Secure coding

Secure Coding Resources: Popular Books, Whitepapers, Tutorials and More

Secure coding is seen as a manner of writing source code compatible with the best security principles for a given system and interface. All devices, platforms, systems and even people have their own vulnerabilities and are exposed to several attack vectors and security issues, including cyberattacks and hacking.

In this sense, IT developers need to realize how important the principle of secure coding is. It can help to anticipate security challenges and prevent security issues in a premature design phase.

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

Learn More

Some of the strategies used include the validation of all external inputs to ensure that input comes from trusted sources, checking the range of allocated memories in order to prevent buffer overflows, and many others; the list is immense. To fight this problem, developers must create a new doctrine to make secure code possible, preventing and reducing its exposure to the backdoors, loopholes, and vulnerabilities that can invite hackers.

In this article, we will present some resources connected to secure coding, including books, guides, whitepapers and discussion forums that can provide valuable information for both new students and experts.

Popular Books About Secure Coding

This section presents some interesting books that can help programmers improve their secure coding skills.

Secure Computer Software Development: Introduction to Vulnerability Detection Tools, by Ron McFarland, Ph.D., PMP, CISSP (Buy here)

A solid introduction to secure coding with screenshots, tools and compliance guidelines for best practices provided by OWASP and CERT. Rather than being a deep dive, this book serves as an introductory text. It includes a list of additional resources provided by the author and is under revision to reflect new information.

Engineering Safe and Secure Software Systems (Artech House Information Security and Privacy), by C. Warren Axelrod (Buy here)

If you need a broad spectrum of knowledge about secure system engineering, this is the place to begin. With a strong focus on different approaches based on situational data and the different types of risk, Engineering Safe and Secure Software Systems provides a valuable resource for a student looking to get a sense of the breadth of the field and the many different aspects of the security landscape.

The Software Vulnerability Guide (Programming Series) by Herbert H. Thompson and Scott G. Chase (Buy here)

Aimed specifically at developers and testers, The Software Vulnerability Guide tackles the issue of secure code from the development side of the equation. Guides like this are extremely important both for professional programmers and tester/developers, as many security issues begin as developer mistakes or oversights. The book covers a variety of tools, techniques, potential issues and the vulnerabilities that can result from them.

Secure Coding: Principles and Practices by Mark G. Graff and Kenneth R. van Wyk (Buy here)

Why is code today prone to vulnerabilities? What can be done to stem the problem at its source? Secure Coding: Principles and Practices provides a sweeping overview of the secure coding issue, based on the authors’ decades of experience. Readers will explore secure coding throughout each stage of the development life cycle.

Popular Whitepapers About Secure Coding

Whitepapers can provide important guidelines that help to implement software more efficiently and with fewer flaws. By following these guidelines, programmers can make their code more resilient against cyberthreats and slow or prevent dangerous attacks.

OWASP

OWASP provides a secure coding practices quick reference guide with a set of general software security coding practices, compiled in a checklist format that can be integrated into the development life cycle.

Veracode Whitepaper

Veracode provides a guide that give practical tips in using secure coding best practices. This resource is based on the OWASP Top 10 Proactive Controls, widely considered the gold standard for application security.

Best Online Forums, Discussion Boards, Lectures and Tutorials

OWASP: This is one of the standards for software development. Here experts will find content focused on clear, simple, actionable guidance for providing input validation security functionality in their applications.

GitHub: This resource provides a collection of sources related to several programming languages and technologies. Various approaches, best practices, examples and some discussion in general can be found to help experts in their daily tasks.

Secure Coding LinkedIn Group: This is a secure coding forum that is facilitated by the CERT Secure Coding Team at the Software Engineering Institute at Carnegie Mellon University. It will provide guidance and expertise in identifying common programming mistakes that can lead to software flaws and also help to educate software developers.

YouTube: Below are some videos related to secure coding and that can help programs to improve your development skills.

Secure Coding Best Practices, Coding Tech
How to Write Secure JavaScript Applications, Coding Tech
From Secure Coding to Secure Software, Software Engineering Institute

Final Thoughts

Secure code is a practice that can protect code from vulnerabilities, and today, it is more important than ever. We understand that flaws in software can result in denial of service conditions, compromised secrets, loss of service, damage to the systems of thousands of users and possibly even loss of life — just remember the vulnerabilities identified in pacemaker devices!

In fact, developing secure software is not an easy task, but looking for the number of cyberattacks these days, it should be considered a mandatory form of study for all developers. By educating programmers to avoid common security mistakes, performing security code reviews and testing applications for security bugs, organizations can quickly eliminate most of the vulnerabilities recently exploited by criminals.

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

Learn More

Sources

Secure Coding, Techopedia
What Is Secure Coding?, Performance
Secure Coding, Symantec
Secure Coding Practices, OWASP
Recent Threats, Segurança Informática

Posted: March 6, 2019

Pedro Tavares

View Profile

Pedro Tavares is a professional in the field of information security working as an Ethical Hacker, Malware Analyst and a Security Evangelist. He is also Editor-in-Chief of the security computer blog seguranca-informatica.pt.

In recent years, he has invested in the field of information security, exploring and analyzing a wide range of topics, such as malware, reverse engineering, pentesting (Kali Linux), hacking/red teaming, mobile, cryptography, IoT, and security in computer networks. He is also a Freelance Writer.