Secure coding: What is it, and why should you care about it?

The so-called zero-day exploits (security vulnerabilities found in the brand new software) attest to how fragile software can be. Programming code is the blueprint of any piece of software; the DNA gives it life. So what happens if your code has a vulnerability? A single line of vulnerable code will turn the whole program into a security liability.

If you peruse the tech headlines of the last twelve months, you’ll see just how frequent it is for fragile pieces of code to become the focus of an exploit by unauthorized users. Let’s face it, it happens all the time, and the press loves to cover it.

And this isn’t a problem pestering the more petite guys in the software business. The digital universe knows nobody bigger than Google and Apple. Both had to report vulnerabilities in their respective operating systems. Even the pioneering Red Hat, now an IBM subsidiary that provides a Linux distro for commercial clients, had to report a vulnerability within its Linux Enterprise version, which was being exploited–Linux exploits are rare, so it was more important news.

Here’s the thing about security: adequate security is not about applying patches. It’s about adopting an integrated approach in which security priorities are hard-wired to every step of the process from the very beginning. Consequently, having secure software starts at the early stages when the initial code is being written. Even at that time, the code writers need to have security in mind and ensure that the final product will be secure.

In other words: security starts with the source code. To understand this, let’s explore in further detail the concept of secure coding, its relevance, and how to get it right.

What are the best secure coding practices? Quick list

There are whole books written to answer this question alone, but you should start by ensuring that your code delivers on the following regards:

• Input validation
• Access control
• Authentication and password management
• Threat modeling
• Data protection
• Cryptographic practices
• Error logging

Secure coding: What is it? Why does it matter?

We start with the basics. Code writing or computer programming is the design and construction of executable programs in a language that your computer can interpret. A programmer engaged in writing code must keep several factors in mind, such as the application’s architecture, code optimization, efficiency, and, most importantly for us, the code’s security and safety.

Secure removes some of the friction in the process of weeding out vulnerabilities. Developers and code writers can follow a set of practices and guidelines to ensure code security, known as secure coding standards.

Adopting certain coding standards matters because it removes commonly exploited zero-day vulnerabilities, thus precluding future cyberattacks. It even helps the company’s bottom line. Let’s not forget that exploits cost money. The longer they take to fix, the more expensive they become. So having a safe piece of code from the start can reduce costs considerably.

Writing safe code is essential. That should go without saying. And yet, vulnerable software remains the rule rather than the exception. According to the National Institute of Standards and Technology (NIST), over the last three years, more than 40,000 software vulnerabilities have been. And these are only the ones that got reported.

And all that begs the following question.

How do you write code securely?

There’s plenty of literature about the best coding practices regarding security. No matter if you’re looking for secure web or app development. For example, take The Open Web Application Security Project (OWASP). This project has published some guidelines that can help those programmers who want’ to avoid the most frequent security pitfalls. Or consider SEI CERT, which has a secure coding standard that consists of ten points to incorporate into your programming philosophy to enhance an application’s security.

So you don’t have the time to read everything in detail through those two websites? That’s fine, and we did already. We’ve prepared a security digest for programmers using both sources right below.

Data input validation

Injection attacks, buffer overflows, and cross-site scripting are essential sources of cybersecurity threats. They happen because the application doesn’t correctly validate the input, so it admits something that can harm the system. Therefore, the code writer needs to ensure security practices so that all the input always comes from trusted sources or consists of the proper information type. If using untrusted sources is unavoidable, a verification process needs enforcement within the software.

Authentication and password management

Your program is for authorized users only. Period. Security problems invariably start with unwanted visitors, so keeping them away saves you a lot of issues down the road. Enforce these policies:

• Using a sound system for password hashing.
• Enforcing password length and complexity requirements.
• Keep the user’s credentials on a trusted, secured server.
• Implement multi-factor authentication.

Access control

Access control and authentication are two sides of one coin. Together they ensure that malicious users can’t gain access to your system.

The safest path is to adopt default denial, which means that everybody is denied access until they can prove their credentials to be bona fide.

Simplicity

Keep your code simple, clean, efficient, and minimal. If your code is transparent to read, it will not have any unnecessary complexity that clouds vulnerabilities that creep in under the fog.

Adopting cryptographic technology

There is always some information in any system or application that needs to remain secret. Some other information is not supposed to be secret precisely, but it should be available only to authorized users. So let’s face it, there are always some secrets to protect, which takes cryptographic technology. And cryptographic development has its own set of security rules –learn them, practice them.

Errors

Have you ever written a piece of code that compiled correctly on the first try? Neither have we. And we’re talking about errors that will prevent a program from running at all. Other errors will always creep in, the ones that run along with your program but do something you don’t want.

Yes, even the best programmer in the world will allow some errors to occur first. So you need to have a way to find them and deal with them. And that’s all keeping proper logs that allow for forensic analysis and diagnostics.

