Security & Identity
Architect secure distributed systems:
All Topics in Phase 11
0 of 17 completedDistinguish identity verification from permission enforcement: "Who are you?" (AuthN) vs "What are you allowed to do?" (AuthZ), 401 Unauthorized vs 403 Forbidden, and Policy Enforcement Points (PEP) vs Policy Decision Points (PDP).
Compare stateful server-side sessions against stateless JSON Web Tokens: Redis session storage, horizontal scaling bottlenecks, instant revocation mechanics, and the hybrid short-lived JWT + refresh token pattern.
Master JSON Web Tokens: Base64URL anatomy, symmetric HS256 vs asymmetric RS256/ES256, JWKS key rotation, the "alg: none" vulnerability, RSA-to-HMAC key confusion attacks, and JWS vs JWE differences.
Master delegated authorization: Authorization Code Grant with PKCE (Proof Key for Code Exchange) for SPAs and Mobile, Client Credentials for microservices, Device Flow for CLIs, and deprecation of the Implicit and Password grants.
Unify identity and delegated access: ID Tokens vs Access Tokens, OIDC standard claims (sub, nonce, at_hash), the UserInfo endpoint, and automated Discovery via `/.well-known/openid-configuration`.
Architect enterprise federated identity: Identity Providers (IdP) vs Service Providers (SP), SAML 2.0 XML assertions, modern OIDC federation, SCIM automated user provisioning, and instant employee offboarding mechanics.
Architect enterprise secrets pipelines: Eliminating secret sprawl, structured API key prefixing with one-way database hashing, dynamic ephemeral credentials in HashiCorp Vault, and automated rotation without downtime.
Protect data throughout its entire lifecycle: TLS 1.3 with Perfect Forward Secrecy (ECDHE) for in-transit network traffic, AES-256-GCM for at-rest storage, and the DEK/KEK Envelope Encryption pattern with Cloud KMS and HSMs.
Architect uncrackable password authentication: One-way cryptographic trapdoors vs two-way ciphers, GPU brute-force economics, per-user cryptographic salts, peppers in HSMs, and memory-hard KDF algorithms (Argon2id, bcrypt).
Automate public key infrastructure: The ACME protocol (RFC 8555), HTTP-01 vs DNS-01 validation challenges, Let's Encrypt 90-day rotation cycles, Kubernetes cert-manager orchestration, OCSP Stapling, and Certificate Transparency logs.
Architect invulnerable web systems: Parameterized prepared statements against SQL Injection, Content Security Policy (CSP) & HttpOnly cookies against XSS, and SameSite cookie attributes with Synchronizer Tokens against CSRF.
Mitigate massive distributed denial-of-service floods: Layer 3/4 volumetric SYN floods and UDP reflection amplification vs Layer 7 HTTP application floods and Slowloris, BGP Anycast scrubbing centers, and eBPF/XDP wire-speed packet filtering.
Protect APIs and authentication endpoints from credential stuffing and scraping: Multi-tiered compound rate limiting (IP, User ID, Fingerprint), sliding window algorithms in Redis, and step-up CAPTCHA verification.
Architect modern perimeterless enterprise security: The BeyondCorp model, eliminating VPN lateral movement, mutual TLS (mTLS) with SPIFFE/SPIRE workload identities, continuous context-aware authorization, and network micro-segmentation.
Architect modern authorization engines: The RBAC role-explosion trap, dynamic 4-attribute ABAC evaluation (Subject, Resource, Action, Environment), Open Policy Agent (OPA) Rego policies, and Google Zanzibar ReBAC graph traversal.
Architect enterprise secrets infrastructure: Vault storage backends with Raft consensus, Shamir's $(k, n)$ Secret Sharing unsealing, Auto-Unseal with Cloud KMS, Transit Encryption-as-a-Service, and the dynamic credential lease lifecycle.