What is the best approach to secure a web application?
-
Use https
-
Use encryption
-
Black box testing
-
Secure coding
Secure coding (D) is foundational - building applications without vulnerabilities from the start prevents entire attack classes. HTTPS (A) and encryption (B) protect data in transit but don't prevent application logic flaws. Black box testing (C) finds issues but doesn't prevent them.
Secure coding practices — validating input, avoiding injection flaws, proper authentication/session handling, etc. — address vulnerabilities at their root, in the code itself. HTTPS and encryption only protect data in transit/at rest and don't fix flawed application logic, and black-box testing merely finds issues after the fact rather than preventing them.