🔒Security Engineer

The OWASP Top 10 is the industry-standard list of the most critical web application risks (injection, broken auth, XSS, misconfiguration and similar). It matters because it prioritizes testing, guides secure-design checklists, and gives teams a shared vocabulary for triage and training. Use it to scope reviews and map findings to remediations.

SQL injection injects attacker SQL through unsanitized input concatenated into queries, enabling data theft or destruction. Prevent it primarily with parameterized queries and prepared statements plus least-privilege DB accounts, along with input validation, safe ORM usage, WAF rules and regular testing. Never build queries by string concatenation.

Stored XSS persists payloads server-side, reflected XSS bounces input off responses, and DOM XSS executes purely client-side through unsafe sinks. Prevent all three with contextual output encoding, framework auto-escaping, Content Security Policy and Trusted Types, plus input validation on the server. Test with payload fuzzing and review innerHTML style sinks carefully.

Issue anti-CSRF tokens bound to sessions for state-changing requests, enforce SameSite Lax or Strict cookies, and validate Origin and Referer headers server-side. Prefer custom headers or token-based auth for APIs so browsers do not attach credentials automatically. Test logout, cross-site flows and cookie flags in staging.

Server-side request forgery tricks a server into fetching attacker-chosen internal URLs, exposing metadata services and intranets. Prevent it with allowlists for outbound hosts, blocking private IP ranges, disabling redirects to internal addresses, and requiring authentication for metadata endpoints. Validate and sanitize user-supplied URLs with network egress controls.

Enforce server-side ownership checks on every object ID, use unpredictable identifiers where appropriate, and test by swapping IDs across users and roles. Centralize authorization logic with deny-by-default policies and log violations for review. Include BOLA cases in code review checklists and automated API tests.

Deploy Content Security Policy to limit script sources, HTTP Strict Transport Security for HTTPS enforcement, X-Content-Type-Options against sniffing, Referrer-Policy for privacy, and frame protections against clickjacking. Configure them tightly, monitor violation reports, and test with header scanners. Headers are cheap defense-in-depth that blunt entire exploit classes.

Tier limits by endpoint sensitivity and customer plan, use token buckets with burst control, and return standard 429 responses with retry guidance. Layer bot detection, API keys with quotas, and anomaly alerts for credential stuffing. Load-test limits to avoid breaking legitimate peaks.

Inventory endpoints with data classification, centralize policy enforcement with deny-by-default, and add automated tests that cross user roles and object IDs. Review risky mass-assignment and CORS configs, log denials for tuning, and train teams on object and function-level checks. Track repeat findings to prove systemic fixes.

Ship hardened baselines for frameworks, clouds and containers, disable defaults like debug modes and directory listing, and scan continuously with CIS benchmarks. Manage config as code with reviews, drift detection and secrets separation. Verify with pre-prod checklists and periodic red-team spot checks.

Log auth events, privilege changes, input validation failures, API errors and admin actions with user, time, source and outcome, protecting logs from tampering with central append-only storage. Avoid sensitive data like passwords and full card numbers, define retention by compliance, and alert on high-value patterns. Test that logs actually answer incident questions.

Attackers craft serialized objects that execute code or alter logic when trusted libraries deserialize them without integrity checks. Prevent by avoiding native deserialization of untrusted data, using safe formats like JSON with schema validation, signing payloads where needed, and patching frameworks. Test with gadget-chain payloads in isolated labs.

Authentication verifies identity (who you are) via passwords, MFA, SSO or keys. Authorization enforces what an authenticated identity may do via RBAC or ABAC policies checked on every request. Common failures include confusing the two, trusting client-side checks, and broken object-level authorization (IDOR), so enforce server-side checks with least privilege.

Network and host sensors inspect traffic and behavior against signatures and anomalies, feeding SIEM with context for triage. Tune to asset criticality, decrypt strategically with privacy controls, and layer with EDR for endpoint truth. Measure detection precision and coverage rather than raw alert volume.

VPNs: grant broad network access after perimeter login, implicitly trusting connected devices and enabling lateral movement. Zero Trust access: grants per-app, per-request access after identity and posture checks with no network trust. Prefer Zero Trust for SaaS and hybrid work, keeping VPNs only for legacy segments during migration.

