Skip to main content

Security

This portion covers security related questions & techniques

Security Models​

RBAC (Role-Based Access Control)​

  • Full form: Role-Based Access Control
  • An approach to restricting system access to authorized users based on their assigned roles (e.g., Admin, Editor, Viewer).
  • It simplifies permission management; instead of managing permissions for 1,000 users, you manage them for 5 roles and simply assign users to those roles.

ABAC (Attribute-Based Access Control)​

  • Full form: Attribute-Based Access Control
  • A logical access control methodology where access rights are granted through the use of policies which combine attributes (user, resource, and environment).
  • It provides fine-grained control; for example, you can create a rule saying "Only Managers (User Attribute) can view Financial Reports (Resource Attribute) if they are accessing from the office IP (Environment Attribute)."

RBAC vs. ABAC​

  • RBAC is better for smaller, standard applications where roles are clearly defined.
  • ABAC is better for complex, enterprise-scale systems that require high security and context-aware permissions.

API Protection & Resilience​

How we protect the infrastructure from abuse and high-volume traffic.

Rate Limiting​

  • A technique to control the number of requests a user or IP can make to a service within a specific timeframe.
  • It prevents DoS/DDoS attacks and ensures that a single "noisy neighbor" (a user making too many requests) doesn't crash the server for everyone else.
  • Rate Limiting algorithms
    • Token Bucket: Users are given a "bucket" of tokens. Every request uses one. Tokens refill at a steady rate. (Allows for "bursts" of traffic).
    • Leaky Bucket: Requests enter a bucket and "leak" out to be processed at a constant, fixed rate. (Ensures a very steady, predictable flow; no bursts allowed).
    • Fixed Window: Limits requests per calendar minute (e.g., 100 requests between 10:00 and 10:01). (Easy to implement but can be "gamed" at the minute boundaries).
    • Sliding Window: A more accurate version of Fixed Window that looks at the exact previous 60 seconds from the current timestamp.

Throttling​

  • The process of gradually slowing down a user’s responses once they near their limit, rather than hard-blocking them.
  • It provides a better user experience (UX) by allowing a user to finish their task at a slower speed instead of receiving an immediate "429 Too Many Requests" error.

WAF (Web Application Firewall)​

  • Full form: Web Application Firewall
  • A specialized firewall that monitors, filters, and blocks HTTP traffic to and from a web application.
  • It provides edge-level protection against common attacks like SQL Injection and Cross-Site Scripting (XSS) before the traffic even touches your internal network.

Payload Size Limiting​

  • A configuration that rejects any incoming request if the body (JSON/Image) exceeds a pre-defined size (e.g., 5MB).
  • It prevents memory exhaustion attacks; without this, an attacker could send a 1GB JSON file that crashes your server’s memory while it tries to parse it.

IP Whitelisting / Blacklisting​

  • A network security mechanism that allows (whitelists) or blocks (blacklists) traffic based on the sender's IP address.
  • It secures internal services; for example, a production database should only allow connections from the specific IP addresses of your application servers.

Fail-open & fail-close​

  • Fail-Closed (Best for Auth): If the auth service is down, the system denies all access. Better to be down than compromised.
  • Fail-Open (Best for UX): If a non-critical feature (like a recommendation engine) fails, the user can still use the core app.

Defense in Depth​

  • A security strategy that uses multiple layers of defense so that if one layer fails, others are in place to stop the attack.
  • It assumes that no single security measure is perfect; by layering WAF, API Gateways, and Hashing, you make it exponentially harder for an attacker to reach the core data.

Principle of Least Privilege (PoLP)​

  • Full form: Principle of Least Privilege
  • The practice of giving a user, process, or system only the minimum level of access necessary to perform its job.
  • It minimizes the "Blast Radius"; if a specific service is compromised, the attacker can't move laterally to the rest of the system because that service had restricted permissions.

Zero Trust Architecture​

  • A security model based on the principle of "Never Trust, Always Verify," even for users or devices already inside the corporate network.
  • It prevents attackers from moving freely inside a network once they get past the initial firewall, which is how most major data breaches escalate.

Encryption At-Rest​

  • Encrypting data while it is stored on a physical disk (e.g., in a database or cloud storage).
  • It protects against physical theft or unauthorized access to the server's hard drives or database backups.

Encryption In-Transit​

  • Encrypting data as it moves across a network between the client and the server (e.g., via HTTPS/TLS).
  • It prevents "Man-in-the-Middle" (MITM) attacks, ensuring that attackers cannot sniff or alter sensitive data as it travels through the internet.

Idempotency​

While often discussed in Performance, Idempotency is a security/reliability feature.

  • Concept: Ensuring that making the same request multiple times (e.g., "Pay $10") has the same effect as making it once.
  • It prevents double-charges or duplicate data entries if a user clicks a button twice or if a network retry happens automatically.