The Security Mindset

THE SECURITY MINDSET Applied Security · 01 — think like an attacker AND a defender: goals, threats, boundaries, layers engineering asks 'how do I make this work?'. security asks 'how does this BREAK, and who abuses it?'. every input is hostile until proven safe; assume an adversary who knows your design. this is a whole track (shop auth, the vault secrets, real breaches). 1 · THE MINDSET & THE CIA TRIAD the shift: think about what the system SHOULDN'T do, not just what it should. what are you PROTECTING, from WHOM, and what happens if it fails? every security goal is one of three (the CIA triad): C I A CONFIDENTIALITY — only authorized parties can READ it. defense: encryption, access control. breach = data LEAK. INTEGRITY — data is authentic & UNMODIFIED. defense: hashing, signatures, checksums. breach = TAMPERING. AVAILABILITY — the system is UP for legit users. defense: redundancy, rate-limiting, DDoS protection. breach = OUTAGE. they TRADE OFF: more checks can hurt availability; more sharing can hurt confidentiality. security is choosing the right balance for what you're protecting — not 'maximum lockdown' everywhere. (often extended with Authenticity & Non-repudiation — proving WHO did WHAT, undeniably.) the core reflex: TRUST NOTHING from outside your boundary. every input is an attack until validated. 2 · THREAT MODELING — STRIDE a systematic way to enumerate 'what can go wrong'. each letter is a threat + the property it violates + its fix: THREAT VIOLATES DEFENSE S Spoofing (fake identity) authenticity AUTHENTICATION T Tampering (alter data) integrity hashing / signing R Repudiation (deny it) non-repudiation logging / signatures I Info disclosure (leak) confidentiality ENCRYPTION D Denial of service availability rate-limit / redundancy E Elevation of privilege authorization least privilege / authz THE PROCESS: 1. draw the data-flow (who talks to what). 2. mark the TRUST BOUNDARIES (→ panel 3). 3. at each boundary, walk STRIDE: which threats apply? 4. rate by risk, then mitigate. do it BEFORE you build (design-time) — a threat found on a whiteboard costs nothing; one found in prod costs a breach. you'll apply STRIDE to shop in this track's capstone. 3 · ATTACK SURFACE, TRUST BOUNDARIES & DEFENSE IN DEPTH ATTACK SURFACE = every point an attacker can poke: inputs, APIs, open ports, dependencies, files, the UI. MINIMIZE it — fewer doors = less to defend. every feature/endpoint/dependency you add is more surface. TRUST BOUNDARY = the line where data crosses from LESS-trusted to MORE-trusted. validate everything crossing it: INTERNET (untrusted) trust boundary VALIDATE HERE YOUR SERVER (trusted) DEFENSE IN DEPTH — never rely on ONE control. layer them, so if one fails the others still hold: network fw app authn/z encrypted data outer: firewall / WAF → inner: auth → inner: DB perms → core: encryption + monitoring. ASSUME BREACH: design so compromising one layer doesn't cascade to the crown jewels. (the same 'rings' idea as the OS kernel boundary — How-Computers-Work l.07.) 4 · THE PRINCIPLES & the asymmetry · LEAST PRIVILEGE — every user/process gets the MINIMUM access needed (limits blast radius). · FAIL SECURELY — deny by default; an error should LOCK, not open. · DON'T TRUST INPUT — validate/sanitize everything from outside. · MINIMIZE ATTACK SURFACE — fewer entry points, fewer dependencies. · NO SECURITY THROUGH OBSCURITY — assume the attacker knows your design (Kerckhoffs). · COMPLETE MEDIATION — check EVERY access, every time (no cached 'already allowed'). · SECURE DEFAULTS — the out-of-the-box config should be the safe one. THE ASYMMETRY (why this is hard): the DEFENDER must cover EVERY hole. the ATTACKER needs only ONE. that imbalance is the whole game — which is why you need SYSTEMATIC threat modeling + LAYERED defense, not ad-hoc patching. security isn't a feature you add at the end — it's a property of how the whole system is designed. this track builds that. JARGON, DECODED CIA triad = confidentiality (secret) / integrity (untampered) / availability (up) · authenticity = provably who they claim · non-repudiation = can't deny you did it · security mindset = think like an attacker STRIDE = Spoofing/Tampering/Repudiation/Info-disclosure/DoS/Elevation-of-privilege — a threat-enumeration checklist · threat model = the structured 'what can go wrong' at each trust boundary attack surface = all points an attacker can interact with · trust boundary = line between trust levels (validate crossings) · defense in depth = layered controls · assume breach = design for a compromised layer least privilege = minimum access needed · fail secure = deny on error · complete mediation = check every access · no security through obscurity (Kerckhoffs) = assume the design is known · secure defaults