Introduction

Every business system and app holds valuable information: customer names and phone numbers, addresses, order histories, prices, payment records and sometimes health, financial or identity details. To the business, this information is essential. To criminals, it is a target.

Security failures can be expensive and embarrassing. A data breach can lead to lost customers, legal liability, regulatory penalties, ransom demands and weeks of disruption. Even a small online store or booking system can be attacked, because many attacks are automated and look for common weaknesses on any website they can find.

The good news is that most incidents exploit well-known weaknesses that can be prevented with sound design, careful coding, secure hosting and regular maintenance. Security is not a product you buy once. It is a set of habits applied at every stage of the software’s life.

This article explains how secure software is built and run. It covers the most common risks, as described by the OWASP Top 10, the practices that protect against them, the role of hosting and operations, and the data protection laws that apply in Sri Lanka and the UAE. It reflects the approach of our development team at Dsigngo Group and Raiden (Pvt) Ltd, which also provides cybersecurity, firewall and data protection services to businesses.

Why software security matters for every business

It is easy to assume that attackers only target banks and large corporations. In reality, smaller organisations are often attacked because their defences are weaker. Common threats include:

• Account takeover, where attackers use stolen or guessed passwords to log in.
• Data theft, where customer records are copied and sold or published.
• Ransomware, where systems and backups are encrypted and a ransom is demanded.
• Website defacement and malware, where pages are changed or used to infect visitors.
• Payment fraud, where attackers abuse checkout processes or steal card details.
• Business email compromise, where criminals impersonate staff or suppliers to redirect payments.

Beyond the direct costs, customers increasingly expect businesses to protect their information. Trust lost through a breach is hard to regain.

Security by design

The most effective and least expensive time to address security is at the start. “Security by design” means considering risks during discovery and architecture, not adding protections after the software is built.

In practice, this involves:

• Identifying sensitive data. Which personal, financial or confidential information will the system hold, and where?
• Collecting only what is needed. Data that is never collected cannot be stolen. This is also a key principle of data protection law.
• Threat modelling. Asking how an attacker might misuse each feature, and planning controls against it.
• Defining roles and permissions. Deciding who can see, change, export and delete each type of data.
• Planning for failure. Assuming that something will eventually go wrong and designing logging, alerts, backups and recovery procedures.

The OWASP Top 10: the most common web application risks

The Open Worldwide Application Security Project (OWASP) is a non-profit foundation that publishes widely used guidance on application security. Its Top 10 list ranks the most critical security risks to web applications, based on data and expert input. The 2025 edition lists the following categories.

Compared with the 2021 list, broken access control remains the top risk, security misconfiguration has moved up, and software supply chain failures and the mishandling of exceptional conditions are new categories. Mobile apps have their own OWASP Mobile Top 10, which covers risks such as insecure data storage on the device and weak communication security.

Secure coding practices

Our developers apply practices that address these risks directly.

Access control on every request

Every action is checked on the server: is this user logged in, and is this user allowed to do this to this record? We never rely on hiding buttons in the interface, because attackers can send requests directly.

Safe handling of input

All input from users and other systems is validated. Database queries use parameterised statements, which prevent SQL injection. Output is encoded so that user-supplied text cannot run as code in other users’ browsers.

Strong authentication

We support strong passwords, store them only as salted hashes using modern algorithms, limit repeated login attempts, and offer two-factor authentication, especially for administrators. Sessions expire sensibly and are protected from theft.

Encryption

All traffic is encrypted with HTTPS using current TLS settings. Sensitive data, such as identity numbers or documents, can also be encrypted when stored. Encryption keys and passwords for other services are kept in secure configuration, never in source code.

Careful use of third-party components

Modern software uses many open-source libraries. We choose well-maintained components, track the versions used, and apply security updates promptly. Automated tools warn us when a known vulnerability affects a library in one of our projects.

Secure error handling and logging

Users see friendly error messages without technical details that could help an attacker. Detailed errors are logged securely for developers. Important events, such as logins, failed logins, permission changes and data exports, are recorded.

Code review and testing

Every change is reviewed by another developer before it is merged. We test for security issues during development and before launch, and for higher-risk systems we recommend independent penetration testing.

