Abdullah Bin Zarshaid Personal portfolio · abdullahzarshaid.com
Learning room
Small lessons. Sharper security questions.
Three original, practical explanations. Read a scenario, make a decision and check the reasoning. No account, tracking or certificate claims.
01 / Application security5-minute lesson
A valid login is not permission.
Authentication establishes an identity. Authorization decides whether that identity may perform a particular action on a particular resource. A hidden button or unpredictable identifier does not replace the server-side decision.
Synthetic scenario
In a synthetic shop, User A requests an order belonging to User B. The important question is whether the server evaluates User A’s authority over that order, not whether User A has logged in.
Which result is the strongest evidence for this specific boundary?
Before interpreting an absence of alerts, ask whether the required sources are producing and delivering events. Detection depends on coverage, collection health, useful rules and an actual response process.
Synthetic scenario
A fictional identity connector stops ingesting logs overnight. The alert count drops to zero. The first useful check is ingestion freshness and source health, not a congratulatory risk score.
What should be checked before interpreting the empty queue?
A policy describes intent and responsibility. Evidence of operation addresses whether an activity occurred within a relevant boundary and period. A questionnaire should not silently turn the first claim into the second.
Synthetic scenario
A fictional offboarding policy says access is removed promptly. There are no available records for the period being reviewed. Describe the policy and the missing operational evidence separately.
Which response best matches the available material?
These are introductory lessons, not an accredited course or certification. A tailored workshop starts with the audience, desired skills and appropriate examples.
