Seems like an intro to the basics of web app sec. :-( First step... do not try to do application security until you know it all: until then, find someone who d

Seems like an intro to the basics of web app sec. :-( First step... do not try to do application security until you know it all: until then, find someone who does know all about it. Before you even start development research your risks and expectations: - legal requirements (financial, data protection, healthcare: fines or criminal charges aren't fun (although who knows anyone who got investigated never mind lost? Enforcements a joke!)) - ethical (it's not just about money) - your targets (customers, staff, browsers, servers, network) - financial (data, financial/payment systems, IP, etc) - Work out what you must do (legal) - Work out what would be crazy not to do (financial) - Work out what you should do (ethical) - Work out what the hell your capturing that you don't need to (mother's maiden names belong with financial institutions and your mother's family; do you really need them to check for your user? Is a Captcha and some 2FA setup with a mobile and email not good enough for you?) - Don't have a business model where you catch all and work it out later (Google has billions for lawyers so it can just screw everyone, we're not all Google) - Document the rest, so you have a baseline for any future analysis. Other todos: - keep libraries up to date (owasp CVE checking helps), if there's a known attack on the mapping library you are using then escaping might not be enough - worry about url content (screw REST when it comes to PII: demanding /user/hilary@homeserver.com is not a good idea: never put PII or security tokens there if they might be bookmarked or sent as referers) - understand http headers (especially referers, CORS, etc) - understand how to setup https servers/clients (that actually authenticate certificates) - be wary of social engineering risk (one factor auth is easy to commit to github, no devs should be exposing test servers bound to 0.0.0.0 on Starbucks wifi) - test your security! system tests and integration tests: definitely not just external testing companies (they're terrible unless they can see your source code) - don't use security frameworks without reading the documentation (some are dumb enough to have default private keys in there: Apache Shiro I'm looking at you) Most importantly of all.... Document and share your security expectations with all of your team. When Graduate Bob walks into work and doesn't know enough about application security, he shouldn't be commiting to master in your web app until he does. Ensure expectations are regularly audited and that code reviews and testing reflect the expectations. If you have a problem with this, leave sensitive data alone: there's lots of jobs in IT that don't base their business model around capturing as much personal data as possible (well, there's a few left).