Classic security design problems, solved step by step
Every problem is built one requirement at a time, with a diagram or a code listing at each step and the trade-offs said out loud. HLD problems design the system; LLD problems design the component.
Design a zero-trust access gateway
Design the system that replaces a corporate VPN: every request to a private app authenticated, authorised with identity and device context, proxied and logged. Built one requirement at a time, from a single proxy to a global, highly available control plane.
Design an SSO identity provider
Design the identity provider a company of 20k employees logs in through: OIDC and SAML, MFA, sessions, risk signals, SCIM provisioning, key management and a 99.99 % availability story for the thing everything depends on.
Design an MFA and step-up service
Design the service that proves the second factor for 2 million users: TOTP, passkeys, push with number matching, risk-based step-up for sensitive actions, recovery that is not the weakest link, and a defence against MFA fatigue.
Design an API authorisation gateway
Design the edge that every public API call crosses: token validation without calling the IdP, JWKS caching that cannot be abused, scopes at the edge and fine-grained decisions where the data lives, per-tenant rate limits, and a 10 ms latency budget.
Design a SIEM pipeline
Design the system that ingests 100 MB/s of security logs from endpoints, cloud and identity, never loses an authentication event, normalises everything to one schema, runs detections within a minute and keeps a year of searchable history at a price the CFO accepts.
Design an EDR telemetry pipeline
Design the backend for 50,000 endpoint agents: event collection at 1 kB/s each, process-tree reconstruction, real-time rules with a one-second budget, a response channel that can isolate a host, and a data lake for hunting, all without the agent becoming the attacker's best tool.
Design a threat intelligence platform
Design the platform that turns 60 noisy feeds into indicators your SIEM, EDR and firewalls can act on: STIX/TAXII ingestion, normalisation and dedupe, scoring with decay, enrichment on a quota, distribution within each tool's limits, and a false-positive loop that makes feeds earn their place.
Design a secrets manager
Design the service that every workload asks for credentials: authentication by workload identity, policy by path, an encrypted store rooted in an HSM, dynamic short-lived credentials for databases and clouds, leases, audit and a 99.99 % availability story for a service that, when down, stops deploys.
Design a DDoS protection edge
Design the anycast edge that keeps a public API up under a 1 Tbps volumetric attack and a 200k rps application-layer attack, while real users keep getting through.
Design PKI and certificate automation
Design the internal certificate authority and automation that issues millions of short-lived certificates to services, devices and people, with an offline root, online issuing CAs, transparency, revocation and monitoring that prevents the classic expiry outage.
Design a vulnerability management platform
Design the system that turns millions of scanner findings into a prioritised, owned, SLA-tracked backlog: ingestion and dedupe across tools, enrichment with exploitability and exposure, ownership mapping, ticketing and the dashboards leadership actually reads.
Design a key management service
Design the KMS every other system encrypts with: an HSM-backed root, envelope encryption, a key hierarchy that keeps the HSM out of the hot path, rotation and versioning, multi-region keys, dual control over root material, audit of every use, and caching of data keys without breaking AES-GCM limits.
Design an authorisation engine (RBAC + ABAC)
Design the in-process policy engine a service calls on every request: roles and permissions, attribute conditions, explicit deny, deterministic evaluation, an audit event per decision and a test suite that proves deny-by-default. In TypeScript, from interfaces to working code.
Design a JWT validator
Design the library every service uses to accept bearer tokens: pinned algorithms, kid lookup against a cached JWKS that survives key rotation, exp, nbf and iat with bounded skew, issuer and audience checks, typed claims and an error taxonomy callers can act on. No `alg: none`, no algorithm confusion.
Design a session manager
Design the server-side session component behind a web app: opaque random ids stored only as hashes, rotation on login and privilege change, idle and absolute timeouts, revocation that a concurrent request cannot undo, light device binding and a store interface with compare-and-set.
Design a log normaliser
Design the component that takes raw lines in JSON, CEF and syslog, detects the format, parses, maps fields into a common schema, handles failures without losing data and lets a new format be added without touching existing code.
Design a detection rule evaluator
Design the engine that runs detection rules over normalised events: a typed rule AST, field matchers, thresholds over sliding windows grouped by entity, compile once at load, a static cost limit plus a runtime budget, linear-time regex and a fixture-driven test suite.
Design an alert deduplication and correlation engine
Design the component that takes 10,000 alerts a day and produces a few dozen cases: fingerprinting, time-windowed dedupe, entity-based grouping, scoring and the state machine of a case.
Design a rate limiter component
Design the in-process and distributed rate limiter behind an API gateway: token bucket and sliding window as strategies, composite keys, atomic check-and-take in Redis, fail-open versus fail-closed per rule, and Retry-After.
Design a credential store
Design the component that stores and verifies passwords and API keys: Argon2id with parameters that upgrade on login, a server-side pepper from KMS, constant-time verification, HMAC-indexed API keys with prefixes, and lockout that resists enumeration.
Design a secrets rotation scheduler
Design the component that rotates hundreds of credentials on schedules without downtime: a rotation state machine with dual-key windows, pluggable rotators per secret type, idempotent steps, leases to avoid double rotation across replicas, and verification before cut-over.
Design a tamper-evident audit log
Design the audit log an attacker with database access cannot quietly rewrite: canonical entries in a hash chain, an append-only store contract, serialised appends across writers, a Merkle tree with inclusion proofs, signed checkpoints, verification that anyone can run, and signing-key rotation that keeps old checkpoints verifiable.