97 Things Every Application Security Professional Should Know

Chapter 1. Secure Code for Tomorrow’s Technology

Alyssa Columbus

The software we build today has the potential to power critical systems for years to come. To ensure the longevity and security of tomorrow’s technology, developers must adopt a security-focused mindset and consider security as part of the quality of the code. Writing secure code requires meticulous attention to detail. To assist you in this endeavor, I have compiled the following checklist of fundamental principles and important items to keep in mind:

Start by learning secure coding standards.

Many common vulnerabilities result from a lack of awareness. Familiarize yourself with leading authorities such as the Open Web Application Security Project (OWASP) Top 10 and CWE/SANS Top 25. Study guidelines for your specific languages and frameworks. Understand basic security principles like least privilege, defense in depth, and secure by default. Reference these standards early when designing applications to build in security from the start.

Adopt a secure development life cycle.

Integrate security practices into all phases of development, from conception to deployment. Conduct threat modeling to identify risks. Define abuse cases. Perform static analysis security testing to catch issues in code. Run dynamic analysis to test for vulnerabilities in running applications. Automate processes such as policy compliance ...