Allan Cavazos

Probably one of the hardest sells to management is the Authentication and supporting systems. The chain is only as strong as the weakest link and if the support systems are weak, so is your Authentication. Don't skimp on costs or resources.

OWASP is just one source; however, it may not be the best one or only one your organisation needs or can implement. Having an experiences staff that can discover and utilise multiple sources that are best for your organisations' environment is important. Don't be sold by vendors offering a "one size fits all", "all-in-one" or turnkey solutions, they may be more of a problem than they solve. Take it slow, stop, analyse, ask questions. One question I ask vendors is this, "How easy is it to replace your product with another if we need to?" - the answer may lead to further questions and surprise you (ps don't forget to ask about the costs of replacement).

A core practice to focus on, using the highest level of hardening your organisation can implement is vital. Shore up with Change Management, Patch Management, Patching, along with Security and Monitoring tools is Best Industry Practice but don't forget the People part - Documentation (including configuration deviations), staff training, IV&V, PenTesting; Having people that understanding Hardening in the Architecture Phase can go a long ways to help the organisation.

Injection comes from several forms that include human error, tool weaknesses, tool side/supply chain attacks, code reminisces, misconfigurations, budget cutbacks, and staff experiences. Looking at other areas that could allow attacks to happen should also be identified and addressed.

To get started in with what you know, what you do, what your interest are and how to relate it to an area of cybersecurity. Start with YouTube, LinkedIn and other Media to start searching, learning and understanding where you fit into the cyberworld. Join some of the Special Interest Groups or organisations. Socialise with the people in the industry. Nothing is better than thank talking with people in the industry and exploring the possibilities. Sharing what you want with others can help you and the entire community.

Least Privileges and Zero Trust are two critical components of Limiting access, however adding Security Zones are important as well. Application RBACs can be added as a second layer as needed or required. One overlooked component is Personnel Transfers or departures. These changes should be an integral component the Directory Services and automation. One other Use Case could be to have privileged accounts to auto expire every year with an alert to the approver. This will force a check and review at least annually, help in compliance as as well