You do not need a security department to close the gaps that attackers actually use. This is the checklist we apply to every project before its first deployment.
Most of the breaches we are asked to investigate did not involve a sophisticated attack. They involved a default password, an out-of-date software library, or a storage bucket that someone opened for a demo and forgot to close.
The baseline
- Keep secrets out of the code repository. Use environment variables on the platform, a secrets manager in production, and an automatic check that blocks any commit containing a key.
- Scan dependencies automatically. Set up automatic updates for security fixes, with a rule that critical vulnerabilities block a release.
- Grant the minimum access needed. Every service account starts with no permissions and gains only what it can be shown to need.
- Use multi-factor authentication everywhere. The cloud console, source control, deployment pipeline and DNS. DNS is the one people forget.
- Validate data on the server. Validation in the browser improves usability. It is not a security control.
- Rate-limit everything that does not require a login. Sign-in, password reset, contact forms and public APIs.
- Log security events. Sign-ins, failed permission checks and changes to access rights, and make sure someone actually reads the alerts.
What it costs
Applied from the start, this baseline takes about two days to set up on a typical project, plus a little extra effort on each change. Added after an incident, the same work takes weeks and comes with a difficult conversation about disclosure.
TopicsSecurityDevOpsChecklist