Security - Wyatt's Notes
sources:
- text: Standard textbook reference
What This Site Covers
Information security from principles to practice: threat modelling, secure coding, system hardening, network security, monitoring, and incident response. Covers both offensive (penetration testing) and defensive (blue team) perspectives.
Key Topics
- Secure Development — OWASP Top 10, input validation, authentication
- System Hardening — SSH, firewall rules, minimal services
- Monitoring — Log analysis, intrusion detection, SIEM
- Incident Response — Containment, eradication, recovery procedures
Essential Security Checklist
| Area | Action | Priority |
|---|---|---|
| Authentication | Use bcrypt/scrypt/Argon2 for password hashing | Critical |
| Secrets | Never commit API keys or passwords to source control | Critical |
| Updates | Apply security patches within 24-48 hours of release | High |
| Access | Apply principle of least privilege to all accounts | High |
| Network | Segment services and enable firewalls by default | High |
| Logging | Centralise logs and monitor for anomalies | Medium |
| Backups | Test restore procedures quarterly | Medium |
Intuition
Security is about managing risk, not eliminating it: Perfect security is impossible — the goal is to make attacks harder, more expensive, and more detectable. Security is a process, not a product.
Why it matters: Every system connected to a network is a potential target. Security breaches can result in data loss, financial damage, and reputational harm.
The key insight: Defense in depth — multiple layers of security controls — is more reliable than any single security measure. No single point of failure should compromise the entire system.
Common Mistakes
Assuming security is a feature you add later: Security must be built in from the start (security by design). Bolting security onto an existing system is expensive and error-prone. Threat modelling and secure coding should be part of development from day one.
Using MD5 or SHA-1 for password hashing: MD5 and SHA-1 are cryptographically broken. Never use them for password storage. Use bcrypt, scrypt, or Argon2 — these are slow by design to resist brute-force attacks.
Hardcoding secrets in source code: API keys, passwords, and certificates in source code are exposed in version control. Use environment variables, secret managers (Vault, AWS Secrets Manager), or encrypted configuration files. Never commit secrets.
Cross-References
Overview
This section provides comprehensive study materials and resources. Content is organised to build understanding progressively, from foundational concepts to advanced applications.
Key Topics
- Core concepts and definitions
- Worked examples with step-by-step solutions
- Practice problems for self-assessment
- Cross-references to related topics
Study Tips
Begin with the introductory material before progressing to advanced topics. Use the practice problems to test your understanding and identify areas for further study.