s_streichsbier
Joined 8 years ago
Karma
22
Submissions
10
Member since
Dec 3
Fascinated by AI's ability to bring ideas to life. Working on giving engineers security superpowers by combining LLMs with AppSec.
View on Hacker NewsRecent submissions
Comment · 7 years ago
Famous last words ;)
While leveraginvg serverless gives a lot of benefits in terms of hardening and infrastructure setup, all the traditional application security issues (e.g. OWASP TOP 10) like SQL injection can still apply.
Comment · 7 years ago
I think for API consumption one important consideration is keeping API keys secure. Besides that, most of the modern issues I have seen are related to authentication and access control.
Regarding reverse engineering, I personally feel that this is not as important an issue as others. Anyone that get's access to an app or a mobile device will always be able to reverse engineer it. It is just a question of time and effort. Mobile apps mostly should have the same objective as modern browsers, as providing the UI and UX.
Business logic and security should be handled on the backend side.
If you are still keen on reverse engineering and resiliency against it, check out this document https://www.owasp.org/images/6/61/MASVS_v0.9.4.pdf.
Comment · 7 years ago
These are excellent suggestions Bucephalus. One note though, they mainly deal with the infrastructure/network/os level security.
A simple SQL injection in the code would still be exploitable regardless of the countermeasures above.
So on top of what you have suggested, what are your ideas to get the security right on the code level of the applications?
Comment · 7 years ago
<3
Comment · 7 years ago
Good one, I didn't know that one yet.
For the dynamic scans, I can also suggest https://www.securityheaders.com and https://ssllabs.com/