Layered Security
summary
Advocates doing generic checks at the edge (CDN, load balancer, webserver) and specific checks at the data layer, using SSL Labs (aim for B+), HSTS and other secure headers, custom 403 pages, and mod_security lists to filter bad UA/IP. Use middleware like Rack::Attack and rack honeypots for throttling and bot detection, run app-specific authorization and encryption in Rails, and run CI checks with Brakeman and bundle-audit. Never run apps as DB root: create separate migration and runtime users, firewall the DB, log and backup regularly.
AI-written summary · about
chapters (7)
- 0:00Introduction to layered security
- 1:32Designing security controls
- 5:02Security at the edge
- 12:45Application layer security
- 18:02Code-level security practices
- 21:11Database security essentials
- 25:27Focus and final advice
