Skip to main content

04 - Security & Privacy

Security Foundations

Core Concepts

  • Information security - The practice of protecting information by mitigating information risks
  • Vulnerability - A weakness which can be exploited by a threat actor
  • Threat - A potential negative action or event facilitated by a vulnerability
  • Shared Responsibility Model - A security and compliance framework that outlines the responsibilities of cloud service providers (CSPs) and customers for securing every aspect of the cloud environment

Common Threats & Attack Vectors

  • Malware - Any software intentionally designed to cause disruption to a computer, server, client, or computer network
  • Ransomware - A type of malware from cryptovirology that threatens to publish the victim's personal data or perpetually block access to it unless a ransom is paid
  • Social engineering - The psychological manipulation of people into performing actions or divulging confidential information
  • Phishing - A type of social engineering where an attacker sends a fraudulent message designed to trick a person into revealing sensitive information
  • Business Email Compromise (BEC) - A type of phishing attack in which an attacker impersonates a high-level executive and attempts to trick an employee or customer into transferring money or sensitive data
  • Infostealer - A type of Trojan horse designed to gather information from a system
  • Think before you Click(Fix) - A social engineering technique that tricks users into running malicious commands on their devices by taking advantage of their target's tendency to solve minor technical issues
  • Attack Simulation Tools
    • Evilginx - A man-in-the-middle attack framework used for phishing login credentials along with session cookies

Modern Security Architectures

  • Zero trust security model - An approach to the design and implementation of IT systems where trust is never granted implicitly and verification is required for everyone
    • All data sources and computing services are considered resources.
    • All communication is secured regardless of network location.
    • Access to individual enterprise resources is granted on a per-session basis.
    • Access to resources is determined by dynamic policy and may include other behavioral and environmental attributes.
    • The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
    • All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
    • The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture.
  • Mutual authentication - A process in which both parties in a communications link authenticate each other
  • Control-flow integrity - A general term for computer security techniques that prevent a wide variety of malware attacks from redirecting the flow of execution of a program

Cryptography & Data Protection

Hashing

  • Hash Function
    • MD5 - A cryptographically broken but still widely used hash function producing a 128-bit hash value
    • SHA-2 (SHA-224, SHA-256, SHA-384, SHA-512) - A set of cryptographic hash functions designed by the United States National Security Agency (NSA)
    • Bcrypt - A password-hashing function based on the Blowfish cipher
    • Scrypt - A password-based key derivation function created by Colin Percival

Symmetric-key Cryptography

  • Symmetric-key algorithm - Algorithms for cryptography that use the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext
  • Block Cipher
    • AES - A specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001
    • Salsa20 ChaCha - A variant of Salsa20 that increases the diffusion per round while achieving the same or slightly better performance
  • MAC (Message Authentication Code)
    • HMAC - A specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key
  • Modes of Operation
    • CBC (Cipher block chaining) - A mode of operation for a block cipher where a block of plaintext is XORed with the previous ciphertext block before being encrypted
    • GCM (Galois/Counter Mode) - A mode of operation for symmetric-key cryptographic block ciphers which is widely adopted for its performance
    • CCM - A mode of operation for cryptographic block ciphers designed to provide both authentication and confidentiality

Public-key Cryptography

  • Public-key cryptography - A cryptographic system that uses pairs of keys
    • RSA - A public-key cryptosystem that is widely used for secure data transmission
    • EdDSA - A digital signature scheme using a variant of Schnorr signature based on twisted Edwards curves
  • Key Agreement
  • Encryption Scheme
    • RSAES-PKCS1-v1_5, RSAES-OAEP
  • Signature Scheme
    • RSASSA-PKCS1-v1_5, RSASSA-PSS, DSA, ECDSA
  • Key format
  • Digital signature - A mathematical scheme for verifying the authenticity of digital messages or documents

Public Key Infrastructure (PKI)

