Least privilege and defense in depth
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
apply two core design rules.
Planned topics
- Least privilege: give each user, service, and database account only the access it needs.
- Defense in depth: several layers, so one failure is not a breach.
- Example layers: authentication, authorization check, validation, database permissions, logging.
- Do not rely on a single check, such as a hidden button in the UI.
- Review defaults: new accounts start with the lowest role.
Draft outline details
Demonstration
the Shop database user has only SELECT/INSERT/UPDATE/DELETE on its own schema, not admin rights.
Check your understanding
Why have both an API check and limited database rights?
Show answer
If one fails, the other still limits the damage.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.