Security Practices for Developers
summary
Covers specific, actionable developer controls: threat modeling steps (identify assets, map architecture, rank threats), use OWASP cheat sheets and Microsoft threat modeling tools, enforce 128-bit session IDs with 64-bit entropy and idle/absolute timeouts, apply input validation and output encoding to stop SQLi and XSS, prefer MFA and auth apps over SMS, use TLS (eg use Let's Encrypt) and avoid wildcard certs, push infra-as-code (Terraform) and log all auth/session events.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:143 he challenge
- 7:57treat Modeling
- 12:033 lentify the Most Valuable Assets
- 13:03reate Architecture Overview
- 14:38entify and Document the Threats
- 18:31put Validation aka Data Validation
- 22:29utput Encoding
- 23:35uthentication Management
- 28:14Session Management
- 32:07ammunication Security
- 35:32eminders Systems Security - Harden the systems
related talks
30mWeb Security Engineering - Protect all layers of your project
01h 03mTen Key Steps for Enhanced Web App Security
51mSecure Applications, By Design
59mPractical Security for Web Applications
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
46mThe Path of Secure Software
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
44mSecurity Lessons for Early Adopters