Browse Chunks

OAuth 2.0 is an authorization framework that enables a client application to obtain limited access to a protected resource on behalf of a user without exposing the user's credentials. It solves the pain point of delegating authority securely across domains. It is typically reached for web, mobile, or API integrations that need third‑party access to user data.

client requests authorization → authorization server issues token → client presents token to resource server

...

...

SAML is an XML‑based protocol that enables identity providers to exchange authentication and authorization data with service providers. It solves the pain point of managing separate credentials for each application by allowing users to log in once and gain access to multiple services. It is typically employed when integrating enterprise applications that require federated identity across organizational boundaries.

Identity Provider → generate SAML Assertion → Service Provider validates and grants access

Kerberos is a network authentication protocol that uses tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. It is commonly used for single sign-on (SSO) in enterprise environments.

obtain TGT → request service ticket → access protected service

Certificate-based authentication uses a digital X.509 certificate presented by a client to prove its identity to a server. It addresses the pain point of credential theft inherent in password schemes by relying on cryptographic proof of possession. It is triggered whenever a system requires strong, mutual authentication, such as in TLS handshakes between services.

client presents certificate → server validates chain → authentication succeeds

Role-based access control (RBAC) is a security pattern where access permissions are assigned to roles rather than individual users, and users are granted permissions based on the roles they occupy. Use RBAC when you need to manage permissions for many users with similar responsibilities.

if user.role in allowed_roles: permit(action) else: forbid(action)

Attribute-based access control (ABAC) evaluates access decisions by comparing attributes of the subject (e.g., user role, department), the object (e.g., resource type, sensitivity), and the environment (e.g., time, location). It addresses the pain point of overly coarse permission models that cannot express nuanced policies. It is triggered whenever an application must enforce fine‑grained, context‑aware security rules beyond static role checks.

subject attributes + object attributes + environment attributes → policy evaluation → access decision

Policy-based access control (PBAC) evaluates access requests against a set of defined policies that describe permitted actions for subjects on resources. It addresses the difficulty of managing complex permission rules that cannot be captured by simple role assignments. It is used when an application must enforce fine-grained, context‑aware authorization decisions.

Define policies → evaluate access request against policies → grant or deny access

Capability-based security is a model where access rights are conveyed via unforgeable tokens called capabilities. Possessing a capability grants the holder the authority to perform specific operations on a resource, without needing additional identity checks.

capability = make_capability(resource, permissions) result = use_capability(capability, action)

Separation of duties is a security principle that divides responsibilities among different individuals or system components to prevent any single entity from having complete control over a critical process. It reduces the risk of error or fraud by requiring collusion to misuse authority. In software, it translates to designing distinct modules or services for distinct functions such as authentication, authorization, and auditing.

class ServiceA: def execute_duty_a(self, data): # duty A logic return outcome_a class ServiceB: def execute_duty_b(self, data): # duty B logic return outcome_b

Establishes an encrypted communication channel between two parties to ensure confidentiality and integrity of data transmitted over a network. It typically involves performing a TLS handshake, verifying certificates, and then exchanging application data over the secured link.

with create_secure_channel(host, port, cert_file, key_file) as channel: channel.send(message)

Mutual TLS (mTLS) is a TLS handshake where both client and server present X.509 certificates for authentication. It solves the problem of verifying the identity of both parties, preventing unauthorized access. It is used when a service must ensure that only trusted clients can connect and vice‑versa.

client presents certificate → server validates → server presents certificate → client validates

End-to-End Encryption (E2EE) encrypts data on the sender's device and decrypts it only on the recipient's device, ensuring that no intermediate party can read the content. It addresses the pain point of data interception and privacy breaches during transmission or storage. It is employed whenever confidential information must remain hidden from servers, network operators, or any third‑party observers.

generate key pair → encrypt data with recipient's public key → decrypt with own private key

Certificate pinning binds a client to a specific server certificate or public key. It mitigates man‑in‑the‑middle attacks that exploit compromised or rogue Certificate Authorities. It is used when a TLS connection is established and the client wants to ensure the server presents the expected credential.

Validate server certificate → compare its fingerprint or public key hash with a stored pin → proceed only if they match

Perfect Forward Secrecy (PFS) is a property of key‑exchange protocols that ensures each session uses a fresh, short‑lived key derived from an ephemeral key pair. It prevents an attacker who later compromises a long‑term private key from decrypting past recorded sessions. PFS is employed whenever a secure channel must protect confidentiality even against future key exposure.

Generate ephemeral key pair → perform key exchange → discard private key after handshake

Authenticated encryption combines confidentiality and integrity in a single cryptographic operation. It encrypts plaintext while simultaneously generating an authentication tag that protects the ciphertext and any associated data from tampering. Use it whenever data must be kept secret and any alteration must be detected, such as transmitting messages over an insecure channel.

derive key → encrypt plaintext with nonce and associated data → produce ciphertext and authentication tag

Session key rotation is the process of replacing an active cryptographic key used to protect a user session with a newly generated one. It mitigates the risk of key compromise by limiting the time window an attacker can exploit a stolen key. The operation is triggered whenever a key is suspected to be exposed, after a defined usage count, or on a regular time schedule.

