Defensive Coding Bootcamp
2 likes207 views
The document provides tips on defensive coding best practices to help developers write more secure code. It discusses topics like using secure libraries and frameworks, hashing passwords correctly, validating all user input, practicing least privilege access, and continuously learning about new security threats. The goal is to educate developers on how to think proactively about security throughout the development process.
Defensive Coding Bootcamp
- 1. Heather Downing @quorralyne Defensive Coding Bootcamp
- 2. (A Primer) …what I wished I knew when I started coding, speci fi cally on how to be notashackable more secure @quorralyne
- 3. (Roughly) What you get out of this Helpful tips on how to be an incrementally more secure developer Scenario examples to avoid Useful, non-language speci fi c knowledge A quick starting point/checkup before your next project @quorralyne
- 5. @quorralyne
- 6. Don’t (always) build it yourself @quorralyne
- 7. Plan to rotate your keys @quorralyne
- 8. @quorralyne
- 9. https://tinyurl.com/CodeCovBreach Mackenzie Jackson, GitGuardian - 21 June 2021 @quorralyne
- 10. Be skeptical about the new library on the block @quorralyne
- 12. Challenge the status quo @quorralyne
- 13. Your stack can obfuscate reality @quorralyne
- 14. An Object Relational Mapping framework can = security obfuscation ORM @quorralyne
- 15. Know what tests cover security @quorralyne
- 16. Secure app != secure data @quorralyne
- 17. Don’t assume popular tech is secure by default @quorralyne
- 18. There is more than one way to approach auth @quorralyne
- 19. Incorrect encoding & serializations are an issue @quorralyne
- 22. @quorralyne
- 23. Don’t use insu ffi cient hashes @quorralyne
- 25. Just because it’s available doesn’t mean it’s safe to use @quorralyne
- 26. Code your wrote, with time, will become insecure @quorralyne
- 28. Validate everything, every time @quorralyne
- 29. String comparisons are red fl ags @quorralyne
- 30. Don’t assume the user will follow your use case @quorralyne
- 31. You can be lazy and secure @quorralyne
- 32. Don’t assume all cultures have the same threat issues @quorralyne
- 33. “80% of security is a common body of knowledge.” -Marc Rogers, organizer, DEFCON @quorralyne
- 34. Get your head out of the code @quorralyne
- 35. Have a trusted person take a look @quorralyne
- 36. CORS is code for TODO @quorralyne
- 37. Verify that your environment has bare minimum security @quorralyne
- 39. What do YOU wish you had known about coding defensively? @quorralyne