Security
Security tests how systems protect confidentiality, integrity, and availability against threats. Expect authentication and authorization, common attacks, cryptography, and defensive controls.
Core principles
The CIA triad: confidentiality prevents unauthorized disclosure; integrity prevents unauthorized modification; availability ensures timely access. Authentication proves identity; authorization decides what an authenticated principal may do. Least privilege grants only necessary rights. Defense in depth uses multiple controls.
Threats and defenses
Malware includes viruses, worms, and trojans. Phishing tricks users into revealing credentials. SQL injection inserts malicious SQL through unsanitized input; parameterized queries and input validation reduce it. Cross-site scripting (XSS) injects script into pages viewed by others; output encoding and content security policy help. Firewalls filter network traffic; access controls limit resource use; backups support recovery.
Cryptography
Symmetric encryption uses one shared key and is fast for bulk data. Asymmetric encryption uses a public/private key pair and helps with key exchange and digital signatures. Hashing is one-way and checks integrity; it is not encryption. Passwords should be stored as salted hashes, not plaintext or reversible encryption.
Worked example
A site stores passwords by computing hash(password + salt) with a slow password-hashing algorithm, storing the salt and hash. On login, it recomputes the hash and compares. A salt makes identical passwords produce different hashes and defeats precomputed rainbow tables. Encryption would be reversible if the key leaked; hashing is not.
Traps
Do not say hashing encrypts data. Authentication is not authorization. HTTPS protects data in transit, not data at rest. A firewall does not stop all phishing or insider misuse. Input validation helps but parameterized queries are the key defense against SQL injection.