Just designing a service to be secure is not enough. There will be security implications to many of the decisions made during the build phase too. And no doubt there will be iterations to the design once the build is underway. Consider security as a factor in every decision you make.
Securing commodity components
- To protect data in transit across untrusted networks, follow our network security advice.There is dedicated advice on using TLS to secure communications between your digital service and users.
- Deploy the latest versions of all of the commodity components, such as operating systems, and web development frameworks, that you are using, to ensure you benefit from the latest security features.
- Follow the manufacturer’s recommended configuration guidance to protect your server infrastructure.
- Containerisation can be great to help you manage your digital service, but we recommend not using containers to separate different trust domains within your system.
Securing your custom software
Whilst working on a digital service you’ll make many important security-related decisions in relation to the design, but there will also be important implementation choices too. You’ll need to think about how to threat model new features, how to perform security testing, how to protect your source code repository and how to protect the integrity of your development environments.
Testing
Testing is the best way of checking the security of the service you’ve built. Even with the best of intentions, it’s common for things to be missed in the configuration of components.
Security and penetration testing should be part of your overall testing. It’s important for you to do some security testing yourself that gives you the confidence that the service you are building is secure, however you should use professional penetration testers to verify that the service you are building is secure. You’ll know you’re doing a good job at your own internal testing when the professional penetration testers have to work very hard to find a flaw your system that you were not already aware of and acting on.
When it comes to digital services there are two types of penetration testing that you will need to think about:
- Web app penetration testing
concerned with the security of the applications you’ve built or deployed
- Infrastructure penetration testing
concerned with the underlying infrastructure, networks, operating systems and platforms.
For more information, see our detailed guide on penetration testing.
Source: NCSC
