🛡️ शाळेच्या पद्धतीने application आणि cloud security शिका

# the 60-second wow — every door checked:
git clone https://github.com/BaluRaut/learn-security-school.git && cd learn-security-school
python3 sec/demo.py                # 16 lessons: each weakness on local data, and its fix
python3 sec/test_sec.py            # 16 checks across the lessons

तुम्हाला काय दिसायला हवे (छाटलेले — यश असे दिसते):

═══ injection ═══
── the grade lookup asks for one pupil's grade
   normal input 'katrina'           unsafe → [('katrina', 'A+')]  ·  safe → [('katrina', 'A+')]
   crafted input "x' OR '1'='1"     unsafe → [('katrina', 'A+'), ('dipika', 'B+'), ('aishwarya', 'A')]
                                       safe   → []
   the fix is the same everywhere: send data as parameters, never glue it into the command (SQL, shell, LDAP, templates)

═══ xss ═══
── a comment on the notice board: 'Great results! <script>fetch("/api/grades")</script>'
   rendered raw     → <p>Great results! <script>fetch("/api/grades")</script></p>
   rendered escaped → <p>Great results! &lt;script&gt;fetch(&quot;/api/grades&quot;)&lt;/script&gt;</p>
── Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.school.example
   inline <script>…</script>             → blocked
   src    self                           → runs
   src    https://cdn.school.example     → runs
   src    https://evil.example           → blocked
   escape on output for the right context (HTML, attribute, JS, URL) — CSP is the safety net, not the fix

═══ browser ═══
── Set-Cookie: session=abc123                                   → missing httponly, secure, samesite
── Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax   → ok
── CSRF: the form carries a token tied to the session → valid True · forged False · missing False
── CORS allow-list: https://school.example → True · https://evil.example → False
── SSRF: the server fetches a photo URL a user typed — check it first
   https://images.school.example/p/7.jpg      → (True, 'allowed')
   http://images.school.example/p/7.jpg       → (False, 'only https')
   https://169.254.169.254/latest/            → (False, 'private / internal address')
   https://10.0.0.5/admin                     → (False, 'private / internal address')
   https://evil.example/x                     → (False, 'host not on the allow-list')

═══ passwords ═══
── stored: salt + 200,000 PBKDF2 rounds → 7f2c954f85f5934bde900ac7… (never the password itself)
   login with the right password → True · wrong → False
── how fast can a stolen hash be guessed? (one GPU, illustrative)
   md5 (unsalted)             50,000,000,000 guesses/s
   sha256 (salted)            10,000,000,000 guesses/s
   pbkdf2 200k iterations             50,000 guesses/s
   use Argon2id / bcrypt / scrypt / PBKDF2 with a salt · add MFA · rate-limit logins · check breached passwords

═══ oauth ═══
── the ID token the school login gives the app (OIDC) — checked before trusting any claim:
   good       → ok
   forged     → bad signature
   alg none   → algorithm 'none' refused
   other app  → wrong audience
   expired    → expired
── PKCE: the app sends challenge E9Melhoa2OwvFrEM… · later proves it with the verifier → True · a thief with only the code → False
   authorization code + PKCE for browsers and phones · never the implicit flow · tokens short-lived

═══ authz ═══
── RBAC: parent may grades:read True · grades:write False · teacher grades:write True
── GET /grades/{id}: the role check passes for both — the OBJECT check is what matters
   Dipika (parent of Aishwarya) reads Aishwarya's record → True
   Dipika changes the id in the URL to Katrina's record  → False  (without this check: IDOR / BOLA)
   check ownership on the server for every object, every time — never trust an id from the client

═══ secrets ═══
── envelope encryption: ciphertext fe1cf83a01159db61697… · wrapped data key 00d66fb446efd05f5b12…
   decrypt = unwrap the data key with the master key (KMS) → 'Katrina: A+ in maths'
── secret scan of 4 files → [('config.py', 'generic secret'), ('deploy.sh', 'AWS access key id'), ('notes.md', 'private key')]
   secrets live in a manager (Secrets Manager / Vault), are fetched at runtime, rotated, and never committed

═══ boundaries ═══
── the grades service was granted 5 permissions and used 2 → remove ['dynamodb:*', 'ec2:*', 's3:DeleteObject']
   sg-alb         → port 8080  allowed
   0.0.0.0/0      → port 8080  refused
   10.20.0.0/16   → port 5432  allowed
   198.51.100.9   → port 22    refused
   private subnets for apps and data · WAF in front · no SSH from the internet · least privilege everywhere

═══ tls ═══
── school.example       → ok
── api.school.example   → TLS 1.0 allowed — require 1.2+; certificate expires in 6 days; certificate name does not match the host
   in transit: TLS 1.2+ everywhere, HSTS · at rest: encrypt disks, buckets, backups with KMS keys · rotate certificates automatically

═══ k8s_rbac ═══
── who may do what in the cluster (RBAC denies by default)
   sa:results-api   get    pods         in school      → (True, 'read-grades allows get pods')
   sa:results-api   get    secrets      in school      → (False, 'no binding allows it (RBAC denies by default)')
   sa:ci            update deployments  in school      → (True, 'deployer allows update deployments')
   sa:ci            update deployments  in kube-system → (False, 'no binding allows it (RBAC denies by default)')
   one ServiceAccount per app · no cluster-admin for apps or CI · automountServiceAccountToken: false when unused

