DEV Community

Discussion on: If you were tasked to conduct a security audit on a server/database-backed web app, where would you start?

Collapse
 
theworstdev profile image
Kurt Kemple

I would start from the back of the stack and work towards the front end. The theory being that locking down the DB operations and access will give the most benefit vs time spent as the source is secure. Then I would start fanning out to any services that interact with the data source and make sure they are secure. Lastly moving on to any clients that interact with those services.