I would appreciate pointers to either publicly or commercially available sets. Here is the list so far
Some other relevant sites include
Hope you find this helpful. I plan to keep this list current.
An0n S3c
Sunday, September 28, 2008
Secure Coding Standards ...
I was (actually still am) looking for a comprehensive set of secure coding standards that I can implement for my development teams. Ideally, I would like to find a set of standards that
can be updated automatically/easily - that way, we are working to current recommendations
I can add our own specific recommendations without making the content upgrade difficult - for example, we have our own encoding routines
can be implemented internally - e.g., it comes as a web portal
is prescriptive and can be easily applied
I would appreciate pointers to either publicly or commercially available sets. Here is the list so far OWASP Development Guide and OWASP Backend Security Project - thanks to Bedirhan Urgun for the pointer
CERT Secure Coding Standards - thanks to Robert C. Seacord for the pointer
Joint Strike Force AV C++ Coding Standards and MISRA C Coding Standards - thanks to Robert C. Seacord for the pointer
OpenOffice C++ Coding Standards
Andrew van der Stock's Coding Standards - thanks to Jim Manico for pointer
Microsoft's MSDN Secure Coding Standards - thanks to Jim Manico for pointer
Some other relevant sites include DHS Build Security In
SANS Software Security Institute
CERT Top 10 Secure Coding Practices -
SANS GIAC Secure Software Programmer
Hope you find this helpful. I plan to keep this list current.
An0n S3c
I would appreciate pointers to either publicly or commercially available sets. Here is the list so far
Some other relevant sites include
Hope you find this helpful. I plan to keep this list current.
An0n S3c
Subscribe to:
Post Comments (Atom)
Posts
2 comments:
We at Foundstone do offer such standards. Please refer to http://www.foundstone.com/us/services-software-policy-procedures-standards.asp for more details and contact us if interested. We look forward to helping you.
Last year, I did a thesis that focused partly on mapping rules for writing secure Java code to secure design principles. I mainly covered core Java SE, but the list is fairly comprehensive. You can see my taxonomy here:
A Taxonomy of Heuristics for Writing Secure Java Code
Post a Comment