Toward a readiness model for secure software coding

Abstract

The heart of the application's secure operation is its software code. If the code contains flaws, the entire program might be hacked. The issue with software vulnerabilities is that they reveal coding flaws that hackers could exploit. The prevention of cybersecurity issues begins with the program code itself. When writing software code, a software developer must consider expressing the application's architecture and design requirements, keeping the code streamlined and efficient, and ensuring the code is safe. Secure code helps save the system from various cyber-attacks by eliminating the weaknesses that many hacks rely on. To assist the software organization in Secure Software Coding (SSC), this article proposes a readiness model for SSC, namely SSCRM. The proposed model has five levels; SSC challenges and best practices (BP) are mapped at each level. The proposed model will help the organizations better understand SSC challenges and BPs and provide a roadmap for developing secure software code. The proposed model was evaluated using three case studies. The findings demonstrate that the proposed approach helps determine an organization's SSC level.

Organizational information security threats: Status and challenges

“…Technologies alone are not enough; secure coding practices play a vital role in preventing vulnerabilities and reducing the risk of exploits. Secure coding frameworks, guidelines, and training programs help developers write secure software [92]- [95].…”

Secure Software Development Best Practices

“…Security is a crucial aspect that necessitates careful consideration right from the inception of the software development process. Bugs and faults identified in the early stages of development are more easily and cost-effectively addressed in comparison to those discovered at later Hence, the integration of security measures throughout the whole Software Development Life Cycle (SDLC) is necessary in order to provide secure conventional practices, security is commonly regarded as a secondary concern that is addressed by developing patches for any vulnerabilities discovered during project testing or post-deployment [4] . Briefly, software security may be defined as the protection of software applications from unauthorized access, use, or destruction.…”