Security Mindset for Software Engineers Series
Back in 2023, I started writing an article about what I thought software engineers should keep in mind about application security. It wasn’t about tools, libraries, or techniques. It was about general ideas that could shape how they think about security while building software.
I never got to finish or publish it. Recently, I decided to revisit it, spending some time updating and expanding it with new content and perspectives I’ve acquired since then.
What started as a single post is now a short series of four articles. It’s my perspective on the ideas I consider most important for software engineers to keep in mind, particularly those that can help them recognize common security risks and make better decisions while building software.
The intended audience is software engineers. I’ve deliberately left out some topics, particularly the detailed implementation of security tools and controls. My goal is to help engineers develop a security mindset rather than provide a comprehensive guide to application security.
While working on the series, I realized there might also be room for a follow-up post (or series) that takes a more comprehensive approach, focusing on tools, solutions, and security capabilities, including those typically implemented and operated by security teams.
Below are the four posts in the series:
- Part 1: When Your Software Is Open to the World
- Part 2: A Vulnerability Is Often Just the Beginning
- Part 3: Security Beyond Your Application’s Code
- Part 4: Security Doesn’t End When You Deploy
I hope you find them useful.
AI assistance acknowledgment: This post was written with AI support for paragraph construction, organization, and reviewing sentence clarity and arguments. The ideas, experiences described, perspective, and editorial decisions remain with the author.