Security Engineering
& Cryptography

Testing Tools — Know the Difference

• SAST (Static Application Security Testing) — analyzes source code or binaries without executing them. Runs early in the pipeline (pre-build).
• DAST (Dynamic Application Security Testing) — tests a running application by simulating external attacks. Runs against a deployed/staging environment.
• SCA (Software Composition Analysis) — scans third-party libraries and dependencies for known CVEs.
• IAST — hybrid approach that instruments the running app from within.

Supply Chain Transparency

• SBoM (Software Bill of Materials) — a complete inventory of every component (including transitive dependencies) in a software artifact. Critical for supply chain security audits.
• IaC Security — scanning Infrastructure-as-Code (Terraform, CloudFormation) for misconfigurations before deployment.
• Container security — image scanning (Trivy, Snyk), Dockerfile linting, runtime protection.

Security Gates

• Fail builds automatically when vulnerabilities above a severity threshold are found.
• Enforce code signing and artifact integrity checks throughout the pipeline.

• TLS 1.3 — removed weak cipher suites, mandatory forward secrecy. Know preferred AEAD ciphers (AES-GCM, ChaCha20-Poly1305).
• PKI operations — root CA → subordinate CA → end-entity certificate hierarchy. OCSP for real-time revocation; CRL as the offline alternative. Certificate transparency logs.
• Certificate pinning — embedding expected public key or certificate in the app to prevent MitM with rogue certs. Risk: pins must be updated before expiry.
• HSM (Hardware Security Module) — dedicated hardware for secure key generation, storage, and cryptographic operations. Keys never leave the HSM in plaintext.
• Tokenization — replaces sensitive data with a non-sensitive token. The token has no mathematical relationship to the original (unlike encryption, which is reversible). Common in PCI DSS environments.
• Key escrow — third-party holds a copy of encryption keys for lawful access/recovery.

Why This Matters

• Shor's algorithm — a quantum algorithm that can factor large integers efficiently, breaking RSA and ECC in polynomial time on a sufficiently powerful quantum computer.
• Grover's algorithm — provides quadratic speedup for searching, effectively halving symmetric key strength (AES-256 becomes equivalent to AES-128).

NIST PQC Standardized Algorithms (2024)

• CRYSTALS-Kyber (ML-KEM) — lattice-based key encapsulation mechanism (KEM). Use for key exchange.
• CRYSTALS-Dilithium (ML-DSA) — lattice-based digital signature algorithm.
• FALCON (FN-DSA) — compact lattice-based signatures.
• SPHINCS+ (SLH-DSA) — hash-based signature scheme. Larger signatures but no lattice assumptions needed.

Crypto Agility

• Design systems to swap cryptographic algorithms without full redesign.
• "Harvest now, decrypt later" threat — adversaries collecting encrypted traffic today to decrypt when quantum computers mature.

• AI threat modeling — applying frameworks (STRIDE, MITRE ATLAS) to AI/ML pipelines to identify where adversaries can attack.
• Adversarial ML — model evasion (crafting inputs to fool classifiers), model poisoning (corrupting training data), model inversion (reconstructing training data from outputs). See also Domain 1 of SecAI+.
• AI-assisted security tooling — SAST/DAST tools enhanced with ML for better false-positive reduction and novel vulnerability detection.
• Securing AI pipelines — treating ML training and inference as part of the software supply chain: data integrity, model provenance, output monitoring.
• Bias and fairness controls — ensuring AI security tools don't produce discriminatory outcomes in access control or threat scoring.

SCADA / ICS / OT

• Purdue Model — hierarchical OT/IT architecture with levels from field devices (L0) to enterprise (L4/5).
• OT/IT convergence — as operational technology connects to IT networks, attack surface expands dramatically.
• Compensating controls — for systems that cannot be patched: network segmentation, air gaps, unidirectional gateways (data diodes), allowlisting.

Embedded Systems & IoT

• Secure boot — cryptographically verifies firmware integrity before execution, preventing unsigned firmware from loading.
• Firmware analysis — static and dynamic analysis of firmware images for vulnerabilities.
• Hardware security — TPM (Trusted Platform Module) for key storage and attestation; secure enclaves (Intel SGX, ARM TrustZone) for isolated execution.