Lessons
1Turn a feature diagram into a threat model25 min read
Identify assets, trust boundaries and verifiable controls.
- →Identify assets, trust boundaries and verifiable controls
2Make authorization follow the object25 min read
Evaluate tenant and object permissions on every access path.
- →Evaluate tenant and object permissions on every access path
3Design a server-side fetcher with bounded reach25 min read
Prevent untrusted URLs from granting internal network authority.
- →Prevent untrusted URLs from granting internal network authority
- →Apply layered controls to a server-side fetcher
4Treat a leaked credential as a lifecycle incident25 min read
Plan revocation, replacement and evidence review for an exposed secret.
- →Plan revocation, replacement and evidence review for an exposed secret
- →Distinguish credential rotation from incident recovery
Skills in this course
- 01Identify assets, trust boundaries and verifiable controlsIdentify assets, trust boundaries and verifiable controls.
- 02Evaluate tenant and object permissions on every access pathEvaluate tenant and object permissions on every access path.
- 03Prevent untrusted URLs from granting internal network authorityPrevent untrusted URLs from granting internal network authority.
- 04Plan revocation, replacement and evidence review for an exposed secretPlan revocation, replacement and evidence review for an exposed secret.
- 05Apply layered controls to a server-side fetcherApply layered controls to a server-side fetcher.
- 06Distinguish credential rotation from incident recoveryDistinguish credential rotation from incident recovery.