Five Minute Guide to Software Security
oneupsecurity.com
Five Minute Guide to Software Security
1–10 of 37 posts
Re: Five Minute Guide to Software Security
#2>Ensure use of Anti-CSRF tokens, CORS, and crossdomain.xml policies to prevent an attacker from forcing a user to submit authenticated requests.
isn't crossdomain.xml an adobe flash thing?
Re: Five Minute Guide to Software Security
#3"Be prepared to investigate breaches." << This
Re: Five Minute Guide to Software Security
#4Great guide. Reminded me of some of the learnings from the Pokémon Go hacking expeditions I wrote about last year (https://medium.com/@salqadri/a-peek-into-the-pokémon-go-hack...).
Re: Five Minute Guide to Software Security
#5Wow did I miss arguably the most important box to check, KISS?
Seriously, keep it EFFING SIMPLE. The more complex and involved it is the more things can and will break.
Does no one follow that anymore?
Re: Five Minute Guide to Software Security
#6These types of guides always overlook the most important principle of software security:
Always avoid reading, storing, or interacting with secure, personal, or otherwise "interesting" data. As much as possible, strip this information from your application, so that when it gets pwned the blast radius is absolutely miniscule.
Create software not liabilities.
Re: Five Minute Guide to Software Security
#7Wow did I miss arguably the most important box to check, KISS? Seriously, keep it EFFING SIMPLE. The more complex and involved it is the more things can and will break. Does no one follow that anymore?
Easier said than done in the real world.
Re: Five Minute Guide to Software Security
#8These types of guides always overlook the most important principle of software security: Always avoid reading, storing, or interacting with secure, personal, or otherwise "interesting" data. As much as possible, strip this information from your application, so that when it gets pwned the blast radius is absolutely miniscule. Create software not liabilities.
Unless the point of your software is to collect and manipulate this data. Like Facebook (in one sense); or like electronic medical record-keeping software (in a very different sense); or... like most free-without-microtransactions casual mobile games today, that are "free" because they make all their money on selling audience analytics.
Re: Five Minute Guide to Software Security
#9These types of guides always overlook the most important principle of software security: Always avoid reading, storing, or interacting with secure, personal, or otherwise "interesting" data. As much as possible, strip this information from your application, so that when it gets pwned the blast radius is absolutely miniscule. Create software not liabilities.
While this is great advice in principle, in practice it substantially complicates development. We need far better and more accessible end-to-end encryption tools if we want developers to start doing this by default in non-security critical use cases.
Re: Five Minute Guide to Software Security
#10Wow did I miss arguably the most important box to check, KISS? Seriously, keep it EFFING SIMPLE. The more complex and involved it is the more things can and will break. Does no one follow that anymore?
Sorry to burst that bubble, but KISS doesn't produce neither secure nor reliable software. Security and reliability is something you have to design for.