Security Skills
Overview
Security knowledge essential for building secure applications, protecting user data, and preventing common vulnerabilities.
Security Layers
┌─────────────────────────────────────────────┐
│ Application Security │
│ ┌─────────────────────────────────────────┐│
│ │ Authentication & AuthZ ││
│ │ ┌───────────────────────────────────┐ ││
│ │ │ Input Validation │ ││
│ │ │ ┌─────────────────────────────┐ │ ││
│ │ │ │ Data Protection │ │ ││
│ │ │ └─────────────────────────────┘ │ ││
│ │ └───────────────────────────────────┘ ││
│ └─────────────────────────────────────────┘│
│ Infrastructure Security │
└─────────────────────────────────────────────┘Categories
Authentication
- JWT tokens and refresh strategies
- OAuth 2.0 / OpenID Connect
- Session management
- Multi-factor authentication
- Passwordless authentication
Authorization
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Permission systems
- Access control patterns
OWASP Top 10
- Injection attacks
- Broken authentication
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Security misconfiguration
- Sensitive data exposure
API Security
- Rate limiting
- Input validation
- API key management
- CORS configuration
Data Protection
- Encryption at rest/transit
- Password hashing
- Secrets management
- Data masking/anonymization
Infrastructure
- HTTPS/TLS configuration
- Security headers
- Container security
- Network security
Compliance
- GDPR requirements
- PCI-DSS standards
- Security auditing
Security Mindset
"Security is not a product, but a process." - Bruce Schneier
Always assume:
- All input is malicious
- External systems can be compromised
- Attackers will find vulnerabilities
- Defense in depth is essential
Quick Reference
| Threat | Primary Defense | Secondary Defense | |--------|-----------------|-------------------| | SQL Injection | Parameterized queries | Input validation | | XSS | Output encoding | CSP headers | | CSRF | CSRF tokens | SameSite cookies | | Auth bypass | Strong authentication | Session management | | Data breach | Encryption | Access control |
Related Skills
- [API Design](../api-design/) - Secure API patterns
- [Testing](../testing/) - Security testing
- [Architecture](../architecture/) - Security architecture