do after
- Apply layered protection to Spring applications and identify where application-level security does not address lower-layer threats.
Read how Spring Security in Action, Second Edition explains security →
Data-Driven Cybersecurity
Information security is the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
- How it is used
- Frames protection of critical data as an ongoing organizational risk-management task.
- How deep it goes
- Defines data-security goals and identifies protective layers, policies, and metrics, without specifying a complete control implementation.
- Examples
- Illustrates layered protection with a data-vault analogy and multichannel phishing with a voice-cloned IT call.
- What you can do after
- Evaluate/understand security controls using access, training, encryption, incident-response, and availability metrics.
Kafka for Architects
Security is the protection of systems, data, and operations against unauthorized access, misuse, disruption, or compromise.
- How it is used
- Secures Kafka deployments end to end while aligning authentication, authorization, encryption, networking, compliance, and operational complexity.
- How deep it goes
- Defines the security model and architectural trade-offs, then applies protocols and ACLs to a deployment without providing detailed setup instructions.
- Examples
- Uses a Customer 360 deployment, topic-level ACLs, mTLS client traffic, SASL internal traffic, and documented component communication paths.
- What you can do after
- Operate/configure Kafka security by selecting authentication, encryption, ACL, and network controls for each communication path.
Quarkus in Action
Security is the protection of software systems, data, and communications against unauthorized access, misuse, or disruption.
- How it is used
- Secures Quarkus web applications and multiple cooperating services through authentication, identity providers, tokens, credential stores, and request filters.
- How deep it goes
- Demonstrates OIDC authentication and Dev Services configuration, but only briefly mentions JWT, credential stores, and CORS without practical examples.
- Examples
- Uses shared Keycloak development services, a login screen, secured HTTP paths, logout configuration, and authenticated greetings for Alice and Bob.
- What you can do after
- Operate/configure Quarkus authentication with Keycloak, OIDC settings, shared Dev Services, and authenticated application routes.
Azure Security
Cybersecurity is the practice of protecting digital systems, data, identities, applications, and networks from unauthorized access, disruption, or misuse.
- How it is used
- Frames Azure security as continuous protection of identities, data, applications, infrastructure, and networking resources.
- How deep it goes
- Explains threats, shared responsibility, iterative posture improvement, and layered defense without detailing individual service configurations.
- Examples
- Uses exposed virtual machines, leaked credentials, unencrypted repository secrets, ransomware, and misconfigurations as concrete threat examples.
- What you can do after
- Evaluate security posture and apply multiple Azure security services as evolving, layered controls.
Generative AI in Action
Security is the protection of systems, data, and services against unauthorized access, alteration, disruption, or destruction.
- How it is used
- Protects enterprise GenAI applications, user data, infrastructure, and services during production deployment.
- How deep it goes
- Explains encryption, access control, audits, and anomaly detection operationally, while stopping short of detailed implementation procedures.
- Examples
- Uses TLS, cloud encryption, RBAC, least privilege, compliance audits, anomaly detection, Azure OpenAI controls, and enterprise-controlled RAG data.
- What you can do after
- Operate/configure production GenAI security using encryption, access controls, audits, anomaly monitoring, and controlled data retrieval.
Microsoft Azure in Action
Security is the protection of systems, data, applications, and infrastructure against unauthorized access, misuse, disruption, or damage.
- How it is used
- Frames security as a continuous Azure design responsibility spanning infrastructure, access, data, monitoring, and database choices.
- How deep it goes
- Explains a layered security continuum with concrete VM, storage, and database controls, but does not provide exhaustive configuration procedures.
- Examples
- Uses Azure virtual machines, Azure Storage, Banning Books, and competing relational databases to illustrate protection decisions.
- What you can do after
- Evaluate Azure security choices by balancing access controls, encryption, monitoring, cost, performance, and continuity requirements.
First-Party Data Activation
Security is the protection of data and systems against unauthorized access, disclosure, alteration, or destruction.
- How it is used
- Protects customer data, preserves trust, and guides privacy-conscious marketing architecture and technology decisions.
