How can you secure your application from external threats?

Use of standards such as SAML 2.0 , OpenID Connect for Authentication must be encouraged. Custom authentication methods( forms based, LDAP) should be gradually deprecated or a 2FA can be introduced . With the support of WebAuth in all major browsers and easy access to authenticators this protocol can be used for 2FA in case of custom login scenarios. Some examples SAML is more suited for enterprise applications for federated identity management and OAuth/OIDC for mobile and javascript applications. WebAuth as primary Authentication is a possible use case however I have not seen that yet in enterprise applications. Overall there are multiple protocol choices and need through evaluation based on use case.

First rule - never trust the user! - Security protocols. - Modern hash functions. - In time updates of your softeare, libs, dependencies, etc. - Try to avoid using unknown third-party libs and software

Implement the principle of least privilege to prevent “Escalation of Privilege” (OWASP) Strategies for mitigation . Oauth 2.0 - When a client application requests for information on behalf of a user from a third-party app, the user consent is translated to scopes e.g. create:user. Scopes are embedded in the access token.When client application requests API information using the valid token, the API should only return the data authorized by the scopes. RBAC - Careful consideration in making the user a member of the correct role .Then check that the resource requested by the user can be accessed by the assigned role else display an authorization error. Web Frameworks such as .Net provide Authorization Filters for this purpose.

Modern enterprise applications deal with many third-party interactions (through various interfaces that are critical for the business). It is important to secure each boundary logically with segregated privileges and ownership. For example, an interface system meant for external party should have access to restricted areas and this should not be an entry point to intrude into other systems/networks in the landscape.

Enforcing this principle we reduce the attack surface, avoiding threat actors to explore over-privileged situations. This strategy is recommended by NIST in many Special Publications

Doing manual sanitization sometimes may be inefficient. Instead of a manual approach, built-in sanitization libraries should be preferred. On the other hand, using whitelisting instead of blacklisting provides more security.

Sanitization is one of the first application security recommendations that I'm able to remember. When I started studying about OWASP and SAMM framework I can remember that this strategy is a strong recommendation since it can avoid a lo of other app issues like XSS, Javascript injection, LDAP injeciton and many other kind of injections.

Code Analysis Tools: Use tools to automatically scan for bugs and vulnerabilities, identifying security flaws that manual reviews might miss. Coding Conventions: Adhere to coding standards for better readability and easier identification of security anomalies. Code Comments: Document code to clarify logic Sensitive Information: Avoid hard-coding sensitive data Encryption and Hashing: Use encryption for data at rest and in transit, ensuring its security even if intercepted. Error Handling: Implement secure error handling and maintain logs for effective debugging without compromising vulnerabilities. Regular Updates: Consistently update your code with the latest patches to guard against emerging threats.

When it comes about application security, its mandatory know about best pattern and best recommendations including best recommendations to each programming language. There are a lot of companies and communities talking about it, OWASP is the most important community about app sec. In my way of thinking (and experience), implementing SAST and DAST together with Continuous Integration, avoiding apps with poor level being launched to production environment is a good maturity level.

Run regular vulnerability checks on your application servers especially those that are publicly facing. You never know when a new vulnerability may show up and cause issues. It is also ideal to have a general workflow involving running vulnerability detection tools and code checks to ensure the secure deployment of your application.

Not sure if this idea could fit in the previous points, but I would add cryptography. Since from network layer( encrypting the channel, encrypting data, pinning SSL) to data layer, encrypting important data in disk, being everything manipulated by an obfuscated app.