Recommended Secure Coding Practices to Safeguard Your Software

When it comes to cybersecurity, it’s always less expensive and more efficient to implement security from the start. One of the best ways to do so is by introducing and maintaining a secure coding culture. Secure coding means developers take responsibility for the security of the code to prevent it from threat agents and malicious attacks.

While there are many secure coding practices to get acquainted with, in this article, we’ve collected the most common ones recommended by OWASP and CERT – let’s get started.

The undeniable importance of secure coding 

“I get a window from a glass – he must get a window from a glass. I get a step, he must get a step. I get a clock radio, he cannot afford. Great success!”

Silly as it sounds, but this movie quote quite accurately represents the conflict between software developers and hackers. Due to technological advancement, we get more powerful tools to secure the software – but at the same time, hackers get more powerful hacking tools. Hence, one of the cornerstones of cybersecurity is taking preventative measures to proact rather than react to a threat.

Secure coding allows you to create robust and secure software from the start by following security considerations towards coding and encryption. This approach significantly reduces the chances of a data breach and helps mitigate and even prevent attacks. And that means you won’t be facing colossal financial damage in case even a tiny bit of the data gets stolen or lost.

If you need some numbers, IBM rolled out a report that states the cost of a data breach rose from $3.86 million to $4.24 million in 2021. This number is the highest average cost in 17 years – and there is no guarantee that it won’t be rising. And let’s not forget the disastrous data dump by Facebook that happened in April 2021 and resulted in publishing online the data of 550+ million Facebook users.

The issue of cybersecurity is as acute as ever these days, and secure coding is one of the ways to manage it. So what does it mean and where to start? First, let’s have a look at the available secure coding standards.

Where do I obtain secure coding standards and principles?

The good news is that you won’t have to come up with your own standards because they are already there. The bad news is that there is quite a lot of information to research and process, but it’s an obligatory step if you care about the security of your work.

There are several organizations that issue internationally applicable security standards. Below, we will cover the most well-known ones.

OWASP

OWASP (Open Web Application Security Project) is a non-profit foundation that functions through hundreds of local chapters and involves software developers worldwide to improve software security. In addition to providing developers with security guidelines and strategies, OWASP also releases its annual OWASP Top 10: a research paper that contains the most critical cybersecurity risks for a given year. 

CERT CC

CERT Coordination Center is another non-profit organization that focuses on secure coding. The organization has its coding standards known as CERT, and a broad community of developers helps develop these standards. Note: the CERT coding standards support C, Java, and C++, so double-check whether these standards apply to other languages.

ISO 27001

ISO 27001 is an international standard for information security. The standard is issued by ISO, an International Organization for Standardization, and is one of the many standards that the organization provides to IT companies and businesses worldwide. A company can also become ISO certified (within the selected domain, i.e., quality management or security). This certification will serve as a valid indication that the company follows international standards and strives to provide the highest quality of services to its clients.

You can check the official documentation of these organizations to see the recommended secure coding standards in full. But for the sake of time and efficiency, we will cover the main secure coding practices below in a nutshell.

OWASP secure coding practices

OWASP provides a detailed checklist on secure coding that every IT company should consider following in its official guide. The checklist is divided into different sections, and each section addresses specific risks and vulnerabilities:

• Input validation: you need to identify all data sources and classify them as trusted or untrusted. You should validate all data coming from untrusted sources.
• Output encoding: all encoding should be performed on a trusted system, and all data outputs must be encoded. As well, all outputs should be sanitized.
• Authentication and password management: authentication should be present for all pages and resources, and you need to use solid and robust authentication controls. As for passwords, all of them need to be complex, temporary passwords need to have a short expiration time, and multi-factor authentication should be used.
• Session management: session activity should be thoroughly controlled, so expired sessions terminate completely and every new session starts with a unique identifier.
• Access control: consider establishing a “deny by default” approach, meaning access is denied by default, and only users with permissions can get access. 
• Cryptographic practices: you need to implement all cryptographic functions on a trusted system, and master secrets should be protected from unauthorized access.
• Error handling and logging: error responses must not disclose any sensitive information, error handlers should not display debugging, and everything happening in the system should be logged for further analysis.
• Data protection: establish a “least privilege” approach, meaning users can perform only limited processes needed to complete a task. Also, it’s recommended to disable the autocomplete feature and remove unnecessary application and system documentation. 
• System configuration: the whole system needs to be regularly updated and run on the latest approved versions of its components. 

Please note that this is not a complete checklist, and each section contains more steps than listed above. For more information, please see the official OWASP documentation on secure coding.

CERT secure coding practices

We’d also like to list a few recommendations by CERT here. Even though most of them correlate with the ones by OWASP, there are still some extra practices that are worth considering.

• Keep the design simple and follow the KISS approach (“keep it simple, stupid”). The thing is, complex design means there is a higher chance of making an error or missing out on a vulnerability. In this way, small and simple design is much easier to manage and monitor.
• Apply multiple defensive strategies, so you have several layers of defense. 
• Use effective QA techniques. While QA does not fall into the coding domain, continuous testing may significantly prevent attacks and detect errors at early development stages.
• Pay attention to compiler warnings and compile your code by using the highest warning level available.

Tips on implementing secure coding

While the secure coding implementation will vary for every business, there are a few general tips that we can give to anyone who wants to pay closer attention to security. Note that this is not a complete checklist, and you will have to develop your unique strategy depending on the current state of your team and project infrastructure.

Establish security culture

The first thing to take care of when implementing security is establishing a security culture within your organization. This implies educating your team and internal and external stakeholders on security and providing corresponding training for all parties involved. You’ll also need to build threat models and create detailed plans on risk management, so you know exactly how to act in case a threat occurs. 

The general steps towards building a security culture within an organization are:

1. Start with the C-suite: executives of a company are the first people who need to understand the importance of cyber security and become willing to implement it on all levels.
2. Analyze your stakeholder communities: since security belongs to anyone, it is important to understand what each stakeholder community needs, how it behaves, and what needs to be changed.
3. Implement rewards into security training: people may be warned off by excessive security training so try making it engaging and rewarding (i.e. employees can get tangible rewards for reporting a detected phish).
4. Invest in efficient security tools: if you are not yet using security tools, it’s high time to start. Also, develop security talent within your organization and assign a security champion to help people with security training.
5. Consider introducing SSDLC: secure software development lifecycle that we’ll talk about below.

Implement SSDLC

SSDLC stands for Secure Software Development Lifecycle and implies injecting security into every standard software development lifecycle stage. In this way, security is addressed not after the product is developed but at the very early stages, starting from requirements gathering.

The implementation of SSDLC requires a shift of mind as most developers are used to specific work patterns, and it might be challenging to switch to another way of work. It is also important to mention that SSDLC implementation does not mean you won’t have to perform your regular security checks – both practices go hand in hand.

Use effective security controls

Security controls in terms of cybersecurity are processes that you establish to protect yourself from vulnerabilities and attacks. To enhance security within your organization, you need to regularly validate the effectiveness of these controls and ensure they provide the required level of defense.

Summing up

Secure coding is a highly efficient way to maintain a proper level of security within your company and ensure that every step of the development process is safeguarded from threats. While it might not be easy to implement secure coding from scratch, the results will be highly rewarding, so it makes sense to consider what steps you can take now to build a robust security culture in the future.