Release It!, 2nd Edition

Wrapping Up

Application security affects life and livelihood. It’s another area where we need to consider both the component-level behavior and the behavior of the system as a whole. Two secure components don’t necessarily mix to make a secure system.

The most common target of value is user data, especially credit card information. Even if you don’t handle credit cards, you might not be off the hook. Industrial espionage is real and it can sometimes look as harmless as the location of a shipment of tasty pecans.

Beware the pie crust defense. Internal APIs need to be protected with good authentication and authorization. It’s also vital to encrypt data on the wire, even inside an organization. There’s no such thing as a secure perimeter today. ...