Security Fundamentals — Cybersecurity for Engineers

Before you start: no prior security background is assumed — this is the entry point for the whole Security academy. Basic familiarity with how a web request reaches a server (client → network → server) helps for the later examples, but isn't required.

Imagine a bank vault. It isn't protected by one lock — there's a guard at the door, a vault door itself, a time lock, cameras, an alarm tied to a monitoring center, and a safe deposit box inside that. Any single one of those failing (a guard falls asleep, a camera goes offline) doesn't mean the bank gets robbed, because the other layers are still there. A secure computer system works the same way: no single protection is ever assumed to be perfect, so real systems stack several independent defenses, and a failure in one layer is a warning, not a catastrophe. Security engineering is the discipline of designing and reasoning about those layers deliberately, instead of hoping nothing ever goes wrong.

The CIA Triad

Every security decision traces back to protecting one (or more) of three properties:

Each is broken differently — data exfiltration (data being stolen and copied out) breaks confidentiality; SQL injection (an attack that sneaks database commands into a form field) breaks integrity by letting an attacker alter data directly; a DDoS attack (flooding a system with fake traffic until it can't respond to real users) breaks availability.

Threat Modeling

Threat modeling means deliberately asking "what could go wrong here, before it actually happens" — walking through a system on paper and identifying its weak points, rather than waiting to find out the hard way. STRIDE is one structured way to do this — a checklist of 6 categories of things that can go wrong with any system:

|--------|-------------|---------|

Defense in Depth

Never rely on a single security control — the vault-with-many-layers idea from the opening, applied to a real web system. Each layer below assumes every layer above it could fail:

Common Attack Vectors

OWASP Top 10 (Web Applications):

Cloud Security Misconfigurations (most breaches):

Encryption Fundamentals

Symmetric Encryption — Same key for encryption and decryption. Fast. AES-256 is the standard. Problem: secure key exchange.

Asymmetric Encryption — Public key encrypts, private key decrypts. RSA, ECC. Slower but solves key exchange. Used in TLS handshake, SSH, digital signatures.

Hashing — One-way function, produces fixed-length digest. SHA-256, bcrypt (passwords). Used for integrity verification, password storage.

TLS (Transport Layer Security) — Combines asymmetric (handshake) + symmetric (data transfer). TLS 1.3 is current standard. Provides: authentication, confidentiality, integrity.

# Check TLS certificate
openssl s_client -connect synfracore.com:443 -showcerts 2>/dev/null | openssl x509 -noout -text

# Check expiry
echo | openssl s_client -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

# Generate self-signed cert (dev only)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout server.key -out server.crt

Identity and Authentication

Multi-Factor Authentication (MFA):

Always enable MFA for: AWS root account, cloud consoles, VPN access, admin SSH, code repositories.

Zero Trust Model: "Never trust, always verify." Assume the network is compromised. Verify every request regardless of origin. Least-privilege access. Micro-segmentation.

Incident Response — PICERL