The document provides tips on defensive coding best practices to help developers write more secure code. It discusses topics like using secure libraries and frameworks, hashing passwords correctly, validating all user input, practicing least privilege access, and continuously learning about new security threats. The goal is to educate developers on how to think proactively about security throughout the development process.

1. Heather Downing @quorralyne
Defensive Coding
Bootcamp

2. (A Primer)
…what I wished I knew
when I started coding,
speci
fi
cally on how to be
notashackable
more secure
@quorralyne

3. (Roughly)
What you get out of this
Helpful tips on how to be an incrementally more secure developer
Scenario examples to avoid
Useful, non-language speci
fi
c knowledge
A quick starting point/checkup before your next project
@quorralyne

4. Yourperceptionshiftswith
experienceandtime
@quorralyne

5. @quorralyne

6. Don’t (always) build it yourself
@quorralyne

7. Plan to rotate your keys
@quorralyne

8. @quorralyne

9. https://tinyurl.com/CodeCovBreach
Mackenzie Jackson, GitGuardian - 21 June 2021
@quorralyne

10. Be skeptical about the new
library on the block
@quorralyne

11. owasp.org/www-project-top-ten @quorralyne

12. Challenge the status quo
@quorralyne

13. Your stack can obfuscate reality
@quorralyne

14. An Object Relational Mapping framework can = security obfuscation
ORM
@quorralyne

15. Know what tests cover security
@quorralyne

16. Secure app != secure data
@quorralyne

17. Don’t assume popular tech is
secure by default
@quorralyne

18. There is more than one way to
approach auth
@quorralyne

19. Incorrect encoding &
serializations are an issue
@quorralyne

20. owasp.org/www-community/How_to_write_insecure_code @quorralyne

21. owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html @quorralyne

22. @quorralyne

23. Don’t use insu
ffi
cient hashes
@quorralyne

24. (Some examples)
Deprecated/Insecure Hashes
RC2
MD4
MD5
SHA1
owasp.org/www-project-mobile-top-10/2016-risks/m5-insu
ffi
cient-cryptography
@quorralyne

25. Just because it’s available
doesn’t mean it’s safe to use
@quorralyne

26. Code your wrote, with time, will
become insecure
@quorralyne

27. www.nist.gov/cyberframework
@quorralyne

28. Validate everything, every time
@quorralyne

29. String comparisons are red
fl
ags
@quorralyne

30. Don’t assume the user will
follow your use case
@quorralyne

31. You can be lazy and secure
@quorralyne

32. Don’t assume all cultures have
the same threat issues
@quorralyne

33. “80% of security is a common
body of knowledge.”
-Marc Rogers, organizer, DEFCON
@quorralyne

34. Get your head out of the code
@quorralyne

35. Have a trusted person
take a look
@quorralyne

36. CORS is code for TODO
@quorralyne

37. Verify that your environment
has bare minimum security
@quorralyne

38. Be transparent immediately
@quorralyne

39. What do YOU wish you had
known about coding defensively?
@quorralyne

40. Heather Downing
Stay Curious.
quorralyne.com
@quorralyne