Data protection

Hackers target your system for a reason: they want the data it holds. The more sensitive, the better. So keeping your data secured is the name of the game. Here are some of the best practices for data protection:

• Adhere to the principle of least privilege. If a user doesn’t have a minimal degree of rights to complete a task, do not allow it.
• Keep your cache clean. 
• Passwords and connection strings do not belong in plain-text files. They have to be encrypted.

Threat modeling

If you are unaware of a given threat, you can’t fight it. So if you’re going to keep an eye open for the security risks out there, you’ll need to know what to look for and what to expect. Threat modeling is the only way to achieve that. First, you must come up with the most likely threats your system will face and then with a set of countermeasures for each.

And remember that this is not a one-time thing. The internet’s digital environment is constantly changing, and your threat models and countermeasures must move with the times.

Walk the extra mile

Successful security measures are never about one thing only, even when it’s something as essential as programming code. Instead, good security requires an integrated approach that considers the whole environment and is constantly aware and vigilant. So yes, write the best code you can, but also do this:

• Practice the “least privilege” scheme. Access must be need-to-know only and only when proper credentials are supplied.
• Defend in depth. Your defense strategy must comprise several lines. And do not forget that runtime environments need securing everything as much as production software.
• Ensure good quality.
• Learn about the Software development Life Cycle (SDLC), and understand how it helps develop secure code and put it into practice.

Other useful resources

Digital security is a dynamic, ongoing process. If you’re going to keep up with the times, you’ll need to be ready to learn constantly. You can help your ongoing education process by making sure you have access to the following resources:

• Microsoft’s Bible on Secure Coding. Microsoft wants its products to be as secure as possible, so it’s created a guide on secure coding for programmers creating software for Microsoft’s platforms. This comprehensive guide deals with every stage in the program’s development’s life cycle.
• OWASP developer guide. A good starting point to help you avoid the most frequent security errors. It also has a tool that tells you if any of your program’s dependencies are vulnerable.
• OWASP Security Knowledge Framework. It’s an open-source web app that explains how secure coding works depending on the programming language of your choice. 
• Red Hat tutorials. Red Hat has a set of tutorials that cover all the basics to get started with secure coding. And you don’t have to be a Linux user to take advantage of them.
• CAST Software and CheckMarx. These two companies are in the business of sweeping your source code to find potential security problems. If you’re new to secure coding and are unsure about what you’re doing, then take advantage of expert service.

Reasons why you should be securing your code

Code repository security

Secrets, credentials, and sensitive data do not belong in remote repositories. Of course, the developer often doesn’t mean to do this, but it happens because he follows the defaults without paying attention to where the critical information gets stored.

Remote repositories are readily available for hackers and malicious users to scan, so you must ensure they will find nothing there.

Password management in code

Not including passwords in your source code is one of the most basic security measures you can think about. This is no different from just publishing that password when dealing with an attacker who knows his craft. 

Plenty of well-known security breaches started with a hard-coded password into the software. For example, the Mirai malware incident of 2016 or the Uber breach that leaked the information of 57 million users.

This is a basic rule. Get the basics right. Always.

Dependency security

Open-source projects are the main force behind the digital world today. As estimations go, about 4/5 of today’s software runs on open-source libraries and platforms. And nearly one-quarter of those libraries are known to be vulnerable somehow.

So when you’re working on your next project, ensure you know if the libraries and dependencies you intend to use are secured. If they’re not, then find a way to substitute them.

Container security

Containerizing application is a growing worldwide trend that is here to stay. But, if you’re going to join the hype, you must ensure that your container is clean. Otherwise, that polluted container image can cost your employer millions in fines, losses, and sales.

Web page security

Exposed secret keys give unauthorized users the right to perform any task. So if they have that magic key, they can download your site’s most sensitive data or overload your database with any garbage they would like and delete production databases.

Your web page is not only your project’s gate to the world. Unfortunately, it’s also how unwanted intruders can come in. So make sure they don’t.

DDoS mitigation and network security

DDoS used to be exotic. They’re now the bread and butter of any security expert. They’re not just more common but also more subtle and sophisticated.

While DDoS used to be directed toward the internet’s giants (Yahoo, Microsoft, etc.), any server can and will be targeted in our day and age.

So you need to make sure you are aware of anti-DDoS measures and be ready to deploy them.

0Auth

The 0Auth standard is loaded with ambiguities in how it handles pattern matching. Thus, it makes URL redirect attacks possible.

You can prevent this type of attack by ensuring that your servers have URL validations in place.

Final thoughts

Everything starts with a piece of source code in the digital world. And that includes security. Writing secure code is an integral part of a genuinely excellent piece of software.

Neglecting security in your software puts your customers at risk; it will harm your company’s reputation and your own reputation within the company. In other words: everybody loses.

The good news is that there is plenty of literature and help out there so you can get started with secure coding, confident that your chances to succeed are indeed very high. Thus you will meet the goal that every user on the internet should have in mind: staying safe.

FAQs