Generate new session key → invalidate old key → distribute new key to client

Diffie-Hellman Key Exchange is a cryptographic protocol that allows two parties to jointly compute a shared secret over an insecure channel. It solves the problem of establishing confidentiality without having exchanged any secret material beforehand. The protocol is triggered whenever two peers need to start an encrypted session but only have public parameters in common.

generate public parameters → exchange public keys → compute shared secret

The Noise Protocol Framework defines a suite of cryptographic handshake patterns that allow two parties to establish a shared secret over an insecure channel. It addresses the pain point of building secure, authenticated key exchange without the complexity of TLS. You reach for it whenever you need a lightweight, flexible way to negotiate encryption keys for peer‑to‑peer or client‑server communication.

initialize handshake → exchange messages → derive shared keys

Post-Quantum Key Exchange (PQKE) is a cryptographic protocol that establishes a shared secret between parties using algorithms believed to be resistant to attacks by quantum computers. It addresses the looming security risk that quantum algorithms, such as Shor's algorithm, could break classical public‑key schemes. It is employed when a system must protect communications against future quantum adversaries, typically during the initial handshake of a secure channel.

establish shared secret → derive post‑quantum keys → secure communication

Authenticated Key Exchange (AKE) is a cryptographic protocol that simultaneously establishes a shared secret between two parties and verifies each party’s identity. It solves the problem of man‑in‑the‑middle attacks that arise when unauthenticated key agreement is used. AKE is employed whenever two peers need to start a confidential session over an insecure network.

authenticate peer A → authenticate peer B → perform key agreement → derive session key

The Principle of Least Privilege states that a subject should be given only the permissions essential to perform its tasks. It reduces the attack surface by limiting what code or users can do if compromised. It is applied whenever a system assigns access rights, creates roles, or runs processes with elevated capabilities.

design system → assign minimal required permissions → enforce least privilege

Separation of Duty is a security principle that divides critical tasks among multiple roles to prevent fraud or error. It addresses the risk that a single individual could abuse authority by performing all steps of a sensitive process. The principle is applied whenever a workflow involves high‑value transactions, privileged operations, or compliance‑driven activities.

Define role → assign duties → enforce separation checks

Privilege separation is a security design pattern where a program splits its operations into privileged and unprivileged components, limiting the damage that can be done if the less trusted part is compromised.

if process_has_privileges(): child_pid = fork() if child_pid == 0: drop_privileges(target_user) run_unprivileged_work() else: continue_privileged_work()

The Least Privilege principle dictates that a system component should be granted only the permissions necessary to perform its intended function. It addresses the security risk of excessive rights, which can be exploited if a component is compromised. It is applied whenever permissions, roles, or capabilities are being assigned to users, services, or processes.

Determine required actions → assign only those permissions → deny all others

Network segmentation divides a larger network into smaller, isolated zones. It reduces the attack surface by limiting lateral movement and simplifies policy enforcement. It is applied when a network contains assets of varying sensitivity or compliance requirements.

define zones → assign IP ranges → apply firewall policies

Intrusion detection is the practice of monitoring system or network activities for malicious actions or policy violations, and generating alerts when suspicious patterns are observed.

if detect_signature(log_entry, signature_db): trigger_alert(log_entry)

Metrics collection gathers quantitative data about a system’s behavior, such as request counts, latency, and error rates. It helps developers monitor performance, detect anomalies, and maintain service health. It is typically employed when instrumenting services to expose operational data to monitoring back‑ends.

metrics.record(metric_name, value, tags={})

Sampling is the process of selecting a subset of items from a larger population to estimate characteristics of the whole population, often used when processing large datasets or performing statistical analysis.

def sample(collection, size): return random.sample(collection, size)

A Service Level Objective (SLO) is a quantitative target for a specific reliability metric of a service, such as availability or latency. It addresses the pain point of ambiguous performance expectations by defining clear, measurable goals. Teams reach for an SLO when they need to formalize service reliability expectations and drive operational decisions.

Define SLO → monitor metrics → alert if breach

A Service Level Indicator (SLI) is a quantitative measure of a service's reliability, such as latency percentile or error rate. It addresses the pain point of not having objective data to assess whether a service meets its reliability commitments. Teams reach for an SLI when they need to monitor real‑time performance against agreed targets.

