Skip to content

Product Security Overview

Product Security is the practice of building security into a product end-to-end - the application code, the infrastructure it runs on, and the pipeline that ships it - rather than bolting it on after release. This section is organized around that lifecycle: how you write and review code, how you secure the network and cloud/container platforms it runs on, and how you automate all of it through DevSecOps.

How to Use This Section

  1. New to product security? Start with Web Security Overview and Application Security: Secure Coding - the foundational concepts everything else builds on.
  2. Pick your track - the tables below map each topic to where it lives, roughly in the order you'd learn them for a given specialization.
  3. Pair with the Study Plans for a structured, week-by-week schedule instead of just a topic list.
  4. Self-test with Interview Questions once you've worked through a topic.

Web & Network Security

Topic Focus
Web Security Overview Foundational web application security concepts
OWASP Top 10 (2025) The 10 most critical web application security risks, with vulnerable/fixed code examples
Web Security Concepts Same-origin policy, CORS, cookies, CSP, TLS, CSRF
Network Security Overview Defense in depth, segmentation, firewalls, IDS/IPS, zero trust vs. perimeter

Application Security (Zero to Hero)

A full learning path from web/HTTP fundamentals through architecture-level reasoning, red teaming, and real-world incident analysis.

Topic Focus
AppSec Preliminary Concepts HTTP, client-server model, sessions/cookies - the vocabulary everything else assumes
Secure Coding Core principles and vulnerability classes with mitigations
Secure Code Review Manual review methodology, risk-based prioritization, findings checklist
Authentication & Session Security OAuth2/OIDC/SAML, JWT pitfalls, MFA, session hijacking
Authorization & Access Control RBAC/ABAC/ReBAC, IDOR, BFLA, OPA/Rego policy engines
Injection Security Blind/second-order SQLi, command injection, NoSQL injection, XXE, SSTI
XSS & Client-Side Security Stored/reflected/DOM XSS, context-aware encoding, CSP, DOM clobbering
Cryptography Encryption, hashing, password storage, key management, TLS
Threat Modeling STRIDE, DFDs, trust boundaries, methodology comparison
Secure Application Architecture Reference architecture, defense in depth, ASVS/SAMM - with diagrams
Business Logic Security Race conditions, mass assignment, request smuggling, cache poisoning
API Security OWASP API Security Top 10, BOLA, mass assignment, SSRF
SAST Static analysis tooling, CI/CD integration, tuning false positives
SCA Dependency/CVE scanning, SBOMs, remediation strategy
AppSec Red Teaming & Labs Testing methodology, tools, practice labs and CTFs
Real-World AppSec Incidents Equifax, Capital One, Log4Shell, MOVEit - curated and sourced
AppSec Resources Standards, books, tools, labs, courses - go deeper on any topic above

Cloud Security

Topic Focus
Cloud Security Essentials Shared responsibility model, IaaS/PaaS/SaaS, foundational checklist
OWASP Top 10 Cloud Common cloud misconfiguration risk categories
AWS Security IAM, S3, CloudTrail, GuardDuty, KMS - hands-on with real CLI/policy examples
GCP Security Cloud IAM, Security Command Center, Cloud KMS, VPC Service Controls
GCP IAM & Data Security Resource hierarchy, Workload Identity Federation, Cloud Storage, Cloud KMS
Azure Security Defender for Cloud, Entra ID, Key Vault, Sentinel
Azure Identity & Data Security Conditional Access, PIM, Storage/Key Vault hardening
Multi-Cloud Security Architecture CSPM/CWPP/CNAPP, identity federation risk, attack-surface map - with diagrams
Cloud Red Teaming & Labs Prowler, ScoutSuite, Pacu, flaws.cloud, CloudGoat, AzureGoat, GCPGoat
Cloud Security Incidents Storm-0558, Uber 2022, exposed storage - curated and sourced
Cloud Security Resources Multi-cloud standards, tools, labs, courses

Container Security

Topic Focus
Container Overview What containers are, containers vs. VMs, use cases
Introduction to Docker Docker fundamentals, images vs. containers
Docker Security Image hardening, scanning, secrets, non-root containers
Docker Isolation Architecture Namespaces, cgroups, capabilities, seccomp/AppArmor - with diagrams
Docker Attack Techniques Socket breakout, runc escape (CVE-2019-5736), privileged-container abuse
Docker Red Teaming & Labs Assessment methodology, Vulhub, Docker-specific test cases
Docker Real-World Incidents Docker Hub breach, cryptomining images - curated and sourced
Kubernetes Core concepts - pods, deployments, services, control plane
Kubernetes Security RBAC, network policies, Pod Security Standards, secrets management
Kubernetes Architecture & Security 4Cs model, control-plane trust boundaries, attack-surface map - with diagrams
OWASP Kubernetes Top 10 K01-K10 (2025), cross-linked to existing RBAC/NetworkPolicy/Secrets coverage
Kubernetes Attack Techniques Container escape, privilege escalation, cluster-to-cloud lateral movement
Kubernetes Red Teaming & Labs kube-hunter, kube-bench, Peirates, Kubernetes Goat, CKS certification path
Kubernetes Real-World Incidents Tesla cryptojacking, CVE-2018-1002105 - curated and sourced
Container Security Resources Docker & Kubernetes standards, tools, labs, courses

DevSecOps

Topic Focus
DevSecOps Fundamentals Shift-left, core practice areas, how the pipeline pieces fit together
DevSecOps Maturity Model Self-assessment levels from manual review to fully automated gates
Vulnerability Management Full lifecycle, CVSS/EPSS/KEV-based prioritization, SLAs
Compliance as Code Policy-as-code (OPA/Rego, Checkov), mapping checks to frameworks
SDL in CI/CD Embedding SDL gates stage-by-stage in a pipeline
SCA in CI/CD Concrete dependency-scanning pipeline integration
DAST in CI/CD Running DAST against ephemeral/staging environments in CI
Ansible Security automation and hardening at scale
Terraform IaC security scanning, secure state management
Pulumi IaC security with general-purpose languages, Policy as Code
Jenkins Securing the CI/CD tool itself - credentials, RBAC, plugin risk

Credits/References