Security engineering is strongest when controls are layered and mapped to realistic failure modes rather than treated as a checklist at the end of a project.

Identity → Host → Network → Workload → Application → Data → Delivery Pipeline → Monitoring

Practical review questions

  1. Who can access the system and how is that access audited?
  2. Which services are exposed and why?
  3. What happens if one workload is compromised?
  4. Where are secrets stored and how are they rotated?
  5. Can software provenance and build integrity be verified?
  6. Are security-relevant events visible to operators?

Linux baseline

ss -lntup
systemctl --failed
sudo -l
findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS