Skip to content
View abdullahzarshaid's full-sized avatar
2 followers · 6 following

Block or report abdullahzarshaid

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
abdullahzarshaid/README.md

Abdullah Bin Zarshaid

Abdullah Bin Zarshaid, Cybersecurity, Information Security, GRC and Corporate Training

Abdullah Bin Zarshaid

Cybersecurity Manager & Security Researcher

Information Security · GRC · Security Assessment · Corporate Training

I work as a cybersecurity manager, combining hands-on security assessment with information-security governance, risk and compliance. My work spans web and API security, network security, practical tooling, research and teaching. This portfolio brings together tools I build, coauthored research and learning resources.

My personal site is abdullahzarshaid.com. This GitHub account holds my own tools, research and teaching material.

Run the Security Self-Assessment · Try PostureKit · Try EvidenceGate · Read the handbook · Open the GRC Documentation Kit

Latest (26 October 2026): the new Security and Compliance Self-Assessment is live, fifteen in-browser readiness assessments (NIST CSF 2.0, ISO 27001, SOC 2, cloud and identity, AI security, incident response, GDPR, vendor risk, recovery, secure delivery and more) plus five hands-on security tools, where every gap links straight to a remediation template. It pairs with the GRC Documentation Kit, 121 original documents and 56 Excel registers for ISO/IEC 27001, ISO/IEC 27701, SOC 2, GDPR, HIPAA and AI governance, with a crosswalk between them and a searchable online site. PostureKit 0.6, EvidenceGate 1.0.0, the handbook's October 2026 edition and the GRC trackers 1.0.1 are tagged releases. Next: a Web and API penetration testing manual, lab targets only, written from the basics up.

Connect on LinkedIn Personal website View ORCID research profile Email Abdullah

Choose your starting point

Use a tool: PostureKit demo · EvidenceGate demo

Learn the workflow: From Scope to Security Evidence

Run security work in spreadsheets: six GRC trackers, pick one online

  • PostureKit: Windows, directory and wireless configuration assessment: evidence collection, rule-based analysis and scanner imports. Project page.
  • EvidenceGate: local integrity, HTTP capture-structure, CVSS and scope checks for security assessments. Project page.
  • Security and Compliance Self-Assessment: fifteen free, in-browser readiness assessments (NIST CSF 2.0, ISO 27001, SOC 2, cloud, AI, incident response, GDPR, vendor risk and more) on an honest five-point evidence scale, plus five security tools (subnet calculator, JWT inspector, header analyzer, access-control demo, risk matrix). Answers never leave your browser, and every gap links to a remediation template. Run it online.
  • GRC Documentation Kit: 121 original policies, procedures, registers and playbooks for ISO/IEC 27001, ISO/IEC 27701, SOC 2, GDPR, HIPAA and AI governance, in Markdown, Word and Excel, with a crosswalk between the frameworks. Read online.
  • GRC Excel Starter Templates: six original MIT-licensed blank trackers for risk, evidence, remediation, vendors, policies and assessment scope. Not complete framework checklists or certification tools. Browse online.
  • Network Security Assessment Handbook: methodology, worked scenarios and protocol reference. Read online.
  • Ethical Hacking Labs: 19 topic guides for isolated practice, with credited student examples.

Research & contributions

CWE proposal, explicit session termination

I submitted Improper Enforcement of Explicit Session Termination to the CWE Program. The proposal is publicly tracked in the CWE Content Development Repository, issue #224, submission ES2609-7b54439f.

Status checked 25 September 2026: receipt acknowledged (Phase02-Ack-Receipt); evaluation pending. This is a proposal, not an assigned or accepted CWE entry. The linked issue is the source for subsequent status changes.

Session-lifecycle research

Lifecycle Conditions in CWE-613 Disclosures: A Reproducible, Evidence-Linked Characterisation (earlier working title Logout Is Not Expiration), with Shahbaz Akhtar Siddiqui. Manuscript under peer review; the data and code repository will be opened when the review concludes. Record on ORCID.

Tools & technology

Build & automate

Python   PowerShell   Bash   Git

Python · PowerShell · Bash · Git

Platforms & environments

Kali Linux   Linux   Docker   Microsoft Azure

Kali Linux · Linux · Docker · Microsoft Azure

Security assessment & analysis

Burp Suite   Nmap   Wireshark   Metasploit

Burp Suite · Nmap · Wireshark · Metasploit

Also in the assessment workflow: Greenbone / OpenVAS and Active Directory.

How I approach the work

  • Evidence before conclusions. Keep observations, interpretations and confirmed impact distinct.
  • Clear scope. Assess only authorized systems; keep private engagement material out of public examples.
  • Useful artifacts. Prefer inspectable Python and PowerShell, documented limits and reproducible examples.

Across the security lifecycle

  • Assess & investigate: Web and API security; network and wireless assessment; Windows, Active Directory and cloud configuration.
  • Govern & improve: Information-security governance; risk assessment; control mapping; evidence quality and remediation tracking.
  • Teach & research: Corporate training; practical labs; assessment methodology; reproducible security research.

Teaching materials retain contributor credit; research identifies its coauthors and publication status in the project repository. My earlier master's work on SDN-enabled IoT security is being revisited; it is not presented here as a new released tool or a published result.

Useful community resources

OWASP · NIST Cybersecurity Framework · MITRE ATT&CK · PortSwigger Web Security Academy

These are independent third-party resources, not my projects or endorsements of my work.

Connect

LinkedIn · Website · ORCID · Email

For a tool issue, please use its repository's issue tracker with a synthetic, sanitized example, never live credentials or client evidence.

Pinned Loading

  1. ethical-hacking-labs ethical-hacking-labs Public

    19 ethical-hacking topic guides: isolated practice, assessment evidence and defensive controls, with credited student examples.

    16

  2. evidencegate evidencegate Public

    Local evidence-quality checks for security assessments: SHA-256 integrity, CVSS 3.1, HTTP capture structure, scope and selected secret patterns.

    Python

  3. network-security-assessment-handbook network-security-assessment-handbook Public

    A 138-page practitioner's handbook: from networking fundamentals to network, wireless, web, API, cloud and directory assessment. Based on NIST SP 800-115, PTES, OWASP and MITRE ATT&CK.

    HTML

  4. posturekit posturekit Public

    Evidence-led Windows, Active Directory and wireless posture assessment with Python/PowerShell and scanner importers.

    Python

  5. grc-documentation-kit grc-documentation-kit Public

    Original policies, procedures, registers and playbooks for ISO/IEC 27001:2022, ISO/IEC 27701, SOC 2, GDPR, HIPAA and AI governance, in Markdown, Word and Excel, with a crosswalk between frameworks.

    Python

  6. security-assessment-tools security-assessment-tools Public

    Fifteen free, in-browser security and compliance self-assessments (NIST CSF 2.0, ISO 27001, SOC 2, cloud, AI, incident response, GDPR and more) plus five security tools. Private by design; every ga…

    HTML