Security Principles

Foundation Track | 4 Modules | ~2 hours total

The mindset and principles of building secure systems. Concepts that apply regardless of which tools, languages, or platforms you use.

Why Security Principles?

Every system you build will be attacked. The question isn’t “if” but “when” and “how prepared are you?”

Security principles teach you to:

Think like attackers to defend against them
Design systems that are secure by default
Layer defenses so one failure doesn’t mean total compromise
Manage identity and access with least privilege

This isn’t about memorizing checklists. It’s about developing the security mindset that makes those checklists obvious.

Modules

#	Module	Time	Description
4.1	The Security Mindset	25-30 min	Attacker thinking, security principles, trust
4.2	Defense in Depth	30-35 min	Layered security, network/app/data layers
4.3	Identity and Access Management	30-35 min	Authentication, authorization, least privilege
4.4	Secure by Default	30-35 min	Secure defaults, guardrails, configuration

Learning Path

START HERE
    │
    ▼
┌─────────────────────────────────────┐
│  Module 4.1                         │
│  The Security Mindset               │
│  └── Attacker's advantage           │
│  └── Core security principles       │
│  └── Trust boundaries               │
│  └── Security vs. theater           │
└──────────────────┬──────────────────┘
                   │
                   ▼
┌─────────────────────────────────────┐
│  Module 4.2                         │
│  Defense in Depth                   │
│  └── Security layers                │
│  └── Network security               │
│  └── Application security           │
│  └── Data security                  │
└──────────────────┬──────────────────┘
                   │
                   ▼
┌─────────────────────────────────────┐
│  Module 4.3                         │
│  Identity and Access Management     │
│  └── Authentication factors         │
│  └── Authorization models           │
│  └── Least privilege                │
│  └── Service identity               │
└──────────────────┬──────────────────┘
                   │
                   ▼
┌─────────────────────────────────────┐
│  Module 4.4                         │
│  Secure by Default                  │
│  └── Default state matters          │
│  └── Guardrails and constraints     │
│  └── Configuration as code          │
│  └── Secure deployment patterns     │
└──────────────────┬──────────────────┘
                   │
                   ▼
              COMPLETE
                   │
    ┌──────────────┼──────────────┐
    │              │              │
    ▼              ▼              ▼
DevSecOps     Security       Distributed
Discipline     Toolkit        Systems

Key Concepts You’ll Learn

Concept	Module	What It Means
Attack Surface	4.1	Everything an attacker could target
Least Privilege	4.1, 4.3	Grant minimum necessary permissions
Defense in Depth	4.2	Layer independent security controls
Zero Trust	4.1, 4.2	Never trust, always verify
Fail Secure	4.1	When things fail, fail to secure state
Trust Boundary	4.1	Where data crosses trust levels
Authentication	4.3	Proving identity (who are you?)
Authorization	4.3	Granting access (what can you do?)
RBAC	4.3	Role-Based Access Control
Secure by Default	4.4	Security without explicit configuration
Guardrails	4.4	Constraints that prevent mistakes
Immutable Infrastructure	4.4	Deploy new, never update in place

Prerequisites

Recommended: Systems Thinking Track — Understanding system interactions
Recommended: Reliability Engineering Track — Failure modes and defense
Helpful: Some experience with web applications or APIs
Helpful: Basic understanding of networking

Where This Leads

After completing Security Principles, you’re ready for:

Track	Why
DevSecOps Discipline	Put security into practice in CI/CD
Security Tools Toolkit	Learn specific tools (Vault, OPA, Falco)
CKS Certification	Kubernetes security specialization
Distributed Systems	Security in distributed architectures

Key Resources

Books referenced throughout this track:

“The Web Application Hacker’s Handbook” — Dafydd Stuttard
“Threat Modeling: Designing for Security” — Adam Shostack
“Building Secure and Reliable Systems” — Google
“Container Security” — Liz Rice

Standards and Frameworks:

OWASP Top 10 — owasp.org/Top10
NIST Cybersecurity Framework — nist.gov/cyberframework
CIS Benchmarks — cisecurity.org/cis-benchmarks

The Security Mindset

Question to Ask	Why It Matters
”What could go wrong?”	Threat modeling starts here
”Who would want to attack this?”	Determines threat level and investment
”What’s the blast radius?”	Scopes potential damage
”How would we know?”	Detection and monitoring
”What’s the secure default?”	Security shouldn’t require action
”What do I implicitly trust?”	Hidden assumptions are vulnerabilities

“Security is not a product, but a process.” — Bruce Schneier