Roll out FIDO2 passkeys or hardware keys that bind auth to origin, enforce number matching for push fallbacks, and phase out SMS codes vulnerable to SIM swap. Plan enrollment, recovery and exception flows, monitor auth strength by user group, and require step-up for sensitive actions. Report reduced account-takeover rates as success proof.

Start from CVSS base scores for severity, adjust with temporal and environmental factors like exploit availability and asset criticality, then factor reachability and business impact. Prioritize internet-facing, authenticated-bypass and data-access issues first with SLAs. Track remediation burn-down and exception expiries.

Firewalls: filter network traffic by IP, port and protocol at layers three and four to segment networks. WAFs: inspect HTTP semantics like payloads and sessions at layer seven to block injection and abuse. Deploy both: firewalls for segmentation and WAFs tuned per app in front of public APIs.

Discover assets continuously, scan with authenticated checks, prioritize by exploitability and business risk, assign SLAs, verify fixes with rescans and track exceptions to expiry. Report burn-down by team, integrate tickets into sprints, and celebrate SLA wins. Close the loop with root-cause fixes for repeat classes.

Use OAuth 2.0 and OIDC with short-lived access tokens and refresh rotation, enforce scopes per endpoint, validate tokens (signature, expiry, audience) at the gateway, and require mTLS or service identities for service-to-service calls. Add rate limiting, audit logging, key rotation via JWKS, and deny-by-default authorization checks in each handler.

Defense in depth layers independent controls so one failure does not compromise the system: edge protection with WAF and DDoS mitigation, network segmentation, hardened hosts, app-level validation and auth, data encryption, monitoring and backups. Each layer covers the gaps of others; size investments by threat model and crown-jewel assets.

OAuth 2.0 delegates authorization with scoped access tokens through flows like authorization code with PKCE, while OpenID Connect adds ID tokens for authentication of the user. Validate issuer, audience, expiry and signatures, use short lifetimes with rotation, and never trust claims client-side alone. Store secrets securely and enforce least-privilege scopes per client.

Verify every request with strong identity, device posture and context, enforce least-privilege micro-segmentation, and encrypt traffic end to end with continuous monitoring. Replace implicit network trust with policy engines, conditional access and per-request authorization. Roll out incrementally starting from crown-jewel apps with measurable auth and lateral-movement metrics.

Enforce least privilege with scoped roles, short-lived credentials and MFA, separate duties across accounts and projects, and review access with periodic recertification. Monitor with CloudTrail style audit logs, alert on privilege escalation and key exposure, and automate guardrails with policy as code. Remove long-lived keys wherever possible.

Model early with data-flow diagrams, STRIDE or similar frameworks, rank threats by impact and likelihood, and convert mitigations into acceptance criteria and security stories. Gate high-risk changes with architecture reviews, automate checks in CI, and revisit models when data flows change. Track reduced rework as proof of value.

Tier networks into public, app and data zones with deny-by-default rules, isolate workloads with security groups and NACLs, and restrict east-west traffic with micro-segmentation. Log accepted and denied flows centrally, review rules quarterly, and test with port scans and breach simulations. Document each rule with owner and business justification.

Watch for none-algorithm acceptance, algorithm confusion, weak secrets enabling brute force, missing expiry and audience checks, and token replay after logout. Defend by allowlisting algorithms, validating issuer audience expiry and signatures, using short lifetimes with rotation, and keeping sensitive auth server-side. Log and alert on validation failures.

Focus on auth, crypto, input handling, business-logic abuse and secrets, tracing tainted data from sources to sinks with threat-model context. Use checklists and SAST to pre-filter, verify fixes with tests, and teach secure patterns in comments. Track recurring flaw classes to drive training and safe defaults.

Pin and verify dependencies with lockfiles and hashes, scan for vulnerabilities and malware, require signed builds with provenance like SLSA, and monitor for typosquatting and maintainer changes. Isolate build systems, enforce code review for upgrades, and maintain an SBOM for incident response. Practice rapid revocation and replacement for compromised packages.

