Draft: Roadmap to harden the application using genAI

Security hardening without dedicated Security Team

genAI vs. Security professionals

We are a small team with limited resources. While we had senior developers on our team, we did not have dedicated security experts. To achieve world class security, we decided a 2 step approach.

1. Leverage genAI wherever we can to harden the code and configurations to improve the security posture
2. Engage security professionals AFTER we have done our part.

This dramatically reduced our cost for getting to world-class security. Security is an ongoing process and we will update this documentation as we make more progress.

Road-map to a super secure system

1. Secure Coding Practices

   • Implement input validation and sanitization to prevent common vulnerabilities like cross-site scripting (XSS), SQL injection, and command injection
   • Use parameterized queries or prepared statements to mitigate SQL injection risks
   • Implement proper error handling and avoid exposing sensitive information in error messages
   • Use secure coding practices specific to React/TypeScript, NEST, and Java/Quarkus
   • Conduct regular code reviews to identify and fix security vulnerabilities
   • Comments
     1. We used genAI to suggest libraries for input validations and sanitization in our REACT/Typescript.
     2. We used class-validator in NEST as well as Java/Quarkus inbuilt mechanisms
     3. We had already upgraded our error handling using genAI (Cody)
     4. Todo: Create custom prompts in Cody to analyse and upgrade code right at the time of writing the code.

2. Authentication and Authorization

   • Implement strong and secure authentication mechanisms (e.g., multi-factor authentication, password policies)
   • Use Keycloak or other robust identity and access management solutions
   • Implement proper session management and secure session handling
   • Enforce strong password policies and consider using password hashing algorithms like bcrypt
   • Implement proper authorization checks to ensure users can only access resources they are allowed to
   • Comments
     1. We use KeyCloak for all authentication.
        1. We enabled SSO with google(and other identity providers like Microsoft, Facebook).
        2. For the few users who want to create an id with us, we direct them to Keycloak inbuilt mechanisms to enforce high security.
     2. We secured Keycloak itself by leveraging genAI to implement best practices in hardening and performance.
        1. Todo: Illustrate the hardened config file.

3. Secure Communication

   • Use HTTPS/SSL for all communication between the client and server
   • Implement proper certificate validation and use strong encryption algorithms
   • Use secure cookies with the "Secure" and "HttpOnly" flags set
   • Implement Content Security Policy (CSP) headers to prevent cross-site scripting and other attacks
   • Comments
     1. We hardened our public facing ngnix
     2. We used the same approach and leveraged genAI to harden ALL our internal dockers, components and application.

4. Secure Configuration

   • Follow the principle of least privilege and configure components with minimal necessary permissions
   • Disable or remove unnecessary services, ports, and protocols
   • Use secure default configurations for all components (e.g., Elastic, MariaDB, Keycloak, Nginx)
   • Keep all components and dependencies up to date with the latest security patches
   • Comments
     1. We used the same approach and leveraged genAI to harden ALL our internal dockers, components and application.
     2. Todo: Link some examples of the hardened configuration files and the prompts used in the process.

5. Database Security

   • Use strong authentication and access controls for the database (MariaDB)
   • Implement proper database user roles and permissions
   • Encrypt sensitive data at rest and in transit
   • Regularly backup and monitor the database for any suspicious activities
   • Comments
     1. Todo: Create the documentation and link it here.

6. Secure Integration with Third-Party Services

   • Ensure secure integration with Stripe for payment processing
   • Properly validate and sanitize any data received from third-party services
   • Use secure APIs and follow the security best practices provided by the third-party services
   • Comments
     1. Todo: Create the documentation and link it here.

7. Containerization and Deployment Security

   • Implement secure containerization practices using Docker
   • Use minimal and secure base images for containers
   • Scan container images for vulnerabilities and ensure they are up to date
   • Implement proper network segmentation and isolation between containers
   • Use secure deployment practices and ensure proper access controls for deployment environments
   • Comments
     1. Todo: Create the documentation and link it here.

8. Security Testing and Monitoring

   • Conduct regular security assessments, including vulnerability scanning and penetration testing
   • Implement continuous integration and continuous deployment (CI/CD) pipelines with security checks
   • Monitor application logs and system events for suspicious activities
   • Implement intrusion detection and prevention systems (IDPS)
   • Establish an incident response plan and conduct regular security drills
   • Comments
     1. This will be taken up with external consultants once we finish our internal hardening

9. Security Policies and Awareness

   • Develop and maintain a comprehensive security policy for the organization
   • Provide regular security training and awareness programs for developers and other team members
   • Implement secure development lifecycle (SDLC) practices and integrate security into the development process
   • Conduct regular security audits and risk assessments
   • Comply with relevant industry standards and regulations (e.g., OWASP, NIST, ISO 27001)
   • Comments
     1. Basic systems are in place.
     2. Audit with external consultants once we finish our internal hardening

Security is an ongoing process. Expect more updates in this section as we go forward.