![](https://csdnimg.cn/release/download_crawler_static/11808911/bg14.jpg)
xviii ◾ Preface
As fate would have it, my hobby in college turned out to be my profession. e fact that
no universities provided majors in network security only strengthened my resolve to take
up security as a career.
In Alibaba, I soon gained prominence. I spoofed the e-mail password of our develop-
ment manager in the internal network, paralyzed the company network in a pressure test,
obtained the privilege of the domain-controlled server several times, and was able to access
any computer as an administrator.
But, apart from these, what I am most proud of is the piles of security assessment reports,
because I am well aware that every vulnerability in a network aects millions of users. I get
immense job satisfaction by ensuring that the benets reach so many users. While I was
starting out, the web was becoming immensely popular as the core of the Internet; I thus
feel happy to have been involved in the wave of web research.
I became the youngest technical expert in the history of Alibaba at 23, even though there
are no ocial records maintained. In 2010, I took part in the development of the security
department from scratch. At around the same time, Taobao and Alipay also started from
scratch, and I was invited to be one of the security experts to set up the foundation for their
security development process.
REFLECTIONS ON NETWORK SECURITY
With professional experience, I realized the major dierence between Internet companies
and traditional network security as well as information security. e challenge for develop-
ers in an enormous environment with millions of users is to search and identify problems.
With an increase in quantity there will be a change in quality. Managing 10 servers is not
the same as managing 10,000 servers! Likewise, managing the code of 10 developers and
the code of 1000 developers is considerably dierent.
Internet companies specialize in user experience, performance of product, and the
release time of the product, and thus the traditional security solution will not work well in
this environment. is poses a greater challenge for security developers.
All of this makes me believe that Internet security will become a new science or that
security will be industrialized. But the books published so far are either too academic or
too entertaining (like hacking tool instructions). ere are few informative books that dis-
cuss security principles or technology. us, due to this lack of knowledge, various prob-
lems may occur in this new eld.
erefore, I decided to write this book in which I could share my experience. e book
covers the applications of security technology in enterprises and should be of practical
value to developing engineers in top Internet companies. So when Zhang Chunyu sug-
gested I write a book on that subject, I agreed without any hesitation.
We, as core users of the Internet, are the best carriers for the future of cloud computing
and mobile Internet. us, web security should be the focus of all Internet companies and
has been my main research eld in the last few years. ough this book is mainly about
web security, it covers all aspects of the Internet.
www.allitebooks.com