Security — Software Architecture

API Gateway concept

Gateway taxonomy (enterprise/microservices/mesh), capabilities, pitfalls, history

*Mastering API Architecture* — Gough, Bryant, Auburn

OAuth2 roles, JWT, grants (Auth Code, PKCE, Client Credentials), OIDC, refresh tokens

Prompt Engineering concept

Prompt anatomy; system vs user prompt; chat templates; in-context learning (zero/few-shot, CoT); prompt decomposition; defensive prompt engineering (extraction, jailbreaking, injection, information extraction); three-layer defence (model/prompt/system)

Sidecar / Service Mesh pattern

East–west traffic governance: mTLS, service authorisation, evolution from libraries to eBPF; sidecar as reuse mechanism for operational concerns; orthogonal coupling; data-sinking sidecar for EDM legacy integration

Threat Modeling concept

STRIDE, DREAD, OWASP API Top 10, six-step process, rate limiting strategies

TLS (Transport Layer Security) concept

TLS encryption (asymmetric key exchange + symmetric data), authentication (certificate chain, root CA), integrity (HMAC), handshake, certificate expiry risk

Zero Trust concept

Zonal architecture critique, NCSC eight principles, service mesh + OAuth2 implementation stack