Learning note / Reflections on my studies
Cyber Security
Security study makes me look at an application from another direction: what could be misused, what information matters, and what happens when an assumption stops being true?
Starting with what needs protection
I find a security discussion more useful when it begins with an asset and a possible consequence. That gives a reason for a control instead of treating a security checklist as an isolated set of tasks.
Confidentiality, integrity, and availability describe different things that can go wrong, so protecting one does not automatically protect the others.
The boundaries inside an application
Knowing who a user is and deciding what they may do are separate responsibilities. I want those boundaries to be visible in the design, especially around data access and administrative actions.
I also think about inputs as claims to validate. A value arriving from a client should not gain trust simply because the interface normally sends the expected format.
How it changes my development questions
For me, security belongs in the same conversation as features and usability. I want to ask what a feature exposes and how a failure is contained while the design is still being decided.
What I take forward
- Explain what each control protects.
- Separate authentication from authorization.
- Question trust at application boundaries.