Web Developer Security Checklist

Re:Web Developer Security Checklist by tptacek on Tuesday May 16, 2017 @11:17AM (#14350226)

There are 168 comments on this thread all earnestly discussing what is pretty clearly a marketing document written by someone without a firm grip on most of the bullets they've written.

Is there that much of a need for another "security checklist", that we'll dive in this deep on a really bad one? Seriously asking!

Finally: if you're worried about "APTification" or whatever it is this company is talking about, and you're deploying in AWS or GCP, do what Ryan's team at Slack did and get auditd monitoring on all your servers, and perhaps get osquery instrumentation set up as well. Attack detection systems like the product this post sells are pretty far down the list of things you should be considering.

[ Parent | on HN ]

Re:Web Developer Security Checklist by aeronautic on Tuesday May 16, 2017 @11:44AM (#14350451)

As the author, I should clarify that I am a developer - full time and have been for years. If my english seems to imply a lack of depth of understanding - I'm sorry.

The purpose of the checklist is to get people thinking about items they may have forgotten to address during their dev. In the push to ship new products quickly, that happens all too often.

I agree with you that there are many more important and basic things to do first when securing your app - than worrying about APTs. I did not think the checklist gave that impression?

[ Parent | on HN ]

Re:Web Developer Security Checklist by wglb on Tuesday May 16, 2017 @08:26PM (#14354572)

English is not the problem.

You are missing fundamentals like the Seven Deadly Sins of Web Security. Also missing is ninja threat model.

These are the thing that will wipe you out.

[ Parent | on HN ]