Application Security Best Practices
A starting point for application security.
Read article: Application Security Best PracticesApplication Security
21 articles tagged Application Security.
Zero Trust Architecture
Zero Trust Architecture (ZT or ZTA) is a security model / framework based on one simple idea: Never trust, always verify. From NIST, we have, the “… ZT approach is primarily focused on data and service protection but can and should be expanded to include all enterprise assets (devices,…
Read article: Zero Trust Architecture
Any Day Your Socks Don’t Burst Into Flames Is A Good Day
I’ve been wanting to use this as a title for a blog post for a while now. It’s actually one of the quotes I have in my personal email signature. The open question has been what the topic of this blog post should be. There are so many asinine stories from fifteen years of consulting that could be…
Read article: Any Day Your Socks Don’t Burst Into Flames Is A Good Day
What Is Digital Privacy?
Privacy (and Digital Privacy) is one of those terms that I’ve thrown around a lot in the last few years. However, I never took the time to define it.
Read article: What Is Digital Privacy?
Prevent XSS and Other Common Attacks on Your App
Regardless of your application architecture or front-end type, there are a variety of common attack types that the application security architecture’s capabilities must protect against. I’ve talked about these topics briefly before here, here, and here.
Read article: Prevent XSS and Other Common Attacks on Your App
Application Front-Ends Must Not Make Authorization Decisions
First, let’s get the usual introductions out of the way. For an in-depth discussion of what Authorization is, check out this post. For a complete introduction to Authorization concepts see my Authorization Series. This post continues my long-running Authorization Series. In this post, we’re going…
Read article: Application Front-Ends Must Not Make Authorization Decisions
The Many Ways of Approaching Identity Architecture
At some point in the finite past, I had the good fortune to become involved in a project that was essentially completely greenfield. An unnamed company, in an unnamed industry decided to try something new. In a page right out of “The Innovator’s dilemma”, they spun up a new, separate organization,…
Read article: The Many Ways of Approaching Identity Architecture
Application Security Models
I like to start system design (at the application level) with the security model that will be used to protect the system. Application security models have several attributes that need to be addressed at each layer of the application.
Read article: Application Security Models
OpenID Connect Logout
The OpenID Connect (OIDC) family of specs supports logout (from a single application) and global (or single) logout (from all applications that the user has logged into through the OpenID Provider, OP), but these features are optional or in draft status (as of Q2, 2017). So, these spec features may…
Read article: OpenID Connect Logout
API Security vs. Web Application Security: Part 2
This post was originally published as “API Security vs. Web Application Security: Part 2” on the Levvel Blog.
Read article: API Security vs. Web Application Security: Part 2