One thing I'd add is that input validation deserves to be part of the conversation too. It works well alongside authentication, authorization, and rate limiting. Secure Coding Practices also has a few useful resources that cover the same ideas from a practical perspective.