Loading...
Loading...
CIA triad, AuthN versus AuthZ, TLS in transit, at-rest encryption and threat models you must enumerate
Backpressure ended on a hostile faucet: ten thousand hijacked devices arriving on purpose, where 503s and Retry-After hints negotiate with nobody. That faucet is not hypothetical. The day you put anything on the internet, automated scanners, which are programs that probe every new server for default passwords, known bugs, and open ports, start rattling it within the hour. One careless input field once let attackers read an entire database by typing database commands into a login box. Another let them run code in other users browsers just by posting a comment. Think of a house with locks, alarms, and habits as the single analogy here: no single device makes it safe, and safety comes from layered devices plus daily habits that assume someone will try the door, then the window.
The naive fix is scheduling security for later, after the launch works. Its quieter sibling is hiding instead of locking: an unlinked admin panel on a non-standard port, on the theory that attackers cannot attack what they cannot find. Scanners brute-force roughly ten thousand common paths per host per hour, so the secret URL survives about as long as the first full sweep, while every legitimate user pays the obscurity tax of bookmarks and oral tradition. Hidden doors add zero bits against automation. That fails because retrofits cost roughly ten times more than building controls in, and some holes cannot be patched without redesigning the thing they live in, such as a query layer built on string concatenation. Security is the difference between a system and a liability, and it starts with three promises so basic they fit on an index card.
The expensive truth: bolting security on after launch costs roughly ten times more than building it in, and some holes cannot be patched without redesigning the thing they live in.
Confidentiality, which is keeping messages, passwords, and health records visible only to the right eyes through encryption and access control.
Integrity, which is making tampering detectable through signatures, hashes, and permission checks, so changed data tells on itself.
Availability, which is staying responsive to legitimate users even under attack through capacity, throttling, and layered absorption.
Security people call this the CIA triad. Every control below exists to defend one of these three promises.
Authentication, which is proving identity, starts with passwords as the weakest form, which is why everything important stacks a second proof on top.
Authorization, which is deciding what an authenticated identity may touch, starts from deny because every permission granted is future breach surface.
Forget Hollywood hackers. Real breaches reuse the same short playlist, and each entry has a boring, well-known fix. Learn the playlist by mechanism, not by name:
SQL injection, which is smuggling database commands through an input field that concatenates typing straight into a query, lets the database obey you instead of the app. The classic payload closes the quote, ends the statement, and comments out the rest. The mechanics end with parameterized queries, which send code and data on separate channels so data stays data and never executes.
'; DROP TABLE users;--
Fix: parameterized queries with bound variables, never string concatenation.
Cross-site scripting, which is stored attacker JavaScript that runs in every other visitor browser, starts in a comment box rendering raw HTML. The script steals sessions with the victim browser privileges. The mechanics end with escaping output, which is converting markup characters to inert text, stripping scripts on input, and setting content-security headers that block inline scripts even when one slips through.
Fix: escape on output, sanitize on input, content-security policy blocking inline scripts.
Cross-site request forgery, which is an attacker page submitting a form as you while your browser helpfully attaches your cookies, needs no clicks on the real site. You visit the attacker page while logged into your bank, and the transfer submits with your credentials. The mechanics end with per-form secret tokens the attacker page cannot guess, plus SameSite cookies, which tell the browser not to attach cookies on cross-site requests.
Fix: unguessable per-form tokens validated server-side, plus SameSite cookie attribute.
A distributed denial of service, which is more requests than your servers can swallow, often from thousands of hijacked devices at once, needs no cleverness. The mechanics end at the edge: absorb floods in a content-delivery network built for it, throttle per client so one source cannot take the pool, and scale horizontally so legitimate traffic still fits.
Fix: absorb at the edge, throttle per client, scale the serving tier horizontally.
HTTPS everywhere with HSTS, which is a header telling browsers to refuse plain HTTP. Unencrypted traffic is a postcard anyone along the path can read.
bcrypt, scrypt, or Argon2, which are deliberately slow hashes that survive database leaks by costing a quarter second per guess. Plaintext storage is malpractice.
Least privilege, which is granting every service, user, and key only the minimum it needs. Breaches inherit exactly the permissions you granted, so small grants mean small blasts.
Validate shape, escape output, parameterize queries. Every field arrives hostile until proven otherwise, because the attacker chooses the bytes.
A vault, which is a service that stores secrets encrypted and rotates them automatically, beats keys in code. Keys in code end up on hosting sites within the quarter.
Record auth failures, permission denials, and odd-hour access with who, when, and source address. You cannot investigate what you never recorded.
Every defense above fails sometimes through bugs, misconfigurations, or unknown flaws. Defense in depth, which is stacking independent layers so an attacker who passes one meets another, is the answer: each wall is cheap alone and formidable together.
Your login allows unlimited attempts, hashes passwords with a fast general hash, and logs the attempted password beside the username. An attacker with a leaked database cracks fast hashes at billions of guesses per second on graphics cards, stuffs those passwords into your unlimited endpoint from a botnet, which is a fleet of hijacked devices rented by the hour, and reads your logs for the rest. Every number below is a wall against exactly that evening: slow the guesses, cap the attempts, shorten the sessions, and never record secrets.
password hashing: Argon2id (m=64MB, t=3, p=1) or bcrypt cost 12 (~250ms/login)
fast hashes (SHA-256, MD5) are NOT password storage — GPUs try 10B+/s
login abuse: 5 failures -> 15-min lockout + CAPTCHA, per-account AND per-IP
CAPTCHA, which is a human-proof challenge such as distorted text scripts fail, applied here
alert on > 100 failed logins/min globally (credential stuffing wave)
credential stuffing, which is replaying leaked username-password pairs from other breaches
sessions: 15-min idle timeout, absolute 12h, rotate id after login
log auth events at INFO: who, when, IP, result — never the password
production log level: INFO for auth, WARN+ for app; DEBUG never in prodTLS, which is the encryption for traffic in transit, needs version 1.2 or newer, HSTS with preload, and automated certificate rotation. Expired-certificate outages outnumber cryptanalytic breaks a thousand to one, so monitor expiry at 30, 7, and 1 day.
Allow 100 requests per minute per address on login paths and 1,000 per minute per key on APIs, returning 429 with a Retry-After hint beyond that. Without them every endpoint is a password-guessing oracle and an account-enumeration oracle, which is a yes-or-no signal telling attackers which usernames exist.
Locks keep strangers out through confidentiality, integrity, and layered availability, with friction spent where breaches start at auth and input. But the stranger with a stolen badge, a valid login used maliciously, walks past every wall above smiling. Proving which human is really behind the keyboard, and what exactly they are allowed to prove it with, is its own dark art. That is next.