Skip to content

security.md

Latest commit

 

History

History
95 lines (67 loc) · 6.55 KB

security.md

File metadata and controls

95 lines (67 loc) · 6.55 KB
Raw

Security

This sections contains notes on API security and other helpful information. Below are some links to helpful resources. For example, OWASP is the Open Worldwide Application Security Project which produces a lot of articles on best practices that are freely available. APIsec offers courses to learn more about security and TryHackMe provides hands-on lessons on a ton of topics as well.

Contents

OWASP Top 10 API Security Risks

  1. Broken Object Level Authorization
  2. Broken Authentication
  3. Broken Object Property Level Authorization
  4. Unrestricted Resource Consumption
  5. Broken Function Level Authorization
  6. Unrestricted Access to Sensitive Business Flows
  7. Server Side Request Forgery
  8. Security Misconfiguration
  9. Improper Inventory Management
  10. Unsafe Consumption of APIs

Disaster Recovery Plans

Many things could occur to disrupt normal operation of your software. It could range from a natural disaster, an accident or nefarious actors attempting to impact your application. When an outage occurs, it is important to know how you will react. Depending on the size and scope of the application the response can range from simply waiting if that's reasonable in your situation to deploying the application to another region. In some cases, the application will already be built to handle large server outages by being cross-region. Below are a number of links discussing important disaster recovery concepts to keep in mind.

Chaos Engineering

In order to test your disaster recovery preparedness teams can run "game days" to see how software and teams respond to outages. Netflix is known for developing a "chaos engineering" culture to ensure systems run smoothly in the face of adversity. Below are links covering this topic.

Common Vulnerabilities

There are a lot of common things we need to keep in mind when building software. In terms of security, sanitizing user input is one that comes to mind. Below is a link to OWASP cheat sheets for many different aspects of software development as well as a few highlights:

Add Salt to Passwords

To help increase security around passwords it can be good to add what is known as "salt" before hashing them. To do this extra characters are appended to the passwords. Doing so can make it harder for people to crack and analyze.

Automated Package Scanning

There are tools to automatically scan and detect vulnerabilities in software. These can be plugged into our code repositories and even automatically create PRs to update package versions.

Package Vulnerabilities

You can review security vulnerabilities found in online packages using services like Snyk. They provide an online search tool to review issues across the major package managers.

Character Encoding

URL encoding is a core part of web development. This can help prevent common attacks like XSS and SQL injection.