4.8-4.9: Application Security & Infrastructure

🔐 4.8 Application Security Issues

Overview

Application security involves protecting secrets, encrypting data in transit and at rest, and handling data securely.

graph TD A["Application Security"] --> B["Secret Protection"] A --> C["Encryption"] A --> D["Data Handling"] B --> B1["API Keys"] B --> B2["Passwords"] B --> B3["Tokens"] C --> C1["In Transit"] C --> C2["At Rest"] D --> D1["Input Validation"] D --> D2["Output Encoding"] style A fill:#667eea,stroke:#764ba2,stroke-width:3px,color:#fff style B fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff style C fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style D fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff

1. Secret Protection

🔑 Managing Secrets Securely

Secrets include API keys, passwords, tokens, and certificates that must be protected.

❌ NEVER Do This:

# ❌ Hardcoded secrets
API_KEY = "sk_live_1234567890abcdef"
DB_PASSWORD = "MyP@ssw0rd123"

# ❌ Secrets in Git
git add config.py

# ❌ Secrets in Docker image
ENV DB_PASSWORD=secret123

# ❌ Logging secrets
print(f"Password: {password}")

✅ Best Practices:

# ✅ Use environment variables
import os
API_KEY = os.getenv('API_KEY')
DB_PASSWORD = os.getenv('DB_PASSWORD')

# ✅ Use .env files (add to .gitignore)
from dotenv import load_dotenv
load_dotenv()

# ✅ Secret management tools
# - HashiCorp Vault
# - AWS Secrets Manager
# - Azure Key Vault

2. Encryption

🔒 Encryption in Storage and Transport

A. Encryption in Transit

Protects data while moving over the network.

Protocol	Port	Use Case
HTTPS/TLS	443	Web traffic, REST APIs
SSH	22	Secure remote access
VPN	Various	Encrypted tunnel

# Python - Enforce HTTPS
import requests

# ✅ Always use HTTPS
response = requests.get('https://api.example.com/data')

# ✅ Verify SSL
response = requests.get('https://api.example.com', verify=True)

B. Encryption at Rest

Protects stored data.

# Python - Encryption with Fernet
from cryptography.fernet import Fernet

key = Fernet.generate_key()
cipher = Fernet(key)

# Encrypt
encrypted = cipher.encrypt(b"Sensitive data")

# Decrypt
decrypted = cipher.decrypt(encrypted)

# Password Hashing (bcrypt)
import bcrypt
password = b"user_password"
salt = bcrypt.gensalt()
hashed = bcrypt.hashpw(password, salt)

3. Data Handling

🗃️ Secure Data Handling

# ✅ Input Validation
import re

def validate_email(email):
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return bool(re.match(pattern, email))

# ✅ Parameterized queries (prevent SQL injection)
import sqlite3
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

# ✅ Escape HTML (prevent XSS)
import html
safe_output = html.escape(user_input)

🌐 4.9 Infrastructure Components

Overview

Modern applications rely on infrastructure components for routing, security, and high availability.

graph LR A["User"] --> B["DNS"] B --> C["Firewall"] C --> D["Load Balancer"] D --> E["Reverse Proxy"] E --> F["App Servers"] style A fill:#e3f2fd,stroke:#1976d2,stroke-width:2px,color:#000 style B fill:#fce4ec,stroke:#c2185b,stroke-width:2px,color:#000 style C fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000 style D fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000 style E fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px,color:#000

1. Firewall

🛡️ Network Security Barrier

Controls incoming and outgoing network traffic based on security rules.

Functions

Packet Filtering: Allow/deny based on IP, port, protocol
Stateful Inspection: Track connection states
NAT: Network Address Translation
IPS/IDS: Intrusion prevention/detection

# Firewall Rules Example

# Allow HTTPS from anywhere
Source: 0.0.0.0/0  Port: 443  Protocol: TCP  Action: ALLOW

# Allow SSH from admin network only
Source: 10.0.0.0/8  Port: 22  Protocol: TCP  Action: ALLOW

# Deny all other traffic
Source: 0.0.0.0/0  Port: *  Protocol: *  Action: DENY

2. DNS (Domain Name System)

🌍 Domain Name Resolution

Translates domain names to IP addresses.

DNS Record Types

Record	Purpose	Example
A	IPv4 address	example.com → 192.0.2.1
AAAA	IPv6 address	example.com → 2001:db8::1
CNAME	Alias	www.example.com → example.com

3. Load Balancer

⚖️ Traffic Distribution

Distributes incoming traffic across multiple servers.

Algorithms

Algorithm	Description
Round Robin	Distribute sequentially
Least Connections	Send to server with fewest connections
IP Hash	Based on client IP

# Nginx Load Balancer
upstream backend {
    least_conn;
    
    server app1.example.com:8080;
    server app2.example.com:8080;
    server app3.example.com:8080;
}

server {
    listen 80;
    location / {
        proxy_pass http://backend;
    }
}

4. Reverse Proxy

🔄 Gateway to Backend

Forwards client requests to appropriate backend servers.

Functions

Request Routing: Route based on URL path
SSL Termination: Handle HTTPS
Caching: Cache static content
Compression: Gzip responses

# Nginx Reverse Proxy
server {
    listen 80;
    
    location /api/ {
        proxy_pass http://api-backend:5000/;
    }
    
    location /admin/ {
        proxy_pass http://admin-backend:3000/;
    }
    
    location / {
        proxy_pass http://frontend:8080/;
    }
}

🐍 Interactive Python Interpreter

💡 How to use:

Write Python code in the editor
Click "▶ Run Code" to execute
Try sample code buttons

📝 Python Code Editor

# Security & Infrastructure Demo

print("🔒 APPLICATION SECURITY")
print("="*60)

security_topics = {
    'Secret Protection': 'Environment variables, Vault',
    'Encryption in Transit': 'HTTPS/TLS, SSH',
    'Encryption at Rest': 'Database, disk encryption',
    'Data Handling': 'Validation, sanitization'
}

for topic, desc in security_topics.items():
    print(f"{topic}: {desc}")

⚡ Console Output

Ready to execute Python code...

🔒 Application Security & Infrastructure

🔐 4.8 Application Security Issues

Overview

1. Secret Protection

🔑 Managing Secrets Securely

2. Encryption

🔒 Encryption in Storage and Transport

A. Encryption in Transit

B. Encryption at Rest

3. Data Handling

🗃️ Secure Data Handling

🌐 4.9 Infrastructure Components

Overview

1. Firewall

🛡️ Network Security Barrier

Functions

2. DNS (Domain Name System)

🌍 Domain Name Resolution

DNS Record Types

3. Load Balancer

⚖️ Traffic Distribution

Algorithms

4. Reverse Proxy

🔄 Gateway to Backend

Functions

🐍 Interactive Python Interpreter