How can secure code be created?

Creating secure code involves adopting several key practices and principles:

1. Defensive Programming:

   • Rey Bango emphasizes the importance of defensive programming, which involves anticipating potential failures and designing code to handle those gracefully. This includes validating all input data and ensuring proper error handling to prevent unexpected system behavior 1.

2. Vetting Third-Party Packages:

   • It's crucial to audit and vet external packages before incorporating them into your project. This involves understanding how the code works and ensuring it does not introduce vulnerabilities into your system. Using private package managers can help maintain control over the packages used 2.

3. Secure Coding Practices:

   • Developers should be familiar with common secure coding practices such as proper input validation, parameterization, and avoiding common vulnerabilities like SQL injection and cross-site scripting (XSS). Rey Bango highlights that while not every developer needs to be a security expert, understanding these patterns and practices is essential for reducing the threat landscape 3.

     Security as Software Bug

     Priyanka Raghavan

     Rey Bango

     Rey emphasizes that security issues should be viewed as software bugs, highlighting the importance of proper input validation and data handling throughout the development lifecycle. He argues that every major hack in recent history has compromised software, urging developers to integrate security into their coding practices. Priyanka points out that the challenge lies in adopting secure coding as a fundamental aspect of software design, which requires new skills and approaches.

     

     Software Engineering Radio - the podcast for professional software developers

     Episode 475: Rey Bango on Secure Coding Veracode

     Explore similar conversationsView full episode summary

     1

     2

     3

     4

     5

     6

4. Immutable Packages and Defense in Depth:

   • Design systems with the assumption that any code may eventually have bugs or act as a security vector. Implementing defense-in-depth strategies, where multiple layers of security are in place to protect against breaches, can enhance security. Immutable package repositories and public databases for checkpoints help in managing code security 4.

5. Infrastructure as Code (IaC):

   • Secure coding isn't limited to application code but also includes infrastructure code. Ensure that infrastructure configurations (e.g., Terraform scripts) are secure and reviewed. Validate the security of the infrastructure setups and control access to who can deploy what resources 5.

6. Avoiding Common Pitfalls:

   • Avoid storing secrets in source control. Ensure that sensitive data like passwords and API keys are managed securely, using environment variables or dedicated secret management tools. Starting with security in mind from the beginning of the project helps prevent the need for rushed, insecure implementations later 6.

These practices, when integrated into the development lifecycle, can significantly reduce the risk of vulnerabilities and ensure the creation of secure code.