Security considerations

Document status	35 - Reviewed

This section highlights the security considerations relevant to developers working on the solution.

OWASP

All developers involved in the project are aware of the OWASP top 10 of security concerns in web applications. The primary check is built into the build pipeline, as describes here: O240 - Deployment Guide The current list is always here: https://owasp.org/www-project-top-ten/

Microsoft identity platform

The setup of identities should follow Microsoft's best practices and recommendations. This is a living reference that is ever-evolving. Please refer to Microsoft documentation for insight into the current version.

Documentation can be found here:

• Security best practices for application properties in Microsoft Entra ID
• Microsoft identity platform best practices and recommendations
• Increase application security using Zero Trust principles

Some recommendations that are current at the time of writing which are relevant to the solution are:

1. Follow 'least privileged access' when assigning roles.
2. Don't use the same application registration for multiple applications.
3. Use certificate credentials, not password credentials (client secrets).
4. Don't store credentials in code or config, and never allow them to be handled by humans.
5. If possible, use managed identities for Azure resources or Azure Key Vault to store and regularly rotate your credentials.
6. Use modern authentication solutions (OAuth 2.0, OpenID Connect) to securely sign in users.
7. Don't program directly against protocols such as OAuth 2.0 and Open ID. Instead, leverage the Microsoft Authentication Library (MSAL).