Secure by Design

[Marcin Hoppe @marcin_hoppe]

@jacobian I am mostly interested in stuff at the intersection of software engineering and software security and I liked @SecuringDevOps and @SecByDesign a lot.

Reading „API Security in Action” by @neilmaddog and liking it so far.

[Marcin Hoppe @marcin_hoppe]

If you are processing untrusted data, you need to validate it at different levels (via @SecByDesign):

1. Origin
2. Size
3. Lexical correctness
4. Format
5. Semantics

The validation should be done in this order. Cheaper checks come first.

#appsec