If I'm a non-security-focused developer who realizes that I have a security requirement for my code, what's the best way to find defenses I might leverage?

[letoams@defcon.social]

@adamshostack “assume, I am about to fail, how will AI that’s over my head to use, save me?”

[adamshostack@infosec.exchange]

@letoams But that's not what I'm asking. I'm asking what is someone practically supposed to do, and I would love answers that are not "ask an LLM a question where the person can't evaluate the answers."

[aimaz@mstdn.social]

@mweiss @adamshostack @hacksilon something I’ve long thought an issue with search engines is that they’re great at finding things you already know the name of. LLMs seem pretty good at finding the names of things from a description. So if someone is finding mitigations that they understand what it is, why it works and any limitations that seems like a good thing.

[lee_holmes@infosec.exchange]

@adamshostack I think the answer should be "Defensive Design Patterns." Good security architects have built up a bank of these in their head: "It looks like you're writing an updater! Here are some best practices around that." Once somebody makes that connection that they are writing an updater, they can always search the internet (or ask AI) for the best practices part - but having that lightbulb moment is not guaranteed.

[alien@mastodon.green]

@adamshostack honestly this whole grammar (role+"assume" context) is giving me prompt vibe, I hope you are not trying to compare the same answer from a person and an AI haha

That being said there's no correct answer? I would suggest a PR with compulsory security review to merge, being the review manually taken from a security programmer. Problem is you could find a lot of useful things in OWASP (mostly vuln focused) as well as other sources (depending on the case) but if you don't know (...)

[alien@mastodon.green]

@adamshostack the jargon, or the basics, you might be implementing stuff half the way or making things worse for future reviewers. Even if you ask an AI to do the job, without this base, it might misunderstand or patch the wrong thing.

Aren't you able to ask a community for your specific needs? Are you sure you don't have time to recheck with a security team, even if they are not devs?

[canario@infosec.exchange]

@adamshostack I would suggest to check your dev environment first and esp. the frameworks, libraries and tools you use. They may come with security controls that you can leverage incl. docs with usage examples and references to OWASP resources for further research if needed.

[spacelifeform@infosec.exchange]

@adamshostack

The fewer dependencies, the better.

Minimize the attack surface.

[paulshryock@phpc.social]

@adamshostack validate and sanitize your inputs, and escape your outputs.

Treat what isn't yours as "input", including anything you receive from the network, database, file system, etc.

This will get you surprisingly far.

I'm "not a security expert", so don't take this as " advice from a security expert."

[hacksilon@infosec.exchange]

@aimaz @mweiss @adamshostack yep. It reaches its limits with more complex issues or specific technical stuff (for example, it usually gets very specific keycloak configuration strategies wrong and hallucinates features that do not exist). I actually have a personal benchmark question for LLMs where I‘m asking a question whose answer requires some specific knowledge of how TLS works, which works quite well as a differentiator for me: https://infosec.exchange/@hacksilon/116076554555995053

So, general brainstorming = good, the more specific it gets, the likelier it will lead you wrong.