  • Public Key Infrastructure (PKI) - A set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates
  • Certificate authority (CA) - An entity that stores, signs, and issues digital certificates
  • Registration authority (RA)
  • Validation authority (VA)
  • Protocols & Standards
  • Validation & Enrollment
    • Domain Control Validation - A process used by certificate authorities (CAs) to verify that the person or organization requesting a certificate has control over the domain(s) listed in the certificate
  • Trust Stores
    • Certifi - A carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts
  • Public key certificate - An electronic document used to prove the validity of a public key
    • Domain Validated (DV)
    • Organization Validated (OV)
    • Extended Validation (EV)
  • Let's Encrypt - A nonprofit Certificate Authority providing TLS certificates
    • certbot - A free, open source software tool for automatically using Let's Encrypt certificates on manually-administrated websites to enable HTTPS
    • lego - A Let's Encrypt client and ACME library written in Go
    • cfssl - Cloudflare's PKI toolkit
  • ACME (Automatic Certificate Management Environment) - A communications protocol for automating interactions between certificate authorities and their users' web servers
  • mkcert.org - A simple tool for making locally-trusted development certificates
  • cert-manager - A powerful and extensible X.509 certificate controller for Kubernetes and OpenShift

Secrets Management

  • Vault - A tool for securely accessing secrets like API keys, passwords, or certificates
  • SOPS - An editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats
  • git-secret - A bash tool to store your private data inside a git repo
  • Sealed Secrets - A Kubernetes controller and tool for one-way encrypted Secrets
  • Vendor Services
    • Azure Key Vault - A cloud service to safeguard cryptographic keys and other secrets used by cloud apps and services
    • Google Cloud Secret Manager - A secure and convenient storage system for API keys, passwords, certificates, and other sensitive data
    • AWS Key Management Service - A service that makes it easy for you to create and manage cryptographic keys
    • AWS Secrets Manager - A secrets management service that helps you protect access to your applications, services, and IT resources

Advanced Topics

  • Post-quantum cryptography - Cryptographic algorithms that are thought to be secure against a cryptanalytic attack by a quantum computer
  • Information Hiding
    • Steganography - The practice of concealing a file, message, image, or video within another file, message, image, or video
    • Digital watermarking - A kind of marker covertly embedded in a noise-tolerant signal such as an audio, video or image data

End-to-end Encryption Tools

  • Pretty Good Privacy (PGP) - A data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication
  • OpenPGP - A non-proprietary protocol for exchanging public keys and encrypted messages
  • keys.openpgp.org - A public key server for OpenPGP
  • GnuPG - A free software replacement for the PGP cryptographic software suite
  • Gpg4win - A Windows software package that facilitates the secure transport of emails and files with the help of OpenPGP

Transaction Security

  • 3-D Secure - A security protocol designed to be an additional security layer for online credit and debit card transactions

Cryptographic Libraries

  • PyCryptodome - A self-contained Python package of cryptographic primitives
  • Python cryptography - A package designed to expose cryptographic primitives and recipes to Python developers
  • Go Cryptography - A collection of Go cryptography libraries
  • Botan - A cryptography library written in C++

Identity & Access Management (IAM)

Integrated IAM

  • Identity management - A framework of policies and technologies for ensuring that the proper people in an enterprise have the appropriate access to technology resources
  • Self-hosted IAM Platforms
    • FusionAuth CE - The self-hosted, community supported version of FusionAuth
    • KeyCloak - An open source identity and access management solution
    • FreeIPA - An integrated security information management solution combining Linux, 389 Directory Server, MIT Kerberos, NTP, DNS, and a certificate system
  • Cloud IAM Services
    • Microsoft Entra ID - A cloud-based identity and access management service
    • AWS IAM - A service that helps you securely control access to AWS resources
    • Amazon Cognito - A service that lets you add user sign-up, sign-in, and access control to your web and mobile apps
    • Auth0 - A flexible, drop-in solution to add authentication and authorization services to your applications
  • Directory service - A service that maps the names of network resources to their respective network addresses
    • LDAP - An open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services
    • OpenLDAP - An open source implementation of the Lightweight Directory Access Protocol
    • 389 Directory Server - A free and open source software project developed by Red Hat for Linux systems
  • Specifications

Authentication (AuthN)

