My Cybersecurity Internship Journey at Nexzer

My Cybersecurity Internship Journey at Nexzer

I started my internship at Nexzer, a cybersecurity company. With the few weeks I've spent there as an intern, I've learnt a lot about cybersecurity which I want to share with you in this blog post.

In my first week, I learnt about the fundamentals of Cybersecurity: the CIA Triad (Confidentiality, Integrity, and Availability):

• Confidentiality: Ensuring data remains private and is only accessible to authorized individuals.
• Integrity: Keeping data accurate, reliable and untampered with.
• Availability: Ensuring systems, networks and data remain accessible to legitimate users whenever needed.

While the CIA triad is the backbone of security, most failures happen when one of these three pillars breaks down. But the triad alone doesn't tell us how systems actually decide who gets to see or do what. That's where these extra concepts come in:

• Authentication: Proving you are who you claim to be (e.g logging in with a password or MFA).
• Authorization: Verifying what an authenticated user is actually allowed to do.
• Accountability: The ability to trace specific actions back to a unique identity.
• Non-Repudiation: Ensuring an actor cannot credibly deny performing a specific action.

Real-World Flaws That Stem From Ignoring Authorization

Most security flaws happen when developers mix up authentication and authorization. They might do a great job verifying exactly who you are (authentication), but they forget to check if you are actually allowed to view or change a specific piece of data (authorization).

Ignoring authorization has a massive impact. When systems fail to double-check permissions, it leads to vulnerabilities known as Insecure Direct Object Reference (IDOR) and its API variant, Broken Object Level Authorization (BOLA).

To explain how it works simply: imagine you are logged into a website, and your account ID in the web address or background data is "101". If you can just manually change that "101" to "102" and suddenly view another user's private messages or bank details without the system stopping you, that's IDOR/BOLA in action. It doesn't require complex hacking tools, it just requires a system forgetting to ask, "Is this person authorized to see user 102's data?"

These aren't just minor bugs. IDOR falls under the broader category of Broken Access Control, which sits firmly at #1 on the main OWASP Top 10 list of critical security risks. BOLA has also held the #1 position continuously on the OWASP API list since its inception. The industry impact is huge data indicates that roughly 40% of all API attacks involve BOLA or IDOR.

How Do We Fix It?

Fixing BOLA and IDOR comes down to one fundamental rule: never trust the client side. Every single time an API request asks for a specific resource or object, the backend server must verify that the currently logged-in user actually owns or has permission to access that specific item (e.g., checking current_user.id == resource.owner_id). Relying on hidden UI elements or basic login checks just isn't enough.

Developer Mindset vs. Security Mindset

Working through these flaws made me realize a huge difference in how people approach software. Developers are naturally focused on the happy path building features so that when a user inputs data correctly, the app works seamlessly. Security practitioners, on the other hand, have to look for the unintended path. We have to constantly ask, "What happens if a user alters this URL parameter? What if they skip this step or send a payload the application wasn't expecting?"

Beyond Vulnerabilities: Understanding Who We're Defending Against

Finding bugs like BOLA is only half the battle. To actually secure a network, you have to understand the people on the other side of the screen: threat actors. A threat actor is any individual, group, or entity that intentionally causes harm in the digital realm by exploiting vulnerabilities in systems, networks, devices, or human behavior. I learnt about threat actors, their motivations, capabilities, tactics, techniques, and procedures. Understanding this shift helps cybersecurity experts to be proactive and helps them with risk-based strategies.

Primary Categories of Threat Actors:

1. Nation-State

· Motivation: Espionage, political influence, military advantage, or strategic disruption.

· Characteristics: Highly sophisticated, stealthy, and backed by government funding and vast resources. They often remain undetected inside networks for months or years.

2. Cybercriminals

• Motivation: Financial gain.
• Characteristics: Highly organized and opportunistic. They operate like businesses, using tactics like ransomware, phishing, business email compromise (BEC), and stealing sensitive data to sell on the dark web.

3. Hacktivists

• Motivation: Political, social, or ideological causes.
• Characteristics: Aim to cause public embarrassment, disrupt services, or raise awareness for a cause through DDoS attacks, website defacements, or data leaks.

4. Insider Threats

• Motivation: Revenge, financial gain, coercion, or negligence.
• Characteristics: Current or former employees, contractors, or business partners who have authorized access to internal systems and misuse it either intentionally (malicious insider) or accidentally (negligent insider).

Why Understanding Adversaries Matters

Understanding the adversary shifts a security practitioner's mindset from purely reactive to genuinely proactive. Knowing who might attack and how they operate helps organizations build risk-based strategies and improve system defenses in key ways:

1. Anticipating Tactics: Recognizing attacker patterns before an incident occurs.
2. Prioritizing Remediation: Fixing high-risk vulnerabilities that active threat groups are currently exploiting.
3. Threat Modeling: Identifying potential threats, weaknesses, and attack vectors early in the design or operational phase so you can build security into systems rather than patching it in later.
4. Faster Incident Response: Knowing an adversary's typical tactics, techniques, and procedures (TTPs) allows security teams to detect anomalies quickly, scope the extent of a breach faster, and contain threats before major damage occurs.

Putting Theory into Practice in the Lab

Beyond reading documentation, one of the coolest parts of my journey so far has been getting my hands dirty in an isolated lab environment. Running network scans and manually tweaking requests to see how an authorization check fails in real time made these concepts click way faster than reading a textbook ever could.

In my next blog post, I'll walk you through step-by-step how I set up my personal security lab, so stay tuned for that!

Conclusion

Transitioning into the real-world side of cybersecurity at Nexzer has been an amazing experience so far. Seeing how simple theoretical concepts directly impact real applications and defense strategies has completely changed how I view software and security.

I'm excited to keep diving deeper throughout my internship and documenting what I learn along the way. If you're also starting out in cybersecurity or navigating your own journey, I'd love to hear your thoughts. Feel free to drop a comment or connect with me!