Role Pack · Mid to Senior
Application Security Pack
OWASP Top 10, authN/authZ, crypto, threat modelling and secure design.
AppSec: the OWASP Top 10, authentication, cryptography and threat modelling.
- Questions
- 360
- Topics
- 20
- Pages
- 244pages
- 360 questions, every one with a model answer
- OWASP Top 10 cheat sheet
- AuthN/Z patterns
- Crypto basics
- Threat modelling labs
Get the Application Security Pack — $9
One-off. Delivered as a PDF by email the moment payment clears.
Prices shown are a USD base. Your local-market price is calculated at checkout in your own currency, plus any local sales tax.
What is inside
20 chapters, in the order the interviews tend to ask them:
- Threat modelling with STRIDE and abuse cases
- The CIA triad, privacy objectives and measurable goals
- Authentication versus authorisation and where the line sits
- OAuth 2.0 and OpenID Connect flows, defended
- OAuth 2.1 and the OAuth security best current practice
- Sessions, cookies and where tokens should live
- Input validation, output encoding and safe boundaries
- Injection classes and why parameterised queries work
- CSRF, XSS and choosing the correct defence for each
- The OWASP Top 10 as an engineering checklist
- Cryptographic engineering, key lifecycle and envelope encryption
- TLS configuration and the certificate lifecycle
- Secrets management and why configuration files leak
- Least privilege, authorisation models and policy design
- Secure development lifecycle and threat driven design
- Dependency risk, lockfiles, SBOMs and build provenance
- Static analysis, secret scanning and pipeline security
- Runtime detection, logging and audit trails
- Incident response, containment and recovery
- Vulnerability management, patching and security operations
How the answers are built
Each chapter opens with the checklist the question is really testing. A few from this pack:
- A data flow diagram is the precondition for everything else, because STRIDE applies to elements and crossings rather than to lines of code.
- An objective is only useful when you can say what would count as failing it, so the database must be confidential is not yet a requirement.
- Authentication produces a claim about identity, authorisation consumes it, and the second is worthless if the first is unchecked at the point of use.
- OAuth is a delegation framework, so an access token proves a grant rather than an identity, and confusing the two is the most common integration bug.
- The implicit grant puts the token in the URL fragment, and any change to how browsers handle fragments silently breaks its security argument.
- The HttpOnly attribute is what stops script reading the session cookie, which makes it the most valuable flag on the cookie.
Questions this pack covers
- When in a project's lifetime should the first threat model happen?
- What does a data flow diagram have to show for it to be worth anything?
- What does each part of the CIA triad actually require an engineer to build?
- How do you tell confidentiality and integrity apart when they touch the same field?
- What is the actual difference between authentication and authorisation?
- Why does a check in the gateway not protect the data your application holds?
- What does the authorisation code flow actually exchange, and over which connection?
- What is the state parameter protecting against, exactly?
Each one is answered in full in the pack, with the reasoning written out rather than a bullet list.
About this pack
- How many questions?
- 360, spread across 20 topics, written out in full across 244 pages.
- Do the answers just list keywords?
- No. Each answer is written as prose, because that is what you have to reproduce when someone asks you the question.
- How do I get it?
- Pay once and the PDF arrives by email immediately, with a signed download link.
- Can I get it refunded?
- Yes, if it is not what you expected. See the refund policy.