═══ k8s_network ═══
── NetworkPolicy on the database pods: only results-api, only 5432
   results-api  → postgres:5432  allowed
   notices-api  → postgres:5432  blocked
   results-api  → postgres:22    blocked
   pods with no policy selecting them accept everything → True — start every namespace with default-deny
   Kubernetes Secrets are only base64 — enable encryption at rest, or use an external secret store

═══ admission ═══
── first try → rejected: privileged container; may run as root (set runAsNonRoot: true); allowPrivilegeEscalation not false; mounts a hostPath volume; image has no pinned tag/digest; no resource limits
── fixed     → admitted
   enforce with Pod Security Admission (restricted) or a policy engine (Kyverno / OPA Gatekeeper)

═══ dependencies ═══
── audit of {'requests': '2.28.1', 'jinja2': '3.1.4', 'pyyaml': '5.3.1', 'flask': '3.0.0'}
   requests 2.28.1: leaks Proxy-Authorization on redirect → upgrade to ≥ 2.31.0
   pyyaml 5.3.1: arbitrary code via full_load → upgrade to ≥ 5.4
   typosquat check reqeusts  → ['requests']
   typosquat check numpyy    → ['numpy']
   typosquat check flask     → no close popular name
   typosquat check boto4     → ['boto3']
   lockfiles with hashes · automated updates · an allow-list for new packages · audit in CI

═══ artifacts ═══
── SBOM: [{'name': 'flask', 'version': '3.0.0', 'sha256': 'af4113b6a8b4'}, {'name': 'jinja2', 'version': '3.1.4', 'sha256': 'c85d52da9cf8'}, {'name': 'requests', 'version': '2.32.3', 'sha256': '426739742007'}]
── signature on the image digest: 529a0de3b5e2a1c6 · verify original → True · verify tampered → False
── provenance BaluRaut/school-app    → (True, [])
── provenance someone/fork           → (False, ['built from someone/fork', 'commit was not reviewed'])
   sign in CI (cosign / Sigstore), keep an SBOM per image, and let the cluster admit only signed images with good provenance

═══ pipeline ═══
── STRIDE along the delivery line, one guard per stage:
   developer laptop   stolen token, malware → hardware keys, MFA, short-lived credentials
   git                force-push, secret committed → branch protection, reviews, secret scanning
   dependencies       malicious or vulnerable package → lockfiles, audit, allow-list, pinned versions
   build (CI)         poisoned runner, stolen CI secret → OIDC to the cloud, isolated runners, least privilege
   container image    vulnerable base, unknown content → minimal base, scan, SBOM
   registry           image swapped → sign images, verify digests on deploy
   deployment         unsigned or unreviewed artifact → admission policy that checks signature and provenance
── a secret leaked in a public commit — in this order:
   1. revoke / rotate the secret first (minutes, not days)
   2. find every place it was used (logs, CloudTrail)
   3. remove it from the code AND the git history; assume forks and caches already have it
   4. look for what the attacker did with it; contain
   5. fix the cause: secret scanning in pre-commit and CI, short-lived credentials
   6. write the blameless postmortem

═══ ai ═══
── the school assistant can search notices, summarise, send email and delete notices
   summarise      asked by web page       confirmed=False → (True, 'allowed')
   send_email     asked by user           confirmed=True  → (True, 'allowed')
   send_email     asked by uploaded file  confirmed=False → (False, 'action requested by uploaded file content — blocked')
   send_email     asked by user           confirmed=False → (False, "action needs the user's confirmation")
   delete_notice  asked by user           confirmed=True  → (False, 'tool not allowed for this agent')
   treat retrieved text as DATA, never as instructions · least-privilege tools · a human confirms actions
   filter what goes out (no grades or tokens in answers) and log every tool call

✅ done — every door checked

🗺️ संपूर्ण चित्र — एक आकृती, पूर्ण कोर्स

संपूर्ण कोर्स एका कॅनव्हासवर. 4K आवृत्तीसाठी क्लिक करा.

🖍️ भाग 1 — web (धडे 1–3)

एक git branch = एक कल्पना. प्रत्येक उदाहरण sec/ मधील local data वर चालते — बचावात्मक, network नाही.

🔑 भाग 2 — identity (धडे 4–6)

Authentication, delegated login आणि बहुतेक APIs विसरतात ती authorization तपासणी.

🗝️ भाग 3 — cloud (धडे 7–9)

गुपिते (secrets), permissions, networks आणि encryption — प्रत्येक app ला लागणारी cloud नियंत्रणे.

☸️ भाग 4 — Kubernetes (धडे 10–12)

Cluster ची स्वतःची नियंत्रणे: RBAC, secrets, network policies आणि admission.

📦 भाग 5 — supply chain (धडे 13–15)

Developer च्या laptop पासून production पर्यंत: प्रत्येक टप्प्यावर हल्ला होऊ शकतो, प्रत्येक टप्प्याला पहारेकरी मिळतो.

🤖 भाग 6 — AI (धडा 16)

जग वाचणाऱ्या आणि tools वापरणाऱ्या agents ना इतर कोणत्याही program सारखेच नियम लागतात — आणि काही नवे.

📐 धड्यांच्या आकृत्या — क्रमांक अनुसरा

प्रत्येक धडा एका क्रमांकित बॉक्स-आणि-बाण आकृतीत — स्वतंत्र पानावरही.