Pragmatic Security on Rails
Security is a major concern in all software development, and the creators of Ruby on Rails have built many security features into the framework. In order to build secure applications, we must use the built-in security features correctly. Additionally, most problem domains have their own set of security needs beyond the scope of any framework.
Large companies often utilize a software-development process that overlays security on each phase of a project. For example, at McAfee, we review code for security vulnerabilities before releasing it to the world.
Many development organizations require that architecture be reviewed by someone security-savvy. This process works well for projects that have long life cycles and massive budgets. But let’s face it, heavyweight processes don’t fit for the majority of Ruby on Rails developers. One of the strengths of Ruby on Rails is its agility—security should be applied with the same spirit.
