Security Framework

Overview

Developing a deeper understanding of how software, networks and systems work, how they fail, and how to secure them.

This is my evolving knowledge base for learning at the intersection of networking and systems, software development, and security engineering.

I want to understand the systems beneath the applications I build, investigate problems more effectively in technical support, and apply security principles to my own web applications. Over time, I hope to develop practical Application Security expertise.

The approach combines theoretical understanding, practical experimentation and reusable security principles. These pages are a starting curriculum, with room for questions, experiments and notes as I learn.

Understanding the connections between systems, software and security.

Learning paths

Eight connected areas provide a route from technical foundations to testing and securing applications. Start with the foundations, or follow a question into the area that helps explain it.

Networking & Protocols

How devices communicate and how requests reach their destination.

IP addressing, subnets and routing
TCP, UDP and ports
DNS resolution and caching

Operating Systems

The processes, permissions and resources beneath an application.

Processes, threads and services
Users, groups and file permissions
Filesystems and environment variables

Web Architecture

How browsers, servers, APIs and data stores work together.

Browser and server responsibilities
APIs, databases and background jobs
Cookies, sessions and browser storage

Identity & Access

Establishing identity and deciding what each identity may do.

Authentication versus authorisation
Password storage and multi-factor authentication
Session creation, expiry and revocation

Vulnerabilities

Common ways software assumptions and security boundaries fail.

Injection and unsafe interpretation of input
Cross-site scripting and output encoding
Broken access control and object ownership

Security Testing

Turning security questions into repeatable checks and evidence.

Test scope, permission and lab environments
Threat-led test cases and negative tests
Request inspection and manual verification

Secure Development

Building security reasoning into everyday software work.

Threat modelling and security requirements
Input validation and context-aware output encoding
Safe database queries and error handling

Infrastructure Security

Protecting the environments that build, host and operate software.

Hosting configuration and exposed services
Deployment pipelines and build permissions
Secrets storage, rotation and access

How I’ll use this framework

For each area, I’ll connect a concept to a small experiment, record what happened and identify a principle worth reusing. The notes should distinguish what I have tested from what I still need to understand.

The first version is a standalone learning framework. Project-specific assessments can follow when the underlying knowledge and methods are ready.