Software Security — Secure Code and the OWASP Top 10
Secure SDLC
Put security into each stage of the software life cycle:
Requirements: security requirements, threat modeling
Design: security architecture, STRIDE
Development: secure-coding rules
Testing: SAST, DAST, penetration tests
Deploy: hardening, secret management
Maintain: patches, vulnerability watch
This lecture is exam and design language. It is not a how-to for attacking systems.
OWASP Top 10 (2021)
Common web-application failure classes.
1. Injection (including SQL)
Untrusted input is executed as part of a query.
Defense: parameterized queries (prepared statements) or an ORM. Never concatenate user input into SQL. Input filters alone are not enough.
2. Broken Authentication
Weak credentials, broken session handling.
Defense: password policy, MFA, solid session management.
3. Cross-Site Scripting (XSS)
Untrusted content rendered as script in a page.
Defense: encode/escape on output. Add a Content-Security-Policy header.
4. Insecure Direct Object References
Internal IDs in the URL, no authorization check.
Defense: authorization on every object, not just a logged-in session.
5. CSRF
A browser with a live session is tricked into sending a request the user did not mean.
Defense: CSRF tokens, SameSite cookies.
Input Validation
Allowlists beat denylists.
Output encoding: transform data at display time so it cannot become markup or script.
Security Testing
| Method | Meaning |
|---|---|
| SAST | Analyze source before ship. White box. |
| DAST | Analyze a running app. Black box. |
| Penetration test | Human attacker simulation, in scope. |
| Code review | A reviewer reads for security defects. |
Key Concept Cards
Injection defense ★★★★★
: Parameterized queries. Never splice user input into SQL.
XSS defense ★★★★★
: Encode on output. CSP headers.
SAST vs DAST ★★★★☆
: SAST = code, before build/ship. DAST = running app. Use both.
Practice Quiz
Q1. What is the most effective control against SQL injection on a login form?
Parameterized queries or an ORM. User bytes stay data. They cannot become part of the statement.
Q2. How does CSRF work, and how does a token stop it?
The attacker lures a victim’s browser into sending a request to a site where the victim is already authenticated. A CSRF token is an unguessable value bound to the form; the server rejects requests without it. The attacker cannot read the victim’s token, so the forged request fails.
OIYO Editorial
Editorial DeskThe OIYO editorial desk researches money, law, lifestyle, and self-understanding topics against primary sources and public statistics. Every piece carries source notes and is reviewed on a regular cycle for accuracy and usefulness.