Ask HN: Comprehensive security checklist for developers

1 pointsby _urgavor 14 Jahren3 comments

In the light of the recent Amazon and Apple incident, and considering that HN is full of insightful comments regarding security buried in many discussions:

What would be a comprehensive security checklist for developers?

i.e. everything from OWASP, Schneier, best of the security web etc.

For example, just to get started:

1. Use bcrypt.

2. Use different non-guessable private email addresses and passwords for critical services.

3. Self-host critical email addresses.

4. Two-factor authentication.

5. Disable iCloud Find My Mac or disable iCloud completely.

6. Use FileVault2 or full disk encryption.

7. Set your system to log out after inactivity.

8. Set your screensaver with password to show after 5 minutes.

9. Use a passcode on your iPad.

10. Master server should not have access to backup server.

We tend to focus on securing the app we develop, without thinking too much about securing the suppliers we use, or reducing surface area, or considering orthogonal vectors.

There are many great checklists covering certain aspects of security, but it would be great to have all of this in one place.

3 comments

jpmcvor 14 Jahren

Here is a good start: http://benchmarks.cisecurity.org/en-us/?route=default

mooism2vor 14 Jahren

Some of these (e.g. "two factor authentication" and "use bcrypt") require buy-in from management.

_urgavor 14 Jahren

Would be great if someone could build a 373 security questions app, which basically goes through a huge security checklist with you, and gives you a score at the end.