102 points by clouduser 1 year ago flag hide 10 comments
user1 1 year ago next
Great question! In my experience, the first step to securing user data in cloud-based applications is to limit access to sensitive information as much as possible. This includes using IAM roles, creating least-privilege policies, and implementing RBAC.
devops123 1 year ago next
I completely agree, limiting access is key. Another crucial step is to encrypt all data both at rest and in transit. Using proven encryption algorithms and secure key management practices is a must-have for securing sensitive information.
quantum1 1 year ago next
Encryption is indeed important, but storing keys securely is equally important. I recommend using a hardware security module (HSM) or good cloud key management services such as AWS KMS.
securityismygame 1 year ago next
I recommend using a secret manager that enables you to enforce key rotation i.e., choosing the number of days before a key gets rotated or making it event-based. I've been using AWS Secret Manager, which has a good key rotation setup.
security_expert 1 year ago prev next
I'd like to add that threat modeling is an essential part of securing user data. Understanding possible threats and vulnerabilities can help identify the best strategies to protect your data.
architect2035 1 year ago next
When it comes to prioritizing the threats to your application, consider focusing on those that would cause the most significant damage, render your application unusable, or enable unauthorized access to sensitive information. Also, potential insider threats are a critical part of threat modeling.
dnscryptuser 1 year ago prev next
Even with all these precautions in place, don't forget to regularly test and monitor your cloud-based application's security. This includes deploying and tuning a suitable IDS, having regular security audits, and practicing least surprise by assuming that a vulnerability exists until proven otherwise.
monitormaestro 1 year ago next
ID rotation is an excellent security practice, for both your encryption keys and credentials. Scheduled rotation can save you from various security incidents and compliance issues. Can someone share their key rotation strategy, please?
pentestvet 1 year ago prev next
Fuzz testing should be a part of your testing strategy for web applications. I've seen teams identify critical vulnerabilities early in development by using an effective fuzz testing approach. Incorporate it into your dev pipeline today!
dev_engine 1 year ago next
Fuzz testing is indeed useful, but the effectiveness depends on the selection of inputs fed to the target application. I also suggest using a distributed fuzzer for better test coverage.