Security is part of every DevOps job: certificates, secrets, access control, patching, scanning, audit logs. This subject gives the foundations underneath: what can go wrong, what the mathematical building blocks are, and how they are combined into protocols such as TLS and SSH. This article revisits the five units of the JNTUK course.
Unit 1: Security goals, threats and classical cryptography
The CIA triad and more
| Goal | Meaning | Threat |
|---|---|---|
| Confidentiality | Only authorised parties can read data | Eavesdropping, leaks |
| Integrity | Data is not altered unnoticed | Tampering |
| Availability | Systems work when needed | DoS, ransomware |
| Authentication | Parties are who they claim | Impersonation |
| Non-repudiation | A sender cannot deny sending | Disputed actions |
| Accountability | Actions can be traced | Missing logs |
Attacks
| Type | Examples |
|---|---|
| Passive | Eavesdropping, traffic analysis |
| Active | Masquerade, replay, modification, denial of service |
| Malware | Viruses, worms, trojans, ransomware, spyware |
| Social | Phishing, pretexting |
| Application and network | SQL injection, XSS, buffer overflow, man-in-the-middle, DDoS |
Security uses defence in depth (several layers), least privilege, fail-safe defaults, separation of duties and keeping design open (Kerckhoffs’s principle: only the key is secret). A threat model lists assets, attackers and attack paths.
Classical ciphers
A cipher turns plaintext into ciphertext using a key.
| Cipher | Idea | Weakness |
|---|---|---|
| Caesar (shift) | Shift each letter by k | Only 25 keys; brute force |
| Monoalphabetic substitution | Fixed letter mapping | Frequency analysis |
| Vigenère | Repeating key of shifts | Key length found by analysis |
| Playfair, Hill | Digraph and matrix ciphers | Known-plaintext attacks |
| Rail fence, columnar | Transposition: rearrange letters | Pattern analysis |
| One-time pad | Random key as long as the message, used once | Perfectly secret, but key distribution is impractical |
Classical ciphers are broken today but introduce substitution and permutation (confusion and diffusion), the core of modern ciphers.
Today: the CIA triad frames every risk assessment and compliance audit (ISO 27001, SOC 2, PCI DSS). Ransomware is an availability attack, and phishing is still the most common way in.
Unit 2: Symmetric-key cryptography
In symmetric cryptography, one shared secret key is used for both encryption and decryption. It is fast and used for bulk data.
Block ciphers and DES
A block cipher works on fixed-size blocks. DES (1977) uses a 56-bit key, 64-bit blocks and a Feistel network of 16 rounds; its short key is now brute-forceable. Triple DES applies it three times. AES replaced it.
AES
AES (Rijndael) has 128-bit blocks and key sizes of 128, 192 or 256 bits with 10, 12 or 14 rounds. Each round has four steps: SubBytes (substitution), ShiftRows, MixColumns (diffusion) and AddRoundKey. It is fast, widely implemented in hardware and considered secure.
Modes of operation
| Mode | Behaviour | Note |
|---|---|---|
| ECB | Each block encrypted independently | Insecure: identical blocks give identical ciphertext |
| CBC | Each block is XORed with the previous ciphertext | Needs an IV; encryption is sequential |
| CTR | A counter is encrypted to make a keystream | Parallel, turns a block cipher into a stream cipher |
| GCM | CTR plus an authentication tag | Authenticated encryption; standard in TLS |
Stream ciphers (RC4, now broken; ChaCha20, modern) generate a keystream XORed with the data. The key problem of symmetric crypto is key distribution: how do two parties share a key securely? Unit 3 answers it.
Today: disk and volume encryption (EBS, LUKS), database encryption at rest, S3 server-side encryption, and the data inside TLS all use AES (usually AES-256-GCM). Key management services (AWS KMS, HashiCorp Vault) store and rotate the keys.
Unit 3: Public-key cryptography, hashes and signatures
Asymmetric cryptography
Each party has a public key (shared) and a private key (secret). What one key encrypts, only the other can decrypt. It solves key distribution but is slower, so it is used for key exchange and signatures.
| Algorithm | Based on | Notes |
|---|---|---|
| RSA | Difficulty of factoring large numbers n = p × q | Keys of 2048 bits or more; public key (e, n), private key d with e·d ≡ 1 mod φ(n) |
| Diffie-Hellman | Discrete logarithm | Two parties derive a shared secret over an open channel; needs authentication against man-in-the-middle |
| Elliptic-curve (ECC, ECDH, ECDSA) | Elliptic-curve discrete log | Same security as RSA with much smaller keys |
| ElGamal, DSA | Discrete logarithm | Encryption, signatures |
A tiny RSA example: p = 3, q = 11, n = 33, φ = 20, choose e = 3, then d = 7 (since 3 × 7 = 21 ≡ 1 mod 20). Encrypting m = 4: 4³ mod 33 = 31; decrypting: 31⁷ mod 33 = 4.
Hybrid encryption combines both: use a public-key method to agree on a symmetric key, then encrypt the data with AES. This is how TLS and PGP work. Quantum computers could break RSA and ECC, so post-quantum algorithms (such as ML-KEM and ML-DSA, standardised by NIST) are being adopted.
Hash functions and MACs
A hash function maps any input to a fixed-size digest (SHA-256, SHA-3; MD5 and SHA-1 are broken). Required properties: pre-image resistance, second pre-image resistance and collision resistance. A MAC (such as HMAC) uses a secret key to give integrity and authenticity.
