Security
Beginner 15 min read Security

Security Fundamentals

Security is risk management. Master the CIA triad, the AAA model, attack surface, threat modeling and least privilege before you touch any tooling.

CIA triadconfidentialityintegrityavailabilityleast privilegeattack surfacethreat modeling
Introduction

What is this?

Security in DevOps is the practice of protecting systems and data by understanding what you have, what could go wrong, and how to shrink the blast radius when it does. Everything hangs on the CIA triad (confidentiality, integrity, availability) and the AAA model (authentication, authorization, accounting). The goal is not perfection — it is reducing risk to an acceptable level.

Motivation

Why do you need it?

  • Breaches cost more to fix than to prevent: the blast radius of one leaked credential or one misconfigured bucket can dwarf the cost of hardening.
  • Modern systems are software-defined — infrastructure is code — so misconfiguration is now the leading root cause of breaches.
  • Security gives you the confidence to ship fast: automation and guardrails let teams release without manual approvals.
  • Compliance (PCI-DSS, SOC 2, GDPR) is a business requirement, and security controls are the evidence those frameworks ask for.
  • The cheapest vulnerability to fix is the one found at design time, which is exactly what security fundamentals push you toward.
Think about it

Mental model

Imagine

A house

Think of

A system under attack

You lock the doors and windows, not because someone is breaking in right now, but because the cost of a lock is tiny compared to the cost of a burglary. Threat modeling is deciding which locks matter most.

Mechanics

How it works

  • Confidentiality means only authorized parties can read data; encryption and access control are its main tools.
  • Integrity means data and systems are not modified by unauthorized parties; hashing, signing and audit logs protect it.
  • Availability means services stay reachable; redundancy, rate limiting and monitoring protect it.
  • AAA: authentication proves who you are, authorization decides what you can do, and accounting logs what you did.
  • Threat modeling walks assets, threats and mitigations, turning vague anxiety into a prioritized list of controls.

From asset inventory to prioritized controls.

Identify assets
Map trust boundaries
Enumerate threats
Rate risk
Apply controls
Reference

Key commands

whoami && id

Reveal the current user and their uid/gid and group memberships.

ps aux | head -15

List running processes to spot unexpected or unauthorized workloads.

ls -la /etc/passwd /etc/shadow

Inspect permission bits on account databases — shadow should not be world-readable.

find / -type f -perm -o+w 2>/dev/null | head -5

Find world-writable files, a classic misconfiguration vector.

env | sort

Dump environment variables and review whether any credentials are exposed in plaintext.

Hands-on

Examples

Survey your own attack surface

Survey your own attack surface
whoami
id
hostname
uname -a
ps aux | head -10
ls -la /etc/passwd /etc/shadow
find / -type f -perm -o+w 2>/dev/null | head -5

Before securing anything, inventory it. These commands reveal who you run as, what processes are alive, which credential files exist and which permissions they have, and where any world-writable files lurk.

Real world

In production

  • Security champions embed fundamentals into design reviews: every service documents its data, trust boundary and threat model.
  • Access reviews run on a schedule so the who-can-do-what inventory never goes stale.
  • Incident response drills test confidentiality (can attackers read data?), integrity (were logs tampered?) and availability (how fast do we recover?).
  • Least privilege is applied to humans and code: IAM roles, service accounts and scoped tokens everywhere.
  • Vulnerability management tiers findings by the same risk framing: likelihood times impact, not just the CVSS score.
Guidelines

Best practices

  • Apply defense in depth — never rely on a single control like one firewall or one password.
  • Default to deny: start locked down and open access only where there is a proven need.
  • Use least privilege for every human, process and service account.
  • Separate duties: the person who deploys must not be the only person who approves changes.
  • Document your threat model and revisit it when the architecture changes.
Watch out

Common mistakes

  • Treating security as a final checklist instead of a design input.
  • Protecting the perimeter (firewall) while leaving the inside wide open.
  • Chasing perfect security instead of managing residual risk to an acceptable level.
  • Assuming compliance paperwork means the system is actually secure.
  • Ignoring identity — the most common root cause of real breaches.
Root cause analysis

Common issues

Error
Service exposes an unexpected open port
Root cause

A misconfigured binding (0.0.0.0 vs localhost) or a firewall rule too broad

Fix

Compare the service config to the intended network policy and bind to the narrowest interface.

Error
A user can read files they should not
Root cause

Overly permissive umask, group membership or world-readable bits

Fix

Audit file ownership and permissions, tighten umask and remove the user from unnecessary groups.

Error
Something is always almost secure
Root cause

No inventory or threat model, so controls are applied randomly

Fix

Write the asset list first, then apply controls in order of risk, not in order of convenience.

When things break

Debugging tips

  • Start with what changed: most security incidents follow a recent config, deploy or dependency change.
  • Follow the data: trace who can read, write and delete each asset before judging a control.
  • Check the audit trail (accounting) before theorizing — logs show what actually happened.
  • Reproduce with the least privilege possible so the fix is provable rather than assumed.
Interviews

Interview checkpoint

Practice

Hands-on lab

Map Your Attack Surface
20 min · beginner
In progress
Objectives
  • Inventory identity, processes and credential files
  • Find world-writable files
  • Inspect permission bits on sensitive files
  • Produce a findings report

Map Your Attack Surface

20 min · beginner

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

Data being silently modified in transit is a violation of which goal?

2

Least privilege means giving each process the maximum permissions it might ever need.

3

Which sequence best describes the AAA model?

Quick reference

Cheat sheet

Model review
CIAConfidentiality, integrity, availability
AAAAuthenticate, authorize, account
STRIDESpoofing, tampering, repudiation, info disclosure, DoS, escalation
Risk = L x ILikelihood times impact drives priority
Host inspection
whoami; idWho am I and what groups am I in
ps auxWhat is running right now
ls -la /etc/shadowCredential file permissions
find / -perm -o+wWorld-writable files
Go deeper

Official documentation

OWASP Top Ten
docs
OWASP Threat Modeling
docs
OWASP Cheat Sheet Series
docs
MITRE ATT&CK
docs