PRODUCT SECURITY BAD PRACTICES

Summary from the TLDR InfoSec newsletter

A list from CISA of product security bad practices for software manufacturers with recommendations on how to fix the issues. The first set of product practices focuses on using memory-unsafe languages, usage of default or hardcoded credentials, usage of dependencies with critical vulnerabilities, and unsafe cryptography. The second set focuses on security practices such as supporting MFA and providing access to logs that would enable intrusion detection. The last set focuses on organizational practices such as having a VDP and publishing CVEs and EoL timelines.