Lidiia 'Alice' Skalytska - Security Checklist for Web Developers
1 like552 views
The document outlines a comprehensive security checklist for web developers, emphasizing the importance of a secure software development lifecycle and various practices such as threat modeling, secure authentication, and data validation. Key recommendations include implementing multi-factor authentication, utilizing HTTPS, securing cookies, and performing rigorous testing and penetration assessments. It also highlights the necessity of logging activities and maintaining the integrity of third-party components.
Lidiia 'Alice' Skalytska - Security Checklist for Web Developers
- 1. Security checklist for Web Developers Lidiia ‘Alice’ Skalytska OWASP Kyiv 2017
- 4. Planning Analyze your application threat modeling user interface flaws data presentation flaws Usability create applications that users understand and like to use Security incident plan build security incident plan. One day, you will need it.
- 7. Development / Implementation Authentication Database Input / output / validate Web Traffic Logs The 3rd party components
- 8. Authentication Use Facebook / Google / etc. Login Use multi-factor authentication Implement Proper Password Strength Controls Ensure all passwords are hashed Implement Secure Password Recovery Mechanism Never write your own crypto Prevent Brute- Force Attacks
- 11. Database Access control Use minimal privilege user account If you can use crypto, use it! Store backups in other place(s) Encrypt backups
- 12. Input / Output / Validate Client-side and server-side input validation Always validate and encode user input before displaying Never use untrusted user input Input data is always suspect
- 14. Web Traffic TLS Use TLS for the entire site Cookies Cookies must be httpOnly and secure HSTS Use HSTS responses
- 15. Logs All user account management activity Every access control related events Application errors and system events Changes to application configuration settings You need readable logs (who? when? where?)
- 16. The 3rd party components Libraries • internally or externally • keep them small • check vendor reputation APIs • use a special key to access • testing inputs and outputs • check vendor reputation Microservices • each microservice is separate • use JSON • use TLS
- 18. Testing 1 Create a testing plan 2 Audit your design and implementation 3 Do penetration testing 4 Think like a hacker
- 21. Questions? Security checklist for Web Developers alice.bizarius@gmail.com securit13podcast@gmail.com http://securit13.libsyn.com/ @alice_kaifat