LFD121 Series: How to Deal with Insecure Software and Vulnerabilities
One needs to think ahead of the times
In the world of software development, insecure software is inevitable. Why? Because risks are inevitable. The real key to building secure software isn’t about eliminating all risks but about proactively addressing vulnerabilities before they turn into major problems.
Insecure Software: The Harsh Reality
Mistakes in software development can lead to security vulnerabilities, making your software risky to use. On top of that, malicious actors may attempt to exploit weaknesses by injecting harmful code during development. This means that addressing security concerns at the surface level is not enough—it’s essential to dig deeper.
Think of your software like skincare. It needs cleansing, moisturization, and sunscreen—a metaphorical deep cleanse to remove potential risks and junk while building layers of protection. How do you achieve this? You’ll find out throughout this series. But for now, let’s focus on laying the groundwork for secure development.
Prepare for the Attackers
Once your software is ready for production, attackers are inevitable. While you can’t stop them from trying to attack, you can make it harder for them and reduce the impact of their attempts.
🔰 Security is not a product—it’s a PROCESS.
You must take security steps during every stage of development and deployment, not just at the end. Addressing risks early is not only easier but also more cost-effective. Waiting until a risk turns into a problem might require overhauling your entire software—a nightmare scenario no one wants.
For smaller projects, risk management may be straightforward. However, for large projects with major implications, risk management needs to be rigorous and continuous.
What Does Risk Management Involve?
Risk management includes:
Planning: Strategizing ahead of time for potential risks.
Identification: Pinpointing risks before they escalate.
Analysis: Understanding the likelihood and impact of risks.
Handling: Implementing strategies to mitigate identified risks.
Monitoring: Continuously checking for new risks as the software evolves.
At its core, risk management is just common sense—a little proactive thinking can save a lot of headaches later.
The Security Mindset
Here’s the crux: security is more than just tools and processes—it’s a mindset.
“Security professionals—at least the good ones—see the world differently. They can’t walk into a store without noticing how they might shoplift. They can’t use a computer without considering security vulnerabilities.”
Can this mindset be taught? Absolutely. Think of it as being constantly aware, or a healthy level of paranoia. Not clinical paranoia, but an ongoing concern that risks are ever-present, and someone out there might exploit them. This awareness is critical in a field where unexpected events and mishaps are always lurking.
Security isn’t a “fire-and-forget” task. It’s an ongoing process. The threats and vulnerabilities we faced a decade ago are not the same as the ones we face today. As developers, staying ahead means continuously considering security at every step.
Guidelines, Checklists, and Band-Aids
Good security checklists and guidelines can save time and reduce risks, but they are not a foolproof solution. You can follow them to the letter and still have insecure software. Conversely, you can disregard some and still develop robust, secure software.
The real goal is not simply to tick off boxes but to cultivate a deeper understanding of security practices. This series will provide you with actionable tips to help reduce risks and stay ahead of potential threats.
Understanding Vulnerabilities
Modern society runs on software, and the rise in software has naturally led to a massive growth in known vulnerabilities. A vulnerability is simply a failure to meet security requirements. Most vulnerabilities are unintentional, but they can also be intentional.
As a developer or supplier, you need to prepare ahead of time for vulnerability management:
Enable clear channels for people to report vulnerabilities.
Discuss issues privately with trusted parties.
Rapidly fix any vulnerabilities that are identified.
The Need for Tracking Vulnerabilities
The sheer volume of vulnerabilities in modern software led to the creation of systems like Common Vulnerabilities and Exposures (CVE). These systems are essential for tracking, categorizing, and addressing vulnerabilities—a topic we’ll explore in more detail in this series.
Top Vulnerabilities to Know
The vast majority of vulnerabilities—90–99%—can be found in two primary lists:
OWASP Top 10: A list of the most critical security risks to web applications.
CWE Top 25: A list of the most dangerous software weaknesses.
While the specifics may evolve, learning about these top vulnerabilities will serve you well for years to come.
Conclusion: Always Stay Ahead
When developing software, always think like an attacker. Anticipate how someone might exploit your system. Identify potential problems while they are still risks, and mitigate them before they become costly issues.
Security is a process. It requires continuous vigilance and adaptation to the evolving threat landscape. Through this series, you’ll gain practical insights and tips to strengthen your software and minimize risks.
Stay tuned for the next blog in the LFD121 series, where we’ll dive deeper into actionable strategies for secure software development.