Security is the study of systems that keep working when someone is actively trying to break them. Everything else in engineering assumes a cooperative environment; this section drops that assumption. The notes are grouped so you can start at a foundation note and follow links down into specifics, or drop straight into whichever cluster you need.
Foundations and threat models
Start here. These fix the vocabulary the rest of the section leans on.
- The CIA Triad - confidentiality, integrity, availability, and where the model strains
- Authentication vs Authorization - proving who you are against deciding what you may do
- Privilege Separation and Least Privilege - shrinking what a compromise can reach
- Zero Trust Architecture - dropping the trusted-network assumption
- STRIDE Threat Modeling - enumerating threats by category before writing code
- The Cyber Kill Chain and MITRE ATT&CK - intrusion as stages, and the observed-technique catalog
- The OWASP Top 10 - the recurring application risk classes
- Vulnerability Scoring, CVE and CVSS - naming and ranking weaknesses
Cryptographic primitives
The building blocks. Learn what each primitive guarantees, and just as importantly what it does not.
- Symmetric vs Asymmetric Cryptography - shared secrets against key pairs
- AES and Block Ciphers - the workhorse symmetric primitive
- Block Cipher Modes of Operation - turning a block cipher into a usable scheme
- Cryptographic Hash Functions - one-way, collision-resistant fingerprints
- Message Authentication Codes and HMAC - integrity with a shared key
- Authenticated Encryption and AEAD - confidentiality and integrity in one construction
- Cryptographically Secure Randomness - why ordinary PRNGs fail here
- Key Derivation Functions - stretching passwords and secrets into keys
- Diffie-Hellman and Key Exchange - agreeing on a secret over a public wire
- Digital Signatures - authenticity and non-repudiation
- Elliptic Curve Cryptography - equivalent strength at smaller key sizes
- Perfect Forward Secrecy - past traffic staying safe after a key leak
- Post-Quantum Cryptography - what a cryptographically relevant quantum computer would break
Keys, certificates, and trust
Primitives are useless without an answer to “whose key is this?”
- PKI and X.509 Certificates - binding identities to public keys
- Certificate Transparency - public logs that make misissuance visible
- Certificate Revocation, OCSP and CRLs - undoing trust before expiry
- Certificate Pinning - narrowing the set of acceptable certificates
- PGP and the Web of Trust - decentralized trust and why it stayed niche
- Hardware Security Modules and Key Management - keys that never leave the boundary
- Secure Boot and the Chain of Trust - anchoring integrity in hardware
- COMSEC Principles - communications security as an operational discipline
Identity and access
- Access Control Models, RBAC and ABAC - roles against attributes
- Password Hashing and Salting - storing credentials that survive a database leak
- Multi-Factor Authentication - independent factors and their failure modes
- Kerberos Authentication - ticket-based single sign-on
- OAuth 2.0 and OpenID Connect - delegated authorization, and the identity layer above it
- SAML and Federated Identity - assertions across organizational boundaries
- JSON Web Tokens - self-contained claims and their sharp edges
- WebAuthn, Passkeys and FIDO2 - phishing-resistant public-key credentials
- Session Management and Secure Cookies - keeping state after the login
Web application attacks and defenses
- Cross-Site Scripting - injecting script into another origin’s page
- Cross-Site Request Forgery - riding an authenticated session
- SQL Injection - data crossing into the query language
- Command Injection - data crossing into the shell
- Path Traversal - escaping the intended directory
- Server-Side Request Forgery - making the server fetch on your behalf
- Insecure Deserialization - untrusted bytes becoming live objects
- Clickjacking and UI Redressing - stealing clicks through framing
- The Same-Origin Policy and CORS - the browser’s core isolation boundary
- Content Security Policy - constraining what a page may load and run
- HSTS and HTTP Security Headers - hardening defaults over the wire
- Subresource Integrity - pinning third-party assets by hash
- Web Application Firewalls - filtering at the edge, and its limits
Memory safety and exploitation
Where the attacker stops speaking the application’s language and starts speaking the machine’s.
- Buffer Overflows - writing past the end and taking control
- Format String Vulnerabilities - the format argument as an attacker primitive
- Integer Overflow Vulnerabilities - arithmetic that wraps into a bad allocation
- Use-After-Free and Heap Exploitation - reusing memory the program already released
- Return-Oriented Programming - executing code without injecting any
- Memory Protections, ASLR, DEP and Canaries - raising the cost of exploitation
- Control-Flow Integrity - constraining indirect transfers to legal targets
- Race Conditions and TOCTOU - the window between check and use
- Side-Channel Attacks - leaking secrets through time, power, and cache
Network security
- Firewalls - policy enforcement at the network boundary
- IDS and IPS - detecting and blocking known-bad traffic
- VPNs and Tunneling - carrying private traffic over a public network
- Secure Shell - authenticated encrypted remote access
- DNSSEC - signing the name system
- Email Authentication, SPF, DKIM and DMARC - proving a message came from the domain it claims
- WiFi Security, WPA2 and WPA3 - securing a shared radio medium
- ARP Spoofing and LAN Attacks - abusing a protocol with no authentication
- Man-in-the-Middle Attacks - sitting between two parties who think they are alone
- Denial of Service and DDoS - attacking availability instead of secrecy
- Port Scanning and Network Reconnaissance - mapping a target before touching it
Operating securely
- Penetration Testing Methodology - structured authorized attack
- Fuzzing - finding bugs by generating hostile input at volume
- Malware Classes - viruses, worms, trojans, ransomware, and rootkits
- Phishing and Social Engineering - attacking the human in the loop
- Sandboxing and Isolation - containing what you cannot trust
- SIEM and Security Logging - the evidence you need before an incident
- The Incident Response Lifecycle - preparation through lessons learned
The full file listing follows below, generated automatically by Quartz.