Security Engineering for Backend Engineers — Threats, Auth, Crypto and Shipping Securely

Most of us learned to build features first and think about security later — usually right after something scary happened, or a pentest report landed on the desk. This course flips that. It teaches security the way a backend engineer actually meets it: as a set of concrete decisions you make while designing and writing ordinary code, not as a separate magical discipline practised by people in hoodies.

Here’s the honest truth about application security: the big breaches you read about are rarely exotic. They’re almost never a genius cracking your encryption. They’re a password stored badly, an API that forgot to check who owns the record, a secret committed to git, a dependency nobody updated, a wildcard IAM policy. The attacks are boring and repetitive, which is actually good news: it means a handful of solid habits stops the large majority of real-world attacks. This course is those habits.

It’s written in plain language with Indian product companies and startups in mind, and it’s grounded in real references (the OWASP Top 10 and API Security Top 10, India’s DPDP Act 2023) and in measurements I ran on a plain machine — you’ll see actual numbers for how fast a bad password hash falls and how a SQL-injection string behaves against safe and unsafe code. The stories are illustrative, written to teach a point, and I say so. The techniques are things you can apply at work tomorrow.

A note on intent: this is a defensive course. The goal is to help you build systems that resist attack and to understand how attacks work well enough to stop them — on systems you own or are authorised to test. That understanding is exactly what every good defender needs.

What This Course Covers

#	Lesson	What you will learn
1	Think Like an Attacker	Threat modeling, the CIA triad, STRIDE, trust boundaries
2	Authentication Done Right	Password hashing (measured), MFA, sessions vs tokens
3	Authorization and Access Control	RBAC/ABAC, least privilege, and the IDOR/BOLA bug
4	Injection: Data Treated as Code	SQL, command, path, template — one root cause, one fix
5	Web Attacks and the Headers That Stop Them	XSS, CSRF, SSRF, CSP, SameSite
6	Cryptography for Engineers	Hashing vs encryption vs signing, TLS, not rolling your own
7	Secrets and Key Management	Vaults, rotation, envelope encryption, never in git
8	API Security	BOLA, mass assignment, rate limiting, the OWASP API Top 10
9	Supply Chain and CI/CD Security	Dependencies, SBOM, scanning, pipeline hardening
10	Cloud and Infrastructure Security	IAM least privilege, blast radius, defense in depth
11	Logging, Detection and Incident Response	What to log, what never to, a calm IR playbook
12	Secure SDLC, Privacy and the DPDP Act	Shift-left, SAST/DAST, compliance, privacy by design

Who Is This For?

• Backend and full-stack engineers who want to build secure systems without a security title
• Engineers preparing for security-conscious code reviews, design reviews, or interviews
• Team leads who want a shared, practical security baseline for their team
• Anyone who has felt that “security” was a black box and wants it to be ordinary engineering

How to Use It

Read it in order the first time — the lessons build a mental model, from thinking like an attacker to shipping securely. Then keep it as a reference: when you’re about to design authentication (Lesson 2), add an API endpoint (Lessons 3 and 8), handle secrets (Lesson 7), or respond to an incident (Lesson 11), come back to that lesson. Each one ends with a Pitfalls section and a Quick Recap you can scan in a minute.

Let’s begin where every good defender begins: by learning to look at your own system the way an attacker would.