Cybersecurity Best Practices for Software Development Teams

In This Guide

• 1. OWASP Top 10 — The Vulnerabilities That Actually Hit You
• 2. Injection Prevention — SQL, XSS, Command
• 3. Authentication and Authorization Done Right
• 4. Secrets Management — No More .env in Git
• 5. Dependency Security — Your Weakest Link
• 6. Security Headers and Transport
• 7. Building a Security-First Culture
• 8. Frequently Asked Questions

SQL Injection — Always Use Parameterized Queries

// ❌ VULNERABLE — string concatenation
const query = `SELECT * FROM users WHERE id = ${req.params.id}`;
// Attack: id = "1; DROP TABLE users; --"

// ✅ SAFE — parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
const result = await db.query(query, [req.params.id]);

// PHP — PDO prepared statements
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->execute(['id' => $userId]);

// Python — parameterized
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

// Java — PreparedStatement
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
stmt.setInt(1, userId);

XSS Prevention — Output Encoding

// ❌ VULNERABLE — inserting user input as HTML
element.innerHTML = userComment;
// Attack: userComment = ''

// ✅ SAFE — use textContent (auto-escapes)
element.textContent = userComment;

// ✅ SAFE — React auto-escapes JSX by default
return 
{userComment}
;  // React escapes HTML entities

// ⚠️ DANGEROUS React — never use unless sanitized
return 
;
// If you must: sanitize with DOMPurify first
import DOMPurify from 'dompurify';
return 
;

// Content Security Policy header (blocks inline scripts)
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'

IDOR Prevention — The #1 Missed Vulnerability

// ❌ VULNERABLE — Insecure Direct Object Reference (IDOR)
// GET /api/orders/12345 — any authenticated user can access any order
app.get('/api/orders/:id', authenticate, async (req, res) => {
    const order = await db.query('SELECT * FROM orders WHERE id = $1', [req.params.id]);
    res.json(order);  // No ownership check!
});

// ✅ SAFE — verify ownership on every resource access
app.get('/api/orders/:id', authenticate, async (req, res) => {
    const order = await db.query(
        'SELECT * FROM orders WHERE id = $1 AND user_id = $2',
        [req.params.id, req.user.id]  // Always filter by authenticated user
    );
    if (!order) return res.status(404).json({ error: 'Not found' });
    res.json(order);
});

# Scan dependencies for known vulnerabilities

# Node.js
npm audit                       # Built-in
npx audit-ci --moderate         # Fail CI on moderate+ vulnerabilities

# Python
pip-audit                       # Scan installed packages
safety check                    # Check requirements.txt

# Java
mvn dependency-check:check      # OWASP Dependency-Check

# Go
govulncheck ./...               # Official Go vulnerability scanner

# Universal (any language)
trivy fs .                      # Aqua Trivy — scans code, deps, IaC
snyk test                       # Snyk — commercial, good integration

# Automate in CI (GitHub Actions example)
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    severity: 'HIGH,CRITICAL'
    exit-code: '1'              # Fail the build on high/critical vulns

# Essential security headers (Nginx example)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "DENY";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()";
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com";

# Cookie security
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Strict; Path=/; Max-Age=86400

# CORS — restrict to your domains
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true

Related Articles