Pursuing ideals takes time, not just in systems and design.<\/p>\n\n\n\n
When building systems, failing to implement robust security measures can lead to unexpected issues arising from user actions. In projects with tight budgets and schedules, planning and design phases often get rushed, so extra caution is essential.<\/p>\n\n\n\n
If I were to list just three points, they would be as follows.<\/p>\n\n\n\n
\u30fbMinimize input points Ninety percent of attacks begin with “input.” Conversely, systems that attackers cannot access cannot be breached. The greater the freedom in input, the higher the risk.<\/p>\n\n\n\n Of course, there is no system that is 100% impossible to break.<\/p>\n\n\n\n \u30fbMinimize input points (user-interaction areas) to the absolute minimum The idea is to make it a system that’s difficult to break through within the allotted time.<\/p>\n\n\n\n By the way, “1” refers to measures like string sanitization and prepared statements during database processing. “2” covers escaping during HTML output generation, and so on. Also, “3” is surprisingly important\u2014it involves conditional branching that immediately halts processing when unexpected values are received.<\/p>\n\n\n\n There are other detailed countermeasures, but ultimately it depends on the budget.<\/p>\n\n\n\n Conversely, it’s often the case that we have no choice but to implement only basic security measures, leaving finer details somewhat lax. Even when we aim to refine the handling of specifics, there are limits depending on the case, so realistically, it comes down to implementing what’s feasible within the constraints.<\/p>\n\n\n\n At its core, any system is nothing more than “input and output”.<\/p>\n\n\n\n All things entering from outside = data “ingestion”.<\/p>\n\n\n\n \u30fbForm input The above refers to all input (the act of importing into the system).<\/p>\n\n\n\n Next, what the system returns internally = the data’s “output”.<\/p>\n\n\n\n \u30fbHTML display Output is the act of returning data from the system to the outside world.<\/p>\n\n\n\n Breaking down the process into smaller steps reveals a surprisingly simple structure. Writing meticulous, safe logic is essential. Never forget that implementation time directly translates to the quality of the deliverable. Take your time to build it carefully.<\/p>\n","protected":false},"excerpt":{"rendered":" Pursuing ideals takes time, not just in systems and design. When building systems, failing to implement robust security measures can lead to unexpected issues arising from user actions. In projects with tight budgets and schedules, planning and design phases often get rushed, so extra caution is essential. If I were to list just three points, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/touhyo.com\/blog\/?p=1416","footnotes":""},"categories":[1],"tags":[],"class_list":["post-1431","post","type-post","status-publish","format-standard","hentry","category-memo","en-US"],"_links":{"self":[{"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/posts\/1431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/comments?post=1431"}],"version-history":[{"count":9,"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/posts\/1431\/revisions"}],"predecessor-version":[{"id":1554,"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/posts\/1431\/revisions\/1554"}],"wp:attachment":[{"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/media?parent=1431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/categories?post=1431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/touhyo.com\/blog\/wp-json\/wp\/v2\/tags?post=1431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u30fbMulti-layered defense per boundary
\u30fbUnexpected events trigger immediate errors<\/strong><\/p>\n\n\n\n
\u30fbImplement “boundary defense” by blocking data flow at the block level
\u30fbDesign systems to handle all unexpected behavior as exceptions<\/mark><\/strong><\/p>\n\n\n\nWhen in doubt, go back to basics<\/h2>\n\n\n\n
Input (Store \/ Ingest)<\/h2>\n\n\n\n
\u30fbAPI requests
\u30fbFile uploads
\u30fbCookies \/ Sessions
\u30fbDatabase writes
\u30fbLog storage
\u30fbConfiguration changes<\/p>\n\n\n\nOutput (Serve \/ Provide)<\/h2>\n\n\n\n
\u30fbJSON response
\u30fbAPI response
\u30fbFile distribution
\u30fbImage provision
\u30fbEmail sending
\u30fbDisplay database read results<\/p>\n\n\n\n