登录查看更多内容

What are the best practices for ensuring application security throughout the SDLC?

由人工智能和领英社区提供技术支持

Application security is the process of ensuring that your software is free from vulnerabilities, defects, and malicious attacks that could compromise its functionality, data, or users. It is not something that you can add at the end of the development cycle, but rather a continuous practice that should be integrated throughout the software development lifecycle (SDLC). In this article, you will learn some of the best practices for ensuring application security throughout the SDLC, from planning to deployment and maintenance.

此文章中的业界达人

由社区从 4 条内容中精选。了解更多

1 Define security requirements

Before you start coding, you need to define the security requirements for your application, based on the business objectives, user needs, and regulatory standards. Security requirements specify what your application should and should not do, and how it should handle different scenarios, such as authentication, authorization, encryption, logging, error handling, and so on. You can use frameworks and tools, such as OWASP Application Security Verification Standard (ASVS), to help you define and document your security requirements.

添加您的观点

2 Implement secure coding practices

Once you have your security requirements, you need to follow secure coding practices to prevent common vulnerabilities, such as injection, cross-site scripting, broken authentication, and insecure deserialization. Secure coding practices include using secure libraries and frameworks, validating and sanitizing user input, applying the principle of least privilege, encrypting sensitive data, implementing secure communication protocols, and avoiding hard-coded credentials. You can use code analysis tools, such as SonarQube, to help you identify and fix potential security issues in your code.

添加您的观点

Nir Valtman

Co-Founder & CEO at Arnica | Ex-CISO
举报内容
The "what" is fairly common - static code analysis tools can present findings with various accuracy levels. However, it is important to ensure that developers are empowered with the ability to not only remediate, but also dismiss potential false positives, or run through risk acceptance, if needed. If the scanner is deployed as IDE plugin, it would be hard to provide a context about what will fail the deployment early on. If the scanner runs in CI/CD pipelines, it would be challenging to ensure all repositories are covered with a consistent guardrail (not to mention, only a subset is truly important, but how do you prioritize?). In this case, worth implementing a pipelineless security approach that addresses the above.

已翻译

赞
Arjun BM

Head of Security at Tesco | CXO Cyber Icon 2024
举报内容
Define a secure coding practice guidelines document in your organization. It should be mapped for the security evaluation test cases, so that developers have a more clear objective on how to code, what to avoid and where to prevent vulnerabilities. If any scanning tools are used for code review, it is important to provide immediate feedback to the developer rather than wait till testing phase. Align to existing standards such as OWASP to begin with and refine them over time. Also note that is is impractical for developers to do all of it at once. So prioritize it and break it down into manageable chunks of work to be implemented in a phased manner.

已翻译

赞

3 Perform security testing

Security testing is the process of verifying that your application meets the security requirements and does not have any vulnerabilities that could be exploited by attackers. Security testing should be performed at different stages of the SDLC, such as unit testing, integration testing, system testing, and acceptance testing. Security testing methods include static analysis, dynamic analysis, penetration testing, and vulnerability scanning. You can use tools, such as ZAP, Nmap, and Burp Suite, to help you perform security testing on your application.

添加您的观点

Arjun BM

Head of Security at Tesco | CXO Cyber Icon 2024
举报内容
Security testing can in the form of: code review, dynamic testing, software component analysis, container scanning, etc These can be integrated into the CI/CD pipeline and security reports can be generated and viewed in real time. To increase security assurance in higher environments (prod) you can set a "build fail" criteria if any CRITICAL/HIGH risk vulnerabilities are found in the testing process in the CI/CD pipeline.

已翻译

赞

4 Deploy securely

Deploying your application securely means ensuring that your application environment, such as servers, databases, networks, and firewalls, is configured and maintained properly to protect your application from external threats. Deploying securely also means following best practices, such as using secure protocols, enforcing strong passwords, applying patches and updates, monitoring and auditing system activities, and implementing backup and recovery plans. You can use tools, such as Ansible, Chef, and Puppet, to help you automate and manage your deployment process.

添加您的观点

5 Educate and train your team

Application security is not only a technical issue, but also a human issue. Your team members need to be aware of the security risks and challenges that your application faces, and how to prevent and mitigate them. You need to educate and train your team on the security principles, policies, and procedures that apply to your application, and how to use the security tools and techniques that you have adopted. You also need to foster a security culture within your team, where security is everyone's responsibility and priority.

添加您的观点

6 Review and improve your security

Application security is not a one-time event, but a continuous improvement process. You need to review and improve your security practices and measures regularly, based on the feedback, metrics, and incidents that you collect and analyze. You need to keep up with the changing security landscape, such as new threats, vulnerabilities, standards, and technologies, and update your security requirements, code, tests, and deployment accordingly. You also need to learn from your mistakes, and implement corrective and preventive actions to avoid repeating them.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Nir Valtman

Co-Founder & CEO at Arnica | Ex-CISO
举报内容
The last mile in mitigating AppSec vulnerabilities is always to the most challenging. When you start, identify which assets are most important for your business and find the individual that are best equipped to resolve vulnerabilities in each code repository and product. Reason for the need of business important context is that AppSec teams are expected to do more with less, and such prioritization enables doing better where it is mostly important. The reason for the remediation owners is that most code older than 3 years is typically authored by individuals that are no longer in the company, so someone else who works in the company needs to address these vulnerabilities.

已翻译

赞

Application Development

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the best practices for ensuring application security throughout the SDLC?

1

2

3

4

5

6

7

1 Define security requirements

2 Implement secure coding practices

3 Perform security testing

4 Deploy securely

5 Educate and train your team

6 Review and improve your security

7 Here’s what else to consider

Application Development

给文章评分

感谢您的反馈

更多Application Development相关文章

更多相关阅读内容