Security
13 articles
Designing Secure API Tokens with NIST CSF 2.0: Working Backward from Protect and Detect
Design an API token feature such as Personal Access Tokens (PATs) by working backward from the six NIST CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover). Covers the DB schema, token format, scope checks, anomaly detection, secret scanning, and revocation with code examples.
8 Books for Learning Web Application Security (Auth and Secure Design)
A staged reading list of 8 books for learning web application security, from authentication and authorization to secure design: OAuth-based authorization, digital identity, and secure design and implementation. Each entry links to its full review.
Secure API: Principles for Design, Construction, and Implementation
A review of Secure API. A book that treats API security as consistent principles spanning design, construction, and implementation. From authn/authz, TLS, and secret management to dependency vulnerabilities and CI/CD, it organizes the whole API lifecycle from the threat-based view of why it is needed.
Prerequisite Knowledge Before Starting a Risk Assessment
A single map of the prerequisite knowledge worth having before you start a risk assessment. Starting from assets, threats, vulnerabilities, and risk, it places NIST SP 800-30, ISO/IEC 27005, OWASP ASVS, NIST SP 800-63B, and CVSS v4.0, through to threat modeling and MITRE ATT&CK.
パスキーのすべて: Adoption, UX Design, and Implementation
A review of Everything About Passkeys. From the context of passkeys' rise, password limits and phishing resistance, to WebAuthn and FIDO specifications, server- and platform-side implementation, login UX design, and operational pitfalls like device loss and recovery, it covers the whole picture in one volume.
Everything About Digital Identity: Knowledge for Realizing a Secure and User-Centric Identity System
A review of a comprehensive book on digital identity. It explains everything from concepts to implementation systematically and broadly, covering OAuth 2.0, OpenID Connect, SAML, zero trust, and decentralized identity, giving engineers who design and operate authn/authz platforms a wide perspective.
Introduction to Digital Identity: Essential Authentication, Authorization, and ID Management for Web Services
A review of Introduction to Digital Identity. A book that plainly explains the basics of authentication, authorization, and ID management for web services, with real examples. It spans the mechanisms of OAuth 2.0, OpenID Connect, and SAML through single sign-on, social login, and using IDaaS, an ideal primer.
Secure by Design: Safe Software Design
A review of Secure by Design. A book that advocates improving security from software design itself rather than patching individual vulnerabilities. Centering on DDD, it shows how careful domain modeling weaves security naturally into design, treating it as a design concern rather than a bolt-on feature.
Building Secure and Reliable Systems: Design, Implementation, and Maintenance from Google SRE
A review of Building Secure and Reliable Systems. A book that frames security and reliability not as things simply implemented but as emergent properties arising from deployment and operations. Drawing on Google SRE's insights, it argues for weaving both into design from a project's earliest stages.
A Comprehensive Introduction to OAuth: Principles and Practices for Implementing a Secure Authorization System
A review of A Comprehensive Introduction to OAuth. One of the few books that explains OAuth in depth. Covering authorization from principles to practice, it is a good bridge to keep at hand after a primer and before diving into the specifications.
A Book to Understand Attacks and Countermeasures on OAuth and OIDC (Redirect Attack Edition)
A review of a book that organizes attacks and countermeasures on OAuth and OIDC (Redirect Attack Edition). It gently organizes the basic security of OAuth and OpenID Connect from the angle of attacks and defenses, using redirect-related attacks to help you grasp the essentials.
A Tutorial Guide to Understanding OAuth2.0 Without Just Going Through the Motions!
A review of A Tutorial Guide to Understanding OAuth2.0 Without Just Going Through the Motions. An introductory book for understanding OAuth2.0 by organizing its mechanisms rather than using it on vibes. Easy to read, it is well suited to first grasping OAuth2.0 flows.
A Book to Understand the Differences Between OAuth, OAuth Authentication, and OpenID Connect
A review of a book that helps you understand the differences between OAuth, OAuth authentication, and OpenID Connect. It clearly sorts out these easily-confused concepts for beginners, offering a starting point for understanding the role and proper use of each.