Implementing Security Best Practices
1. Using HTTPS Everywhere
| Practice | Detail |
|---|---|
| HSTS | Strict-Transport-Security: max-age=63072000; includeSubDomains; preload |
| TLS 1.2+ | Disable 1.0/1.1; prefer 1.3 |
| Cipher suites | Modern only (Mozilla SSL Configurator) |
| HTTP redirect | 301 to HTTPS |
2. Implementing Secure Password Storage
| Algorithm | Params (2026 OWASP) |
|---|---|
| Argon2id | m=19MiB, t=2, p=1 (minimum) |
| scrypt | N=2^17, r=8, p=1 |
| bcrypt | cost ≥ 12 |
| PBKDF2-SHA256 | ≥ 600,000 iter |
3. Avoiding Security Through Obscurity
Hiding implementation is not security. Assume attacker knows the system; rely on cryptographic primitives and access controls.
4. Implementing Principle of Least Privilege
| Layer | Detail |
|---|---|
| DB user | Service-specific account, minimum grants |
| Cloud IAM | Scoped policies, no wildcards |
| API tokens | Per-purpose, expirable |
| Containers | Non-root user, read-only filesystem |
5. Using Secure Random Number Generation
| Language | API |
|---|---|
| Node | crypto.randomBytes, crypto.randomUUID |
| Python | secrets module |
| Java | SecureRandom |
| Go | crypto/rand |
| Never use | Math.random, random module, java.util.Random |
6. Implementing Defense in Depth
| Layer | Control |
|---|---|
| Network | WAF, DDoS protection |
| App | Auth, input validation |
| Data | Encryption at rest + in transit |
| Monitoring | SIEM, alerting |
| Process | Code review, pentest, incident response |
7. Keeping Dependencies Updated
| Tool | Detail |
|---|---|
| Dependabot / Renovate | Auto-PRs for updates |
| npm audit / pip-audit | Vulnerability scan |
| Snyk, Mend | Commercial SCA |
| SBOM | SPDX / CycloneDX |
8. Implementing Security Headers
Example: Modern baseline
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; ...
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin9. Using Input Validation
Validate at trust boundaries with allowlist schemas. Reject early; never sanitize as primary defense (encoding is for output, validation is for input).
10. Implementing Error Handling
| Practice | Detail |
|---|---|
| Fail closed | Default to deny on errors |
| Generic to user | Details in logs |
| Don't leak versions | Remove headers |
| Catch all paths | Top-level handlers |
11. Conducting Security Audits
| Activity | Cadence |
|---|---|
| SAST | Every commit |
| DAST | Weekly / pre-release |
| Penetration test | Annual + major changes |
| Code review | Mandatory for security-sensitive changes |
| Bug bounty | Continuous external testing |
12. Implementing OWASP Top 10 Mitigations
| 2021 Top 10 | Mitigation |
|---|---|
| A01 Broken Access Control | Centralized authz, deny-by-default |
| A02 Cryptographic Failures | TLS 1.3, modern KDFs, AEAD ciphers |
| A03 Injection | Parameterized queries, encoding |
| A04 Insecure Design | Threat modeling, secure SDLC |
| A05 Security Misconfig | Hardened baselines, infra-as-code |
| A06 Vulnerable Components | SCA, patch SLA |
| A07 Identification/Auth Failures | MFA, rate limit, secure session |
| A08 Software/Data Integrity | Signed packages, SBOM, SLSA |
| A09 Logging/Monitoring | Centralized, alerting |
| A10 SSRF | Allowlist URLs, block metadata IPs |