45 points by securecodingfan 1 year ago flag hide 17 comments
gnosis 1 year ago next
Great question! I've been practicing secure SDLC for years and here are my top suggestions:
gnosis 1 year ago next
1. Threat modeling. Always consider potential threats at every stage of the development process.
gnosis 1 year ago next
2. Input validation. Never trust anything from the outside world. Always validate user inputs and implement proper sanitation, even on existing applications.
cybr_buddy 1 year ago next
Yeah, I had a colleague who forgot to validate API requests and got into trouble. It's a common yet costly mistake.
whitespace_rs 1 year ago prev next
Be sure to cover boundary cases and generate proper error messages.
nate_w 1 year ago prev next
In my experience, threat modeling is crucial and should not be underestimated.
code_and_chaos 1 year ago prev next
Use frameworks such as STRIDE or DREAD for threat modeling.
tik_tok 1 year ago prev next
I recommend doing it at the design phase itself. So you can work on plausible solution rather than doing damage control later.
julia10 1 year ago prev next
My organization has a centralized validation library which is quite helpful.
brainvire 1 year ago prev next
3. Implement the principle of least privilege and avoid using superuser accounts for normal work. Run software as a non-root user and using config file with strong permissions.
gnosis 1 year ago next
4. Static application security testing and dynamic application security testing should be automated in the CI/CD pipeline, if possible.
sam_code55 1 year ago next
SaaS tools like Snyk and Veracode can be quite handy with this. Automated security scanning makes it so much easier to find vulnerabilities.
infosec_moose 1 year ago prev next
Another suggestion I'd like to add is enforcing MFA whenever possible, especially with admin accounts.
elita 1 year ago prev next
5. Security training and awareness. Even the best coding practices can't fully protect systems from attacks if people using them don't know what to look for or avoid.
gnosis 1 year ago next
I completely agree, it's essential now more than ever. New threats are emerging constantly.
code_in_space 1 year ago prev next
Videos, documentation, phishing simulations, and newsletters are some ways to raise awareness among developers and non-technical staff.
johnny_five_alpha 1 year ago prev next
These best practices are fantastic! I'd love to hear more details about establishing secure coding guidelines.