Skip to content
Ameen Abozaid
Englishالعربية
JNR-035

Security fundamentals

  • 6 Lessons
  • 1.5 h practice (estimate)
Start module
On this page 8 topics

Overview

Topics

  • Threats
  • trust boundaries
  • least privilege
  • defense in depth

Learn first

1.5 h of practice (estimate)

Learning outcomes

  1. Describe the CIA triad and common attacker goals against a web API.
  2. Identify trust boundaries in a system diagram.
  3. Apply least privilege and defense in depth to a concrete design.
  4. List the assets, entry points, and likely threats for the Shop API.

Lessons

  1. 01Thinking like an attacker
  2. 02Confidentiality, integrity, availability
  3. 03Trust boundaries
  4. 04Least privilege and defense in depth
  5. 05A first threat list
  6. 06Demo: drawing Shop's trust boundaries

Lab and exercises

Lab

JNR-035-LAB1 · Shop threat list

Outcomes: 1–4 · Time: ~1.5 h Draw the Shop API's data flow with trust boundaries. List the top 10 threats, each with a planned control. Acceptance: diagram and ten threat/control rows committed; becomes the capstone's "documented security controls" seed.

Exercises (assessment: threat list review)

IDOutcomeTask
JNR-035-EX011Map each to C, I, or A: leaked customer emails; a price changed in transit; a server flooded with requests.
JNR-035-EX021Write three goals an attacker might have against the Shop API.
JNR-035-EX032List the trust boundaries in: browser, Shop API, PostgreSQL, payment provider, log aggregator.
JNR-035-EX043The Shop app connects to the database as the admin user. Apply least privilege.
JNR-035-EX053Name three layers of defense for the "view order" endpoint.
JNR-035-EX064List five assets and five entry points of the Shop API.
Show solutions
  • EX01 Emails: confidentiality; price changed: integrity; flooded server: availability.
  • EX02 For example: read others' orders, get goods for free, take the site down, take over accounts.
  • EX03 Browser | API; API | database; API | payment provider; API | log aggregator.
  • EX04 Create an app user with only the needed privileges on its schema; keep migrations on a separate account.
  • EX05 Authentication, ownership check, input validation, database account limits, audit logging.
  • EX06 Assets: customer data, orders, credentials, catalog integrity, availability. Entry points: login, register, catalog, cart, orders endpoints (and headers/tokens).
  • Outcome 4 is also covered by the lab acceptance.

Quiz

Outcomes: O1 CIA and attacker goals · O2 trust boundaries · O3 least privilege and defense in depth · O4 Shop threat list.

A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.

  1. 1Confidentiality means:O1
  2. 2A DDoS attack mainly targets:O1
  3. 3A changed order total in transit breaks:O1
  4. 4A trust boundary is:O2
  5. 5Input from your own mobile app should be:O2
  6. 6Least privilege means:O3
  7. 7Defense in depth means:O3
  8. 8Which is an asset of the Shop API?O4
  9. 9GET /orders/{id} is best described as:O4
  10. 10A threat list entry should include:O4

Practical part

The lab threat list is reviewed against the assessment. Pass: at least 8 of 10 threats with sensible controls and a diagram that shows boundaries correctly; quiz 8 of 10.

Common mistakes

Security as a final checklist; trusting anything from the client.

Assessment

Threat list review.

Career relevance

Threat modeling (MID-052) and security reviews (SRC-018).

Type to search levels, phases, modules and lessons.