Payments: let specialists hold card data

Handling card numbers directly brings strict obligations under the Payment Card Industry Data Security Standard (PCI DSS). For most businesses, the safest approach is to use a reputable payment gateway with hosted payment pages or secure payment components, so card details go directly to the gateway and never touch your servers. This greatly reduces both risk and compliance work.

Secure hosting and operations

Secure code needs secure infrastructure. Operational security includes:

• Hardened servers with only necessary services running and regular operating system updates.
• Firewalls and web application firewalls that block common attacks and unwanted traffic.
• Separate environments for development, testing and live systems, with real customer data protected.
• Least-privilege access for staff and developers, with individual accounts and two-factor authentication.
• Monitoring and alerts for unusual activity, errors and performance problems.
• **Regular, tested backups** following the 3-2-1 principle: at least three copies of data, on two different types of storage, with one copy off-site or offline. Backups must be tested by restoring them.
• Incident response plans that set out who does what if something goes wrong.

Raiden (Pvt) Ltd provides cybersecurity services including firewalls, secure remote access, data protection and data recovery, as well as cloud and web hosting management. This means security can be handled consistently across software, servers, networks and devices.

Extra protections for mobile apps

Mobile apps face some risks that web applications do not. Phones are lost and stolen, apps can be copied and inspected, and users connect through public Wi-Fi. Good mobile security therefore includes:

• Storing as little as possible on the device, and using the platform’s secure storage (Android Keystore and iOS Keychain) for tokens and keys.
• Protecting communication with HTTPS and, for high-risk apps, certificate pinning, which helps prevent interception.
• Biometric and PIN locks for apps that show sensitive information, such as account balances or medical reports.
• Never trusting the app alone. Every important check must also happen on the server, because a determined attacker can modify an app.
• Removing debug information and test accounts from release builds.
• Keeping libraries and software development kits updated, including analytics and advertising components, which can introduce their own risks.

The human side of security

Many incidents begin not with clever code but with a person: a reused password, a convincing phishing email or an administrator account shared by several staff. Software can reduce these risks, but people need support too.

We recommend that every client gives each user an individual account, uses two-factor authentication for administrators, removes access promptly when staff leave, and trains staff to recognise phishing and suspicious payment requests. Short, regular reminders are more effective than a single long training session. Raiden’s IT and cybersecurity team can help organise these measures alongside the software itself.

A security maintenance calendar

Security needs regular attention after launch. A simple calendar helps make sure nothing is forgotten.

Security for websites built on content management systems

Many business websites and online stores run on content management systems such as WordPress, often with WooCommerce for selling. These platforms are popular and capable, but their popularity also makes them a common target. Most attacks on them exploit outdated plugins and themes, weak administrator passwords or abandoned add-ons that no longer receive updates. Good practice includes using only well-maintained plugins, removing anything unused, keeping the core software, themes and plugins updated, limiting administrator accounts, adding two-factor authentication and placing the site behind a web application firewall. Raiden’s web hosting and support plans include these checks for the websites we look after.

Data protection law in Sri Lanka

Sri Lanka’s Personal Data Protection Act, No. 9 of 2022 (PDPA) is the country’s first comprehensive data protection law. It was amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, and a Data Protection Authority has been established. Reports indicate that key compliance provisions take effect from 1 January 2027.

The PDPA sets out principles for processing personal data, including:

• Processing data lawfully, for specified and legitimate purposes.
• Collecting only data that is adequate, relevant and limited to what is necessary.
• Keeping data accurate and not keeping it longer than needed.
• Protecting data with appropriate technical and organisational measures.
• Respecting individuals’ rights, such as access to and correction of their data.
• Being transparent about how data is used.

For software, this means designing systems that collect only necessary data, record consent where required, allow data to be found, corrected and deleted, protect data properly and keep records of processing. Building these features in from the start is far easier than adding them later.

Data protection in the UAE

In the UAE, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) sets rules for processing personal data, including requirements for consent, security, data subject rights and breach notification. Some free zones, such as the Dubai International Financial Centre and Abu Dhabi Global Market, have their own data protection regulations. Businesses serving customers in the UAE should check which rules apply to them.

