Security Practices
There are many different types of vulnerabilities and weaknesses to consider when developing new applications. The Open Worldwide Application Security Project (OWASP) has published a list of the 10 most common types of vulnerabilities since 2004, primarily aimed at web applications. Although this list does not cover everything, it is often used as a starting point for vulnerabilities that must be addressed in development projects.
Current Points on the OWASP Top 10:
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery
If the team has no processes around secure development, this would be a good start. For teams with greater maturity in application security, other checklists, such as the Application Security Verification Standard - also from OWASP, are a further option. This is divided into three different levels; level 1 covers the main points and requires only general competence, while level 3 goes more in-depth and requires specific competence and support tools.
OWASP publishes much more in addition, including other Top 10 lists and what they call "Cheatsheets"; detailed information on specific security-related topics.