Security Engineering Cheat Sheet

Technical Reference & Key Concepts

**OWASP Top 10 (condensed)** - **Injection:** Use parameterized queries, ORM sanitization. Never build SQL with string concatenation. - **Broken Auth:** Rate-limit login attempts, enforce MFA, use secure session management. - **Sensitive Data Exposure:** Encrypt at rest (AES-256) and in transit (TLS 1.3). Never log PII. - **XXE:** Disable XML external entity processing if not needed. - **Broken Access Control:** Server-side authorization checks on every request. Never trust client-side. - **Security Misconfiguration:** Disable default accounts, remove debug endpoints, keep dependencies updated. - **XSS:** Sanitize and escape all user input rendered in HTML. Use Content-Security-Policy headers. - **Insecure Deserialization:** Validate serialized objects. Use safe formats like JSON instead of native serialization. - **Known Vulnerabilities:** Use Dependabot / Snyk. Keep a software bill of materials (SBOM). - **Logging & Monitoring:** Log auth failures, access anomalies. Alert on suspicious patterns.

Practice discussing these concepts out loud in live voice drills on GitGrilled.