Alice and Bob Learn Application Security

CHAPTER 9Good Habits

Software developers, system administrators, help desk professionals, and all other IT professionals who have special privileges on technology systems are prime targets for malicious actors. The superpowers that you have on your network and systems are much sought after by those looking to harm your organization, and it is your responsibility to protect them to the best of your ability. In this chapter we will talk about good habits for ensuring you keep your data, code, and systems safe.

The very first habit that you will want to form may sound like clickbait, but it is not. Whenever you search online about how to code something, look for the most secure way to do whatever it is you need to do, and your code quality will improve immediately. Generally, when people search for how to do something online, they go to the same handful of websites, and they pick whatever item has been voted to the top. They copy and paste from that top post directly into their application, try to compile it, and if it compiles, they continue their day, not thinking twice about whether they have just pasted a vulnerability into their application.

Unfortunately, whatever is in the topmost post is generally also the most insecure way to do whatever it is that you are trying to do.⁸⁹ This is because removing security features (also known as unhardening) often makes things “work,” because everything is set to “open.” This is extremely dangerous for those who are copying and pasting ...