Flagship course · LLD · Security Components· ~/academy/tracks/lld
Low-Level Design for Security Components
The machine-coding round, security edition. A method that turns requirements into classes and interfaces, the patterns that earn their place, then real security components designed in TypeScript with interfaces, working code and tests.
4
Modules
11
Lessons
10
Design problems
8 h
Reading
01
Start here
How the round is scored and the method.
FREE1 lessons
02
Problems: Access control
Components that decide who may do what.
FREE3 lessons
- Design an authorisation engine (RBAC + ABAC)Design the in-process policy engine a service calls on every request: roles and permissions, attribute conditions, explicit deny, deterministic evaluation, an audit event per decision and a test suite that proves deny-by-default. In TypeScript, from interfaces to working code.Must know● Medium55 min
- Design a JWT validatorDesign the library every service uses to accept bearer tokens: pinned algorithms, kid lookup against a cached JWKS that survives key rotation, exp, nbf and iat with bounded skew, issuer and audience checks, typed claims and an error taxonomy callers can act on. No `alg: none`, no algorithm confusion.● Medium50 min
- Design a session managerDesign the server-side session component behind a web app: opaque random ids stored only as hashes, rotation on login and privilege change, idle and absolute timeouts, revocation that a concurrent request cannot undo, light device binding and a store interface with compare-and-set.● Medium45 min
03
Problems: Telemetry
Components that turn noise into events and events into cases.
FREE2 lessons
- Design a log normaliserDesign the component that takes raw lines in JSON, CEF and syslog, detects the format, parses, maps fields into a common schema, handles failures without losing data and lets a new format be added without touching existing code.● Easy40 min
- Design a detection rule evaluatorDesign the engine that runs detection rules over normalised events: a typed rule AST, field matchers, thresholds over sliding windows grouped by entity, compile once at load, a static cost limit plus a runtime budget, linear-time regex and a fixture-driven test suite.● Medium50 min
04
Problems: Advanced components
Correlation, rate limiting, credential storage and rotation.
🔒 PRO5 lessons
- Design an alert deduplication and correlation engineDesign the component that takes 10,000 alerts a day and produces a few dozen cases: fingerprinting, time-windowed dedupe, entity-based grouping, scoring and the state machine of a case.Must know● Medium45 min🔒
- Design a rate limiter componentDesign the in-process and distributed rate limiter behind an API gateway: token bucket and sliding window as strategies, composite keys, atomic check-and-take in Redis, fail-open versus fail-closed per rule, and Retry-After.● Medium40 min🔒
- Design a credential storeDesign the component that stores and verifies passwords and API keys: Argon2id with parameters that upgrade on login, a server-side pepper from KMS, constant-time verification, HMAC-indexed API keys with prefixes, and lockout that resists enumeration.● Medium40 min🔒
- Design a secrets rotation schedulerDesign the component that rotates hundreds of credentials on schedules without downtime: a rotation state machine with dual-key windows, pluggable rotators per secret type, idempotent steps, leases to avoid double rotation across replicas, and verification before cut-over.● Hard40 min🔒
- Design a tamper-evident audit logDesign the audit log an attacker with database access cannot quietly rewrite: canonical entries in a hash chain, an append-only store contract, serialised appends across writers, a Merkle tree with inclusion proofs, signed checkpoints, verification that anyone can run, and signing-key rotation that keeps old checkpoints verifiable.● Hard60 min🔒