testeronious@lemmy.world to Programming@programming.dev · 9 months agoWhy software 'security debt' is becoming a serious problem for developerswww.itpro.comexternal-linkmessage-square10fedilinkarrow-up11arrow-down10
arrow-up11arrow-down1external-linkWhy software 'security debt' is becoming a serious problem for developerswww.itpro.comtesteronious@lemmy.world to Programming@programming.dev · 9 months agomessage-square10fedilink
minus-squareCodeMonkey@programming.devlinkfedilinkarrow-up0·9 months ago Encrypt the data at rest Encrypt the data in transit Did you remember to plan for a zero downtime encryption key rotation? No shared accounts at any level of access Did you know when account passwords expire? Have you thought about password rotation? Full logging of access and activity. That sounds like a good practice until you have 20 (or even 2000) backend server requests per end user operation. All of those are taken from my experience. Security is like an invasive medical procedure: it is very painful in the short term but prevents dire complications in the long term.
Did you remember to plan for a zero downtime encryption key rotation?
Did you know when account passwords expire? Have you thought about password rotation?
That sounds like a good practice until you have 20 (or even 2000) backend server requests per end user operation.
All of those are taken from my experience.
Security is like an invasive medical procedure: it is very painful in the short term but prevents dire complications in the long term.