PHP Security for Architects - Revision history

Raugust at 10:54, 30 July 2017

2017-07-30T10:54:57Z

Raugust: /* Design Principles */

2017-07-21T05:41:39Z

‎Design Principles

Raugust: /* Design Principles */

2017-07-21T05:39:56Z

‎Design Principles

Raugust at 05:38, 21 July 2017

2017-07-21T05:38:31Z

Raugust at 05:36, 21 July 2017

2017-07-21T05:36:27Z

Raugust: /* Design considerations */

2017-01-30T15:28:20Z

‎Design considerations

Raugust: /* Design considerations */

2017-01-30T15:27:14Z

‎Design considerations

Raugust at 15:25, 30 January 2017

2017-01-30T15:25:57Z

Raugust at 20:52, 13 January 2017

2017-01-13T20:52:36Z

Raugust at 13:46, 13 January 2017

2017-01-13T13:46:46Z

@@ Line 49: / Line 49: @@
 Good software architecture and design are the foundation for secure code, but what is good software design?
 From security perspective, the most important element of good software design is that your code should be simple, well structured, modular and easy to maintain.
-This is something known as as "good" code, clean code or high quality code.
+This is something known as code quality, clean code or "good" code.
-Good code depends on developer skills but more importantly results from following proven design principles such as:
+Good code depends on developer skills but also results from following proven design principles such as:
 * KISS: Keep it simple and avoid unnecessary complexity - Complexity is a potential source of security bugs

@@ Line 57: / Line 57: @@
 * COCO: Follow Coding Conventions to ensure efficiency and consistency - Confusing and unmaintainable code contributes to errors and security issues
-These principles are the foundation for secure code, security by design principles are only the next step to secure code.
+These principles are the foundation for secure code, security by design principles are the next step to secure code.
 === Architectural considerations===

@@ Line 54: / Line 54: @@
 * KISS: Keep it simple and avoid unnecessary complexity - Complexity is a potential source of security bugs
 * DRY: Avoid unnecessary repetition, implement functionality by a single piece of code - Vulnerabilities may continue to exist in overlooked duplicated code
-* YAGNI: Don't waiste effort on features you don't need - Reduce attack surfaces by leaving out unnecessary features
+* YAGNI: Don't waiste effort on features you don't need - Reduce attack surface by leaving out unnecessary features
 * COCO: Follow Coding Conventions to ensure efficiency and consistency - Confusing and unmaintainable code contributes to errors and security issues

@@ Line 47: / Line 47: @@
 ===Design Principles===
-Good software architecture and design are the foundation for secure code, but what is good software design ?
+Good software architecture and design are the foundation for secure code, but what is good software design?
 From security perspective, the most important element of good software design is that your code should be simple, well structured, modular and easy to maintain.
 This is something known as as "good" code, clean code or high quality code.

@@ Line 45: / Line 45: @@
 ==Design considerations==
 PHP frameworks can speed up development with well organized, reusable and maintainable code while they have also many built-in security features. Nevertheless, you can still find many poorly secured PHP web applications on the Internet which have been build by using a framework. Most of the security issues with these web applications are caused by misconfiguration and client code written on top of  frameworks. This is the downside to frameworks, developers may become too dependent upon them, so they no longer understand how the code exactly works "under the hood". There is even a new generation of web application developers who don’t know how to code anymore as they are no longer a PHP developer but a "framework XYZ" developer. Learning to code PHP from scratch is therefore not only a good exercise to learn and understand MVC and good design practices, it's also essential to get a real understanding of secure coding.
 === Architectural considerations===

@@ Line 44: / Line 44: @@
 ==Design considerations==
-PHP frameworks can speed up development with well organized, reusable and maintainable code while they have also many built-in security features. Nevertheless, you can still find many poorly secured PHP web applications on the Internet which have been build by using a framework.Most of the security issues with these web applications are caused by misconfiguration and client code written on top of the frameworks. This is the downside to frameworks, developers may become too dependent upon their frameworks, so they no longer understand how the code exactly works "under the hood". There is even a new generation of web application developers who don’t know how to code anymore as they are no longer a PHP developer but a "framework XYZ" developer. Learning to code PHP from scratch is therefore not only a good exercise to learn and understand MVC and good design practices, it's also essential to get a real understanding of secure coding.
+PHP frameworks can speed up development with well organized, reusable and maintainable code while they have also many built-in security features. Nevertheless, you can still find many poorly secured PHP web applications on the Internet which have been build by using a framework. Most of the security issues with these web applications are caused by misconfiguration and client code written on top of  frameworks. This is the downside to frameworks, developers may become too dependent upon their frameworks, so they no longer understand how the code exactly works "under the hood". There is even a new generation of web application developers who don’t know how to code anymore as they are no longer a PHP developer but a "framework XYZ" developer. Learning to code PHP from scratch is therefore not only a good exercise to learn and understand MVC and good design practices, it's also essential to get a real understanding of secure coding.
 === Architectural considerations===
@@ Line 50: / Line 50: @@
 ==== Web Services Middle tier====
 ==== Middle tier====
 ==Noteworthy Frameworks==
 === Zend Framework===

@@ Line 39: / Line 39: @@
 (Good) frameworks are based on a proven software architecture and feature built-in best practices for software design. Current most popular PHP frameworks are all MVC based.
 Though frameworks allow developers less freedom, applications build without using a framework, depend entirely on the developer's own interpretation of good architecture and design.
 ==Design considerations==