Product Security Overview
Product Security is the practice of building security into a product end-to-end - the application code, the infrastructure it runs on, and the pipeline that ships it - rather than bolting it on after release. This section is organized around that lifecycle: how you write and review code, how you secure the network and cloud/container platforms it runs on, and how you automate all of it through DevSecOps.
How to Use This Section
- New to product security? Start with Web Security Overview and Application Security: Secure Coding - the foundational concepts everything else builds on.
- Pick your track - the tables below map each topic to where it lives, roughly in the order you'd learn them for a given specialization.
- Pair with the Study Plans for a structured, week-by-week schedule instead of just a topic list.
- Self-test with Interview Questions once you've worked through a topic.
Web & Network Security
| Topic | Focus |
|---|---|
| Web Security Overview | Foundational web application security concepts |
| OWASP Top 10 (2025) | The 10 most critical web application security risks, with vulnerable/fixed code examples |
| Web Security Concepts | Same-origin policy, CORS, cookies, CSP, TLS, CSRF |
| Network Security Overview | Defense in depth, segmentation, firewalls, IDS/IPS, zero trust vs. perimeter |
Application Security (Zero to Hero)
A full learning path from web/HTTP fundamentals through architecture-level reasoning, red teaming, and real-world incident analysis.
| Topic | Focus |
|---|---|
| AppSec Preliminary Concepts | HTTP, client-server model, sessions/cookies - the vocabulary everything else assumes |
| Secure Coding | Core principles and vulnerability classes with mitigations |
| Secure Code Review | Manual review methodology, risk-based prioritization, findings checklist |
| Authentication & Session Security | OAuth2/OIDC/SAML, JWT pitfalls, MFA, session hijacking |
| Authorization & Access Control | RBAC/ABAC/ReBAC, IDOR, BFLA, OPA/Rego policy engines |
| Injection Security | Blind/second-order SQLi, command injection, NoSQL injection, XXE, SSTI |
| XSS & Client-Side Security | Stored/reflected/DOM XSS, context-aware encoding, CSP, DOM clobbering |
| Cryptography | Encryption, hashing, password storage, key management, TLS |
| Threat Modeling | STRIDE, DFDs, trust boundaries, methodology comparison |
| Secure Application Architecture | Reference architecture, defense in depth, ASVS/SAMM - with diagrams |
| Business Logic Security | Race conditions, mass assignment, request smuggling, cache poisoning |
| API Security | OWASP API Security Top 10, BOLA, mass assignment, SSRF |
| SAST | Static analysis tooling, CI/CD integration, tuning false positives |
| SCA | Dependency/CVE scanning, SBOMs, remediation strategy |
| AppSec Red Teaming & Labs | Testing methodology, tools, practice labs and CTFs |
| Real-World AppSec Incidents | Equifax, Capital One, Log4Shell, MOVEit - curated and sourced |
| AppSec Resources | Standards, books, tools, labs, courses - go deeper on any topic above |
Cloud Security
| Topic | Focus |
|---|---|
| Cloud Security Essentials | Shared responsibility model, IaaS/PaaS/SaaS, foundational checklist |
| OWASP Top 10 Cloud | Common cloud misconfiguration risk categories |
| AWS Security | IAM, S3, CloudTrail, GuardDuty, KMS - hands-on with real CLI/policy examples |
| GCP Security | Cloud IAM, Security Command Center, Cloud KMS, VPC Service Controls |
| GCP IAM & Data Security | Resource hierarchy, Workload Identity Federation, Cloud Storage, Cloud KMS |
| Azure Security | Defender for Cloud, Entra ID, Key Vault, Sentinel |
| Azure Identity & Data Security | Conditional Access, PIM, Storage/Key Vault hardening |
| Multi-Cloud Security Architecture | CSPM/CWPP/CNAPP, identity federation risk, attack-surface map - with diagrams |
| Cloud Red Teaming & Labs | Prowler, ScoutSuite, Pacu, flaws.cloud, CloudGoat, AzureGoat, GCPGoat |
| Cloud Security Incidents | Storm-0558, Uber 2022, exposed storage - curated and sourced |
| Cloud Security Resources | Multi-cloud standards, tools, labs, courses |
Container Security
| Topic | Focus |
|---|---|
| Container Overview | What containers are, containers vs. VMs, use cases |
| Introduction to Docker | Docker fundamentals, images vs. containers |
| Docker Security | Image hardening, scanning, secrets, non-root containers |
| Docker Isolation Architecture | Namespaces, cgroups, capabilities, seccomp/AppArmor - with diagrams |
| Docker Attack Techniques | Socket breakout, runc escape (CVE-2019-5736), privileged-container abuse |
| Docker Red Teaming & Labs | Assessment methodology, Vulhub, Docker-specific test cases |
| Docker Real-World Incidents | Docker Hub breach, cryptomining images - curated and sourced |
| Kubernetes | Core concepts - pods, deployments, services, control plane |
| Kubernetes Security | RBAC, network policies, Pod Security Standards, secrets management |
| Kubernetes Architecture & Security | 4Cs model, control-plane trust boundaries, attack-surface map - with diagrams |
| OWASP Kubernetes Top 10 | K01-K10 (2025), cross-linked to existing RBAC/NetworkPolicy/Secrets coverage |
| Kubernetes Attack Techniques | Container escape, privilege escalation, cluster-to-cloud lateral movement |
| Kubernetes Red Teaming & Labs | kube-hunter, kube-bench, Peirates, Kubernetes Goat, CKS certification path |
| Kubernetes Real-World Incidents | Tesla cryptojacking, CVE-2018-1002105 - curated and sourced |
| Container Security Resources | Docker & Kubernetes standards, tools, labs, courses |
DevSecOps
| Topic | Focus |
|---|---|
| DevSecOps Fundamentals | Shift-left, core practice areas, how the pipeline pieces fit together |
| DevSecOps Maturity Model | Self-assessment levels from manual review to fully automated gates |
| Vulnerability Management | Full lifecycle, CVSS/EPSS/KEV-based prioritization, SLAs |
| Compliance as Code | Policy-as-code (OPA/Rego, Checkov), mapping checks to frameworks |
| SDL in CI/CD | Embedding SDL gates stage-by-stage in a pipeline |
| SCA in CI/CD | Concrete dependency-scanning pipeline integration |
| DAST in CI/CD | Running DAST against ephemeral/staging environments in CI |
| Ansible | Security automation and hardening at scale |
| Terraform | IaC security scanning, secure state management |
| Pulumi | IaC security with general-purpose languages, Policy as Code |
| Jenkins | Securing the CI/CD tool itself - credentials, RBAC, plugin risk |
Credits/References
- OWASP Foundation
- NIST Secure Software Development Framework (SP 800-218)
- jassics/security-study-plan for structured study schedules covering these same domains