security-practices

Security Practices Skill

Level 1: Quick Start (5 minutes)

What You'll Learn

Implement essential security practices to protect applications from common vulnerabilities and attacks.

Core Principles

• Zero Trust: Never trust, always verify
• Defense in Depth: Multiple layers of security controls
• Shift Left: Integrate security early in development
• Least Privilege: Grant minimum necessary permissions

Quick Security Checklist

• Enable MFA for all user accounts
• Use HTTPS/TLS 1.3 for all connections
• Validate and sanitize all inputs
• Never commit secrets to version control
• Run dependency vulnerability scans
• Implement proper error handling (no sensitive info in errors)

Common Vulnerabilities to Avoid

// ❌ NEVER: Hardcoded secrets
const API_KEY = "sk_live_abc123";

// ✅ ALWAYS: Use environment variables
const API_KEY = process.env.API_KEY;

// ❌ NEVER: SQL injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ✅ ALWAYS: Parameterized queries
const query = "SELECT * FROM users WHERE id = ?";
db.query(query, [userId]);

// ❌ NEVER: Weak password validation
if (password.length >= 6) { /* valid */ }

// ✅ ALWAYS: Strong password requirements
if (
  password.length >= 12 &&
  /[A-Z]/.test(password) &&
  /[a-z]/.test(password) &&
  /[0-9]/.test(password) &&
  /[^A-Za-z0-9]/.test(password)
) { /* valid */ }

Critical Security Tools

• Secrets Management: HashiCorp Vault, AWS Secrets Manager
• Dependency Scanning: Snyk, Dependabot, npm audit
• SAST: SonarQube, Semgrep, CodeQL
• DAST: OWASP ZAP, Burp Suite

---

Level 2: Implementation (30 minutes)

Deep Dive Topics

1. Zero Trust Architecture

Core Components:

// Identity verification with MFA
interface AuthenticationService {
  // Primary authentication
  verifyCredentials(username: string, password: string): Promise<Session>;

  // Multi-factor authentication
  verifyMfaToken(sessionId: string, token: string): Promise<boolean>;

  // Continuous authentication
  verifySessionValidity(sessionId: string): Promise<boolean>;
}

// Policy engine for access decisions
class PolicyEngine {
  async evaluateAccess(
    user: User,
    resource: Resource,
    context: Context
  ): Promise<AccessDecision> {
    const riskScore = await this.calculateRiskScore(user, context);
    const policy = await this.getApplicablePolicy(user, resource);

    return {
      allowed: this.checkPermissions(user, resource, policy),
      requiresStepUp: riskScore > RISK_THRESHOLD,
      auditRequired: true,
    };
  }

  private async calculateRiskScore(
    user: User,
    context: Context
  ): Promise<number> {
    let risk = 0;
    if (context.location !== user.knownLocations) risk += 30;
    if (context.device !== user.knownDevices) risk += 20;
    if (context.timeOfDay < 6 || context.timeOfDay > 22) risk += 10;
    return risk;
  }
}