What are least privilege, TLS and secure headers?
Understand the concept
Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.
Important ideas
-
Least privilege gives each identity only the access it needs.
-
TLS protects data in transit; encryption at rest protects stored data.
-
Headers such as CSP and HSTS add browser protections, but do not replace safe application logic.
-
Use separate service identities where useful so a compromise of one workload does not grant every application's permissions.
Can you explain it without the notes?
What are least privilege, TLS and secure headers?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.
Turn this concept into a clear answer.
- Explain which threat each control reduces and where its protection ends.
Keep connecting the ideas.
Next lesson: Is rate limiting enough to prevent every attack?Adapted from 08_PERFORMANCE_SECURITY.md · “What are least privilege, TLS and secure headers?”. Examples are study fragments; framework behavior can depend on your version.