Easy Learn
What Is a Security Audit? A ground-up, beginner-friendly deep dive into how security audits actually work — who performs them, what they check, how findings flow into fixes, and how large organisations run this process continuously rather than as a once-a-year fire drill. 01 · Intro & History02 · The…
What Is Secure API Design? A complete, beginner-to-production guide to designing APIs that are safe by default — covering authentication, authorisation, transport security, input validation, rate limiting, secrets management, and the real-world engineering practices companies like Netflix, Amazon, and Stripe use to protect billions of API calls every day. 01…
A complete beginner-to-production guide to defending real systems against DDoS attacks through deliberate architecture, not just bandwidth or vendor purchases. Covers the history from the 1996 SYN flood through MafiaBoy, Estonia, Spamhaus, the 2016 Mirai botnet against Dyn, the 2.3 Tbps AWS Shield mitigation, and today’s HTTP/2 Rapid Reset era;…
A complete, architect-level guide to firewalls: what a firewall really is (a rule-driven network checkpoint), the seven-stage history from 1980s DEC packet filters through Check Point stateful inspection, proxy/application-layer firewalls, UTM appliances, Palo Alto Networks NGFWs, cloud/software-defined firewalls and WAFs, up to modern Zero Trust and identity-aware architectures; the problems…
A complete beginner-to-production walkthrough of hashing versus encryption: what each one really is, how they work internally (Merkle-Damgard SHA-256, AES-256 block-cipher rounds, RSA key math, hybrid TLS handshake), and exactly where each belongs in real systems. Covers the history from 1950s hash tables through DES, RSA, MD5/SHA-1, AES, SHA-2, SHA-3,…
A beginner-to-production deep dive into input validation: the security-guard-at-the-door analogy for what validation is, a six-milestone history arc from 1960s punch-card format checks through the 1988 Morris Worm buffer overflow, the 1990s-2000s rise of SQL injection/XSS/command injection, the 2003 launch of the OWASP Top 10, the 2009 standardisation of Java…
Role-Based Access Control (RBAC) is the security model where access rights attach to roles instead of individual users, and users gain permissions indirectly by being assigned to one or more roles. It is the default authorization model behind AWS IAM, Kubernetes, Azure RBAC, Google Cloud IAM, Windows Active Directory groups,…
A complete, beginner-to-production guide to the principle of least privilege (PoLP): what it is, why it matters, and how modern operating systems, cloud platforms, databases, APIs, microservices, and even AI agents apply it in practice. Traces the history from Saltzer and Schroeder’s landmark 1975 paper “The Protection of Information in…
A beginner-to-production deep dive into security patches and timely patching: a lock/paperclip analogy for what a patch really is, a six-milestone history arc from 1960s paper-tape patches through Windows/Linux in the 1990s, Code Red and SQL Slammer in the early 2000s, the 2003 launch of Microsoft Patch Tuesday, 2010s regulated…
A ground-up guide to why security is classified as a non-functional requirement rather than a feature: what NFRs really mean, how the ISO/IEC 25010 quality model shapes the classification, what “cross-cutting concern” looks like in real Java code, how it maps onto DevSecOps and microservices, and what real breaches (Equifax,…