In this introduction to ISO 27001 Secure Coding you will learn
- What ISO 27001 secure coding is
- Introductory compliance guidance
I am Stuart Barker and this is ISO 27001 Secure Coding Explained Simply.
Table of contents
ISO 27001 Secure Coding
Secure Coding focuses on building security directly into the software development process. Furthermore, it emphasises the importance of integrating security considerations directly into the software development process. This aligns with the concept of “security by design and default,” where security is built into the software from the ground up, rather than being an afterthought.
This proactive approach aims to prevent security vulnerabilities by ensuring secure software development practices.
It includes activities such as:
- Code reviews: Regularly reviewing code for security vulnerabilities.
- Threat modelling: Identifying and addressing potential security threats during the design and development phases.
- Secure coding standards: Adhering to established secure coding guidelines and standards.
- Developer training: Educating developers on secure coding principles and techniques.
Who owns it?
The Chief Information Security Officer (CISO), supported by software development specialists, is responsible for identifying, approving, and implementing information security requirements for secure coding.
Compliance Guidance
The following is compliance guidance for secure coding.
Establishing a Secure Coding Framework:
Define and implement organisation-wide secure coding standards and guidelines.
Establish a minimum security baseline for all software development activities.
Extend these practices to cover third-party components and open-source software.
Continuous Improvement:
Continuously monitor emerging threats and vulnerabilities.
Regularly review and update secure coding principles based on new information and best practices.
Before Coding:
Define clear expectations and approved principles for secure coding.
Analyse historical coding practices and common vulnerabilities.
Configure development tools (e.g., IDEs) to support secure coding practices.
Ensure developers are qualified and trained in secure coding techniques.
Incorporate secure design and architecture principles, including threat modelling.
During Coding:
Utilise secure coding practices specific to the programming languages being used.
Employ techniques like pair programming, code reviews, and test-driven development.
Adhere to structured programming principles.
Document code thoroughly and address identified defects promptly.
Prohibit the use of insecure design techniques (e.g., hard-coded passwords).
After Coding:
Conduct thorough security testing throughout the development and testing phases.
Securely package and deploy software applications.
Vulnerability Management:
Respond to reported vulnerabilities effectively (see 8.8).
Monitor logs for errors and suspected attacks to identify and address issues.
Protect source code from unauthorised access and tampering.
Using External Components:
Manage external libraries effectively (e.g., maintain an inventory and ensure timely updates).
Select and utilise well-vetted components, especially for critical functions like authentication and cryptography.
Consider the license, security history, and long-term availability of external components.
Modifying Software Packages:
Carefully consider the potential risks
Assess the impact of modifications on the integrity of built-in security controls.
Obtain vendor consent when necessary.
Evaluate the potential for obtaining required changes through standard program updates.
Determine the impact of potential future maintenance responsibilities.
Ensure compatibility with other software systems.
Supplementary Guidance
Secure Code Execution:
Tamper Resistance: Ensure that security-relevant code is executed as intended and cannot be easily modified or compromised.
Secure Execution Environments: For interpreted languages, restrict code execution to secure environments (e.g., servers with limited user access, cloud services with strong access controls) to minimise the risk of unauthorised access and modification.
Strong Authentication: Implement robust authentication and authorisation mechanisms for administrative access to secure environments.
Assume Breach:
Design applications under the assumption that they are always subject to attack, whether intentional or unintentional.
Implement fault tolerance mechanisms to minimise the impact of potential errors or attacks.
Prevent Common Vulnerabilities:
Address common web application vulnerabilities like SQL injection and cross-site scripting through secure design and coding practices.
External Guidance
Refer to the ISO/IEC 15408 series for further guidance on information and communication technology (ICT) security evaluation.
ISO 27001 Secure Development Policy Template
The following is a fully ISO 27001 compliant ISO 27001 Secure Development Policy Template.
Further Reading
ISO 27001 Annex A 8.28 Secure Coding
ISO 27001 Secure Development Policy Template
ISO27001 Annex A 8.25 Secure Development Life Cycle
ISO27001 Annex A 8.26 Application Security Requirements
ISO27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles
ISO27001 Annex A 8.29 Security Testing in Development and Acceptance
ISO 27001 Annex A 8.30 Outsourced Development
ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments
