Embracing a Сulture of Сybersecurity in Software Сompany: A Сhecklist

Unpleasant cybersecurity incidents happen every month. Either due to human mistake or not optimized software. Of course, ransomware attacks happen too but protecting against them is futile.

Let’s see what already happened in 2023:

?? Reddit faced a phishing attack targeting internal systems and code

?? T-Mobile cyberattack compromised the personal data of more than 47.8 million users

?? KFC and Pizza Hunt sent emails to users whose personal info suffered a breach

?? ChatGPT Data Leak revealed card information due to the bug?

A culture of cybersecurity should be one that prioritizes security in all aspects of the company's operations. Every business dealing with customer or sensitive data should use the best practices. (To avoid all those lawsuits, lost money, and a couple of heart attacks ??)?

I tried to do the checklist of practices that software company should know and apply. Let’s go!?

? Build with Secure Coding Standards in Mind??

Usually, software developers would have guidelines that tell them what practices to follow. It’s not that software developers would violate rules on purpose. However, they need a structured document with security risks stated. Also, developers need to be prepared against the most common software threats. Make sure the team knows and has practices that prevent:

1. Code Injection ?

2. Cross-site scripting (XSS )

3. Cross-site request forgery (CSRF)

4. Information leakage and improper error handling

5. Missing Authentication for Critical Function

6. Missing Encryption of Sensitive Data

7. URL Redirection to Untrusted Site ('Open Redirec t')

Each threat has multiple ways to solve and you can find them in OWASP Application security risks . The OWASP list is a common practice, and an essential first step to secure coding. Also, some reports are out there to show the software weaknesses that are on the rise.?

? Be Careful with Access Control?

Make sure only authorized users have access to sensitive data and functions. This includes using strong authentication mechanisms, role-based access control, and least privilege. The mistake often made herу is to give access to everyone and not keep access records. Projects finish, and people quit, so they shouldn’t be left with any passwords or access to ongoing tasks. We often forget who uses accounts which can mess with the current development process.??

? Secure Your Communications

System components communicate quite often so they need to be safe not to intercept data and inject some harmful code. The way to go is encryption and authentication, including the use of secure protocols such as HTTPS, SSH, and SSL . If you encrypt data, store the encryption keys safely and rotate them along with certificates occasionally.?

? Have Risk Assessments and Threat Modeling?

A bad plan is always better that no plan at all. Any app would have different cybersecurity risks. That’s why developers need to identify potential security threats and vulnerabilities during the design phase of the SDLC. This can help prioritize security controls and mitigate potential risks.

Also, cybersecurity measures for outsourcing and risks would be different from in-house development, for instance. So, research first and then patch up security holes.?

? Developer Awareness and Training

It’s definitely not the most common way to have a culture of cybersecurity. But training and educating developers/engineers means fewer mistakes that lead to cybersecurity threats. In our company, e.g. we hold Incora Talks where everyone can discuss common practices, insights, and trends in software, cybersecurity, QA, DevOps, etc. It’s quite fun to do Incident Response in the lounge zone. “What will be done if the code has a vulnerability that slows app performance?”, “The company leaked every user's personal detail, what’s we gonna do next?”

Wrap Up

The software industry has a tight bond with cybersecurity. To avoid leaks, ransomware attacks, phishing, and credentials loss software developers need to put cybersecurity practices forward.?

? Coding Standards

? Software Testing

? Access Control

? Identity Management Systems?

? Secure Comunications Protocols

? Encryption, authentification

? Risk assessment and Threat Modeling?

? Cybersecurity Education

? Compliance and Regulation

All need to be executed perfectly. Then you won’t be among the sad statistics.?