Web Security & OWASP (50 Qs)•Part 1: Candid Security Experience, Threat Modeling & Fundamentals (1 - 10)
The CIA Triad & Defense-in-Depth: How do you design multi-layered security controls in distributed systems?
Architecture & Core Principles
The CIA Triad (Confidentiality, Integrity, Availability) represents the foundational pillars of information security. Defense-in-Depth mandates that no single security barrier should be trusted exclusively; if one layer is compromised, subsequent layers prevent catastrophic exploitation.
rust
+-------------------------------------------------------------------------------+
| DEFENSE-IN-DEPTH LAYERS |
| |
| Layer 1: Edge & Network -> Cloud WAF, DDoS Protection, VPC Subnets |
| Layer 2: Compute & Host -> Hardened OS, Non-Root Containers, seccomp |
| Layer 3: Network Isolation -> Kubernetes NetworkPolicies, Zero-Trust mTLS |
| Layer 4: Application Logic -> Input Sanitization, DTOs, BOLA / RBAC Checks |
| Layer 5: Data & Persistence -> Envelope Encryption (KMS), Argon2id Hashes |
| Layer 6: Auditing & SIEM -> Structured Audit Logs, Honeytokens, Alerts |
+-------------------------------------------------------------------------------+
The CIA Triad Mapped to Engineering Controls
| Pillar | Definition | Enterprise Implementation Mechanisms |
|---|---|---|
| Confidentiality | Sensitive information is concealed from unauthorized actors. | TLS 1.3 in transit, AES-256-GCM at rest, Field-Level Encryption (FLE) for PII/credit cards, RBAC authorization. |
| Integrity | Data and code cannot be tampered with or modified undetected. | HMAC-SHA256 request signatures, Subresource Integrity (SRI), Cosign container image signatures, immutable database ledgers. |
| Availability | Services and data remain accessible to legitimate users during surges or attacks. | Anycast DNS, multi-AZ cloud redundancy, Token Bucket rate limiting, Circuit Breakers, and Auto-scaling. |