Alice And Bob Learn Application Security

The Story of Alice & Bob: Shifting Security Left

Meet Alice, a brilliant full-stack software engineer whose primary mission is shipping elegant features, scaling REST APIs, and delighting users. Meet Bob, a seasoned AppSec architect who views software through the lens of threat modeling, abuse cases, and defensive boundaries. In traditional software companies, Alice and Bob find themselves at odds: Alice wants to push code fast, while Bob blocks releases right before deployment due to last-minute vulnerability scans.

Alice And Bob Learn Application Security reimagines this dynamic. Rather than treating security as an adversarial gatekeeping exercise, this 160-page handbook walks through real-world development sprints where Alice and Bob collaborate to embed security directly into the software development lifecycle (SDLC). By shifting security left—moving threat modeling into sprint planning, implementing secure coding patterns in code reviews, and automating SAST/SCA checks in CI/CD pipelines—Alice builds software that is fast, scalable, and inherently resilient to cyber attacks.

Core Application Security Domains & Engineering Patterns

The handbook provides comprehensive coverage across five fundamental domains of application security:

1. Threat Modeling with Data Flow Diagrams & STRIDE

Before writing code, Bob teaches Alice how to draw Data Flow Diagrams (DFDs) to map trust boundaries, processes, data stores, and external entities. They apply Microsoft's STRIDE framework to identify threat vectors:

• Spoofing Identity: Bypassing authentication or impersonating valid users (Mitigation: OAuth 2.0 PKCE, WebAuthn, FIDO2).
• Tampering with Data: Modifying payload data in transit or storage (Mitigation: HMAC signatures, TLS 1.3, AES-GCM authenticated encryption).
• Repudiation: Users denying performing an action (Mitigation: Immutable audit logs, cryptographic signing).
• Information Disclosure: Leaking sensitive PII or API tokens (Mitigation: Data minimization, field-level encryption).
• Denial of Service: Exhausting CPU/RAM or API rate limits (Mitigation: Token bucket rate limiting, request size limits).
• Elevation of Privilege: Unauthorized horizontal or vertical authorization bypass (Mitigation: Attribute-Based Access Control / ABAC).

2. Authentication & Password Hashing Fundamentals

Alice learns why traditional cryptographic hash functions like MD5 or SHA-256 must never be used for password storage. The book explores modern memory-hard password hashing algorithms:

• Argon2id: Winner of the Password Hashing Competition, combining resistance to side-channel attacks and GPU cracking.
• bcrypt & PBKDF2: Configuring work factors (`cost = 12`) and iteration counts to keep pace with hardware advancements.
• OAuth 2.0 with PKCE: Implementing Proof Key for Code Exchange (PKCE) to prevent authorization code interception in single-page and mobile apps.

3. Context-Aware Input Validation & Injection Defense

All untrusted input must be validated and contextually encoded. The handbook demonstrates how to prevent SQL Injection, Cross-Site Scripting (XSS), and Server-Side Request Forgery (SSRF) at the code level.

Field Engineering: Defensive Code Cheatsheets

Chapter 6 of the handbook provides practical, copy-pasteable secure coding patterns across popular programming languages:

from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError

# Initialize Argon2id Password Hasher with Recommended Parameters
ph = PasswordHasher(
    time_cost=3,        # Iterations
    memory_cost=65536,  # 64 MB RAM
    parallelism=4,      # 4 Threads
    hash_len=32,
    salt_len=16
)

# Hash Password During User Registration
hashed_password = ph.hash("UserSuperSecretPassword123!")

# Verify Password During Authentication
try:
    ph.verify(hashed_password, "UserSuperSecretPassword123!")
    print("Authentication Successful!")
except VerifyMismatchError:
    print("Invalid Credentials Provided!")

const express = require('express');
const helmet = require('helmet');
const session = require('express-session');

const app = express();

# 1. Apply Helmet HTTP Security Headers (CSP, HSTS, X-Frame-Options)
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://apis.google.com"],
      objectSrc: ["'none'"]
    }
  }
}));

# 2. Configure Hardened Session Cookies
app.use(session({
  name: '__Host-mmn_session', // Host prefix enforces HTTPS and root path
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true, // Prevents XSS cookie theft
    secure: true,   // Transmitted over HTTPS only
    sameSite: 'lax', // CSRF protection
    maxAge: 3600000 // 1 Hour Expiration
  }
}));

// DO NOT Concatenate SQL Strings! Use Prepared Statements with Parameter Binding
String userEmail = request.getParameter("email");
String query = "SELECT user_id, password_hash, role FROM users WHERE email = ?";

try (Connection conn = dataSource.getConnection();
     PreparedStatement pstmt = conn.prepareStatement(query)) {
    
    // Bind Parameter Explicitly
    pstmt.setString(1, userEmail);
    
    try (ResultSet rs = pstmt.executeQuery()) {
        if (rs.next()) {
            String role = rs.getString("role");
            // Process authenticated record securely
        }
    }
}

Complete Table of Contents & Module Syllabus

• Module 01 Foundations of Secure Software Design & The Alice & Bob Story

  Pages 1–20
  Introduction to AppSec principles, CIA Triad, Defense-in-Depth, Shift-Left philosophy, and bridging the communication gap between software developers and security engineers.
• Module 02 Threat Modeling: Data Flow Diagrams & STRIDE Framework

  Pages 21–40
  Mapping trust boundaries, drawing architectural DFDs, applying STRIDE threat analysis, constructing attack trees, and calculating risk ratings using CVSS v3.1.
• Module 03 Authentication Engineering & Modern Password Hashing

  Pages 41–60
  Implementing Argon2id, bcrypt, and PBKDF2, Multi-Factor Authentication (TOTP/WebAuthn), OAuth 2.0 Authorization Code Flow with PKCE, and JWT security pitfalls.
• Module 04 Input Validation, Contextual Output Encoding & Injection Defense

  Pages 61–80
  Preventing SQLi via Prepared Statements, Context-Aware HTML/JS/URL encoding against XSS, DOMPurify sanitization, and Server-Side Request Forgery (SSRF) mitigations.
• Module 05 Cryptography for Software Engineers

  Pages 81–100
  Symmetric encryption (AES-256-GCM), asymmetric key exchange (RSA, ECC), TLS 1.3 configuration, HMAC data integrity, key rotation, and secret management tools (Vault).
• Module 06 Session Management, Cookies & CSRF Defense

  Pages 101–120
  Session identifier generation, Cookie hardening (`HttpOnly`, `Secure`, `SameSite=Strict`, `__Host-` prefix), Anti-CSRF Synchronizer Tokens, and CORS policy configuration.
• Module 07 DevSecOps & CI/CD Security Automation

  Pages 121–140
  Integrating SAST (Semgrep, SonarQube), DAST (OWASP ZAP), and SCA dependency scanners (`npm audit`, Trivy) into GitHub Actions and GitLab CI without breaking builds.
• Module 08 API Security (OWASP API Top 10) & Secure Architecture Review

  Pages 141–160
  Securing REST and GraphQL APIs, Broken Object Level Authorization (BOLA/IDOR) defense, rate limiting, secure code review checklists, and capstone architectural audit.

Who Should Read This Handbook?

This handbook is written for developers and security professionals seeking practical secure coding expertise:

Verified Engineer Reviews

Frequently Asked Questions