Designing Security Architecture
1. Designing HTTPS and TLS Configuration
| Practice | Detail |
|---|---|
| TLS version | TLS 1.3 preferred; min 1.2 |
| Ciphers | AEAD (GCM, ChaCha20-Poly1305) |
| HSTS | max-age=31536000; includeSubDomains; preload |
| OCSP stapling | Faster cert validation |
| Cert mgmt | Let's Encrypt + cert-manager / ACM |
| mTLS | Service-to-service auth |
2. Designing Secrets Management
| Tool | Detail |
|---|---|
| HashiCorp Vault | Dynamic secrets, leases |
| AWS Secrets Manager / SSM | Cloud-native; auto-rotation |
| K8s External Secrets | Sync from Vault/SM into Secrets |
| Sealed Secrets / SOPS | Git-safe encrypted |
| Never | Commit secrets; bake into images |
3. Designing Input Validation Architecture
| Layer | Detail |
|---|---|
| Schema | JSON Schema, Bean Validation, Zod |
| Allow-list | Validate against known-good |
| Length / range / type | Strict bounds |
| Canonicalization | Normalize before checks |
| Reject early | At API boundary |
4. Designing SQL Injection Prevention
| Defense | Detail |
|---|---|
| Prepared statements | Parameterized queries (always) |
| ORM | Avoid raw string interpolation |
| Stored procedures | If parameterized |
| Least privilege DB user | App role can't DROP/ALTER |
| WAF | Defense-in-depth, not primary |
5. Designing XSS Prevention
| Defense | Detail |
|---|---|
| Context-aware escaping | HTML / attr / JS / URL / CSS |
| Templating auto-escape | React, Thymeleaf, Jinja2 |
| CSP | script-src 'self' 'nonce-…' |
| Sanitize HTML | DOMPurify for user HTML |
| HttpOnly cookies | Not stealable via XSS |
6. Designing CSRF Protection
| Mechanism | Detail |
|---|---|
| SameSite cookie | Lax (default) or Strict |
| CSRF token | Synchronizer / double-submit |
| Custom header | X-Requested-With (preflight required) |
| Origin/Referer check | For state-changing requests |
7. Designing CORS Strategy
| Aspect | Detail |
|---|---|
| Allow-Origin | Specific domains; never * with credentials |
| Allow-Credentials | true only when needed |
| Preflight | OPTIONS for non-simple |
| Max-Age | Cache preflight |
8. Designing Security Headers
| Header | Purpose |
|---|---|
| Content-Security-Policy | Restrict sources |
| Strict-Transport-Security | Force HTTPS |
| X-Content-Type-Options | nosniff |
| X-Frame-Options / frame-ancestors | Anti-clickjacking |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | Disable unused features |
9. Designing DDoS Protection
| Layer | Defense |
|---|---|
| Network (L3/L4) | AWS Shield, Cloudflare, Anycast |
| Application (L7) | WAF, rate limit, bot mgmt |
| Caching/CDN | Absorb traffic at edge |
| Auto-scale | Soak legitimate spikes |
| Black/greylisting | Block abusive IPs/ASNs |
10. Designing Session Management Security
| Practice | Detail |
|---|---|
| Regenerate ID | On login/privilege change |
| Cookie flags | HttpOnly Secure SameSite |
| Idle/absolute timeout | e.g., 30min idle, 12h absolute |
| Concurrent session limit | Optional |
| Logout | Server-side invalidation |
11. Designing Encryption at Rest and Transit
| Layer | Detail |
|---|---|
| Transit | TLS 1.3 everywhere; mTLS internal |
| At rest | AES-256-GCM; envelope encryption (KMS) |
| App-level | For PII columns; deterministic vs random |
| Key rotation | Automatic; re-wrap DEK |
| Key separation | Per-tenant DEKs for isolation |
12. Designing Security Auditing and Compliance
| Element | Detail |
|---|---|
| Audit log | Immutable, append-only, signed |
| SIEM | Splunk, Elastic, Sumo, Datadog |
| Vuln scanning | SCA, SAST, DAST in CI |
| Pen test | Annual + on major release |
| Frameworks | SOC2, ISO 27001, PCI, HIPAA, GDPR |