Digital signatures and certificates
A digital signature is a hash of the message encrypted with the sender’s private key; anyone can verify it with the public key. It gives integrity, authentication and non-repudiation. A certificate (X.509) binds a public key to an identity and is signed by a certificate authority (CA); the PKI is the system of CAs, chains of trust, revocation (CRL, OCSP) and expiry.
Today: SSH keys, TLS certificates (Let’s Encrypt), code signing, container image signing (cosign), Git commit signing, JWT signatures and password storage (salted hashes with bcrypt, scrypt or Argon2) all use this unit. An expired certificate is one of the most common production outages.
Unit 4: Authentication and network security
Authentication
| Factor | Examples |
|---|---|
| Something you know | Password, PIN |
| Something you have | Phone, hardware key, smart card, OTP token |
| Something you are | Fingerprint, face (biometrics) |
Multi-factor authentication (MFA) combines factors. Password storage must use a slow salted hash, and password guessing is countered by lockouts, rate limits and breach checks. Kerberos uses tickets from a trusted server for single sign-on; OAuth 2.0 (delegated authorisation) and OpenID Connect / SAML (identity and single sign-on) are the web equivalents; FIDO2 / passkeys provide phishing-resistant public-key login.
Secure network protocols
| Protocol | Layer | Purpose |
|---|---|---|
| TLS (SSL) | Transport | Encrypts and authenticates TCP connections; the handshake negotiates a cipher, authenticates the server with its certificate and derives session keys |
| HTTPS | Application | HTTP over TLS |
| SSH | Application | Secure remote login and tunnelling |
| IPsec (AH, ESP) | Network | Encrypted tunnels and VPNs |
| WPA2/WPA3 | Link | Wi-Fi security |
| PGP / S/MIME | Application | Email encryption and signing |
| DNSSEC | DNS | Signed DNS records |
Network defences
| Control | Purpose |
|---|---|
| Firewall | Filters traffic by rules: packet filter, stateful, application-level (proxy, WAF) |
| IDS / IPS | Detect or block attacks: signature-based and anomaly-based |
| VPN | Secure access across an untrusted network |
| Network segmentation, DMZ, zero trust | Limit lateral movement; “never trust, always verify” |
| DDoS protection | Rate limiting, scrubbing, CDN |
Today: security groups and network policies are firewalls, a WAF fronts web apps, and a VPN or zero-trust proxy replaces open SSH. OIDC and SAML sign users in through an identity provider, and short-lived credentials (IAM roles, workload identity) replace long-lived keys.
Unit 5: System, application and cloud security
System and software security
| Topic | Key points |
|---|---|
| Access control | DAC, MAC, RBAC, ABAC; least privilege; Linux permissions and SELinux or AppArmor |
| Vulnerabilities | Buffer overflow, format string, race conditions, privilege escalation; CVE IDs and the CVSS score |
| Malware defence | Antivirus, endpoint detection (EDR), application allow-lists |
| Secure coding and OWASP Top 10 | Injection, broken access control, cryptographic failures, insecure design, security misconfiguration, vulnerable components, authentication failures, logging failures, SSRF |
| Patch management | Regular updates, vulnerability scanning |
Web and application security
Defend against SQL injection (parameterised queries), cross-site scripting (output encoding, Content Security Policy), CSRF (tokens, SameSite cookies), session hijacking (secure cookies, HTTPS) and insecure deserialisation. Validate every input on the server and check authorisation on every request.
Cloud and DevSecOps
- Shared responsibility model: the provider secures the cloud infrastructure; you secure what you put in it (identity, data, configuration).
- Identity and access management (IAM), least-privilege roles, MFA and no root keys.
- Secrets management: never put secrets in Git; use Vault, AWS Secrets Manager or Kubernetes secrets with encryption.
- Supply chain security: pinned and scanned dependencies, SBOMs, signed images, scanning (Trivy), static analysis (SAST) and dependency scanning in CI.
- Container and Kubernetes security: minimal base images, non-root users, network policies, pod security standards, RBAC.
- Logging, monitoring and incident response: centralised audit logs (CloudTrail), alerts, a SIEM, a documented response plan, backups and tested recovery.
Standards, law and risk
Risk management = assets, threats, vulnerabilities, likelihood and impact, with controls to reduce, transfer, avoid or accept risk. Standards: ISO/IEC 27001, NIST CSF, SOC 2, PCI DSS, and in India the IT Act 2000 and the Digital Personal Data Protection Act 2023. Ethical hacking and penetration testing assess defences with permission, and security awareness training reduces human error. Forensics investigates incidents after the fact.
Today: the practices above are the daily material of DevSecOps: Trivy and SonarQube in the pipeline, IAM least privilege, secrets in Vault, signed images, patching windows and audit trails. The log4j incident (2021) showed why dependency scanning and quick patching matter.
One-minute recap
| Unit | Key idea | You meet it in |
|---|---|---|
| 1. Goals and classical ciphers | CIA triad, attack types, substitution and transposition | Risk assessments, ransomware, phishing |
| 2. Symmetric cryptography | AES, block modes, GCM | Disk, database and S3 encryption, KMS |
| 3. Public key, hashes, signatures | RSA, ECC, Diffie-Hellman, SHA-256, certificates | TLS, SSH keys, signed images, password hashing |
| 4. Authentication and network security | MFA, Kerberos, TLS, IPsec, firewalls, IDS | Security groups, WAF, OIDC, VPNs, zero trust |
| 5. System, app and cloud security | RBAC, OWASP Top 10, shared responsibility, supply chain | IAM, secrets, SAST and image scans, audit logs |
Next in Engineering Revisited: Mobile Computing.
Written by Claude, Anthropic’s AI assistant, as part of Engineering Revisited, a quick refresher of the B.Tech subjects one at a time.