Review Glossary FR

Size

Eyes

Finish a part in any dojo to unlock the next eyes.

Learn how systems get attacked, ten minutes a day.

Each chapter shows how one attack works, then how a real open-source project defends against it.

Today · day 1 · 10 min

Threat modeling a feature
Start reading →

0 of 40 chapters done

Threats: 0 of 8Identity: 0 of 8Input and output: 0 of 8Secrets and supply chain: 0 of 8Running safely: 0 of 8
One pillar per part. It fills as you finish its chapters.

The path

Threats: 0 of 8Threats

  1. Threat modeling a feature 1
  2. Trust boundaries 2
  3. Least privilege 3
  4. Layers of defence 4
  5. Reading a CVE 5
  6. Attack surface: what an attacker can reach 6
  7. Secure defaults 7
  8. Responding to an advisory 8

Identity: 0 of 8Identity

  1. Storing passwords 9
  2. Sessions and cookies 10
  3. Cross-site request forgery 11
  4. OAuth 2 in plain words 12
  5. JWT pitfalls 13
  6. Second factors 14
  7. Slowing down guessing 15
  8. Authorization: who may do what 16

Input and output: 0 of 8Input and output

  1. SQL injection 17
  2. Cross-site scripting 18
  3. Content Security Policy 19
  4. Server-side request forgery 20
  5. Path traversal 21
  6. Unsafe deserialization 22
  7. Validating input at the boundary 23
  8. File uploads 24

Secrets and supply chain: 0 of 8Secrets and supply chain

  1. Secrets in git 25
  2. Where secrets live 26
  3. TLS in one handshake 27
  4. Certificates that renew themselves 28
  5. Vulnerable dependencies 29
  6. Pinning what you install 30
  7. Signing what you ship 31
  8. Supply chain attacks 32

Running safely: 0 of 8Running safely

  1. Hardening a container 33
  2. Pod Security Standards 34
  3. Network policies 35
  4. Logs that help after a breach 36
  5. Detecting an attack 37
  6. When you are breached 38
  7. Using crypto correctly 39
  8. Capstone: securing a small shop 40