Secure Coding
What is Secure Coding?
The practice of writing software code that is resistant to security vulnerabilities. Secure coding practices include input validation, output encoding, proper error handling, and following guidelines such as the OWASP Secure Coding Practices.
Terms that appear alongside secure coding
Each of these is named in at least one of the same controls as secure coding. The number is how many controls name both.
- security testing 11 shared controls
- code review 11 shared controls
- threat modelling 9 shared controls
- vulnerability 9 shared controls
- owasp 8 shared controls
- application security 8 shared controls
- threat modeling 6 shared controls
- nist 4 shared controls
Frameworks that govern secure coding
What the standards actually require on secure coding
Requirements naming secure coding across 6 standards, quoted from the control text.
Processes mitigate the vulnerabilities that secure development of systems and applications turns up.
ffiec-cybersecurity-assessment-tool-cat::D3.PC.Se.Int.1 · D3.PC.Se.Int.1 Secure Coding (Intermediate 1) →Software development is to follow secure coding principles. Purpose: have software written securely so that it contains fewer potential security vulnerabilities.
iso-27002-2022::8.28 · Secure coding →Make sure everyone who develops software is trained to write secure code suited to their own development environment and duties. Training may cover general security principles and standard application security practice.
CIS-16.9 · Train Developers in Application Security Concepts and Secure Coding →Make sure everyone who develops software is trained, at least yearly, in writing secure code for their own environment and responsibilities, covering general security principles and standard application security practice, delivered in a way that builds a secur...
cis-controls-v8-1::16.9 · Train Developers in Application Security Concepts and Secure Coding →The bank implements secure coding practices for internally and collaboratively developed applications.
rbi-cybersecurity-framework-for-banks::80 · Para 80: secure coding for internal and collaborative development →A process shall be employed to ensure that secure coding standards are documented, applied and kept current for each language used, covering prohibited constructs, input validation, error handling, memory safety and the other areas the standard names.
iec-62443::SI-2 · Secure coding standards →Questions people ask about secure coding
What is Secure Coding?
Why is Secure Coding important for compliance?
Which compliance frameworks address Secure Coding?
Where can I learn more about Secure Coding?
See how Secure Coding applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.