Security Best Practices

Security Best Practices Skill

Overview

Comprehensive security framework covering OWASP patterns, secure coding, vulnerability assessment, and security testing. Provides actionable guidance for both general application security and healthcare-specific compliance (HIPAA, medical devices).

Core Mantra: Trust nothing, validate everything, assume breach, minimize impact.

Type

technique + domain

When to Use

Trigger this skill when:

• Security review or audit requested
• Implementing authentication/authorization
• Handling sensitive data (PII, PHI, credentials)
• API endpoint design
• Code review for security concerns
• Vulnerability assessment needed
• Healthcare/medical application work
• Dependency or container security

Keywords: security, OWASP, vulnerability, injection, XSS, CSRF, authentication, authorization, encryption, PHI, HIPAA, penetration testing, secure coding

OWASP Top 10 (2021) Quick Reference

Security Testing Pipeline

Automated Scanning (Phase 1)

# Multi-tool security scan
npm audit --audit-level=moderate       # Node.js dependencies
safety check                           # Python dependencies
trivy image --severity HIGH,CRITICAL . # Container images
semgrep --config=auto .                # SAST analysis
truffleHog --regex --entropy .         # Secret detection

Manual Code Review Focus (Phase 2)

• Input validation (whitelist approach)
• Authentication/authorization flows
• Data sanitization (SQL/XSS prevention)
• Cryptographic implementations
• Session management
• Error handling (no stack traces to users)

Dynamic Testing (Phase 3)

• API endpoint fuzzing
• Authentication bypass attempts
• Authorization testing (IDOR, privilege escalation)
• Rate limiting verification
• CORS policy validation

Critical Anti-Patterns (P0 - Fix Immediately)

SQL Injection

// BAD: String concatenation
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized queries
const query = 'SELECT * FROM users WHERE id = ?';
db.execute(query, [userId]);

Hardcoded Secrets

// BAD: In code
const API_KEY = "sk-1234567890abcdef";

// GOOD: Environment variables
const API_KEY = process.env.API_KEY;

Weak Cryptography

# BAD: MD5/SHA1 for passwords
hash = md5(password)

# GOOD: bcrypt/Argon2
hash = bcrypt.hash(password, 12)

Missing Authentication

// BAD: Unprotected endpoint
app.get('/admin', (req, res) => res.render('admin-panel'));

// GOOD: Auth required
app.get('/admin', requireAuth, requireRole('admin'), (req, res) => ...);

Input Validation (Whitelist Approach)

def validate_input(user_input, input_type):
    """Always validate and sanitize user input"""
    validators = {
        'email': r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$',
        'phone': r'^\+?1?\d{9,15}$',
        'alphanumeric': r'^[a-zA-Z0-9]+$',
        'uuid': r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
    }

    if input_type in validators:
        if not re.match(validators[input_type], user_input):
            raise ValidationError(f"Invalid {input_type}")

    if len(user_input) > MAX_INPUT_LENGTH:
        raise ValidationError("Input too long")

    return sanitized_input

Security Headers Configuration

// Express.js with helmet
const helmet = require('helmet');

app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'"],
            styleSrc: ["'self'"],
            imgSrc: ["'self'", "data:", "https:"],
            objectSrc: ["'none'"],
            frameSrc: ["'none'"]
        }
    },
    hsts: { maxAge: 31536000, includeSubDomains: true, preload: true }
}));

// Additional headers
res.setHeader('X-Frame-Options', 'DENY');
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');

Vulnerability Prioritization

CRITICAL (P0) - Fix Immediately:
- Remote code execution
- SQL injection in authentication
- Exposed secrets/API keys
- Missing auth on admin functions
- PHI exposure without encryption

HIGH (P1) - Fix Within 24 Hours:
- XSS in user-facing features
- CSRF on state-changing operations
- Insecure direct object references
- Weak cryptography in production

MEDIUM (P2) - Fix Within Sprint:
- Information disclosure
- Missing security headers
- Insufficient logging
- Outdated dependencies with CVEs

LOW (P3) - Track and Plan:
- Best practice violations
- Non-exploitable theoretical issues

Healthcare Security (HIPAA)

For HIPAA regulatory requirements (PHI definitions, 18 identifiers, safeguard categories, breach notification), see compliance-frameworks skill and compliance-frameworks/hipaa.md.

Implementation Patterns

Production Security Checklist

• All endpoints require authentication (except public)
• Rate limiting per user/IP
• Input validation on all parameters (whitelist)
• Output encoding prevents XSS
• CORS properly configured (no wildcard in prod)
• HTTPS enforced (HSTS enabled)
• Secrets in vault (not in code/repo)
• Dependency scanning in CI/CD
• Security headers configured
• Error messages don't leak system info
• Audit logging captures WHO/WHAT/WHEN/WHERE
• PHI encrypted at rest and in transit
• Penetration testing completed

Breach Response (HIPAA)

Assessment Factors

1. Nature and extent of PHI involved
2. Unauthorized person who accessed
3. Whether PHI was actually viewed/acquired
4. Extent of mitigation

Notification Timeline

Security Tools Reference

Related Skills

• systematic-debugging - For security bug investigation
• architecture-patterns - Secure design patterns
• container-testing - Container security validation

Security is not a feature - it's a requirement. In healthcare, security failures can cost lives.