97 Things Every Application Security Professional Should Know

Chapter 1. Secure Code for Tomorrow’s Technology

Alyssa Columbus

The software we build today has the potential to power critical systems for years to come. To ensure the longevity and security of tomorrow’s technology, developers must adopt a security-focused mindset and consider security as part of the quality of the code. Writing secure code requires meticulous attention to detail. To assist you in this endeavor, I have compiled the following checklist of fundamental principles and important items to keep in mind:

Start by learning secure coding standards.

Many common vulnerabilities result from a lack of awareness. Familiarize yourself with leading authorities such as the Open Web Application Security Project (OWASP) Top 10 and CWE/SANS Top 25. Study guidelines for your specific languages and frameworks. Understand basic security principles like least privilege, defense in depth, and secure by default. Reference these standards early when designing applications to build in security from the start.

Adopt a secure development life cycle.

Integrate security practices into all phases of development, from conception to deployment. Conduct threat modeling to identify risks. Define abuse cases. Perform static analysis security testing to catch issues in code. Run dynamic analysis to test for vulnerabilities in running applications. Automate processes such as policy compliance checks, dependency upgrades, and credential rotation to reduce mistakes.

Use frameworks carefully.

While frameworks (e.g., Django for Python, Express for Node.js, Laravel for PHP) boost productivity, they also introduce risks. Keep frameworks updated to avoid known vulnerabilities. Properly configure frameworks and disable unnecessary features. Extend frameworks securely rather than overwriting insecure defaults. Continuously monitor for vulnerabilities in all dependencies. Lock down functionality to what your app actually requires.

Never trust inputs.

Validate and sanitize all data entering your application, including from users, files, databases, third-party APIs, and internal services. Practice zero trust by assuming all inputs are malicious until validated otherwise. Limit exposure through compartmentalization and minimization. Escape outputs properly to prevent injection attacks. Sign and encrypt sensitive data end to end and at rest.

Promote a culture of security.

Advocate for secure coding as a team effort, not just the developer’s job. Instill a sense of shared accountability through training, mentoring, incentives, and leading by example. Make security reviews a regular part of the development process. Empower all team members to call out potential issues. Automate policy enforcement where possible.

Foster developer empathy.

Understand that developers are often undertrained in security and overburdened with competing priorities under tight deadlines. Help them succeed by providing useful security libraries, user-friendly tools, and clear guidance baked into the software development life cycle. Reward secure coding efforts.

Prioritize appropriately.

Focus first on security issues that pose the most significant risks based on your threat model and business context. Eliminate entire classes of vulnerabilities where possible. Build basic security capabilities before adding advanced features.

Take a long view.

Consider how software architecture and design decisions today could impact security far into the future. Seek designs that are adaptable, resilient, and sustainable as both technology and threats evolve.

Stay current.

Monitor emerging threats, revisit past assumptions, and keep your skills sharp through ongoing education. Contribute to open source security projects. Attend events and training. Learn from peers.

Teach others what you know.

Share your security knowledge with teammates through mentoring, code reviews, and organizational training. Write for publications and speak at events. Learning and progress accelerate when we all help each other.

Writing secure code requires knowledge, skill, and vigilance. By embracing these disciplines now, you can safeguard against tomorrow’s breaches. While challenges may persist, you have the power to create resilient and trustworthy applications by keeping security at the forefront of your mind throughout development. The effort is not only worthwhile but essential in protecting our future.