What are the best strategies for developing highly secure products?

This is the one thing I harp on obnoxiously. When developing an application software system you must define the system's business requirements, functional requirements and security requirements. This is the fundamental pre-cursor to system design and then threat modeling. Failing to define security requirements in the SDLC ultimately leads to failures within threat modelling exercises. At that point, the application software system and its components will be virtually impossible to secure.

Start by gaining a comprehensive understanding of the data involved in your product, as this will enable you to gauge the necessary level of security implementation. Once this is determined, create a set of expectations outlining the criteria for top-notch security mechanisms in your product.

Secure design is the foundation of building secure products. It starts from the basics : 1. Hygiene - CIA Triad 2. Identity is the new boundary. Ensure right authentication and authorisation 3. Data Security across - At rest, In transit - Appropriate encryption must be used 4. Threat Modelling at the earliest possible stage. Apply risk mitigation techniques to minimise attack surface 5. Change Control procedure to be designed upfront and elevated privileges logs should be auditable any time In summary, applying these protections early in the product will ensure smooth, secure development, deployment, release and maintenance.

Security first approach is the foundation of DevSecOps. Any code scanning that we enable must be closer to the developers and provide feedback in such a way that the vulnerabilities are fixed upfront. Software Supply chain security must be built across the cycle especially for the open source libraries planned to be used is critical to success.

“Shift-left” and build security as early in the development lifecycle as possible. 1. Create a Security epic in the backlog and refine down to stories for different security requirements. These can be compliance or technical requirements. 2. Product owners and managers should define a certain percentage of security tickets they’ll put in every sprint or release train. 3. Have source code or other scanners integrated in the CI/CD pipeline. 4. Make sure developers receive security awareness training. Especially on the OWASP Top 10. Gamify the trainings so it is something people actually want to do.

Gamifying training will make it more fun and therefore people are more likely to finish or push themselves to do more. Products like Dune Security do this.

In addition 3rd party Validation and Verification with Continuous development and testing inbuilt framework is vital. The VAPT conducted in the end already have suggested libraries and best practices one can include in the testing framework. OWASP refers to the Top 10 as an 'awareness document' and they recommend that all companies incorporate the report into their processes in order to minimize and/or mitigate security risks. We need to be pro-active in our approach