Security Engineering
Published on
Security engineering protects valuable user and business outcomes against misuse, compromise, and failure. Start with assets, actors, data flows, trust boundaries, and credible threats; then choose controls and evidence proportionate to risk.
Security lifecycle
Curated notes
- Threat Modeling: identify threats, mitigations, assumptions, and residual risk.
- Compliance: turn SOC 2 and GDPR feedback into owned remediation and evidence.
- OAuth 2.0: reason about delegated authorization, tokens, clients, and redirect boundaries.
- Automated Code Review: combine deterministic checks with human review.
- Dynamic Security Testing: test a running system without confusing scanner output for complete assurance.
Security controls should be owned, observable, and connected to a response. The infrastructure security and compliance note covers control evidence, exceptions, and continuous assurance.
Last updated on