أساسيات الأمان
في هذه الصفحة 8 موضوعات
نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.
نظرة عامة
الموضوعات
- التهديدات
- حدود الثقة (Trust boundaries)
- أقل الصلاحيات (Least privilege)
- الدفاع المتعمق (Defense in depth)
تعلّم أولًا
1.5 ساعة تدريب (تقدير)
مخرجات التعلم
- Describe the CIA triad and common attacker goals against a web API.
- Identify trust boundaries in a system diagram.
- Apply least privilege and defense in depth to a concrete design.
- List the assets, entry points, and likely threats for the Shop API.
الدروس
المختبر والتمارين
Lab
JNR-035-LAB1 · Shop threat list
Outcomes: 1–4 · Time: ~1.5 h Draw the Shop API's data flow with trust boundaries. List the top 10 threats, each with a planned control. Acceptance: diagram and ten threat/control rows committed; becomes the capstone's "documented security controls" seed.
Exercises (assessment: threat list review)
| ID | Outcome | Task |
|---|---|---|
| JNR-035-EX01 | 1 | Map each to C, I, or A: leaked customer emails; a price changed in transit; a server flooded with requests. |
| JNR-035-EX02 | 1 | Write three goals an attacker might have against the Shop API. |
| JNR-035-EX03 | 2 | List the trust boundaries in: browser, Shop API, PostgreSQL, payment provider, log aggregator. |
| JNR-035-EX04 | 3 | The Shop app connects to the database as the admin user. Apply least privilege. |
| JNR-035-EX05 | 3 | Name three layers of defense for the "view order" endpoint. |
| JNR-035-EX06 | 4 | List five assets and five entry points of the Shop API. |
أظهر الحلول
- EX01 Emails: confidentiality; price changed: integrity; flooded server: availability.
- EX02 For example: read others' orders, get goods for free, take the site down, take over accounts.
- EX03 Browser | API; API | database; API | payment provider; API | log aggregator.
- EX04 Create an app user with only the needed privileges on its schema; keep migrations on a separate account.
- EX05 Authentication, ownership check, input validation, database account limits, audit logging.
- EX06 Assets: customer data, orders, credentials, catalog integrity, availability. Entry points: login, register, catalog, cart, orders endpoints (and headers/tokens).
- Outcome 4 is also covered by the lab acceptance.
الاختبار
Outcomes: O1 CIA and attacker goals · O2 trust boundaries · O3 least privilege and defense in depth · O4 Shop threat list.
اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.
الجزء العملي
The lab threat list is reviewed against the assessment. Pass: at least 8 of 10 threats with sensible controls and a diagram that shows boundaries correctly; quiz 8 of 10.
أخطاء شائعة
Security as a final checklist; trusting anything from the client.
التقييم
Threat list review.
الصلة بالمسار الوظيفي
Threat modeling (MID-052) and security reviews (SRC-018).