sources:
- text: Standard textbook reference
What This Site Covers
Information security from principles to practice: threat modelling, secure coding, system hardening, network security, monitoring, and incident response. Covers both offensive (penetration testing) and defensive (blue team) perspectives.
Key Topics
- Secure Development, OWASP Top 10, input validation, authentication
- System Hardening, SSH, firewall rules, minimal services
- Monitoring, Log analysis, intrusion detection, SIEM
- Incident Response, Containment, eradication, recovery procedures
Essential Security Checklist
| Area | Action | Priority |
|---|---|---|
| Authentication | Use bcrypt/scrypt/Argon2 for password hashing | Critical |
| Secrets | Never commit API keys or passwords to source control | Critical |
| Updates | Apply security patches within 24-48 hours of release | High |
| Access | Apply principle of least privilege to all accounts | High |
| Network | Segment services and enable firewalls by default | High |
| Logging | Centralise logs and monitor for anomalies | Medium |
| Backups | Test restore procedures quarterly | Medium |
Intuition
Security is about managing risk, not eliminating it: Perfect security is impossible, the goal is to make attacks harder, more expensive, and more detectable. Security is a process, not a product.
Why it matters: Every system connected to a network is a potential target. Security breaches can result in data loss, financial damage, and reputational harm.
The key insight: Defense in depth, multiple layers of security controls, is more reliable than any single security measure. No single point of failure should compromise the entire system.
Common Mistakes
Assuming security is a feature you add later: Security must be built in from the start (security by design). Bolting security onto an existing system is expensive and error-prone. Threat modelling and secure coding should be part of development from day one.
Using MD5 or SHA-1 for password hashing: MD5 and SHA-1 are cryptographically broken. Never use them for password storage. Use bcrypt, scrypt, or Argon2, these are slow by design to resist brute-force attacks.
Hardcoding secrets in source code: API keys, passwords, and certificates in source code are exposed in version control. Use environment variables, secret managers (Vault, AWS Secrets Manager), or encrypted configuration files. Never commit secrets.
Cross-References
- Site Home: Main landing page for security notes.
- Practice: Practice problems for revision.
Overview
Key Topics
- Core concepts and definitions
- Worked examples with step-by-step solutions
- Practice problems for self-assessment
- Cross-references to related topics