Security Fundamentals Tutorial with Examples.
Security fundamentals tutorial for beginners: the CIA triad, risk, attack surface, failing closed, defense in depth and security logging.
Beginner
Start here — no prior experience needed
Cybersecurity Learning Roadmap
A defensive cybersecurity roadmap: shared fundamentals, then five paths (beginner, ethical hacker, SOC, AppSec, cloud) built from runnable lessons.
The CIA Triad, Demonstrated on One Machine
See the CIA triad fail and then hold: a sha256sum mismatch, Permission denied on a 0600 secret, and a capped server refusing a third client.
Threat, Vulnerability, Risk: a Risk Register in 30 Lines
Score risks as likelihood x impact in a Python risk register, catch the averaging bug that hides a 25/25 risk, and decide treatment against an appetite.
Attack Surface: Every Listening Port Is a Door
List a container's listening ports with ss, see an admin port reachable on 0.0.0.0 from a second container, rebind it to 127.0.0.1, and check it in code.
Intermediate
For developers with core concepts down
Fail Closed: When an Exception Grants Access
Watch an authorization check grant access when its policy lookup raises (OWASP A10:2025), catch it with a failing pytest, and fix it to deny on error.
Defense in Depth: Remove One Layer, the Next Still Holds
Stop one SQL injection with three layers against a local Postgres: input validation, a parameterized query, a least-privilege role. Remove them one by one.
Logging Security Events Without Logging Secrets
Log failed logins as JSON events, catch the bug that writes the password into the log, redact it, stop log injection, and alert on 5 failures in 60s.
OAuth and Token-Based Authorization
OAuth from first principles in runnable Python: the three roles, scopes and audiences, short access tokens, rotated refresh tokens, PKCE and DPoP binding.
Also part of Security Fundamentals
Taught in other topics. Each link opens the lesson in its home topic.
Permission Bits, Ownership, and Why passwd Needs setuid
A real permission-denied error from a locked-down file, then stripping the setuid bit from /usr/bin/passwd to see exactly why an ordinary user can't change their own password without it.
Database Security
Secure PostgreSQL with real output: roles, GRANT and REVOKE, column privileges, the locked public schema, row-level security, and SQL injection.
ACL: a User Restricted to One Key Pattern and One Command
A default Redis install lets every connection run every command against every key. ACL SETUSER changes that — including a real NOPERM the moment a restricted user reaches outside its allowed keys or commands.
Kafka Security: SASL Authentication and a Real ACL Denial
A default Kafka cluster trusts every connection completely. Turn on SASL/PLAIN and an ACL authorizer, and watch an unauthorized client fail with the exact exception Kafka throws — for a topic, then for a consumer group.
IAM and Least Privilege
How a policy decision is actually evaluated, why an explicit deny always wins, roles versus long-lived keys, and the wildcard that looks scoped and is not.
Testing Bearer Tokens, Basic Auth, and 401 vs 403
Extend the local test API with two auth schemes and catch the assumption that 'wrong token' and 'no token' return the same status code — they don't, and mixing them up hides real bugs.
FastAPI Authentication: Password Hashing, OAuth2 and JWT
Hash passwords with pwdlib and Argon2, log in through FastAPI's OAuth2 password flow, issue JWTs, and see wrong, expired and tampered tokens get 401s.
Docker Security
Harden Docker images and containers: non-root users, read-only filesystems, secrets management, image scanning, and runtime policies.
Data Security and PII: Hashing, Masking, and Tokenization
Run the same email and SSN through three PII techniques and see what each gives up: hashing for joins, masking for display, tokenization for reversal.
Hashes and HMACs: What Each One Actually Proves
Run SHA-256 and HMAC in Python: one input bit flips half the digest, a recomputed hash fools a naive check, and only the keyed HMAC rejects the forgery.
Broken Access Control and IDOR: Fix It in Code, Pin It with a Test
A Flask API leaks another user's invoice. Add the ownership check that fixes it, and a pytest sweep that catches the next route to forget the check.
MCP Authorization: OAuth 2.1, CIMD and a Real Identity Provider
Protect an MCP server with OAuth: the 401 and resource metadata, audience and scope checks, CIMD versus DCR, token refresh, Keycloak and DPoP in the SDK.