5 Important Secure Coding Practices
2 likes727 views
The document outlines five key secure coding practices essential for minimizing security vulnerabilities in software development: input validation, authentication and access control, fail-safe mechanisms, exception handling, and adherence to secure coding standards. These practices should be integrated into the entire Software Development Life Cycle (SDLC) to ensure the protection of applications and data from unauthorized access and potential breaches. Implementing industry best practices, such as Microsoft SDL, plays a critical role in fostering a uniform and secure coding environment.
5 Important Secure Coding Practices
- 1. 5 Important Secure Coding Practices Let’s begin
- 2. Almost all organisations have coding standards deployed to ensure the uniformity of coding across projects. It is equally important to have secure coding practices as well. These secure coding practices will help to minimise the exposure to security vulnerabilities. Security practices shall be integrated to the entire SDLC phases. 5 important secure coding practices
- 3. Industry best practices like Microsoft SDL will help to set these processes. When it comes to secure coding practices, there are lot to be considered. Here, we will look at the minimum to be considered while developing an application. 5 important secure coding practices
- 4. Input Validation 01 Fail safe 03 Authentication & Access Control 02 Exception handling 04 Adhere to secure coding standard 05 Let’s look at the important ones
- 5. Input Validation A checklist for validation will help to implement these during the development phase. Validation of data entered to the application will help to avoid issues to a greater extend. Ensure that validation is be done for data length , special characters, numerals in text fields and vice-versa.
- 6. Authentication & Access Control There should be provision for the following: • Configure account lockout after defined number of attempts • Restriction to re-use passwords which were already used Wherever possible, implement authentication mechanism for the application. The application should have the concept of normal users and admin (privileged) users. The application should have a mechanism to assign access rights to normal users and privileged users. The application should have the provision to assign password complexity requirements. 01 02 03 04 05
- 7. This will ensure that the data and the application is protected from unauthorised exposure (breaches) even during an unforeseen situation. It is fine for an application to fail, provided it fails in a safe way. If the application fails or terminates abnormally during a process, there should be a mechanism to contain it. Fail safe
- 8. Thus ensuring that the errors or exceptions doesn’t result in a crash or freeze. Exception handling is important. It is always good if the program executes as per the flow or expectations. But at the same time, it is equally important to have a mechanism to handle the exceptions. Exception handling 01 02 03
- 9. Ensure that the developers adhere to the standards as well. Adopt a coding standard for the platform/language used to develop the application. The developers should be trained on these standard. Adhere to secure coding standard 01 02 03
- 10. Thomas Kurian Ambattu CRISC, ISO27001 LA, ISLA-2011 (ISC2)