Secure Coding Practices

CERT/SEI Coding standard rules

• SEI stands for Software Engineering Institute from CMU.

• CERT is the SEI division leading cyber-security issues.

• SEI CERT Coding Standards develops coding standards for commonly used programming languages such as C, C++, Java, and Perl, and the Android™ platform. These standards are developed through a broad-based community effort by members of the software development and software security communities.

Security-specific guides include:

• SEI CERT coding standards (C, C++, Android, Java, Perl)

• OWASP Secure Coding Practices

Before you start “coding” don’t forget to:

• Specify security requirements. Identify and document security requirements early in the development life cycle and make sure that subsequent development artifacts are evaluated for compliance with those requirements. When security requirements are not defined, the security of the resulting system cannot be effectively evaluated.

• Model threats. Use threat modeling to anticipate the threats to which the software will be subjected. Threat modeling involves identifying key assets, decomposing the application, identifying and categorizing the threats to each asset or component, rating the threats based on a risk ranking, and then developing threat mitigation strategies that are implemented in designs, code, and test cases [Swiderski 04].