Essential Cybersecurity Principles Every Developer Should Know
Written on
Chapter 1: Key Cybersecurity Concepts
This guide presents a collection of vital cybersecurity principles that are essential for developing secure applications. To enhance readability, the information is divided into several posts. Please note that the content here is purely educational and does not endorse malicious practices.
Previous sections can be found here:
- Authentication
Authentication is the procedure of confirming a user's identity before granting access to resources. In simple terms, it involves verifying that a user is who they claim to be. This step typically precedes authorization.
- Authorization
This refers to the process of verifying whether a user is permitted to access specific resources. Authorization generally follows successful authentication. For instance, it ensures that only employees have access to internal servers, while customers do not.
- OAuth 2.0
OAuth 2.0 is the standard protocol used for authorization. It allows a service that hosts user accounts (like Google or Facebook) to delegate access to third-party applications, thereby enabling them to access user information securely.
For more details on how OAuth functions, check my related articles.
- Social Engineering
Social engineering involves manipulating human psychology to obtain confidential information from users. An example would be impersonating a bank official and soliciting personal authentication details.
For insights into a real-world case of social engineering, refer to the link provided.
- Principles of Social Engineering
Social engineering often exploits human traits such as:
- Social Proof: People are influenced to share details if they see others doing so.
- Familiarity/Consistency: Establishing rapport before requesting sensitive information.
- Authority: Manipulators may feign authority to extract information.
- Likeability: Building a friendly relationship to persuade victims.
- Reciprocity: Offering a favor to elicit a return of sensitive information.
- Scarcity: Creating a sense of limited opportunity to pressure victims.
- Urgency: Instilling a rush to reveal personal details under false pretenses.
- Phishing
Phishing is a form of social engineering attack where malicious actors send deceptive messages (emails, SMS, etc.) designed to extract sensitive user information.
For an illustration of a large-scale phishing fraud, see the example linked here.
- Whaling
Whaling is a targeted phishing attack aimed at high-profile individuals within an organization, such as CEOs and CTOs. To understand this better, refer to the related example.
- Spear Phishing
This is a more personalized phishing attack directed at specific individuals or organizations, aiming to compromise confidential data.
- Typo-squatting
Typo-squatting occurs when malicious entities register domain names that mimic common misspellings. Users inadvertently redirected to these sites may expose their confidential information.
For instance, an attack might use domains like www.goodle.com or www.goole.com to display fraudulent login pages.
- Email Security Protocols
These protocols safeguard against email-based cyber threats. Key email security protocols include:
- Sender Policy Framework (SPF): Validates email sources.
- DomainKeys Identified Mail (DKIM): Confirms that emails are authorized by the domain owner.
- Domain-based Message Authentication, Reporting, and Conformance (DMARC): Integrates SPF and DKIM with unified policies.
- MTA-STS (Mail Transfer Agent Strict Transport Security): Ensures secure email transmission.
- SSL/TLS: Learn more about these protocols here.
Thank you for taking the time to read this article! Stay tuned for the next installment.
Chapter 2: Learning Ethical Hacking
In this section, we'll explore ethical hacking principles and practices.
The first video titled "Ethical Hacking in 15 Hours - 2023 Edition - Learn to Hack! (Part 1)" provides an extensive overview of ethical hacking concepts and practices.
The second video, "Ethical Hacking in 12 Hours - Full Course - Learn to Hack!" offers a comprehensive course on ethical hacking techniques and methodologies.