Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Key Management Service (KMS): Don't Roll Your Own Crypto
A KMS is a secure vault for your cryptographic keys. Instead of storing secrets in code or config, you ask the KMS to perform cryptographic operations for you. It's used for encrypting database fields, signing data, and managing secrets for microservices.
Service Principal: Your App's Identity
A service principal is an application's identity in a specific security context, like a "robot user." It's the local instance that gets permissions, separate from the app's global blueprint. This is how CI/CD pipelines authenticate to cloud APIs.
Encryption in Transit: Protecting Data on the Move
Encryption in transit acts like a locked box for data moving across a network. It secures everything from website connections (HTTPS) to data moving between services inside a cloud network.
Multi-Factor Authentication (MFA): Defense in Depth for Logins
MFA adds a second layer of security on top of your password, like needing a key and a secret handshake. It's crucial for protecting sensitive accounts like email and banking from attackers who have stolen your password.
RBAC: Manage Permissions with Roles, Not Users
RBAC manages permissions by assigning users to roles (e.g., "editor"), not by giving permissions directly. This simplifies security in large systems like AWS IAM. The footgun is creating overly broad roles that grant excessive, unintended access.
Network ACLs: A Stateless Firewall for Subnets
A Network ACL (NACL) is a firewall for an entire cloud subnet, checking traffic as it enters or leaves. It's used for broad, stateless rules, like blocking a malicious IP from all instances.
NAT Gateway: Your VPC's Outbound-Only Internet Door
A NAT Gateway is a one-way door for your private cloud resources. It lets instances in private subnets initiate outbound traffic to the internet—like for updates or API calls—but blocks unsolicited inbound connections.
Security Groups: Stateful Firewalls for Your Cloud Resources
A security group is a stateful firewall for your cloud resources, like a bouncer with an allow-list. Use it to let a web server accept traffic or a database talk to app servers. The footgun: opening SSH to the entire internet (0.0.0.0/0).
Presigned URLs: Temporary Access to Private Files
A presigned URL is a temporary, authenticated link to a private cloud storage object, bundling credentials into the URL. Use it to let users upload or download private files directly, bypassing your server. The URL is a bearer token, so set short expirations.
Encryption at Rest: Securing Your Data When It's Not Moving
Encryption at rest is like locking your data in a safe when it's not moving. It protects raw files on disk if storage is stolen, a default on platforms like Google Cloud. The footgun: it doesn't stop a compromised app with valid keys from reading.
The Cloud's Shared Responsibility Model
Using the cloud means you share security duties with the provider. The split depends on the service: in IaaS, you manage the OS and up; in PaaS, just your app and data; in SaaS, mostly your data and users.
Shift Left Security: Treat Security Like a Bug
Treat security vulnerabilities like bugs by finding them early in the development cycle, not as a final gate before release. This means running automated security scans in CI/CD pipelines and even in your IDE.
Secret Sprawl: When Credentials Multiply Unchecked
Secret sprawl is when credentials like API keys multiply without control, getting lost in code, config files, and CI/CD pipelines. It's common in automated cloud systems where non-human identities proliferate.
CI/CD and the Principle of Least Privilege
Treat your CI/CD pipeline like a temporary worker, not a superuser. Grant it only the minimum permissions needed for its specific task, like building code or deploying to staging.
RASP: An Immune System for Your Application
Think of RASP as an application's immune system, using runtime instrumentation to block attacks from within. It provides real-time protection against threats that static analysis or network firewalls miss.
The Vulnerability Management Lifecycle: A Continuous Loop
Think of vulnerability management not as a one-off task, but a continuous cycle of finding, prioritizing, fixing, and verifying security weaknesses. This process is crucial for securing any system by systematically reducing its attack surface.
Fuzz Testing: Finding Bugs with Random, Invalid Inputs
Fuzz testing is automated chaos engineering for your inputs. It feeds your program semi-random, invalid data to uncover crashes and security flaws, especially in code that parses files or network protocols.
Software Composition Analysis (SCA): Know Your Dependencies
Software Composition Analysis (SCA) is like checking the ingredient list for your software. It scans the open-source libraries you use for known vulnerabilities, license issues, and outdated versions.
SAST: A Security Spellchecker for Your Code
SAST is like a spellchecker for security, scanning your source code for vulnerabilities before it ever runs. It integrates into your CI/CD pipeline to give feedback on every commit. The main footgun is noise: false positives can overwhelm developers.
Threat Modeling: Thinking Like an Attacker
Threat modeling is thinking like an attacker to find security flaws before they're exploited. It systematically analyzes your system to prioritize defenses against the most likely threats. The footgun is treating it as a one-off task, not a continuous process.
External Secrets Operator: Sync Secrets into Kubernetes
The External Secrets Operator (ESO) acts as a bridge, syncing secrets from an external store like Vault or AWS Secrets Manager into native Kubernetes Secrets. This keeps secrets out of Git and centralizes management.
Kubernetes Sealed Secrets: Git-Friendly Secret Management
Sealed Secrets let you safely commit encrypted Kubernetes secrets to a public Git repo. A one-way lockbox: anyone can add a secret, but only the target cluster can unlock it. Essential for GitOps, but remember: a Sealed Secret is tied to its cluster.
AWS Secrets Manager: Stop Hardcoding Credentials
AWS Secrets Manager is a digital vault for your app's credentials. Instead of hardcoding API keys or database passwords, your app fetches them at runtime. It's used for storing sensitive data securely, with built-in rotation and auditing.
Environment Variables: Configuration Outside Code
Environment variables are settings passed to your app from the outside world, letting you change behavior without touching code. Use them for API keys or database URLs. The biggest footgun is committing secrets to version control instead of using variables.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.