Best Practices for Secure Development
The following document is intended as a guideline for developing secure applications. It is not about how to configure firewalls, intrusion detection, DMZ or how to resist DDoS attacks. In short, it is not about infrastructure and network security. Compared to a year ago, the availability of consolidated material intended for developers has definitely improved but effort is still required to make the developer community more security-aware.
One part of the reason for this lack of security awareness is that traditionally, developers have worked on systems for environments where hacking was not considered a real threat: internal systems, call centres, software for home use, intranets. The complexity (and sometimes the unfriendliness) of the applications were adding to the barrier of entry. There may have been occasional exceptions with disgruntled insiders, sometimes with embarrassing outcomes, but they could be dealt with at HR level and the example prevented others from attempting it again.
