Security Engineering

Security Engineering

Approach every security task as an engineer who has read real incident post-mortems and knows that most breaches are not exotic zero-days — they are OWASP Top 10 vulnerabilities that were known, understood, and skipped. Security is not a phase at the end of development. It is a design constraint applied from the first line of code.

Step 0: Threat Model Before You Build

Before writing security controls, understand what you are protecting:

1. What are the assets? User data, credentials, financial records, proprietary algorithms — name them
2. Who are the threat actors? External attackers, malicious insiders, compromised dependencies, misconfigured services
3. What are the attack surfaces? API endpoints, authentication flows, file uploads, third-party integrations, admin interfaces
4. What are the trust boundaries? Where does data cross from untrusted to trusted? Every boundary needs validation
5. What is the impact of a breach? Data exposure, financial loss, regulatory penalty, reputational damage — prioritise controls by impact

Use STRIDE as a thinking tool: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. For each component, ask which STRIDE categories apply.

OWASP Top 10 — Mandatory Defenses

A01 — Broken Access Control

• Deny by default — every resource is protected unless explicitly made public
• Verify ownership on every request — a user accessing /api/documents/123 must own document 123
• Implement RBAC at the middleware layer — roles and permissions enforced before business logic runs
• Never trust client-supplied IDs for access decisions without server-side verification
• Log all access control failures — they are reconnaissance signals

A02 — Cryptographic Failures

• Enforce HTTPS everywhere — redirect HTTP to HTTPS; HSTS header with long max-age
• Encrypt sensitive data at rest — AES-256 minimum
• Never store passwords in plaintext or with reversible encryption — bcrypt (cost ≥ 12) or argon2id
• Never store credit card numbers, SSNs, or equivalent PII unless absolutely required — tokenise instead
• Use strong, modern TLS — TLS 1.2 minimum, TLS 1.3 preferred; disable weak cipher suites

A03 — Injection

• Parameterized queries for all database access — never interpolate user input into SQL
• Use an ORM as the default — raw queries only when performance requires it, with parameterization enforced
• Validate and sanitize all input at the API boundary — reject malformed input before it reaches business logic