Good security practices are mainly checklists.

Do you use https?

Do you store password hashes instead of passwords?

Is the DB storing passwords in a firewalled network?

Is access to the DB restricted to only "need to know individuals"?

Does the DB send password hashes to other services?

Have you had a penetration test of your authentication system?

Do you sanitize the SQL you send to your DB?

etc.

Unfortunately the majority of security incidents occur due to someone forgetting something pretty basic or assuming "no one will ever find that".

I feel like a checklist is just part of it. The truth is that a secure software development lifecycle needs to be taken seriously at every stage, and this costs a lot of money. During prototyping and requirements gathering you need to be setting security requirements, vetting planned dependencies, and prototyping things like authentication and authorization. Each design should include threat modeling and threat mitigations. Implementation time should include mandatory code review, static analysis and secure code checklists. Testing needs to include manual penetration testing and dynamic scanning. Finally, maintenance is another area where things fall apart. Who is going to handle patching? Who will be accountable in 4 years when that version of Tomcat is EOL? None of these things are trivial, and people that have the skills to execute on them are rare. Getting a company fully willing to spend the money and time on them is even rarer. I had an old boss who aptly said once "Security is a black hole where money goes to die".

> people that have the skills to execute on them are rare

This is the limiting factor in secure coding. We need more efficient ways of scaling out the few teams doing top tier work, as it only takes a single bad code review to open a security hole.

Teams should not need to implement their own authentication mechanism. Most companies should not need to implement their own mechanism. Authentication providers should explicitly and automatically verify that their clients have implemented auth correctly.

Those are best practices in hardening a system but those are just table stakes. Good security requires having observability of your systems and following up and/or checking on any anomalous activity you detect.

For the most part determined actors (many of them state sponsored) are going to be hard to prevent if they target you. Your best defense is early detection and reaction to the initial breaches. If you only do the hardening part and leave out the monitoring/observation part you are going to get owned.

Checklists make aviation and surgery safer.

No one expects the check lists to result in a perfect outcome but not having them quite likely results in a worse outcome.