  • Authentication - The act of proving an assertion, such as the identity of a computer system user
  • Protocols & Standards
    • OpenID Connect - A simple identity layer on top of the OAuth 2.0 protocol
    • SAML - A standard for logging users into applications
    • WS-Federation - A specification that defines mechanisms used to broker trust and manage identities, attributes and authentication between participating Web services
    • FIDO2 (WebAuthn, CTAP, Passkeys) - A set of specifications that enables users to leverage common devices to easily and securely authenticate to online services
      • Relying party - The website or online service that wants to verify a user's identity (e.g., your bank's website)
      • Authenticator - The device or software that securely stores cryptographic keys and performs authentication for the user.
      • Client - The software on the user's device, typically a web browser or operating system component, that communicates between the Relying Party and the Authenticator.
      • WebAuthn - An API for accessing Public Key Credentials
      • CTAP - A protocol that enables an external authenticator to communicate with a client platform
      • Passkeys - A phishing-resistant replacement for passwords
    • SPIFFE - The Secure Production Identity Framework for Everyone
    • Kerberos - A computer network authentication protocol that works on the basis of tickets
  • Credentials & Tokens
    • Basic authentication - A method for an HTTP user agent to provide a username and password when making a request
    • JSON Web Token (JWT) - An Internet standard for creating data with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims
    • TOTP (Time-Based One-Time Password) - A temporary passcode, generated by an algorithm, for use in authenticating access to computer systems
  • Platforms & Tools
    • Dex - A Federated OpenID Connect Provider
    • Firebase Authentication - A service that provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app
    • Supabase Auth - A service that provides user management and access control for Supabase projects
    • ReCAPTCHA - A CAPTCHA system that enables web hosts to distinguish between human and automated access to websites

Authorization (AuthZ)

  • Authorization - The function of specifying access rights/privileges to resources
  • Access Control Models
    • Access control list (ACL) - A list of permissions associated with a system resource
    • Role-based access control (RBAC) - A policy-neutral access-control mechanism defined around roles and privileges
      • Azure RBAC - A system that enables fine-grained access management of Azure resources
        • Security principal kinds: User, Group, Service Principal, Managed Identity
      • Entra ID RBAC - A system that provides fine-grained access management of Microsoft Entra resources
  • Protocols & Standards
    • OAuth 2.0 Authorization Framework - An open standard for access delegation
      • Resource owner - the user who owns the data or resources that are being accessed
      • Resource server - the server that hosts the protected resources
      • Client - an application or service that wants to access the resources on behalf of the resource owner
      • Authorization server - the server that issues access tokens to the client
  • Platforms & Tools
    • Permify - An open-source authorization service that helps you to create any kind of authorization system with its Golang API
    • Azure Shared Access Signature (SAS) - A signed URI that points to one or more storage resources and includes a token that specifies the permissions and interval of access

Secure Development Lifecycle (DevSecOps)

Secure Design & Modeling

  • Threat modeling - A process by which potential threats can be identified, enumerated, and prioritized from a hypothetical attacker's point of view
  • OWASP Threat Modeling - Guidance from the OWASP Security Culture project on integrating threat modeling into the development lifecycle
  • STRIDE model - A mnemonic for categorizing computer security threats into six categories
  • MITRE ATT&CK - A globally-accessible knowledge base of adversary tactics and techniques
    • Tactics: The high-level objectives or goals that an adversary aims to achieve during an attack.
    • Techniques: The specific methods or ways adversaries achieve their tactical objectives.
    • Procedures: The specific implementations or variations of techniques that adversaries utilize in their operations.
  • Modeling Tools
    • OWASP Threat Dragon - A free, open-source, cross-platform threat modeling application
    • threatspec - A tool that allows you to define threat models as code

Secure Development Practices

Application Security Testing (AST)

  • Static Analysis (SAST)
    • SonarQube Server - A self-managed, automatic code review tool that systematically helps you deliver clean code
    • GitLab SAST - A tool that checks your source code for known vulnerabilities
    • Bandit (for Python) - A tool designed to find common security issues in Python code
    • Semgrep OSS - A fast, open-source, static analysis tool for finding bugs and enforcing code standards
    • Fluid attacks - A security tool that allows you to find vulnerabilities in your source code, containers and dependencies
  • Composition Analysis (SCA)
    • SBOM Generation:
      • Syft - A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems
      • OWASP CycloneDX format - A lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts
      • SPDX format - An open standard for communicating Software Bill of Materials (SBOM) information
    • Vulnerability Scanning:
      • Grype - A vulnerability scanner for container images and filesystems
      • OSV-scanner - The official vulnerability scanner for OSV
      • Safety - A tool that checks your installed dependencies for known security vulnerabilities
      • Clair - An open-source project for the static analysis of vulnerabilities in application containers
      • GitLab Container Scanning - A tool that checks your Docker images for known vulnerabilities
    • License & Dependency Analysis:
      • Feluda - A blazing fast dependency graph generator for Python projects
  • Secret Detection
    • GitLab Secret Detection - A tool that scans your repository's history for secrets
    • Whispers - A static code analysis tool designed for parsing various common data formats in search of hardcoded credentials
    • Gitleaks - A SAST tool for detecting and preventing hardcoded secrets like passwords, api keys, and tokens in git repos
    • Talisman - A tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not get committed
    • TruffleHog - A tool that scans your environment for secrets, digging deep into commit history and branches

