Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Docker Compose Secrets: Keep Credentials Out of Your Code
Docker Compose Secrets inject sensitive data into containers as files at runtime, keeping credentials out of your version-controlled `docker-compose.yml`. Use them for API keys and passwords. The footgun: your app must read from a file, not an env var.
Docker Image Scanning: A Background Check for Your Code
Docker image scanning is a background check for your software dependencies, checking packages against known vulnerability lists (CVEs). It's used in CI/CD to block vulnerable builds and in registries for continuous monitoring.
The .dockerignore File: Keep Your Build Context Lean
.dockerignore is like .gitignore for your Docker build. It tells the daemon which files to exclude from the build context, preventing large or sensitive files from slowing your build and bloating your image. The footgun is forgetting it and sending everything.
seccomp: A Kernel-Level Allowlist for Syscalls
seccomp is a Linux kernel firewall for system calls (syscalls), restricting which operations a process can request. Docker and Kubernetes use it to harden containers against exploits. The footgun is creating a custom profile so restrictive it breaks your app.
Connection String: Your App's Key and Address to Data
A connection string is your app's address and key to a data source. It bundles the host, port, database name, and credentials into a single string for a driver to use. The main footgun is committing credentials to version control by hardcoding the string in.
SQL Injection: When User Input Becomes a Command
SQL injection tricks a database into running unintended commands by sneaking them into user input. It's a common attack on websites where user data is directly stitched into SQL queries. The footgun is trusting input; always use prepared statements instead.
Database Encryption: Protecting Data at Rest
Database encryption turns your data into useless gibberish for anyone without the key. It protects sensitive data at rest, like PII or financial records, from direct theft of the database files.
Database Auditing: Your Database's Security Camera
Think of database auditing as a security camera for your data, recording who did what and when. It's essential for security investigations and compliance, but the footgun is treating it as a substitute for access control—it only records a breach, it doesn't…
Role-Based Access Control (RBAC) in Databases
RBAC bundles permissions into roles, like 'analyst' or 'admin', instead of assigning them to individuals. This simplifies managing who can read or write data in a database. The footgun is creating too many roles, making it as complex as individual permissions.
Database Views: A Saved Query That Acts Like a Table
A database view is a saved query you interact with like a real table. It simplifies complex joins for applications or restricts data access for security, showing only specific rows or columns.
Homomorphic Encryption: Compute Without Decrypting
Homomorphic encryption lets you perform computations on data while it's still encrypted. This allows a third party, like a cloud provider, to process your sensitive data without ever seeing the raw information, ensuring privacy.
Differential Privacy: Anonymize Data with Math
Differential Privacy adds mathematical noise to data queries, making it impossible to know if one person's data is included. Tech giants use it to learn from user behavior without seeing individual activity.
API Authentication: Who Goes There?
API authentication is the bouncer at your application's door, checking IDs to prove who is making a request. It's used to protect any networked service, from weather data to banking.
Cloud Governance: Rules for Your Cloud Kingdom
Cloud governance is like city planning for your cloud, setting automated rules to prevent chaos. It's used to control costs by blocking expensive VMs and enforce security with required settings.
Policy as Code: Rules as Versioned, Testable Code
Policy as Code (PaC) treats rules like code: versioned, tested, and automated. Instead of manual UI clicks, you define guardrails in a declarative language. Use it in CI/CD to block bad deploys or in Kubernetes to enforce runtime rules.
Securing Cloud Database Endpoints
Treat your database endpoint like a public API, even if it's "internal." A Zero Trust approach verifies every connection request, granting access based on identity and context, not network location. This prevents unauthorized data access, a top cloud threat.
Cloud Compliance Frameworks: Security as a Standard
Think of a cloud compliance framework as a standardized rulebook for security. It translates broad security goals into specific, auditable controls, providing a checklist to prove your cloud environment is secure to regulators and customers.
Data Sovereignty: Your Data's Legal 'Citizenship'
Data sovereignty means data is subject to the laws of the country it's in; data residency is storing it there to comply. This is critical for apps in regions with strict laws like the EU's GDPR. The footgun is confusing residency with full legal compliance.
Zero Trust: Never Trust, Always Verify
Zero Trust assumes no user or device is safe by default, even on a 'trusted' corporate network. It's like needing a keycard for every door, not just the front gate. The biggest mistake is thinking you can buy a 'Zero Trust' product; it's a strategic.
DDoS Mitigation: Surviving Traffic Floods
DDoS mitigation acts like a smart bouncer, learning your app's normal traffic to block malicious floods. It's used for any public internet endpoint, filtering attacks at the network and transport layers (L3/L4).
Identity Federation: One Login for Many Services
Identity federation lets one trusted system vouch for a user's identity to many apps, like using a driver's license at multiple venues. This powers "Sign in with Google" and corporate SSO, but don't confuse it with simple user directory syncing.
Cloud Audit Trail: The 'Who Did What' Record
Think of a cloud audit trail as security camera footage for your infrastructure, recording who did what, where, and when. It's essential for investigating security incidents, proving compliance, and debugging operational issues.
Single Sign-On (SSO): One Login, Many Apps
Single Sign-On (SSO) lets you log in once to access multiple apps. Instead of juggling passwords for Slack and Jira, you authenticate with one central service. This simplifies corporate IT access management.
Web Application Firewall (WAF): Your App's HTTP Bodyguard
A Web Application Firewall (WAF) is a specialized bodyguard for your web app, inspecting all HTTP traffic for malicious requests. It blocks common attacks like SQL injection and XSS by matching traffic against known patterns.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.