Page 191 - Cyber Defense eMagazine RSAC Special Edition 2025

• Complementing your Symfony stack with third-party tools

Although Symfony provides a robust security toolset by default, teams can complement it with third-party
tooling resources to get access to additional security functionalities and further strengthen the defense
mechanisms of their websites and apps. All your team has to do is to install one of the publicly available
Symfony security bundles (no fees required, they are distributed free of charge), install the bundle, and
configure it.
Some of these bundles, such as SchebTwoFactorBundle, can provide two-factor authentication for your
Symfony websites and apps, which can help you establish an additional layer of protection against
unauthorized access. Others, such as Symfony Health Check Bundle, can assist teams with identifying
performance issues across their systems and detecting security vulnerabilities timely.

There are also bundles, such as SpecShaper Encrypt Bundle or DoctrineEncryptBundle, enabling teams
to implement data encryption in their Symfony applications to protect sensitive user data (names,
addresses, etc.) from malicious use in case hackers gain access to it. In the event of a successful attack,
these free bundles can save you millions of dollars in costs, as, according to IBM's report, the average
cost of a data breach has grown up to $4.88 million in 2024.

• Conducting security audits regularly

Among other things, you should remember that maintaining Symfony app security is a continuous
process rather than a one-time event. Thus, you should constantly evaluate your solution in terms of
cyber risks and threats to ensure that it can withstand both known and new types of threats. In this
context, conducting comprehensive security audits at least twice a year is critical.

Before conducting such an audit, your team should study with the current landscape of web cyber threats
specific to your industry and business niche. Then, they need to conduct comprehensive security testing,
including the review of the solution’s architecture, underlying code, software dependencies, etc. to
determine whether it can withstand these threats. If the audit reveals any software bugs or vulnerabilities,
your team should implement specific measures to mitigate them.

Final thoughts

If you are planning to follow the examples of Spotify, Google, and other companies and develop your
own Symfony solution, make sure to protect it from various cyber threats. Otherwise, you risk
compromising corporate and user data, which can cause business disruption, reputational losses, and
other severe consequences. By following the practices listed in this article, you can significantly
strengthen the security of your Symfony-based solution.

Nonetheless, we recommend additionally consulting Symfony experts about app security enablement,
especially if your in-house team is not experienced enough. Third-party experts can share more specific,
valuable practices to help you maximize your solution’s security. If needed, they can also help you build
a secure Symfony solution by assisting your team with software design, coding, testing, and other tasks.

191