PW.5 Create Source Code by Adhering to Secure Coding Practices

Statement

Follow all secure coding practices that are appropriate to the development languages and environment to meet the organization’s requirements.

Example 1:

Validate all inputs, and validate and properly encode all outputs.

Example 2:

Avoid using unsafe functions and calls.

Example 3:

Detect errors, and handle them gracefully.

Example 4:

Provide logging and tracing capabilities.

Example 5:

Use development environments with automated features that encourage or require the use of secure coding practices with just-in-time training-in-place.

Example 6:

Follow procedures for manually ensuring compliance with secure coding practices when automated methods are insufficient or unavailable.

Example 7:

Use tools (e.g., linters, formatters) to standardize the style and formatting of the source code.

Example 8:

Check for other vulnerabilities that are common to the development languages and environment.

Example 9:

Have the developer review their own human-readable code to complement (not replace) code review performed by other people or tools. See PW.7.