Security Engineering (DevSecOps)

Introduction: Who Are You and What Can You Do?

Modern Auth: OAuth 2.0 vs. OpenID Connect (OIDC)

OIDC in Action: Tokens and Flows

The Enterprise Classic: SAML

Controlling Access: RBAC (Role-Based Access Control)

Fine-Grained Control: ABAC (Attribute-Based Access Control)

Introduction: The Castle and Moat is Dead

Machine-to-Machine Security: Standard TLS vs. mTLS

The Challenge: Who Issues the Passports?

Workload Identity: SPIFFE and SPIRE

Human Access: The Problem with VPNs and the Boundary Model

Introduction: The Problem of Secret Sprawl

The Gold Standard: HashiCorp Vault Architecture

Vault: The Seal and the Keys to the Kingdom

Vault: Getting In (Auth Methods)

Vault Engines: Static vs. Dynamic Secrets

The Cloud-Native Way: AWS Secrets Manager

Secrets in Kubernetes: External Secrets Operator (ESO)

The Root of Trust: HSMs (Hardware Security Modules)

Introduction: Shifting Security Left

SAST: The Code Spellchecker

DAST: The Simulated Hacker

SCA: Checking Your Supply Chain

Container Scanning: Trivy and Grype

Runtime Protection: The Security Camera

Introduction: Why We Model Threats

STRIDE: A Framework for Categorizing Threats

Data Flow Diagrams: The Foundation of Threat Modeling

Visualizing Attacks: Attack Trees

Prioritizing Threats: The DREAD Model and Risk Matrices

The Human Element: Red Teaming and Blue Teaming

Introduction: Why Engineers Should Care About Compliance

FIPS 140-2: The Foundation of Cryptography

FedRAMP: Selling Cloud Services to the US Government

PCI-DSS: Protecting Credit Card Data

GDPR and Data Residency: Geography as a Technical Constraint

Compliance as Continuous Engineering, Not a One-Time Audit

Introduction: Keeping Secrets in a Digital World

Encryption vs. Hashing: The Crucial Difference

Symmetric Encryption: The Shared Secret

Asymmetric Encryption: Public and Private Keys

Hashing Deep Dive: The Digital Fingerprint

Password Hashing: Salt and Pepper

Digital Signatures: Authentication and Non-Repudiation

The Quantum Threat to Cryptography

Post-Quantum Cryptography (PQC)

Introduction: The Third State of Data

What is a TEE (Trusted Execution Environment)?

Implementation 1: Intel SGX (Software Guard Extensions)

Implementation 2: AMD SEV (Secure Encrypted Virtualization)

Implementation 3: AWS Nitro Enclaves

Remote Attestation: The Cryptographic ID Card

Confidential Computing in Practice: Use Cases and Trade-offs

Introduction: The Liability of "Standing Access

How JIT Works: The Four-Step Flow

Automated Workflows: Sym, Indent, and Native Cloud Tools

JIT for Cloud Infrastructure: AWS, GCP, and Azure Patterns

Break-Glass Procedures: When JIT Itself Fails

Introduction: The Spectrum of Trust

BYOK (Bring Your Own Key)

HYOK (Hold Your Own Key) / External Key Store (XKS)

Multi-Party Computation (MPC): The Keyless Key

Introduction: Can You Trust Your Own OS?

The Hardware Ledger: Trusted Platform Module (TPM)

The Chain of Trust: Secure Boot vs. Measured Boot

Releasing Secrets: Sealing and Unsealing

Remote Attestation: Proving Health to the Cloud

The IMA Subsystem: Extending Attestation into Runtime

Introduction: Why Passwords Must Die

FIDO2 and WebAuthn: The Standard

Passkeys: FIDO2 for the Masses

Device Posture: Contextual Access

Introduction: Compliance by Design

Pseudonymization vs. Anonymization: A Legal Minefield

k-anonymity: Hiding in the Crowd

The Failure of k-anonymity: Homogeneity and Linkage Attacks

Differential Privacy: The Gold Standard

Tokenization: Protecting Data at Rest

Data Minimization and the Right to Be Forgotten

Introduction: The "Log Everything" Problem

The Telemetry Triad: What Are We Collecting?

SIEM Engineering: Detection as Code

Advanced Threat Hunting: Finding the Needle

Data Lake Architecture Patterns and Operational Considerations

Introduction: The Ten Most Wanted

A03: Injection (The SQL Nightmare)

A01: Broken Access Control (IDOR and Beyond)

A03: Cross-Site Scripting (XSS)

A10: Server-Side Request Forgery (SSRF)

A02 & A05: Cryptographic Failures and Security Misconfiguration

Introduction: The Unpatchable Vulnerability

Phishing: The Digital Lure

Vishing and Smishing: Voice and SMS Attack Vectors

Physical Security: Tailgating and Piggybacking

Pretexting: The Long Con

Baiting and Quid Pro Quo: Exploiting Greed and Reciprocity

Building Organizational Defenses Against Social Engineering

Introduction: Misconfiguration is the Real Exploit

The Old Way: Agents vs. The New Way: Agentless

How Agentless Works: SideScanning

Graph-Based Context: Connecting the Dots

Compliance Reporting Automation

Introduction: The New Perimeter

The #1 Vulnerability: BOLA (Broken Object Level Authorization)

Excessive Data Exposure: The "Lazy Backend

Rate Limiting: Preventing Abuse at Scale

Authentication Patterns for APIs: Tokens and Keys

Injection Attacks via APIs: SQL and Beyond

Introduction: JavaScript for the Linux Kernel

Why eBPF? The End of TOCTOU

eBPF Hook Types: Where You Can Attach

Falco: The Security Camera

Tetragon: The Enforcer (Prevention)

eBPF Security in Kubernetes: The Full Picture

Introduction: The Problem with "Open by Default

Architecture: The Webhook Interceptor

The Core Model: Templates vs. Constraints

The Language: Rego

Audit vs. Deny: Dry Run Mode

Mutations: Gatekeeper Beyond Validation

Introduction: The "Shared Secret" Problem

What is a JWKS?

Key Rotation: Zero Downtime Security

Caching Strategies: Don't DoS Your Own Auth Server

Security Considerations and Attack Vectors