Hashing, Salting, Cryptography. Help!

Writing secure software is essential in today’s cyber landscape, where threats evolve every day. Security considerations must be integrated from the very beginning of the development lifecycle. While larger teams may have dedicated roles like Security Analysts, Engineers, or Penetration Testers, smaller teams without these specializations must still adopt basic measures to safeguard their systems.
In the article below, I will discuss some of the most basic security considerations and concepts that every developer should be familiar with.

Identity and Access Management (IAM)

Proper authentication of a user and implementing correct authorization is key to securing a system and to ensure that data is not accessed by unauthorized actors.

Authorization Patterns

• Role-Based Access Control (RBAC)
• Attribute-Based Access Control (ABAC)
• Policy-Based Access Control (PBAC)

The best approach often depends on the system requirement and may involve combining multiple patterns for optimal security.

Authentication Methods

While proper Access Control ensures that the resources accessed aligns with policy, authentication is key to ensure that the actor is valid.
Common authentication procedures include:

1. Password authentication
2. Single Sign-On (SSO)
3. Biometric identifiers such a fingerprint, voice or retina pattern
4. Two-Factor Authentication (2FA)
5. Hardware or Token-Based authentication

By combining robust authentication with effective access control, a developer can significantly reduce the risk of unauthorized access and maintain system security.

Web Application Security Vulnerabilities

Web applications are powerful tools, but without proper security measures, they can be exploited to compromise user data or perform unauthorized actions. These common vulnerabilities potentially can have a serious impact on your system.

CORS (Cross-Origin Resource Sharing)

When improperly configured, this can be exploited to allow unauthorized users to access resources and sensitive data.

XSS (Cross-Site Scripting)

By injecting malicious JavaScript code onto an infected website, which is executed in the user's browser, this can potentially steal user's information or perform unauthorized actions on their behalf.

CSRF (Cross-Site Request Forgery)

This attack tricks the user into unknowingly running malicious actions on an authenticated website, the attack exploits cookies and session data to perform unauthorized actions on the users behalf.

These sort of attacks can be easily mitigated by implementing input validation, basic protections and secure coding practices.

Data Security

When authentication fails or systems are exploited, safeguards must be in place to preserve the integrity and security of the data.
These can include:

• encryption
• timeout and session management
• rate limiting
• audit logs
• Intrusion Detection and Prevention Systems (IDPS)

To summarize, security is a complex multi-faceted responsibilty that must be implemented at every stage. There are many resources and tools that a developer may utilize to keep their systems safe and secure.