Thread by @_benjaminowen

A slightly different security talk from @KatyAnton next. #NDCOslo

Argh. I took loads of notes but the Twitter app crashed and I lost them :( From memory and in no particular order:

Use OWASP lists

Encapsulate third party libraries

Prevention is better than mitigation

Log exceptions, e.g. high rates of authentication failure, server-side validation failures where client-side validation should have caught the issue

A single security control (e.g. input / output encoding) may address multiple vulnerabilities

Injection attacks are still the most prevalent

Use parameterization to separate commands and data