Skip to content

Latest commit

 

History

History
210 lines (124 loc) · 4.03 KB

1.Security.md

File metadata and controls

210 lines (124 loc) · 4.03 KB

How I’d answer: “How would you secure an API / application?”

“I secure an application using a defense-in-depth approach, covering identity, network, application, data, and operations.”

That single sentence already sounds senior. Then break it down.

1. Identity & Authentication (Who are you?)

First line of defense

  • Use OAuth 2.0 / OpenID Connect
  • Token-based authentication using JWT
  • Never session-based auth for APIs

Common flows

  • User-facing apps → Authorization Code flow
  • Service-to-service → Client Credentials flow

Best practices

  • Short-lived access tokens
  • Refresh tokens stored securely
  • Token validation at API Gateway

👉 Interview line:

“Every request must be authenticated before touching business logic.”

2. Authorization (What are you allowed to do?)

Most people forget this — don’t.

  • Role-Based Access Control (RBAC)
  • Policy-based authorization
  • Claims-based access (JWT claims)

Example:

  • role = Admin
  • scope = payments.write

👉 Interview line:

“Authentication answers who you are, authorization answers what you can do.”

3. API Gateway & Edge Security

This is where architects shine

Use an API Gateway:

  • Azure API Management / AWS API Gateway / Kong

What gateway handles

  • Token validation
  • Rate limiting
  • IP filtering
  • Throttling
  • Request size limits
  • CORS

👉 Interview line:

“I never expose services directly to the internet.”

4. Network Security

Reduce the attack surface

  • Private networks (VNet / VPC)
  • Services not publicly accessible
  • NSGs / Security Groups
  • Firewall rules
  • Private endpoints for DBs

👉 Interview line:

“Even if credentials are compromised, network isolation limits the blast radius.”

5. Application-Level Security

Inside the app

  • Input validation

  • Protect against:

    • SQL Injection
    • XSS
    • CSRF

  • Use parameterized queries

  • Centralized error handling (no stack traces)

👉 Mention:

  • OWASP Top 10 awareness

6. Data Security

Protect data at rest and in transit

  • HTTPS everywhere (TLS)
  • Encrypt sensitive data at rest
  • Use managed encryption (Key Vault, KMS)
  • Mask PII in logs

👉 Interview line:

“Security doesn’t stop at APIs — data must be protected too.”

7. Secrets Management (Very Important)

Never hardcode secrets

  • Store secrets in:

    • Azure Key Vault
    • AWS Secrets Manager

  • Use Managed Identity / IAM roles

  • Rotate secrets automatically

👉 Red flag if you don’t mention this.

8. Service-to-Service Security (Microservices)

This is advanced-level — say it if relevant.

  • Mutual TLS (mTLS)
  • Token-based auth between services
  • Zero Trust principles

👉 Interview line:

“Internal services are authenticated just like external users.”

9. Rate Limiting & Abuse Protection

Operational security

  • Prevent brute force attacks
  • Prevent DDoS (basic level)
  • CAPTCHA (for public endpoints)
  • Rate limit per IP / token

10. Logging, Monitoring & Auditing

Detection matters as much as prevention

  • Log authentication failures
  • Audit sensitive operations
  • Monitor unusual traffic
  • Alerts for suspicious behavior

👉 Interview line:

“You can’t secure what you can’t observe.”

11. Environment & Deployment Security

Often ignored

  • Separate dev / test / prod
  • No prod data in lower envs
  • Secure CI/CD pipelines
  • Signed builds
  • Least privilege access

How to Wrap Up (Very Important)

End with this:

“Security is not a single feature — it’s a layered approach across identity, network, application, and operations, continuously reviewed and improved.”

30-Second Version (If interviewer is in a hurry)

Memorize this:

“I secure APIs using OAuth2 and JWT for authentication, RBAC for authorization, API Gateway for rate limiting and validation, network isolation with private endpoints, encryption for data, centralized secrets management, and monitoring for detection.”