02 application security fundamentals - part 1 - security priciples
0 likes383 views
The document outlines 10 security principles: minimize attack surfaces, establish secure defaults, least privilege, defense in depth, fail securely, don't trust services, separation of duties, avoid security by obscurity, keep security simple, and fix security issues correctly. Each principle is accompanied by a brief explanation of 1-2 sentences.
1 of 10
More Related Content
What's hot (19)
Ad
Similar to 02 application security fundamentals - part 1 - security priciples (20)
Ad
More from appsec (11)
Recently uploaded (20)
02 application security fundamentals - part 1 - security priciples
- 1. Principle – Minimize Attack Surfaces More points of interaction More difficult to defend 1 of 10
- 2. Principle – Establish Secure Defaults vs. Never rely on someone needing to specially configure or enable basic security functionality. 2 of 10
- 3. Principle – Least Privilege Not everyone should have access to everything. Even people or accounts you might think should have access don’t always need it. 3 of 10
- 4. Principle – Defense in Depth Don’t rely on a single security method to protect everything. Layer basic security practices to ensure the overall safety of an application. 4 of 10
- 5. Principle – Fail Securely Security controls should be designed to fail until they are proven valid. 5 of 10 When a security control does fail, it should place the application in a secure state.
- 6. Principle – Don’t Trust Services Don’t make assumptions that can impact your application’s security goals. 6 of 10
- 7. Principle – Separation of Duties Some combinations of permissions don’t work well together. 7 of 10
- 8. Principle – Avoid Security by Obscurity “But an attacker would never know or see that!” 8 of 10
- 9. Principle – Keep Security Simple The simpler the design of the security, the easier it is to understand and implement correctly. vs. 9 of 10
- 10. Principle – Fix Security Issues Correctly Symptom The real problem 10 of 10