Security, privacy, compliance — detailed guide

A) AuthN/AuthZ & service-to-service auth

Core concepts

• AuthN: who the caller is (user/app/service).
• AuthZ: what actions are allowed (scope/role/policy + resource checks).
• Least privilege: narrow scopes, short-lived credentials, auditable decisions.

B) Secrets management & rotation

What counts as a secret

• API keys, DB creds, signing keys, private keys, OAuth client secrets, webhook secrets.
• Also: “secret-like” values (connection strings, internal endpoints, salt/pepper).

C) Encryption in transit & at rest — envelope encryption

What to encrypt

• In transit: TLS 1.2+ at the edge; mTLS internally where appropriate.
• At rest: disk/volume encryption + app-level encryption for high-sensitivity fields.
• Backups: encrypted + immutable storage (WORM) + access logging.

# CMK (KMS/HSM key) never leaves the service boundary
dek_plain, dek_wrapped = KMS.generate_data_key(CMK)

ciphertext = AEAD.encrypt(plaintext, dek_plain, aad=metadata)

store({
  "ciphertext": ciphertext,
  "dek_wrapped": dek_wrapped,
  "alg": "AES-256-GCM",
  "key_id": "cmk_123"
})

# Rotation: re-wrap DEKs with a new CMK without re-encrypting the data

D) PII handling: minimization, retention & RTBF (deletion)

PII lifecycle

• Classify: tag fields at ingest (Public / Internal / Sensitive / Restricted).
• Minimize: collect only what is necessary; reduce copies; avoid exporting raw PII.
• Retention: explicit time limits per dataset; automated TTL where possible.
• RTBF deletion: delete in DB + propagate to cache, search, logs, analytics; backups expire per policy (and are not “restored into production” without deletion replay).

E) Abuse prevention: WAF, bot controls, spam/fraud signals

Defense layers

• Edge: WAF rules, DDoS protection, token-bucket rate limits, geo/IP reputation.
• Application: device fingerprinting (privacy-aware), anomaly detection, velocity rules, content filtering.
• User safety: reporting flows, moderation queues, appeals, shadow bans where appropriate.

F) Compliance: GDPR/CCPA, PCI (practical engineering view)

GDPR / CCPA (operational)

• DSAR: access/export, correction, deletion (RTBF), portability.
• Vendor risk: DPAs, subprocessors, least-privileged access, audit logs.
• Cross-border/data residency: region pinning + contractual controls.
• Breach readiness: detection + triage + comms runbook.

PCI (payments)

• Minimize scope: hosted payment fields/pages from a compliant provider.
• Avoid storing PAN/CVV; tokenize and store only last4 + brand when needed.

G) Operational guardrails (audit, monitoring, incident response)

H) Quick checklists (fast interview answers)

I) Sample snippets (copy/paste friendly)

{
  "iss": "https://idp.example.com",
  "sub": "user_123",
  "aud": "feed-api",
  "scope": "feed:read posts:write",
  "jti": "9f9d7c3a-0a6e-4e5b-b18e-6c3f25a1e1df",
  "iat": 1731080000,
  "exp": 1731081800
}

Set-Cookie: sid=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1800

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'nonce-<random>';
  object-src 'none';
  frame-ancestors 'none';
  base-uri 'self';

# Verify signature to prevent spoofing/replay
sig = HMAC_SHA256(secret, raw_body)
if !constant_time_equals(sig, request.headers["X-Signature"]):
  reject(401)

# Add replay protection (timestamp + nonce) for high-risk callbacks

J) One-liners (ready for interviews)

• “Least privilege + short-lived tokens; step-up auth for sensitive actions.”
• “Gateway validates identity; services enforce resource-level authorization.”
• “mTLS for service identity; never trust identity headers from untrusted hops.”
• “Envelope encryption: DEK per object, wrapped by CMK; decrypt calls are audited.”
• “Privacy is a pipeline: classify → minimize → retain → delete across DB/cache/search/analytics.”
• “WAF + rate limits at edge; risk scoring and moderation workflow for abuse.”
• “We reduce PCI scope via hosted payments; DSAR/RTBF is operationalized via APIs and runbooks.”