Use minimal base images, run as non-root with read-only filesystems, drop unneeded capabilities, scan images in CI and sign them before deploy. Limit secrets via runtime injection, enforce resource quotas, and monitor syscalls with runtime policies. Rebuild regularly to absorb patched bases.

Grant least-privilege roles per service account, disable automount where unneeded, separate namespaces with network policies, and store secrets in managed vaults with rotation and audit. Protect etcd, enforce admission policies, and scan manifests in CI. Review bindings quarterly for privilege creep.

Start in monitoring mode, baseline false positives by endpoint, enable managed rules for OWASP classes with targeted exclusions, and roll out in stages with canary traffic. Correlate blocks with app logs, alert on bypass patterns, and review monthly against pentest findings. Pair WAF with code fixes since it cannot cure logic flaws.

SAML: is XML-based enterprise SSO with signed assertions exchanged via browser redirects, common in legacy workforce apps. OIDC: is JSON and REST based identity on OAuth 2.0 with ID tokens, better for modern web and mobile. Choose OIDC for new apps and maintain SAML for enterprise compatibility, validating signatures and audiences strictly.

Providers secure the physical infrastructure and hypervisors while customers secure data, identities, configs and workloads they deploy. Misunderstanding this causes open buckets and over-permissive roles, so enforce guardrails, logging and least privilege on your side. Review the matrix per service model from IaaS to SaaS.

Layer edge scrubbing with anycast, rate limiting and bot management, cache static content on CDN, autoscale stateless tiers, and test with game-day simulations. Monitor traffic baselines by region, automate null-routing of extreme sources, and coordinate with providers for volumetric floods. Keep incident comms ready for customer impact.

SAST: analyzes source or bytecode without running the app, catching flaws early with some false positives. DAST: tests running apps from outside like an attacker, finding runtime issues later. IAST: instruments the running app for precise findings during tests. Combine SAST in PRs, IAST in integration and DAST before release.

Store secrets in Vault or cloud managers with dynamic short-lived credentials, inject at runtime rather than env files in repos, rotate automatically with audit trails, and scan repos for leaks with revocation playbooks. Enforce least-privilege access with break-glass procedures. Test rotation without downtime before incidents.

Baseline with assessments and metrics on flaw density and fix SLAs, then sequence quick wins like SSO enforcement and secret scanning before platform investments like secure defaults and IaC guardrails. Staff champions, set quarterly targets, and report risk reduction to executives. Fund prevention proportional to incident costs.

Penetration testing is authorized simulated attack to find exploitable weaknesses, following recon, scanning, exploitation, privilege escalation and reporting phases with clear rules of engagement. It complements automated scanning by chaining issues humans notice. Deliverables are severity-ranked findings with reproduction steps and remediation guidance, then retest after fixes.

Vulnerability scanning is automated, broad and fast, matching known signatures across assets, but produces false positives with no exploit proof. Penetration testing is human-led, narrow and deep, chaining weaknesses to demonstrate real business impact. Mature programs run continuous scanning plus periodic pentests, using scan results to scope the pentest.

Define scope and rules of engagement, perform recon and threat modeling, scan and enumerate, exploit with proof-of-impact care, attempt post-exploitation within bounds, then report severity-ranked findings with reproduction and remediation. Coordinate with defenders for windows, safety and data handling. Close with retesting to confirm fixes.

Route traffic through Burp Suite or ZAP, install the CA to inspect TLS in scope only, then map the app, fuzz inputs and test auth flows with repeater and intruder features. Keep scope tight, respect authorization boundaries, and document requests for reports. Pair proxy findings with code review for root causes.

Start from OSINT like DNS, certificates and cloud footprints, then run authorized Nmap scans with timing controls, service detection and minimal intrusiveness. Document assets, exposures and versions without exploiting, and coordinate windows with owners. Convert findings into prioritized targets for deeper testing.

Attackers exploit misconfigurations, unpatched services, weak sudo rules, token theft and credential reuse to move from user to admin or domain control. Harden with least privilege, patching, credential hygiene, LAPS style rotation and EDR rules for suspicious elevation. Test with assumed-breach exercises and review privileged paths regularly.

