PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security

Statement

Use compiler, interpreter, and build tools that offer features to improve executable security.

Example 1:

Use up-to-date versions of compiler, interpreter, and build tools.

Example 2:

Follow change management processes when deploying or updating compiler, interpreter, and build tools, and audit all unexpected changes to tools.

Example 3:

Regularly validate the authenticity and integrity of compiler, interpreter, and build tools. See PO.3.

Statement

Determine which compiler, interpreter, and build tool features should be used and how each should be configured, then implement and use the approved configurations.

Example 1:

Enable compiler features that produce warnings for poorly secured code during the compilation process.

Example 2:

Implement the “clean build” concept, where all compiler warnings are treated as errors and eliminated except those determined to be false positives or irrelevant.

Example 3:

Perform all builds in a dedicated, highly controlled build environment.

Example 4:

Enable compiler features that randomize or obfuscate execution characteristics, such as memory location usage, that would otherwise be predictable and thus potentially exploitable.

Example 5:

Test to ensure that the features are working as expected and are not inadvertently causing any operational issues or other problems.

Example 6:

Continuously verify that the approved configurations are being used.

Example 7:

Make the approved tool configurations available as configuration-as-code so developers can readily use them.