Security Best Practices
A Defense in Depth approach to security - how to implement layered protection for your systems from the application level all the way to the infrastructure.
Defense in Depth - Layered Security
DevSecOps security best practices are proven methods that build protection into every phase of software delivery and operations, from design and build to monitoring. They rest on the principles of defense in depth and least privilege and draw on frameworks such as the NIST Secure Software Development Framework (SSDF) and the OWASP Top 10.
Security is not a single big wall around your systems. It is a set of protective layers where even if one layer fails, the remaining layers still protect your data. The closer an attacker gets to valuable data, the stronger the protection becomes. Like a video game - each level is harder than the previous one.
Physical Security Analogy
Imagine a luxury villa with valuable items. How would you secure it?
- High wall (Firewall): The first barrier, but if someone climbs over...
- Locked front door (Authentication): Another obstacle, but keys can be stolen...
- Locked room with valuables (Authorization): Even inside the house, access is restricted...
- Safe (Encryption): The most valuable items are in an extra-protected vault...
- Cameras (Logging): They record everything that happens...
- Alarm (Monitoring): Alerts when something is happening...
Key Principle
Do not give keys to all doors to just anyone. Access management is the foundation of security - everyone should only have access to what they need.
Application Security Layers
Security Layers
1. Perimeter Security
First line of defense
- Firewall and security groups
- WAF (Web Application Firewall)
- DDoS protection
- Rate limiting
2. Identity & Access
Who has access and to what
- Authentication (MFA)
- Authorization (RBAC)
- Session management
- Least privilege principle
3. Application Security
Security of application code
- Input validation
- Output encoding
- Secure coding practices
- Dependency management
4. Data Protection
Protecting your data
- Encryption at rest
- Encryption in transit (TLS)
- Key management
- Data masking
5. Monitoring & Response
Detection and response
- Security logging
- Intrusion detection
- Alerting
- Incident response
Least Privilege Principle
Every user, service, or system should have only the minimum permissions necessary to perform its job. Nothing more, nothing less. The principle is described, for example, in control AC-6 of NIST SP 800-53 Rev. 5.
- Developers: Access to the dev environment, not to production
- CI/CD pipeline: Only deploy permissions, not admin
- Applications: Access only to the databases they need
- Containers: No root, with minimal capabilities. In Kubernetes, the Restricted profile of the Pod Security Standards enforces this (
runAsNonRoot: true,capabilities.drop: [ALL])
Why Does This Matter?
If an account with admin privileges is compromised, the attacker can do anything. If an account with limited permissions is compromised, the damage is contained.
Secure Development Lifecycle
Shift Left Security
- Security requirements already in the design phase
- Threat modeling before implementation
- Security code review
- Automated security tests in CI/CD
- Security training for developers
A structured framework for these steps is the NIST SSDF (SP 800-218, version 1.1). Version 1.2 was published as a draft for public comment in December 2025.
Security in Every Phase
- Plan: Security requirements, threat modeling
- Code: Secure coding guidelines, pre-commit hooks
- Build: SAST, SCA, secret scanning
- Test: DAST, penetration testing
- Deploy: Configuration review, hardening
- Operate: Monitoring, incident response
Security Culture
DevSecOps is not just about tools - it is a cultural shift. Everyone on the team is responsible for security.
How to Build a Security Culture
- Security training for everyone (not just the security team)
- Security champions in every team
- Blameless post-mortems after incidents
- Gamification of security (CTF, bug bounty)
- Sharing security learnings across teams
- Measuring and visualizing security metrics
Top Security Best Practices - Summary
Must-Have
- MFA for all accounts
- Least privilege access
- Encryption everywhere (at rest + in transit)
- Regular patching and updates, prioritising vulnerabilities from the CISA KEV catalog
- Logging and monitoring
- Incident response plan (see NIST SP 800-61 Rev. 3)
- Regular backups
- Security awareness training
Most Common Mistakes
- Hardcoded credentials (see OWASP Secrets Management Cheat Sheet)
- Admin access for everyone
- No input validation
- Ignoring security updates
- No logging or monitoring
- Security only at the end of the project
- "Security by obscurity"
Sources
- NIST: SP 800-218, Secure Software Development Framework (SSDF) Version 1.1 (February 2022)
- NIST: SP 800-218 Rev. 1 (Initial Public Draft), SSDF Version 1.2 (December 2025)
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (August 2025)
- NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)
- Kubernetes: Pod Security Standards (August 2026)
- OWASP: OWASP Top 10:2025 (November 2025)
- CISA: Known Exploited Vulnerabilities Catalog (October 2026)