Run scoped phishing and vishing simulations with clear guardrails, measure click and report rates by team, and follow with just-in-time training rather than punishment. Strengthen with MFA, verification workflows for sensitive actions, and easy reporting buttons. Track repeat-offender coaching progress and report-rate improvement over time.

Lead with executive risk summary, then severity-ranked findings each with impact, reproduction steps, evidence and prioritized remediation with effort estimates. Include positive controls, retest results and strategic roadmap items. Clear ownership and timelines turn technical findings into funded fixes.

Red teams: emulate adversaries to test detection and response with stealth within scope. Blue teams: defend through monitoring, hardening and incident response. Purple teams: run collaborative exercises where offense and defense share techniques to close gaps faster. Mature programs rotate all three with shared metrics on detection and dwell time.

With authorization, survey SSIDs and encryption types, test WPA2 and WPA3 configs, rogue AP detection, certificate validation for enterprise EAP, and client isolation on guest networks. Attempt controlled evil-twin and deauth only within agreed bounds. Report with remediation for segmentation and monitoring gaps.

Track click, credential-submit and report rates by department over time, reward fast reporters, and deliver role-based coaching after failures. Harden with mail filtering, link rewriting and MFA so training is the last line, not the only line. Report trend improvement to leadership, not shame lists.

Symmetric encryption uses one shared secret to encrypt and decrypt (AES): fast for bulk data but needs secure key exchange. Asymmetric encryption uses a public and private key pair (RSA, elliptic curve): it solves key distribution and enables signatures, but is slower, so it typically protects keys or small payloads in hybrid schemes like TLS. Mention key lengths and rotation.

Client and server negotiate versions and cipher suites, exchange ephemeral key shares for forward-secret Diffie-Hellman, then derive session keys and authenticate the server with certificates. TLS 1.3 cuts round trips, removes weak primitives and encrypts more of the handshake for privacy. Mention certificate validation, SNI behavior and session resumption trade-offs.

Use memory-hard algorithms like Argon2 or bcrypt with unique salts and tuned cost factors, never plain hashes or reversible encryption. Enforce MFA, breach-password screening and rate limiting on login, and upgrade hashes transparently on next login when costs increase. Store parameters alongside hashes for future migration.

Automate issuance and renewal with ACME style workflows, maintain an inventory with expiry alerts, use short lifetimes and private CAs for internal services. Enforce key protection in HSMs or managed stores, rotate on compromise, and monitor Certificate Transparency logs. Test renewal failure and revocation paths before incidents.

Hashing: is one-way and deterministic for integrity and password storage, where even small input changes produce unrelated digests. Encryption: is reversible with keys for confidentiality, allowing authorized decryption of data. Use salted slow hashes for passwords and authenticated encryption like AES-GCM for sensitive data at rest and in transit.

Version keys with aliases, dual-support old and new during rotation, re-encrypt data in stages, and automate rotation schedules in KMS or HSM with audit trails. Test rollback, update backups, and revoke compromised keys with incident playbooks. Document ownership and rotation cadence per data class.

They generate and use keys inside tamper-resistant hardware or managed services so raw keys never leave the boundary, with fine-grained policies and audit logs. Automate rotation, separation of duties and backup of key material under split control. Compare cloud KMS ease against on-prem HSM control for regulated workloads.

Pinning binds clients to specific public keys or certificates so rogue CAs cannot silently intercept traffic, complementing standard chain validation. Implement with backup pins, staged rollout and fast rotation to avoid bricking apps on expiry. Monitor pin failures to distinguish attacks from operational errors.

Follow an IR plan: detect and triage severity, contain by isolating hosts and revoking keys, eradicate persistence, recover from known-good with rotated credentials, then run a blameless postmortem with detection and prevention actions. Preserve evidence with timelines, communicate status on a cadence, and practice with tabletop exercises before real incidents.

Centralize high-fidelity logs with normalized schemas, write use cases tied to MITRE ATT and CK techniques, tune thresholds to control false positives, and attach runbooks with severity and ownership. Measure mean time to detect, coverage gaps and alert precision, iterating with threat intel and postmortems. Prioritize detections for initial access, persistence and exfiltration.

