Security

Security principles, threat reduction, secure defaults, and engineering controls.

Entries (5)

Authentication vs authorizationAuthentication establishes who or what is acting. Authorization decides what that identity is allowed to do. Conflating them creates access-control gaps.

Defense in depthLayer independent controls so that a failure in one control does not by itself expose the protected asset.

Least privilegeGrant a subject only the access it needs for its current authorized task, scoped in time and operation, and remove that access when the task ends.

Secure defaults and fail-closed behaviorShip a system closed by default, and make an uncertain or failed security decision deny access rather than allow it.

Threat modelingIdentify plausible threats to a system before choosing controls, so security effort targets real risk instead of guesswork.