Define SLO → derive SLI measurement → alert on breach

A sampling strategy defines how to select a subset of data from a larger population. It addresses the need to reduce processing time, memory usage, or cost while preserving statistical representativeness. It is employed whenever the full dataset is too large to handle directly or when a controlled experiment requires a manageable sample.

define population → choose sampling_rate → apply random_selection → obtain sample

Log aggregation collects logs from multiple sources into a centralized system for storage, search, and analysis. It addresses the pain point of scattered logs that hinder debugging and monitoring. It is triggered when an application or infrastructure spans several services, containers, or machines and requires correlated log views.

collect logs from services → ship to central store → index and search

Synthetic monitoring is the practice of generating scripted, simulated user interactions against a system to verify its behavior and performance. It addresses the difficulty of detecting regressions or outages before real users are affected. Engineers invoke it when deploying new releases, scaling infrastructure, or when SLA compliance must be continuously validated.

scripted request → validate response → report status

Centralized logging collects log messages from all components of a system into a single, searchable store. It solves the pain of scattered, inconsistent logs that make debugging and monitoring difficult. You reach for it when multiple services or processes need to be observed and their logs correlated.

emit log → forward to central aggregator → store in centralized log repository

Log rotation is a technique that automatically renames or archives a log file when it reaches a certain size or age, and starts writing to a fresh file. It solves the problem of unbounded log growth that can exhaust disk space and make log analysis difficult. It is typically used when an application produces continuous logging output over long periods.

configure logger → set rotation handler (size or time) → define backup count → logger writes → handler rotates file automatically

Log sampling is a technique that records only a subset of log events based on a defined probability or rate. It reduces log volume and storage costs while preserving a representative view of system behavior. It is typically used when high‑frequency events would overwhelm logging infrastructure.

initialize logger → set sampling_rate → log(event) if random() < sampling_rate

A log retention policy defines how long log entries are kept before being deleted or archived, helping manage storage usage and comply with regulations.

{ "retention_days": days, "compress": compress_flag }

Log anomaly detection is a technique that analyzes log entries to identify patterns that deviate significantly from normal behavior. It addresses the pain point of hidden failures or security incidents that remain unnoticed in massive log streams. It is typically employed when a system produces continuous logs and operators need to spot abnormal events quickly.

collect log entries → compute statistical baseline → flag outliers

A gauge metric represents a value that can arbitrarily go up and down, used to measure instantaneous values like temperature, memory usage, or queue length. It is typically updated with a set operation or increment/decrement.

gauge.set(value)

A histogram metric samples observed values (e.g., request latencies) and counts them into predefined buckets, providing sum, count, and bucket counts for quantile estimation.

histogram = Histogram(metric_name, documentation, labelnames, buckets=bucket_list)

A summary metric is a statistical measure that aggregates a collection of values into a single representative figure, such as mean, median, sum, or count. It solves the problem of extracting quick insight from large numeric datasets without inspecting each individual element. It is employed whenever a concise overview of performance counters, analytical data, or monitoring logs is required.

collect data → compute summary metric → present summary

The `rate()` function computes the number of events occurring per unit of time. It addresses the need to monitor system throughput without manually tracking counts and timestamps. It is typically used when a developer needs to gauge performance or trigger scaling actions based on activity levels.

rate(data_source, time_window)

Computes an approximate percentile from a histogram metric by interpolating between bucket boundaries. Used in PromQL to derive latency or duration SLA indicators from histogram observations.

histogram_quantile(quantile, binned_metric)

Calculates the average value of a time series over a specified time interval. Used in monitoring and alerting to summarize metric behavior.

avg_over_time(metric[duration])

The deriv() function computes the symbolic derivative of a given expression with respect to a specified variable, returning a new expression that represents the rate of change. It eliminates the need to manually derive formulas, reducing errors and speeding up development of gradient‑based methods. You reach for it when you need analytical gradients for optimization, sensitivity analysis, or solving differential equations.

deriv(expression, variable)

Holt-Winters method is a triple exponential smoothing technique for forecasting time series data with trend and seasonality. Use when you have seasonal patterns and need short-to-medium term forecasts.

holt_winters(data, seasonal_periods, trend='add', seasonal='add')

Computes a rolling quantile (e.g., median, 90th percentile) over a time-ordered sequence of numeric values, returning a series where each point reflects the quantile of the preceding window.

def quantile_over_time(data, window, q): """Return list of rolling q‑quantile values for data.""" from statistics import quantiles result = [] for i in range(len(data)): start = max(0, i - window + 1) window_data = data[start:i+1] if len(window_data) >= 2: q_val = quantiles(window_data, n=int(1/q))[0] # simplified else: q_val = window_data[0] if window_data else None result.append(q_val) return result

Context propagation is the technique of carrying request-scoped data, cancellation signals, and deadlines alongside function calls. It solves the pain of losing coordination across asynchronous boundaries or service layers. Developers reach for it when they need to cancel work early, enforce timeouts, or share metadata like request IDs throughout a call chain.

create Context → pass Context through function calls → extract values or cancellation

The traceparent header carries tracing metadata (version, trace-id, parent-id, and sampling flag) across service boundaries. It solves the problem of correlating requests in a distributed system, enabling end‑to‑end visibility. It is used whenever a request leaves a service that participates in W3C Trace Context tracing.

client → inject traceparent header → downstream service