Secure Coding Guidelines and Standards

Coding guidelines and standards can be used by organizations to encourage developers to follow a standard set of rules and guidelines determined by the organization's requirements. This should prevent situations where development of code was driven by the developer's preference or familiarity. This can help in addressing security requirements in software development. Organizations can mandate through policy that software designers and developers apply these coding standards during software development to create systems and applications that address proper security requirements based on the organization's needs.

There are several secure coding guidelines and standards that have been developed by groups and industries to address this requirement. Such groups and platforms include the CERT Division of the Software Engineering Institute (SEI) and the Open Worldwide Application Security Project (OWASP). As a result, coding standards are available for programming languages such as C, C++, Java, Perl, and many others.

Programming Language Support

Different programming languages and their associated development tools can make or break an organization's efforts to embed security from the start of development.

Many factors can dictate the use of a particular language, and perhaps the most dominant one is the affordable availability of talented programmers who can work with it, when and where the development needs to be done. (COVID-19, of course, has helped to accelerate the use of remote development.)

Certainly, it does little good to emphasize a set of development standards, guidelines, and frameworks to improve security if those are not compatible with the chosen programming language. Let's look at other aspects where the choice of language can have good payoffs in security terms.

Safe execution of programs can be made easier during development by requiring the use of a type-safe or strong type enforcing (also called stronglytyped) programming language.

Microsoft's C#, for example, provides Pstronger data type enforcement than Java. A type-safe language inserts additional logic as the source code program is compiled, and this logic prevents the resulting executable from being used to assist in the misuse of a data type. For example, this can help ensure that arrays stay in bounds, pointers are always valid, and code cannot violate variable typing, such as placing code in a string and then executing it, which may prevent injection problems.

Another approach is to control or restrict the use of pointers. Memory access through pointers is one of the main causes for weaknesses, exploits, and security problems in Cor C++. Java does an internal check, called static type checking, which examines whether the arguments an operand may get during execution are always of the correct type.

Verifying and enforcing constraints of types, which is often referred to as "type checking," can usually be done at different times. These times may be during the compile process or during runtime. If a language specification requires its typing rules "strongly," allowing only those automatic type conversions that do not lose information, then the process can be referred to as being strongly typed. If this is not the case, we can refer to it as being weakly typed.