How to secure your web site
I have been developing products for large enterprises and we pay special attention to security matters. E.g. we use long passwords, change passwords each year, apply patches, review logs, do upgrades, etc. You never get bored and it always keeps us busy. How do you ensure your product is secure? Do you do some pentests? How often do you review NPM packages?
Setup
Review
Development
Doing this covers a lot of bases, and only takes me a little bit each day / month. It slows down feature work a little (with a few extra steps), but I'm in the habit now.
Thanks for such a list, it made me think about creating a similar list to periodically check the security setup. I would like to include firewall rules and enabling account locks when the password did not match. What is # 6?
Any restrictions you put in the frontend (length, removing HTML tags, etc.) you just always have to sanity check are enforced on the API side as well.
So if you restrict a user to a 64-char username in your UI, you'd better also be throwing an error in your user-creation API. The UI just stops innocent people from shooting themselves in the foot. The API stops malicious people.
By habit I try to keep a 1:1 relationship with UI restrictions and API restrictions.
Lots of breaches happen due to a gap in API enforcement, even if you've put good locks on the UI.
Hi,
Actually yes. Small local pentests done by our own team is one thing but we also hired special company to do review of our app and servers and honestly it was amazing experience and improvement. We learned a lot from them and they made us sure that we are secured.
It's expensive. What you have to do is to decide how much you could possibly lost if hackers get into your system, then you can think how much would you spend to prevent it :D
Also we need to be aware that most security breaches are caused by human mistakes (passwords stored in sticky notes or just employees lack of knowledge)