Infrastructure as Code (IaC) Security

  • Trivy - A comprehensive and versatile security scanner
  • checkov - A static code analysis tool for scanning infrastructure as code (IaC) files for misconfigurations
  • Haskell Dockerfile Linter - A smarter Dockerfile linter that helps you build best practice Docker images
  • kube-score - A tool that performs static code analysis of your Kubernetes object definitions
  • kubesec - A security risk analysis for Kubernetes resources
  • PSRule - A cross-platform PowerShell module with commands to test and verify infrastructure as code (IaC)
    • PSRule for Azure - A suite of rules to validate Azure resources and infrastructure as code (IaC) using PSRule

Software Supply Chain Security

  • SLSA framework - A security framework of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure
  • in-toto - A framework to protect software supply chain integrity
  • Code Signing & Integrity
    • Sigstore (Fulcio, Rekor, Cosign) - A new standard for signing, verifying and protecting software

Runtime & Operational Security

Cloud & Workload Protection

  • Cloud Security Posture Management (CSPM)
    • Microsoft Defender for Cloud - A cloud-native application protection platform (CNAPP) with a set of security measures and practices designed to protect cloud-based applications
    • AWS Security Hub - A cloud security posture management (CSPM) service that performs security best practice checks, aggregates alerts, and enables automated remediation
  • Cloud-native Application Protection Platform (CNAPP)
  • Cloud Workload Protection Platform (CWPP)
    • Amazon Inspector - An automated security assessment service that helps improve the security and compliance of applications deployed on AWS
    • Falco - The cloud-native runtime security project
    • Tracee - A powerful runtime security and forensics tool for Linux
    • ClamAV - An open source antivirus engine for detecting trojans, viruses, malware & other malicious threats
    • YARA - The pattern matching swiss knife for malware researchers

Security Operations & Monitoring (SecOps)

  • Detection & Response
  • SIEM & SOAR
    • Security orchestration, automation and response (SOAR) - A stack of compatible software programs that allow an organization to collect data about security threats
    • Microsoft Sentinel - A scalable, cloud-native, security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution
    • Amazon GuardDuty - A threat detection service that continuously monitors for malicious activity and unauthorized behavior
  • Detections & Auditing
    • Sigma Detection Format - A generic and open signature format that allows you to describe relevant log events in a straightforward manner
    • AWS CloudTrail - An AWS service that helps you enable operational and risk auditing, governance, and compliance of your AWS account
    • AWS Config - A service that enables you to assess, audit, and evaluate the configurations of your AWS resources

Policy Enforcement

  • Open Policy Agent (OPA) - An open source, general-purpose policy engine that unifies policy enforcement across the stack
    • Rego - A high-level declarative language used to write policies for OPA
    • Conftest - A utility to help you write tests against structured configuration data
  • Kubernetes Policy Engines
    • Gatekeeper - A customizable validating webhook that enforces policies executed by the Open Policy Agent (OPA)
    • Kyverno - A policy engine designed for Kubernetes

Secure Communications & Networking

Transport Layer Security (TLS)

  • Transport Layer Security (TLS) - A cryptographic protocol designed to provide communications security over a computer network
  • Server Name Indication (SNI) - An extension to the Transport Layer Security (TLS) computer networking protocol
  • Tools & Libraries
    • testssl.sh - A free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers and protocols
    • OpenSSL library - A software library for applications that secure communications over computer networks against eavesdropping
    • stunnnel - A proxy designed to add TLS encryption functionality to existing clients and servers
    • Squid SSL Bump - A feature of Squid proxy that allows it to intercept, decrypt, and re-encrypt SSL/TLS traffic
  • Vulnerabilities
    • Lucky Thirteen attack - A timing attack against the TLS protocol that allows an attacker to decrypt ciphertext

Secure Shell (SSH)