- How deep it goes
- Explains controls, organizational accountability, standards, and data-hosting models without descending into implementation procedures.
- Examples
- Uses the Equifax breach, encryption, audits, incident response, SOC 2, ISO 27001, and composable data-hosting comparisons.
- What you can do after
- Evaluate marketing-data solutions by their controls, certifications, hosting model, regulatory fit, and handling of sensitive first-party data.
Apache Kafka in Action
Security is the protection of systems, data, and services against unauthorized access, misuse, disruption, or compromise.
- How it is used
- Protects Kafka data, clients, and services while maintaining trusted access across enterprise streaming environments.
- How deep it goes
- Explains authentication, authorization, encryption, monitoring, and a staged migration, but does not provide exact configuration commands.
- Examples
- Uses payment-data exposure, unsecured-to-secured migration, security metrics, and isolated clusters for sensitive departmental data.
- What you can do after
- Operate/configure Kafka security by adding TLS listeners, migrating clients, managing credentials, enforcing ACLs, and monitoring security signals.
Starting Data Analytics with Generative AI and Python
Protection of systems, data, and operations against unauthorized access, misuse, disruption, or compromise.
- How it is used
- Protects generative-AI analytics against sensitive-data exposure, unsafe model changes, insecure providers, and regulatory or reputational harm.
- How deep it goes
- Maps security across models, infrastructure, communications, storage, logs, and providers, then stops short of detailed implementation.
- Examples
- Uses leaked sensitive information, prompt-history exposure, and downloaded-model checks involving verification, isolation, scanning, and least privilege.
- What you can do after
- Operate AI workflows more safely by assessing providers, isolating tests, restricting permissions, protecting data, and reviewing model changes.
Read how Starting Data Analytics with Generative AI and Python explains security →
LLMs in Production
Security is the protection of systems, data, and operations against unauthorized access, misuse, disruption, or compromise.
- How it is used
- Frames security as a production requirement for LLM applications and agent integrations.
- How deep it goes
- Explains ordinary controls, two major failure cases, prompt injection, sandboxing, and filtering without detailing implementation procedures.
- Examples
- Uses an email-writing agent, tool integrations, internet browsing, malicious prompts, malware, and proprietary secrets.
- What you can do after
- Operate/configure LLM agents with sandboxing, containment, standard application controls, and prompt-filtering defenses.
Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform
- How it is used
- Shifts security left by auditing infrastructure configuration and access policies before systems reach production.
- How deep it goes
- Explains preventive checks, access auditing, breach remediation, and module review, but defers detailed security patterns.
- Examples
- Uses object-store policies, firewall rules, and a database module exposing neither secrets nor third-party data.
- What you can do after
- Evaluate infrastructure configurations and external modules for exposure, unauthorized access, data leakage, and compliance failures.
Machine Learning Platform Engineering
Security is the protection of software, models, data, and infrastructure from unauthorized access, misuse, compromise, or attack.
- How it is used
- Protects data pipelines and deployed models from privacy breaches, information leakage, misuse, and adversarial attacks.
- How deep it goes
- Identifies security risks across ML operations and deployment but stops short of specifying controls, implementations, or attack procedures.
- Examples
- Uses data collection, large-scale data management, and model serving as concrete security contexts.
- What you can do after
- Evaluate security and privacy risks in ML data workflows and deployed model-serving environments.
Read how Machine Learning Platform Engineering explains security →
API Design Patterns
Security is the protection of systems and resources against unauthorized access, misuse, or exploitation.
- How it is used
- Guides API resource identification, method behavior, and representation boundaries to reduce unauthorized discovery and access leaks.
- How deep it goes
- Explains key unpredictability, authorization-error ambiguity, and restricted sub-resources, but stops short of implementation code.
- Examples
- Uses sequential versus random identifiers, 404 versus 403 responses, and employee compensation separated from ordinary employee data.
- What you can do after
- Apply security by choosing unpredictable identifiers, consistent authorization responses, and separate resources for highly restricted data.
Google Anthos in Action
Security is the protection of applications, services, and data against unauthorized access, misuse, disruption, or compromise.
