Considering security beyond the application

This chapter has focused on testing your product and the technical weaknesses it may have. This is only one aspect of system security and not the most important one. If you want administrator access to a rival’s system, the easiest way isn’t to discover a privilege escalation bug – it’s to trick an administrator into telling you their password. Social engineering with phishing emails is a huge problem that requires training, policies, and technical solutions such as email filters.

Internal policies are vital to security, such as requiring laptop hard drives to be encrypted and using a password manager to secure logins, along with 2FA. Wherever possible, these shouldn’t be company policies advising users what to do but should be enforced on all users’ devices.

Security is an area where the smallest gap can undo vast amounts of hard work, and it’s easy to be lulled into a false sense of...