Security Resources

Authorization (BOLA/IDOR)

Authorization failures are consistently the most critical vulnerabilities I identify in assessments.

• Validate access using server-side policy, never UI state or client data
• Test horizontal access (user A accessing user B's data)
• Test vertical access (regular user accessing admin functions)
• Don't rely on unpredictable IDs as security controls
• Implement centralized authorization middleware
• Log all access denials with user context
• Test with multiple users at different privilege levels

Authentication

Weak authentication enables all other attacks. Get the fundamentals right.

• Enforce MFA for privileged accounts
• Throttle authentication endpoints and add risk-based controls — avoid hard account lockout, which becomes a denial-of-service vector
• Implement secure session management (rotation, timeout)
• Use HttpOnly, Secure, and SameSite cookie flags
• Harden password reset flows (time-limited tokens, account verification)
• Prevent username enumeration through timing or responses
• Use bcrypt/Argon2 for password hashing (never MD5/SHA1)

Input Validation

• Server-side validation always
• Use allowlists over denylists
• Parameterized queries for SQL
• Validate JSON structure and types
• Sanitize logs (no PII, no secrets)
• Limit file upload size and types
• Validate redirects and callbacks

API Security

• Require authentication for every non-public endpoint; explicitly classify public endpoints
• Apply rate limits based on operation cost, authentication state, and abuse risk
• Validate content-type headers
• Allow only required origins, methods, and headers; never combine credentialed requests with wildcard origins
• Version your APIs explicitly
• Return consistent error messages
• Document authentication requirements

Security Headers

• HSTS (max-age=31536000)
• Content-Security-Policy
• X-Content-Type-Options: nosniff
• Set a framing policy with CSP frame-ancestors based on what the app actually needs (X-Frame-Options only as a legacy fallback)
• Referrer-Policy: no-referrer
• Disable verbose errors in production
• Proper cache headers for sensitive data

Identity & Access Management

• Implement least privilege policies
• No shared admin credentials
• Prefer short-lived credentials and eliminate long-lived access keys where possible
• Use temporary credentials where possible
• Require MFA for console access
• Implement service control policies (SCPs)
• Audit unused permissions quarterly
• Use IAM roles for service-to-service auth
• Enable CloudTrail/equivalent logging

Data Protection

• Encrypt data at rest and in transit
• Block public access at the account level by default, and document every approved exception
• Enable versioning for critical buckets
• Use KMS for encryption key management
• Implement backup and retention policies
• Tag sensitive data resources
• Enable access logging on storage
• Review bucket policies regularly

Network Security

• Default deny security groups
• Segment environments (dev/staging/prod)
• Limit ingress to necessary IPs
• Use private subnets for databases
• Enable VPC Flow Logs
• Use a WAF where the threat model and traffic justify it
• Implement DDoS protection

Secrets Management

• Use secrets manager/vault
• Never commit secrets to code
• Automate rotation where supported, and test the rotation process
• Limit secret access by role
• Audit secret access logs
• Use environment-specific secrets
• Implement break-glass procedures

Monitoring & Logging

• Enable CloudTrail/equivalent
• Centralize logs to SIEM
• Alert on privilege escalation
• Monitor failed auth attempts
• Track configuration changes
• Set up anomaly detection
• Retain logs according to documented security, operational, and compliance requirements

Detection Engineering Basics

• Log authentication events (success and failure)
• Log authorization denials with context
• Alert on impossible travel patterns
• Detect privilege escalation attempts
• Monitor admin console access
• Baseline normal behavior first
• Tune alerts to reduce false positives
• Document alert response procedures
• Test detection rules regularly

Incident Response Readiness

• Maintain incident response playbook
• Define escalation procedures
• Document critical system owners
• Test backup restoration regularly
• Keep incident communication channels ready
• Define what constitutes an incident
• Practice tabletop exercises quarterly
• Review and update runbooks
• Document lessons learned

Code Review Checklist

• Authentication implemented?
• Authorization checked server-side?
• Input validated and sanitized?
• SQL queries parameterized?
• Secrets properly managed?
• Error handling doesn't leak info?
• Logging includes security events?
• Dependencies up to date?

Dependency Management

• Scan dependencies for vulnerabilities
• Keep packages updated regularly
• Review new dependency additions
• Use lock files for reproducibility
• Monitor security advisories
• Audit supply chain integrity
• Remove unused dependencies
• Lock production dependencies and maintain a tested update process

Pre-Deployment Checks

• Run SAST/DAST scans
• Review security headers
• Verify secrets not in code
• Check default credentials changed
• Confirm logging enabled
• Test authentication flows
• Validate encryption in place
• Review IAM permissions