Secure coding best practices

Introduction

Information security needs

• Security awareness: why we need security, what are insecure practices.

• Imbibing secure practices in daily life.

• Helping others to be secure. Note that it doesn't make me secure if others surrounding me doesn't follow security policies

• Using secure tools as much as possible. It helps to detect, prevent and mitigate attacks.

For secure coding, all of the above are useful. Here, Code review helps others to write secure code.

Secure tools

There are varieties of secure tools available in the market, including open source tools.

These tools helps to prevent

• Buffer overflow risks

• TOCTOU (Time Of Check, Time Of Use) race conditions

• Format string problems

• Potential shell metacharacter dangers (most of the exec() family, system(), popen())

• Poor random number acquisition (such as random())

Gartner report

Gartner has application security testing magic quadrant. This report helps to understand strong test products commercially available for use.

Reference

https://www.sans.org/reading-room/whitepapers/awareness/importance-security-awareness-training-33013

https://code.google.com/archive/p/rough-auditing-tool-for-security/

http://security.stackexchange.com/questions/1840/can-anyone-suggest-good-open-source-tools-for-scanning-source-code-for-vulnerabi

https://www.gartner.com/doc/3107518/magic-quadrant-application-security-testing

http://www.dwheeler.com/flawfinder/#othertools