Systems and Application Security
Harden the host, harden the code
System security means baselines and configuration management, patch management (test, then deploy), least functionality (remove unused services and ports), host firewalls and HIPS, full-disk encryption, endpoint detection and response, application allow-listing and sandboxing.
Malware families to distinguish: virus (needs a host and user action), worm (self-propagating across networks), trojan (disguised as useful), rootkit (hides at kernel or firmware level), spyware/keylogger, ransomware, logic bomb, botnet/zombie, and fileless attacks that live in memory or abuse PowerShell.
Application security follows the SDLC: threat modeling early (STRIDE), secure coding standards, code review, SAST (white-box, examines source without running it), DAST (black-box, probes a running application), and penetration testing. Know the OWASP mainstays: injection (parameterized queries and input validation), XSS (output encoding, CSP), CSRF (tokens, SameSite cookies), broken authentication and access control, insecure deserialization, and security misconfiguration. Validation should be allow-list ("known good"), performed server-side, and never trusted from the client.
Cloud and virtualization add shared responsibility, hypervisor and jailbreak risks, and image sprawl. Mobile/BYOD needs MDM, containerization and remote wipe. Data security: classify first, then apply DLP, encryption at rest and in transit, and database activity monitoring.
Trap: reversing SAST and DAST is extremely common. Also, input validation and output encoding solve different problems - validation resists injection, encoding resists XSS.
Worked example: a login form concatenates user input into a SQL string. Fix it with parameterized queries plus server-side allow-list validation, and give the database account least privilege so a successful injection reaches little.
Rule of thumb: validate input on the server, encode output at the sink, and apply least privilege everywhere in between.