- How it is used
- Frames security as a production-readiness concern spanning cluster configuration, workloads, images, networks, identities, and operational maintenance.
- How deep it goes
- Explains attack surfaces and enumerates controls, while deferring detailed Policy Controller policy implementation.
- Examples
- Uses root containers, privileged containers, image scanning, Gatekeeper policies, binary authorization, TLS, and network isolation as concrete security examples.
- What you can do after
- Operate and configure Kubernetes security with ACM, Gatekeeper, vulnerability scanning, binary authorization, and service-mesh controls.
Software Testing with Generative AI
A quality characteristic concerning protection against unauthorized access, misuse, alteration, disclosure, or loss.
- How it is used
- Uses security as a quality characteristic for analyzing risks during AI-assisted code development and testing.
- How deep it goes
- Defines security as a risk category and demonstrates prompt structure, but stops short of detailed security-testing procedures.
- Examples
- Uses a buffer-overflow example and a booking method containing validation, database, and message-posting operations.
- What you can do after
- Diagnose candidate security risks by applying a structured prompt to delimited code and reviewing the resulting explanations.
Read how Software Testing with Generative AI explains security →
Bootstrapping Microservices, Second Edition: With Docker, Kubernetes, GitHub Actions, and Terraform
Data protection is the set of practices for preventing data from being damaged, lost, overwritten, or deleted.
- How it is used
- Uses security to protect microservice data, infrastructure, customer communications, and application operations from failures and malicious use.
- How deep it goes
- Explains backups, restoration, source-data immutability, service boundaries, and core controls, but defers comprehensive security treatment.
- Examples
- Demonstrates automated backups, practiced restoration, three-place storage, gateway exposure, and shielding RabbitMQ and MongoDB.
- What you can do after
- Apply backups, restoration drills, immutable source capture, service isolation, authentication, authorization, and encryption.
Inside AI
Security is the protection of systems, data, and operations from threats, misuse, disruption, or unauthorized access.
- How it is used
- Frames security as a requirement for critical AI systems and links cyber defense with risks from AI-enabled attacks.
- How deep it goes
- Illustrates security risks through ransomware incidents and broad AI applications, but gives little detail on defensive controls.
- Examples
- Uses file-encrypting ransomware and the Colonial Pipeline shutdown to illustrate operational disruption and ransom pressure.
- What you can do after
- Understand how AI can support threat detection while also enabling cyberattacks and operational disruption.
Data Pipelines with Apache Airflow, Second Edition
Security is the protection of systems and data against unauthorized access, misuse, alteration, or disruption.
- How it is used
- Protects Airflow installations and connected systems by limiting unauthorized access and reducing the potential attack surface.
- How deep it goes
- Explains layered controls through RBAC, LDAP, TLS, Fernet encryption, and centralized secrets management.
- Examples
- Uses RBAC, LDAP, HTTPS, Fernet keys, HashiCorp Vault, and containerized dependencies as security examples.
- What you can do after
- Configure Airflow access controls, encrypted traffic, database secrets, centralized secret storage, and safer task dependencies.
Read how Data Pipelines with Apache Airflow, Second Edition explains security →
Financial AI in Practice
The protection of systems, information, and operations against unauthorized access, disruption, or harm.
- How it is used
- Protects financial AI systems before model processing and supports public trust in a regulated environment.
- How deep it goes
- Specifies authentication, usage-policy enforcement, and PII stripping or masking before model access, without implementation details.
- Examples
- Illustrates protecting a user query by masking customer PII before it reaches the model.
- What you can do after
- Operate/configure a front-door layer to authenticate users, enforce usage policies, and strip or mask PII before model processing.
Related concepts
- encryptionuses · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.
- authorizationuses · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
- authenticationhas part · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- threat modelused by · A threat model is a structured analysis or representation of a system’s relevant threats, adversaries, assets, attack paths, assumptions, and possible mitigations.
- AI agentused by · An AI agent is a computational system that uses artificial intelligence to interpret information, select actions, and pursue goals through interaction with an environment.
- CIA triadmeasured by · The CIA triad is an information-security model comprising confidentiality, integrity, and availability as core protection objectives.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.