Application and Data Security
Application security starts in the SDLC: security requirements, design threat modelling, secure coding standards, code review, SAST, SCA for third-party components, DAST against running builds, and a gated release. Shift-left reduces cost, but you still need runtime testing and monitoring; SAST reads source, DAST probes a live app, and SCA maps dependencies to known vulnerabilities.
The recurring web risks are well defined. Injection (SQL, command, LDAP) is prevented by parameterised queries and allowlist input validation. Cross-site scripting is prevented primarily by context-aware output encoding, plus CSP and safe framework defaults - not by input filtering alone. CSRF is prevented by anti-CSRF tokens and SameSite cookies. Broken access control and IDOR require server-side authorisation checks on every object reference; SSRF requires allowlisting outbound destinations. Authentication failures require MFA, lockout, and strong password storage. Secrets belong in a vault, never in code or images.
Data security depends on state: at rest (encryption, tokenisation, masking, DLP), in transit (TLS with strong ciphers and certificate validation), and in use (memory protections, confidential computing). Choose tokenisation when you must keep the data usable by systems but out of scope of regulation; masking for displays and non-production copies; hashing for integrity and password storage.
APIs need the same controls plus rate limiting, schema validation and scoped tokens. Log security events with correlation IDs, but never log credentials, tokens or full card numbers.
Traps: "validate all input" is not the answer for XSS - output encoding is. Client-side checks are not controls. Hashing is right for passwords; encryption is right for data you must read back. DLP is a detective/partly preventive control and cannot replace classification.
Worked example: a search box concatenates user text into SQL. Fix with a parameterised query, allowlist any expected characters, return generic errors, and log the attempt - do not "sanitise" by stripping quotes only.