.NET - Protecting Code from Malicious Attacks

Question

With the evolution of code and software also comes the evolution of the hacker/cracker.

Does anyone have a link to a product or article that details the most current "Best Practice" on how developers can protect their code, and in turn, protect their clients who use their software?

To be more specific with this question, let me provide a brief scenario, as there are two key aspects to consider:

• A company develops security software for a major utility, their core language is C# and all developers in their company are using the latest Visual Studio. The C# code has many libraries and external references from GITHUB and other sources.
• Now a hacker/cracker gets their hands into one of the GITHUB libraries and alters its code to expose any user of their vulnerabilities. The very same GITHUB library that the software developers use in their product.

Aspect one: Is there a tool, article, or best practice guide for something out there today that can be utilized in Visual Studio to protect code from these types of attacks? (described above)
Aspect two: Is there a tool, article, or best practice guide that details unit test purging of any sensitive data? Example: developer accidently uses real usernames and passwords in their unit test. Yes, they should not do this. But human error is an evident part of our world. Is there something we can put in place to help with this?

Thanks so much for any links or descriptions that may help.

Answer 1

I think you are talking about dependency confusion attacks.

https://www.zdnet.com/article/microsoft-warns-enterprises-of-new-dependency-confusion-attack-technique/

https://learn.microsoft.com/en-us/nuget/concepts/security-best-practices

Answer 2

FYI, in your VS2015+ IDE project settings -> "Code Analysis" you can enable code analysis on build with different rules (Say, "Microsoft Security Rules" or import customized rulesets)

The basic idea is to get rid of coding pattern that is likely to introduces vulnerabilities.