Customers in other regions may bring further obligations. For example, a business that offers services to people in the European Union may need to consider the EU’s General Data Protection Regulation (GDPR).

A practical security checklist for your next project

When commissioning software, ask your developer to confirm:

1. How is access control enforced on the server?
2. How are passwords stored, and is two-factor authentication available?
3. Is all traffic encrypted, and is sensitive data encrypted at rest?
4. How are third-party libraries tracked and updated?
5. How are inputs validated and database queries protected?
6. What is logged, and who receives alerts?
7. How often are backups taken, where are they kept and when were they last tested?
8. How will security updates be applied after launch?
9. Will card payments be handled by a payment gateway?
10. How does the system support data protection obligations, such as access and deletion requests?

Illustrative example

The following example is illustrative and does not describe a real client.

A private medical laboratory wants patients to download test reports through a web portal and app. The reports contain sensitive health information.

During design, the team limits the data shown in the portal to what patients need, requires a one-time code sent by SMS in addition to a password, and ensures each request checks that the report belongs to the logged-in patient. Reports are stored encrypted, links expire after a short time, and every download is logged. Administrators use separate accounts with two-factor authentication. Before launch, an independent penetration test is carried out, and two medium-risk findings are fixed. Backups are tested monthly, and a simple incident response plan is agreed with the laboratory’s management.

How we approach security

Security is part of every project we deliver. Our approach includes:

• Security and privacy questions in discovery and design.
• Secure coding standards based on OWASP guidance.
• Code reviews and dependency monitoring.
• Encrypted communication and secure storage of credentials.
• Role-based access control and audit logs.
• Secure hosting, firewalls, monitoring and tested backups.
• Support plans that include security updates.
• Advice on data protection requirements, working with your legal advisers.

Because our group also provides IT infrastructure and cybersecurity services, we can protect your software, servers, networks and devices together.

Frequently asked questions

Is cloud hosting secure?

Major cloud platforms provide strong physical and network security, but the customer is still responsible for configuring systems, managing access and protecting data. Good configuration and monitoring are essential.

Do small businesses really need penetration testing?

For simple websites, careful development and regular updates may be enough. For systems handling sensitive personal, health or financial data, independent testing is strongly recommended.

How quickly should security updates be applied?

Critical updates should be applied as soon as practical after testing, often within days. A support plan should define this.

Does the PDPA apply to my business?

The PDPA applies broadly to organisations processing personal data in Sri Lanka, and in some cases outside it. Seek legal advice on your specific obligations.

What should we do if we suspect a breach?

Contact your technical team immediately, preserve logs, contain the problem, assess what data was affected and follow your incident response plan and legal notification duties.

Conclusion

Secure software is the result of many good decisions: collecting only necessary data, designing proper access control, coding carefully, protecting passwords and data with encryption, managing third-party components, hosting securely, monitoring, backing up and keeping everything updated. Data protection laws in Sri Lanka and the UAE make these practices not only wise but increasingly required.

Our team builds security into every system and app we deliver, and supports it with the infrastructure and cybersecurity services of Raiden (Pvt) Ltd.

Want to make sure your software and customer data are protected? Ask our team for a security review.

Request a Security Review

Sources

• OWASP Foundation, OWASP Top 10:2025: https://owasp.org/Top10/2025/
• OWASP Foundation, OWASP Mobile Top 10: https://owasp.org/www-project-mobile-top-10/
• Personal Data Protection Act, No. 9 of 2022 (Sri Lanka), and Personal Data Protection (Amendment) Act, No. 22 of 2025.
• Daily FT, “Data protection compliance regime takes effect on 1 Jan 2027”: https://www.ft.lk/front-page/Data-protection-compliance-regime-takes-effect-on-1-Jan-2027/44-795776
• UAE Government portal, data protection laws: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
• PCI Security Standards Council, PCI DSS: https://www.pcisecuritystandards.org
• Raiden (Pvt) Ltd company profile (cybersecurity, hosting and data recovery services): https://www.raiden.lk