SECURITY_BEST_PRACTICES.md

Recommendations of Security and Best Practices

Code Practices

• Use OWASP Application Security Verification Standard(ASVS) for the verification of security controls
• Implement servers and frameworks are running on latest versions.
• Encrypt highly sensitive information(authentication verification data)

Infrastucture

• Monitor networks and update software and hardware regularly
• Use Web Application Firewall(WAF) that monitors HTTP traffic across Internet and blocks vulnerabilities.

Updates

• Perform regular updates for libraries
• Use auto-scanning tools like Synk

Access Control

• Principle of Least Priviledge(PoLP) ensures authorized users can execute jobs within the system.
• Roles based access towards some operations.

Authentication

• Implementing strong password policies with rotation
• Implementing Multi-Factor Authentication(MFA)
• User tokens implemented during login form