How do you secure your code?

You should also consider the availability of mature security related libraries or its binding with each language. For example while Haskell is very secure language due to being pure functional language, availability of security related libraries is very limited compared to other more popular languages like Rust, Go, Java etc.

Validate user inputs, do not accept anything that is not expected. Make UI logical and explain why input is not accepted. Accept only flow that is correct.

Over time, programming languages have undergone significant advancements, offering numerous options to consider. The selection of a programming language should align with the specific requirements of each application. Factors such as user-friendliness, robustness, and security play pivotal roles in making the appropriate decision. Additionally, memory management tools can be employed to identify and address memory leaks effectively.

I've found Abloy locks to be pretty good for securing things. And I am talking about the disc tumbler locks, not these easily pickable pin tumbler locks. Even the original Abloy my grandad used is better than just about any modern pin tumbler lock.

In addition, you can also use tools like static analyser to detect any security issue in the codebase. This kind of tool is more sophisticated than normal tools provided by language installations.

If you are not Microsoft, Google etc. get out of the business of keeping the passwords of other people. Use "login with LiveID, Facebook ID, Google ID" basically a trusted third-party ID which is issued by a big corporation. Obviously, the tasks of MFA, Text Messages, etc. are taken care of by those big corporations and all you hold is the user token / session token. Makes it easier to pass the Security Reviews later :-)

Once you get the dependencies sorted out on your dev machine, copy them in your source repository as External Libraries, which are always available next to the source code. If you have to compile the program inside a quarantined environment (i.e. no access to internet) you can. My team had to do this on multiple occasions when the team had to work from within banks and fincos. In case of open-source code usage in your software, have the source code of the open-source component checked in your repository and "freeze" the versions. Too many time my teams have had to work through issues because of issues e.g. this version of say Hibernate does not work with that version of Java and so on...

In my experience, a codebase that is security critical need to have test driven development, where we define the standard the codebase need to adhere to and then expand upon it by writing test cases which should cover ALL possible code-paths in the application. Advantage of doing this is, there is very less chance of our security critical codebase deviating from the security standard defined which means less possibility of security vulnerability due to human errors.

Based on my experience, testing plays a crucial role in ensuring code quality. The availability of numerous testing tools enhances the overall effectiveness of the testing process. OWASP ZAP, for example, proves to be a valuable asset for identifying security vulnerabilities in the code. Integrating such tools into the development process, following the Test Driven Development approach, empowers developers to detect and address potential issues earlier in the Software Development Life Cycle.

- Avoid blindly importing third-party libraries; take the time to understand their source code and documentation. - Understand the library from the creator's perspective, not just as a user. - Specifically refer to and comprehend the methods or functions you plan to use after importing the library. - Replicate the concepts in your code to prevent unnecessary vulnerabilities. - Be cautious about updating packages without reading the change notes, as it can lead to issues.

In my experience, using static and dynamic code analysis tools helps to a great extent. Developer could integrate this with either the code editor or with CI pipeline to perform periodic checks. Failing the build is considered to be the best approach to address the problem at source.

Running your code through Fortify to identify the vulnerabilities in your code really helps. Then from there you can identify where to secure your code!

Eventual goal of the code is to be deployed to users, so protecting the deployment process is the next logical step. Different types of deployments require different approaches. For example if your code is deployed as an executable or binary, it needs to be signed. The signing process needs to be secure so that the certificate used to sign the binaries need to be secured and not tampered easily. If the code is deployed as a service then there is a need to ensure the process to deploy the same are controlled around who and how that code is deployed. It could go through pre-production environments first for validation. Eventually the process for code reaching customers should follow controlled methods