Preserve evidence with write blockers and memory captures first, maintain chain of custody, then analyze timelines, registry and filesystem artifacts plus process, network and credential artifacts in memory. Use tools like Sleuth Kit, Volatility and timeline explorers to reconstruct attacker actions. Document findings chronologically for legal and remediation use.

Isolate affected hosts, preserve logs and memory for forensics, engage legal and leadership, and avoid wiping before evidence capture. Restore from tested offline backups with credential rotation, hunt for persistence across identity and cloud, then harden remote access and patch the entry vector. Rehearse the playbook with tabletop drills beforehand.

Detonate samples in isolated sandboxes with snapshots, capture network, file and registry behavior, then triage strings, imports and configs before deeper reverse engineering. Block indicators across EDR and mail gateways, hunt historically, and document family and capabilities. Never analyze on production hosts or connected networks.

Prioritize by severity, asset criticality and exploitability, enrich with asset, identity and threat intel context, then escalate true positives with containment steps. Tune noisy rules, automate enrichment and low-risk response, and track mean time to triage and escalate. Review false positives weekly to improve precision.

Consume vetted feeds for IOCs and TTPs, map them to your tech stack with MITRE ATT and CK, and push high-confidence blocks to edge, mail and EDR with expiry. Hunt historically on arrival, measure precision and time saved, and share internally with context. Avoid auto-blocking low-confidence feeds that cause outages.

Pick a realistic scenario like ransomware or cloud-key leak, gather engineering, legal, comms and execs, then inject timed events forcing decisions on roles, comms and recovery. Capture gaps in playbooks and tooling, assign owners, and retest within a quarter. Keep it blameless to surface honest weaknesses.

EDR collects process, file and network telemetry on endpoints with behavioral rules and isolation actions, while XDR correlates across endpoint, identity, mail and cloud for unified investigation. Tune detections, automate containment for high-confidence cases, and hunt with the telemetry. Measure dwell-time reduction after rollout.

Log who collected what, when and how with hashes at capture, store originals immutable with access controls, and document every transfer and analysis step. Use write blockers and forensic copies for examination, keeping originals pristine. Defensible custody sustains legal and HR outcomes.

Map requirements such as GDPR principles (lawfulness, minimization, subject rights, breach notification) into data inventories, retention policies, consent and DSR workflows, encryption and access controls, vendor DPAs and audit evidence. Embed privacy by design in reviews and run periodic access recertification plus tabletop data-breach drills.

Define trust-service criteria scope, implement controls for access, change management, monitoring and incident response with evidence trails, then collect months of operating effectiveness proof. Automate evidence from ticketing, CI and IdP logs, remediate gaps before the observation window, and train owners on walkthroughs. Treat the audit as continuous hygiene, not a scramble.

Minimize card-data scope with tokenization and hosted fields, segment the cardholder environment, encrypt data in transit and at rest, and enforce logging, vulnerability management and annual testing. Validate with self-assessments or QSA audits depending on level, and remediate failing controls promptly. Never store sensitive auth data after authorization.

Apply administrative, physical and technical safeguards with minimum-necessary access, encryption, audit controls and business-associate agreements. Enforce authentication, automatic logoff and transmission security, train staff against phishing, and rehearse breach notification workflows. Audit access logs regularly for inappropriate record views.

It requires an information security management system with leadership support, risk assessment, Statement of Applicability, Annex A controls and continuous improvement through internal audits. Organizations run gap assessments, implement policies and monitoring, then pass staged external audits. Certification signals disciplined governance to enterprise buyers.

Classify data, deploy endpoint, mail and cloud DLP with fingerprinting and exact-match rules, and tune to reduce false positives with user coaching prompts. Encrypt sensitive stores, restrict sharing defaults, and audit bypass requests. Measure blocked exfiltrations and policy-override trends monthly.

Determine scope, affected data and jurisdictions quickly with legal, meet tight windows like 72-hour regulator notices with accurate facts, and notify individuals with remediation offers. Preserve evidence, coordinate law-enforcement timing, and document decisions to show diligence. Practice notification templates before real incidents.

Build data inventories mapping personal data across systems, automate access and deletion workflows with identity verification, honor opt-outs of sale or sharing, and track fulfillment within statutory windows. Train support, log requests for regulators, and minimize collection going forward. Test the flow quarterly end to end.