2.8e Security

Identity and Access Management (IAM):
Authentication—proving who you are: JWT, SSO, OAuth 2.0, multi-factor authentication.
Authorization—determining what you can do: RBAC (Role-Based), ABAC (Attribute-Based).
Public-key cryptosystems: RSA—encrypt with public key, decrypt with private key; sign with private key, verify with public key. TLS handshakes depend on this infrastructure.
Cryptographic protocols: TLS/SSL for transport-layer security. Modern applications should enable HTTPS for all communications.
Principle of least privilege: Every entity (user, process, service) should be granted only the minimum permissions needed to perform its tasks.
Common attack types:
DoS / DDoS: Exhausting target resources to deny service. Defense: rate limiting, CDN, WAF.
SQL injection: Injecting malicious SQL via input concatenation. Defense: parameterized queries, ORM.
Man-in-the-middle: Intercepting and potentially modifying communications. Defense: TLS, certificate verification.
XSS (Cross-Site Scripting): Injecting malicious scripts into pages. Defense: input escaping, Content Security Policy (CSP).
CSRF (Cross-Site Request Forgery): Tricking users into performing unintended actions. Defense: CSRF tokens, SameSite cookies.