.png){kind=small}
What You Will Learn
BEGINNER- Why web security matters (with real breach costs)
- The 3 pillars of security: Confidentiality, Integrity, Availability (CIA)
- Threat model basics — who attacks what, and why
Why Web Security Matters (In Dollars)
The average cost of a data breach in 2025 was $4.88 million (IBM Cost of a Data Breach Report). That's not a typo. A single SQL injection, a single leaked S3 bucket, a single stolen API key — and your company is on the front page of Hacker News for the wrong reason.
Real examples: Equifax paid $1.4 billion for a single unpatched Apache Struts vulnerability (2017). Capital One lost 100M customer records to SSRF (2019), paid $190M in settlements. Uber paid $148M for covering up a breach caused by an MFA fatigue attack (2022). SolarWinds paid $26M for a supply chain compromise (2020). These aren't rare events — they're the median outcome of poor web security.
The 3 Pillars: CIA Triad
Every security decision ultimately serves one of three goals. Memorize these — they'll frame every conversation you have about security:
| Pillar | What It Means | Web Example | Attack That Breaks It |
|---|---|---|---|
| Confidentiality | Only authorized people see the data | Encryption, access controls | SQLi leaking user table |
| Integrity | Data isn't tampered with | Hashing, signatures, audit logs | IDOR letting user change others' records |
| Availability | Service stays up for legitimate users | Rate limiting, DDoS protection | Bot flooding login endpoint |
Who Attacks What, and Why
Threats aren't abstract — they come from real actors with real motivations:
| Attacker Type | Motivation | Common Techniques | Target |
|---|---|---|---|
| Script kiddies | Boredom, bragging | Automated scanners, public exploits | Any unpatched site |
| Cybercriminals | Money | Ransomware, credential stuffing, phishing | SMBs, hospitals, cities |
| Hacktivists | Political/ideological | DDoS, defacement, doxxing | Governments, controversial companies |
| Nation-states | Espionage, sabotage | Supply chain, zero-days, APTs | Critical infra, defense, dissidents |
| Insiders | Revenge, money, coercion | Data exfiltration, backdoors | Current/former employees |
| Bug bounty hunters | Bounties, reputation | Responsible disclosure | Big tech, fintech |
The Threat Model Question
Before writing any security code, ask: What am I protecting, from whom, and what happens if I fail? A blog comment system doesn't need the same security as a payment processor. Don't waste time on over-engineered defenses for low-value assets — but don't under-invest in protecting high-value ones.
🎯 Key Takeaways
- Web security is non-optional — average breach costs $4.88M (2025).
- 3 pillars: Confidentiality (read access), Integrity (tamper protection), Availability (uptime).
- 5 attacker types: script kiddies, criminals, hacktivists, nation-states, insiders. Different motivations, different defenses.
- Threat model first: what am I protecting, from whom, what's the failure cost?
- OWASP Top 10 is your checklist — we'll cover it in Lesson 5.
🧠 Quick Check
Today: Today: you learned why web security matters, the CIA triad, and threat model basics.
Next: Next: Lesson 02 dives into HTTP — the protocol every web security engineer must understand.
Comments
Comments
Post a Comment