OWASP

Question 1

Minimize Attack Surface Area

Answer 1

Minimize the amount of vulnerabilities a threat actor can exploit

Question 2

Principle of least privilege

Answer 2

Give people the absolute minimum required access

Question 3

Defense in depth

Answer 3

Varying security controls for different types of threat

Question 4

Separation of Duties

Answer 4

Critical processes should have multiple people responsible for different parts (eg: check creating and signing)

Question 5

Keep Shit Simple

Answer 5

Simple solutions = used solutions

Question 6

Fix issues correctly

Answer 6

ID the root cause, contain it, ID vulnerabilities, and conduct tests on remediation efforts

Question 7

Establish correct defaults

Answer 7

Make sure that optimal security is the default for all users

Question 8

Fail securely

Answer 8

Make sure when a control fails, it defaults to the most secure option. Eg: a failing firewall shuts off app network access

Question 9

Don’t trust services

Answer 9

Always get 3rd party software

Question 10

Avoid security by obscurity

Answer 10

Don’t hide the details of what makes a system secure