The Cyber Security Body of Knowledge: 5 categories, 21 knowledge areas and how they map to our project.
The 10 most critical web security risks with real attack examples and mitigations.
Authentication vs Authorization, encryption in transit/at rest, and cloud shared responsibility.
Recognize critical security risks and apply CyBOK-informed protections for web applications and cloud infrastructure.
An open, freely accessible body of knowledge developed by 115+ international experts, funded by the UK National Cyber Security Programme. Version 1.1 (current) defines 21 Knowledge Areas organized in 5 categories.
It provides a shared vocabulary for cybersecurity, just like SWEBOK does for software engineering. It maps to university curricula and professional certifications. References IEEE SWEBOK v3 and ACM CS 2013.
Today we focus on the Knowledge Areas most relevant to our project: Web & Mobile Security, Authentication, Authorization & Accountability, Network Security (Cloud), and Applied Cryptography.
A01 (Broken Access Control) has been the #1 risk since 2021. 94% of applications tested had some form of broken access control. Always validate permissions server-side.
The attacker inputs ' OR '1'='1' -- to bypass login. Parameterized queries prevent this by separating SQL structure from user data.
Attacker injects malicious JavaScript into pages viewed by other users.
Fix: output encoding, Content Security Policy (CSP), textContent instead of innerHTML
Attacker tricks authenticated user into submitting unintended requests.
Fix: CSRF tokens, SameSite cookies, verify Origin header
Both XSS and CSRF exploit the trust relationship between browser and server. Defense requires layered controls: input validation, output encoding, secure headers, and proper session management.
| Aspect | 🔐 Authentication (AuthN) | 🛡️ Authorization (AuthZ) |
|---|---|---|
| Question | Who are you? | What can you do? |
| Mechanism | Passwords, MFA, OAuth, JWT | RBAC, ABAC, Policies |
| Principle | Verify identity | Least privilege |
| Failure | Impersonation | Privilege escalation |
| CyBOK ref | User Authentication KA | Access Control KA |
Never trust the client alone. Always validate permissions server-side on every request. Authentication without proper authorization is an open door.
header.payload.signature
Stateless — no server-side session needed.
Use httpOnly cookies or secure storage.
Every API call must use HTTPS. No exceptions.
Encryption keys must be managed separately from data.
Move security checks earlier in the pipeline. Bugs found in design cost 6x less to fix than bugs found in production.
Security does not stop at deployment.
Controls which scripts, styles and resources the browser is allowed to load. Strongest defense against XSS.
Forces HTTPS for all future visits. max-age=31536000 = 1 year. Prevents SSL stripping attacks.
Rule: the browser only talks to the BFF, never to internal APIs.
og:title, og:image per pageFrameworks: Next.js, Nuxt, SvelteKit have built-in BFF.
Without BFF: fetch('https://api.stripe.com', { headers: { Authorization: 'sk_live_...' } }) in the browser exposes your secret key in DevTools. BFF eliminates this entire class of vulnerability.
Agile Project Management: Fundamentals and Practical Applications