Security Fundamentals
Assets, threats, trust boundaries, blast radius, least privilege, defense in depth — and why no system is ever called "secure".
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Security engineering is not a checklist of vulnerabilities; it is the discipline of deciding what you value, who can reach it, what you are trusting, and what happens when one of those assumptions turns out to be wrong.
Three questions that classify any security failure: who can read it, who can change it, and can legitimate users still work — plus the three that modern systems need alongside them: authenticity, accountability and privacy.
A trust boundary is any point where data or control crosses from something you do not control into something you do — and every one of them is a place where an assumption must be re-validated rather than inherited.
The attack surface is the set of places an attacker can send input or trigger behaviour — and reducing it is usually cheaper, more durable and more measurable than defending every entry you leave open.
Give every identity — human, service, job or agent — exactly the permissions its job requires, because the permissions you grant are the definition of how bad a compromise of that identity can be.
Design so that no single control failing is enough to lose the asset — because every control will eventually fail, and the question that matters is what the next layer does about it.
The default configuration is the configuration most of your system will actually run, so the security question is not "can it be configured safely?" but "what happens when nobody configures it at all?"
When the control cannot make a decision — the policy service is down, the token cannot be verified, the rate limiter is unreachable — the system must do something, and choosing which way it fails is a design decision with no universally right answer.
Security is risk management, so the output of security work is not "secure" but four lists: identified controls, known risks we accepted, residual risks that survive our controls, and unknowns we have not examined.