  • Secure Shell (SSH) - A cryptographic network protocol for operating network services securely over an unsecured network
  • Tools & Libraries
    • OpenSSH - The premier connectivity tool for remote login with the SSH protocol
    • PuTTY - A free implementation of SSH and Telnet for Windows and Unix platforms
    • ssh-audit - A tool for SSH server & client configuration auditing
    • keychain - A manager for ssh-agent, typically started from ~/.bash_profile

Web Application Security

  • SOP (Same-origin policy) - An important concept in the web application security model
  • CORS (Cross-Origin Resource Sharing) - A mechanism that allows restricted resources on a web page to be requested from another domain
  • CSP (Content Security Policy) - An added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks
  • HSTS (HTTP Strict Transport Security) - A web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking
  • Cross-origin isolation - A web security feature that allows a web page to use powerful features like SharedArrayBuffer and performance.measureUserAgentSpecificMemory()
  • Privacy sandbox - Google's initiative to create web technologies that protect people's privacy online and give companies and developers the tools to build thriving digital businesses
  • security.txt - A proposed standard which allows websites to define security policies for researchers

Firewalls & Network Protection

  • Web Application Firewall (WAF)
    • AWS WAF - A web application firewall that helps protect your web applications or APIs against common web exploits and bots
    • Azure Web Application Firewall - A cloud-native service that protects web apps from common web-hacking techniques and vulnerabilities
  • Network-level Protection
    • AWS Shield - A managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS
    • Azure DDoS Protection - A service that provides countermeasures against the most sophisticated DDoS threats
    • Fail2ban - An intrusion prevention software framework that protects computer servers from brute-force attacks
    • Snort (IPS) - The foremost Open Source Intrusion Prevention System (IPS) in the world
  • Host-based Firewalls
    • netfilter (iptables, nftables) - A framework inside the Linux kernel that enables packet filtering, network address translation, and other packet mangling
    • Uncomplicated Firewall (ufw) - A program for managing a netfilter firewall

Email & DNS Security

  • Email Security
  • DNS Security
    • DNSSEC - A feature of the Domain Name System (DNS) that authenticates responses to domain name lookups
    • DNS over TLS (DoT) - A security protocol for encrypting and wrapping Domain Name System (DNS) queries and answers via the Transport Layer Security (TLS) protocol
    • DNS over HTTPS (DoH) - A protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol
  • Tools & Libraries
    • OpenDKIM - A community effort develops and maintains a C library for producing DomainKeys Identified Mail-aware applications and an open-source milter for providing the service

Governance, Risk, and Compliance (GRC)

Regulations & Standards

  • Laws & Regulations
  • Security & Privacy Frameworks
    • NIST SP 800-53
      • AC - Access Control
      • AT - Awareness and Training
      • AU - Audit and Accountability
      • CA - Assessment, Authorization and Monitoring
      • CM - Configuration Management
      • CP - Contingency Planning
      • IA - Identification and Authentication
      • IR - Incident Response
      • MA - Maintenance
      • MP - Media Protection
      • PE - Physical and Environmental Protection
      • PL - Planning
      • PM - Program Management
      • PS - Personnel Security
      • PT - Personally Identifiable Information Processing and Transparency
      • RA - Risk Assessment
      • SA - System and Services Acquisition
      • SC - System and Communications Protection
      • SI - System and Information Integrity
      • SR - Supply Chain Risk Management
    • ISO/IEC 27001 / 27002
  • Industry & Audit Standards
    • PCI-DSS - The global standard for payment card data security
    • SOC 2 - A voluntary compliance standard for service organizations which specifies how organizations should manage customer data
    • FIPS 140-2 - A U.S. government computer security standard used to approve cryptographic modules
  • Hardening & Implementation Guides

Vulnerability Management & Reporting

System & Personal Security

OS & Endpoint Security

  • TPM (Trusted Platform Module) - A specification for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys
  • Linux Mandatory Access Control
    • SELinux - A set of kernel modifications and user-space tools that have been added to various Linux distributions
    • AppArmor - A Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles
  • Linux Fine-grained Access Control
    • Linux capabilities - A feature that grants some of the power of the superuser to a process, while not granting all of them
  • General Scanning
    • OpenSCAP - An open source implementation of the Security Content Automation Protocol (SCAP)
    • Lynis - A security auditing tool for systems running Linux, macOS, or Unix-based operating system

Personal Security Tools

  • Password Managers
    • pass - The standard unix password manager
    • gokey - A simple vaultless password manager in Go
    • Buttercup - A free, open-source and cross-platform password manager