Ten Key Steps for Enhanced Web App Security
Description
Most web application security advice boils down to "don't do the bad thing." But knowing the OWASP Top 10 doesn't tell you where to start when you're staring at an existing codebase with no security headers, unvalidated inputs, and CORS set to *.
This talk is the prioritised checklist I wish I'd had. I'll walk through ten concrete steps - from preventing the common vulnerabilities and hardening authentication, through API, client-side and data protection, to CI/CD security, DDoS defence and staying current - showing what the vulnerabilities actually look like when exploited, and what the fixes look like in real code. No slides full of bullet points. The talk includes live demos of the attacks and fixes in real code.
Whether you're securing an existing application or building a new one, you'll leave with a clear, ordered plan for hardening your web app - starting with the changes that have the biggest impact for the least effort.
The Ten Steps
- Prevent Common Vulnerabilities
- Strengthen Authentication and Session Management
- Secure APIs and Manage Shadow APIs
- Client-side Security
- Data Protection and Privacy
- Avoid Security Misconfigurations
- Monitor, Log, and Respond to Security Incidents
- Implement Secure Development Practices in CI/CD
- Defend Against DDoS and Bot Attacks
- Continuous Learning and Staying Updated