登录查看更多内容

Last updated on 2024年7月2日

Your client wants to cut corners in app security. How will you protect the integrity of the application?

由人工智能和领英社区提供技术支持

When your client suggests cutting corners in app security, it's a red flag for the integrity of the application. Security is not just a feature; it's the foundation that protects user data, maintains trust, and ensures the longevity of an app. As an application developer, your role extends beyond just writing code; you are also a guardian of data integrity and user trust. Compromising on security could lead to data breaches, legal issues, and irreparable damage to your client's reputation. In this article, you'll learn how to navigate these tricky waters, ensuring that the app's security remains robust without breaking the bank or sacrificing essential features.

此文章中的业界达人

由社区从 5 条内容中精选。了解更多

Shabarinath Chandrashekhar

Senior Director Cloud & Data Platform Solutions Architecture l Fullstack l DevSecops l MLOps I CISSP l PMP l 2x AWS I…

1 Educate Client

Understanding the risks associated with inadequate security is crucial for your client. Educate them on the potential consequences, such as data breaches, loss of customer trust, and financial liabilities. Explain that investing in security is not just a technical necessity but also a business strategy that can prevent costly incidents and foster user confidence. Use analogies and real-world examples to make the implications clear and emphasize that cutting corners on security can be far more expensive in the long run.

添加您的观点

Shabarinath Chandrashekhar

Senior Director Cloud & Data Platform Solutions Architecture l Fullstack l DevSecops l MLOps I CISSP l PMP l 2x AWS I 2x Azure l 2x ISC2 I 3x Databricks l CKA l Empowering Businesses adopting Cloud, Data and AI at scale
举报内容
Plug in security at the requirements phase. A large organization can have a CISO at account level to ensure this compliance. The earlier phase the requirements are plugged in the better. Having a healthy dialog with key customer stakeholders at the project kick off can be a good idea to have a high level overview of the security needs and risks. This has to be taken further in all phases with rigorous monitoring in status reports so that the stakeholders are aware of the measures in place

已翻译

赞

2 Risk Assessment

Before making any security decisions, conduct a thorough risk assessment of the application. Identify which data is sensitive and needs the most protection. Explain to your client that understanding potential vulnerabilities can help prioritize security measures. This way, resources can be allocated efficiently to areas with the highest risk, ensuring that the most critical aspects of the application are protected without unnecessary expenditure on lower-risk areas.

添加您的观点

Shabarinath Chandrashekhar

Senior Director Cloud & Data Platform Solutions Architecture l Fullstack l DevSecops l MLOps I CISSP l PMP l 2x AWS I 2x Azure l 2x ISC2 I 3x Databricks l CKA l Empowering Businesses adopting Cloud, Data and AI at scale
举报内容
Risk Assessment should be performed both qualitatively and quantitatively. Qualitative risk assessment is done to ensure the understand the probability and impact of each risk and arrive at an overall risk assessment score. Quantitative risk assessment have quantitative metrics which indicate a favourable risk response. ( Avoid, Mitigate, Transfer, Accept)

已翻译

赞

3 Security Essentials

There are non-negotiable security essentials that every application must have. These include using secure communication protocols like HTTPS, implementing proper authentication and authorization measures, and ensuring data encryption both at rest and in transit. Make it clear to your client that these are foundational elements that cannot be compromised on. They form the bare minimum of a secure application, and skimping on these would be akin to leaving the front door unlocked.

添加您的观点

Shabarinath Chandrashekhar

Senior Director Cloud & Data Platform Solutions Architecture l Fullstack l DevSecops l MLOps I CISSP l PMP l 2x AWS I 2x Azure l 2x ISC2 I 3x Databricks l CKA l Empowering Businesses adopting Cloud, Data and AI at scale
举报内容
Having a Strong IAM is the root of any application. It is the entry door of the system to external world. Having a strong IAM with Multi Factor Authentication should exist for any system. The system data should be protected at rest and transit using appropriate encryption algorithm. Passwords should be hashed with salts and strict password and account lockout policies. An Next Gen application firewall should be deployed on the load balancer.

已翻译

赞

4 Cost-Effective Solutions

Explore cost-effective solutions that do not compromise security. For example, open-source security tools can sometimes offer robust protection without the hefty price tag of proprietary software. Suggest implementing security measures in phases, focusing on the most critical areas first. This approach allows for spreading costs over time while progressively enhancing the app's security posture. Remind your client that investing in security is not only about protecting data but also about safeguarding their business's future.

添加您的观点

5 Continuous Monitoring

Emphasize the importance of continuous monitoring for maintaining application security. Automated security monitoring tools can detect and alert on suspicious activities, preventing potential breaches. Explain that investing in such systems can be more cost-effective than dealing with a security incident after it happens. Continuous monitoring also demonstrates to users that the app is actively being safeguarded, which can boost their confidence and trust in the product.

添加您的观点

6 Advocate Best Practices

Finally, advocate for best practices in application development and maintenance. Encourage your client to adopt a security-first mindset throughout the development lifecycle. From secure coding practices to regular updates and patches, these best practices can help prevent security issues from arising in the first place. Stress that cutting corners on security is never worth the risk, but there are smart ways to optimize security investments without compromising on safety.

添加您的观点

Shabarinath Chandrashekhar

Senior Director Cloud & Data Platform Solutions Architecture l Fullstack l DevSecops l MLOps I CISSP l PMP l 2x AWS I 2x Azure l 2x ISC2 I 3x Databricks l CKA l Empowering Businesses adopting Cloud, Data and AI at scale
举报内容
Some of the practices from my experience - Automated vulnerability scanning periodically - Automated patch updates - Periodic review of whitelists and blacklists - Application of least previlege and monitoring previlege abuse - SIEM and SOAR usage - Security monitoring tools like AzwS security hub, Azure armour

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

John Elrick
举报内容
Simply tell them "I can tell from your request that your risk tolerance is significantly higher than mine. We will have to either review the contract or terminate it at this time." Never take a contact unless you are prepared to terminate it at a minutes notice.

已翻译

赞

Application Development

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

Your client wants to cut corners in app security. How will you protect the integrity of the application?

1

2

3

4

5

6

7

1 Educate Client

2 Risk Assessment

3 Security Essentials

4 Cost-Effective Solutions

5 Continuous Monitoring

6 Advocate Best Practices

7 Here’s what else to consider

Application Development

给文章评分

感谢您的反馈

更多Application Development相关文章

更多相关阅读内容