Security
Security work is about reducing risk before a weakness becomes an incident. Use this page as a quick reference for common application security categories and the habits that reduce them.
OWASP Top 10 2025
The OWASP Top 10 is an awareness document for the most critical web application security risks. The current released version is OWASP Top 10:2025.
| Rank | Risk | What To Watch For |
|---|---|---|
| A01 | Broken Access Control | Users can access data or actions they should not be allowed to use. |
| A02 | Security Misconfiguration | Defaults, exposed diagnostics, permissive settings, or missing hardening create avoidable openings. |
| A03 | Software Supply Chain Failures | Dependencies, build systems, packages, or third-party services introduce untrusted or vulnerable code. |
| A04 | Cryptographic Failures | Sensitive data is exposed because encryption, hashing, key handling, or transport protection is weak. |
| A05 | Injection | Untrusted input is interpreted as commands, queries, expressions, or code. |
| A06 | Insecure Design | The system design misses abuse cases, trust boundaries, or security controls from the start. |
| A07 | Authentication Failures | Login, session, credential, or identity flows can be bypassed or abused. |
| A08 | Software or Data Integrity Failures | Code, updates, CI/CD pipelines, serialized data, or stored data can be tampered with. |
| A09 | Security Logging and Alerting Failures | Attacks are hard to detect, investigate, or respond to because useful events are missing or ignored. |
| A10 | Mishandling of Exceptional Conditions | Errors, edge cases, and unexpected states leak information or create unsafe behavior. |
Secure Coding Checklist
- Enforce authorization on the server for every protected action and object.
- Keep production configuration minimal, hardened, and environment-specific.
- Pin, review, and update dependencies; remove packages that are not needed.
- Protect sensitive data in transit and at rest with current cryptographic practices.
- Use parameterized queries, safe encoders, and allowlists for untrusted input.
- Threat model important workflows before implementation.
- Use strong authentication, secure session handling, and safe password storage.
- Verify software and data integrity in deployment, build, and update paths.
- Log security-relevant events with enough context to investigate safely.
- Handle errors consistently without exposing stack traces, secrets, or internal details.
Sources
Cyber security
A practice of protecting compute rnetworks, devices and information from damage, loss or unauthorized access Categories: Infrastructure, applicaiton, network IoT, Cloud Information security (InfoSec) is the proactice of protecting information Information security contains cybersecurity
Information Security
Principles of information security
Confidentiality, integrity availability (CIA) Authentication, authorization and accounting (AAA) Accounting: record keeping and tracing of agent activities on computer devices and networks
Threat Landscape
To be a threat, the information must be relevant, actionable and contextual (some company might think not a threat)
Blue hat hacker -> ethical and hired third party to test the vulnerabilities An attack vector is a method used by a bac actor to illegally access or inihibit a network
Main four categories
Social engineering, malware, unauthorized access, system design failure. Social engineering - tricking other people to expose confidential information
- Trojan attack - infect one computer which can be an entry point to the network to multistage attack.
- Spearphsing - targeted phising attack
- Birthday attack - The password is normally hashed in the db. Db has been hacked. With that hash the attacker can much easily find the password with fewer tries.
- Attack vector: vulnerability, pathway, mechanism
Threat Intelligence
- Internal Threat Intelligence can be found within the organisation’s IT team such as server logs
- External Threat Intelligence can be be from FBI.