Trusted Libraries and Secure Programming Standards and Guidelines

Whether they are creating or modifying new applications source code, web pages, stored queries, or the streams of mobile code that tie them together, programmers know that in almost all cases they are not truly inventing something new to deal with a completely new situation. Most programming is done to tailor or tweak an existing approach to fit what the end user requests. Sometimes, it is far easier and faster to quickly find a snippet of code that does most of that task and tweak it into its final desired shape.

Two problems often result from this:

• The programmer may not correctly understand what the code snippet being reused does, or how it does it.
• The code snippet being used may not actually function correctly as written.

Controlling this risk requires that development teams specify firm limits on code reuse. Development teams should also set policies on which libraries should be used | as the source for reuse and recommend how to change or add to the approved libraries.

Enforcement has two faces: the administrative and technical. Administrative policies need to instruct, motivate, and engage the development team members in the correct use of the chosen standards, guidelines, frameworks, libraries, coding styles, and any other means that the organization has chosen for achieving better software more securely. Technical policies can and should use the features of the chosen integrated development and test environments, the configuration management and change tracking systems, and, if necessary, audits of systems usage by developers. Both administrative and technical approaches work together to guide development along the chosen path, keep it on that path, assess compliance with policies, and alert management to deviations from the requirements of these policies.