CISSP考试指南笔记：8.7 安全编码

Secure coding is the process of developing software that is free from defects, particularly those that could be exploited by an adversary to cause us harm or loss.

Source Code Vulnerabilities

The Open Web Application Security Project (OWASP) is an organization that deals specifically with web security issues.

Secure Coding Practices

One of the organizations that consistently produces good coding standards is Carnegie Mellon University’s Software Engineering Institute (SEI). SEI’s top 10 secure coding practices are listed here along with our brief take on them:

1. Validate inputs.
2. Heed compiler warnings.
3. Architect and design for security policies.
4. Keep it simple.
5. Default deny.
6. Adhere to the principle of least privilege.
7. Sanitize data sent to other systems.
8. Practice defense in depth.
9. Use effective quality assurance techniques.
10. Adopt a secure coding standard.

The ISO/IEC 27034 standard covers the following application security areas: overview and concepts (Part 1); organization normative framework (Part 2); application security management process (Part 3); protocols and application security controls data structure (Part 5); case studies (Part 6); and assurance prediction framework (Part 7).