Secure scripting
If you are leveraging self-written scripts in your environment, secure scripting is indispensable. If your scripts can be manipulated, it doesn’t matter (most of the time) what other security mechanisms you have implemented.
Be aware that your scripts can be hacked, and malicious code can be injected. In these cases, you must do the following:
- Always validate input
- Have your code reviewed when developing scripts
- Secure the script’s location and access
- Adopt a secure coding standard, such as the OWASP Secure Coding Practices – Quick Reference Guide: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
Additionally, two neat PowerShell modules come in handy when developing your own PowerShell scripts that you should know about – PSScriptAnalyzer and InjectionHunter.
PSScriptAnalyzer
PSScriptAnalyzer is a tool that statically checks code for PowerShell scripts and modules. It checks...
