Security

​

Overview

​

Encryption Fundamentals

​

Symmetric Encryption

• Same key encrypts and decrypts data
• Much faster than asymmetric encryption
• Suitable for bulk data encryption
• Key distribution is challenging

• AES (Advanced Encryption Standard) - most widely used
• DES (Data Encryption Standard) - legacy, now considered insecure
• 3DES (Triple DES) - more secure than DES
• ChaCha20 - modern alternative to AES

• Encrypting large amounts of data
• Disk encryption
• Database encryption
• Encrypting PII (Personally Identifiable Information)

​

Asymmetric Encryption

• Public key encrypts, private key decrypts
• More secure - private key never shared
• Slower due to complex mathematical operations
• Solves key distribution problem

• RSA - most widely used
• ECC (Elliptic Curve Cryptography) - more efficient than RSA
• DSA (Digital Signature Algorithm)
• Diffie-Hellman - for key exchange

• HTTPS/TLS handshake
• Digital signatures
• SSH authentication
• Email encryption (PGP/GPG)

​

Authentication and Authorization

​

Authentication Methods

• Most common but weakest form
• Must use strong password policies
• Always hash passwords (bcrypt, Argon2, scrypt)
• Never store passwords in plain text

• Something you know (password)
• Something you have (phone, token)
• Something you are (biometrics)
• Dramatically increases security

• JWT (JSON Web Tokens)
• OAuth tokens
• Session tokens
• API keys

• Fingerprint
• Face recognition
• Voice recognition
• Iris scan

• TLS client certificates
• Mutual TLS (mTLS)
• Used in service-to-service communication

​

Authorization Patterns

• Assign permissions to roles
• Assign roles to users
• Simple and widely used
• Example: Admin, Editor, Viewer roles

• Permissions based on attributes
• More flexible than RBAC
• Can consider context (time, location, etc.)
• More complex to implement

• Specify permissions for each resource
• Fine-grained control
• Can become complex at scale

​

Session Management

​

Session vs JWT vs OAuth

1. User logs in
2. Server creates session, stores in database
3. Returns session ID in cookie
4. Client sends session ID with each request
5. Server validates session in database

1. User logs in
2. Server creates signed JWT
3. Client stores JWT (localStorage or cookie)
4. Client sends JWT with each request
5. Server validates JWT signature

• Industry standard for authorization
• Allows third-party access without sharing credentials
• Multiple grant types (authorization code, implicit, client credentials)
• Used by Google, Facebook, GitHub for login

​

Common Security Threats

​

Injection Attacks

• Attacker inserts malicious SQL code
• Prevention: Use parameterized queries, ORMs
• Example: ' OR '1'='1 to bypass authentication

• Similar to SQL injection but for NoSQL databases
• Prevention: Validate and sanitize input, use query builders

• Attacker executes system commands
• Prevention: Avoid system calls with user input, use whitelisting

​

Cross-Site Scripting (XSS)

• Stored XSS: Malicious script stored in database
• Reflected XSS: Script in URL parameters
• DOM-based XSS: Script manipulates DOM directly

• Sanitize user input
• Encode output
• Use Content Security Policy (CSP) headers
• Use frameworks with built-in XSS protection

​

Cross-Site Request Forgery (CSRF)

• Attacker tricks user into performing unwanted actions
• Prevention:
  • CSRF tokens
  • SameSite cookie attribute
  • Verify Origin/Referer headers
  • Re-authentication for sensitive operations

​

Distributed Denial of Service (DDoS)

• Overwhelm system with traffic
• Prevention:
  • Rate limiting
  • Web Application Firewall (WAF)
  • CDN with DDoS protection
  • Auto-scaling
  • Geo-blocking

​

Man-in-the-Middle (MITM)

• Attacker intercepts communication
• Prevention:
  • Use HTTPS everywhere
  • Certificate pinning
  • HSTS (HTTP Strict Transport Security)
  • Validate SSL certificates

​

API Security Best Practices

​

Data Protection

​

Data at Rest

• Encryption: Encrypt sensitive data in databases
• Key Management: Use dedicated key management services (AWS KMS, Azure Key Vault)
• Access Controls: Restrict who can access data
• Backups: Encrypt backups, test restore procedures

​

Data in Transit

• TLS/SSL: Encrypt all network communication
• VPN: Use VPNs for sensitive internal communication
• Certificate Management: Keep certificates up to date
• Perfect Forward Secrecy: Protect past communications if keys compromised

​

Data Masking and Tokenization

• Hide sensitive data in non-production environments
• Replace real data with realistic fake data
• Preserve data format and relationships

• Replace sensitive data with non-sensitive tokens
• Store mapping in secure token vault
• Commonly used for credit card numbers
• More secure than encryption for some use cases

​

Security Headers

# Prevent XSS attacks
Content-Security-Policy: default-src 'self'

# Prevent clickjacking
X-Frame-Options: DENY

# Force HTTPS
Strict-Transport-Security: max-age=31536000

# Prevent MIME sniffing
X-Content-Type-Options: nosniff

# Control referrer information
Referrer-Policy: strict-origin-when-cross-origin

# Control browser features
Permissions-Policy: geolocation=(), camera=()

​

Secure Password Storage

1. Use Strong Hashing Algorithms:
   • bcrypt (recommended)
   • Argon2 (newer, more secure)
   • scrypt
   • PBKDF2
2. Add Salt:
   • Unique salt for each password
   • Prevents rainbow table attacks
3. Use Proper Work Factor:
   • Make hashing computationally expensive
   • Slows down brute force attacks
4. Never Use:
   • MD5 or SHA1 for passwords
   • Simple encryption (passwords should be hashed, not encrypted)
   • No salt or global salt

​

Security Monitoring and Incident Response

​

Security Monitoring

• Log all authentication attempts
• Monitor for unusual patterns
• Track API usage and anomalies
• Use intrusion detection systems (IDS)
• Implement Security Information and Event Management (SIEM)

​

Incident Response Plan

1. Preparation: Have plan and tools ready
2. Detection: Identify security incidents
3. Containment: Limit damage
4. Eradication: Remove threat
5. Recovery: Restore normal operations
6. Lessons Learned: Improve security posture

​

Related Guides

• How does HTTPS work?
• Symmetric vs Asymmetric Encryption
• OAuth 2.0 Explained
• JWT 101
• Session vs Token vs JWT vs SSO
• How to Store Passwords in Database
• Digital Signatures
• How to Design a Secure System
• Top 12 Tips for API Security