Community Guidance to Prevent Common Coding Errors
Created December 2017 • Updated December 2019
With the billions of lines of code that software developers generate each year, the potential for errors is high. The SEI leads a community initiative to identify unsafe, unreliable, and insecure coding practices to help establish secure coding standards that organizations can implement into their development lifecycles to prevent vulnerabilities.
Vulnerabilities from Coding
Coders are not just translators who take software designs and create secure and functional programs from them. Coding can include numerous pitfalls, and although some vulnerabilities come from design, most of a system’s vulnerabilities are introducing during the coding phase.
Coding standards can help prevent these pitfalls and avoid vulnerabilities, which is the reason that such standards are increasingly established as a requirement by organizations such as the Department of Defense. Establishing and updating standards, however, can pose challenges. Standards must address large volumes of violations found by conformance testing, and the standards must not result in bloated code.
To establish usable and effective coding standards, we need broad collaboration with experts in different coding languages as well as security researchers and software developers. In addition, we must establish ongoing work to continue to evolve and refine the standards.
Leveraging Community Knowledge to Develop Standards
To address the risk of introducing vulnerabilities during coding, the CERT Division of the SEI leads an effort to engage the programming community to develop coding standards. In Spring of 2006, at the meeting of the C Standards Committee in Berlin, Germany, the idea for the CERT C Coding Standard arose as a community-based project where contributors could work together to document their ideas in a wiki-based group. Experts from the programming community, including members of the C Standards Committee, were invited to contribute and were provided with editing privileges on the wiki.
The project we launched in 2006 has developed and evolved over the years. The CERT Coding Standards wiki has more than 1,500 registered contributors, and coding standards have been completed for C, Java, C++, and Perl, and other languages under development.
Our secure coding standards are developed by studying the standards that define the programming languages themselves and how they are interpreted and compiled for runtime platforms. They also reflect our experience with audits of millions of lines of source code and countless contributions from the community. We have contributed to international committees to improve the security of the programming languages and tools that are used to build systems with those languages.
Our secure coding standards consist of actionable guidelines (rules and recommendations), which provide information about the types of security flaws that can be injected through development with specific programming languages. Each guideline offers a wealth of precise information describing the cause and impact of violations, including examples of common noncompliant (flawed) and compliant (fixed) code. Each guideline also includes a risk assessment for violations to it. You can access and download the standards for secure coding on the Secure Coding wiki.
Learn More
The Future of Cyber: Secure Coding
•Podcast
Bobbie Stempfley, director of the CERT Division of the SEI, explores the future of secure coding with Steve Lipner, the executive director of SAFECode and former director of software security at Microsoft.
ListenSecure Coding Newsletter Collection
•Collection
The CERT Secure Coding Team describes plans to inform the community about CERT secure coding efforts and related standards.
Learn MoreFour Secure Coding Publications
•Collection
Presents research and recommended practices for secure coding, preventing common exploits, and prioritizing security alerts.
Learn MoreCERT Secure Coding Books
•Collection
The following books were published as part of the Secure Coding work conducted in the CERT Division of the SEI.
Learn MoreRelated Courses
CERT Secure Coding in C and C++ Professional Certificate
The CERT Secure Coding in C and C++ Professional Certificate provides software developers with practical instruction based upon the CERT Secure Coding Standards. The CERT Secure Coding Standards have been curated from the contribution of 1900+ experts for the C and C++ programming language. The CERT Secure Coding team teaches the essentials of designing and developing secure software in C and C++. Completion of this Professional Certificate will enable software developers to increase security and reduce vulnerability within the C and C++ programs they develop.To learn more about all the CERT Secure Coding Professional Certificates, please see: SEI Certificates.The CERT Secure Coding in C and C++ Professional Certificate is a certificate program that includes two courses and an examination, which are all available online. This Certificate program package includes the required courses, exam, and 3 e-books for continued study.Secure Software ConceptsSecure Software Concepts explores basic security concepts and how security design principles protect the organization. Risk assessment and management, regulatory requirements, and software design are examined within the context of the organization's acquisition and development lifecycles to prepare the student for a deeper study of secure coding. This eLearning course contains two hours of video instruction that may be studied incrementally.Secure Coding in C and C++Secure Coding in C and C++ provides detailed instruction about common programming errors in C and C++ and describes how these errors can lead to code that is vulnerable to exploitation. The course concentrates on security issues intrinsic to the C and C++ programming languages and associated libraries. The intent is for this course to be useful to anyone involved in developing secure C and C++ programs regardless of the specific application. Moreover, this course encourages programmers to adopt security best practices and develop a security mindset that can help protect software from tomorrow's attacks, not just today's.Instruction is accomplished through recorded lectures from SEI instructors. Course exercises allow the concepts taught to be applied in a virtual environment ‹ VM and exercise application files are supplied for download. This eLearning course contains twenty (20) hours of video instruction, that may be studied incrementally, and six (6) optional exercises.This course is also offered as instructor-led training at customer sites.CERT Secure Coding in C and C++ Professional CertificateThe CERT Secure Coding in C and C++ Professional Certificate concludes with an examination of the student's comprehension of the concepts presented in the preceding courses. The exam consists of 40 multiple choice questions. Students proceed through the exam at their convenience over 6 total hours. Students must achieve a passing score of 80%.Please note that successful completion of all program components are necessary to achieve the professional certificate....
RegisterCERT Secure Coding in Java Professional Certificate
The CERT Secure Coding in Java Professional Certificate provides software developers with practical instruction based upon the CERT Secure Coding Standards. The CERT Secure Coding team teaches the essentials of designing and developing secure software in Java. Completion of this Professional Certificate will enable software developers to increase security and reduce vulnerability within the Java programs they develop.To learn more about all the CERT Secure Coding Professional Certificates, please see: SEI Certificates.The CERT Secure Coding in Java Professional Certificate is a certificate program that includes two courses and an examination, which are all available online. This Certificate program package includes the required courses, exam, and 2 e-books for continued study.Secure Software ConceptsSecure Software Concepts explores basic security concepts and how security design principles protect the organization. Risk assessment and management, regulatory requirements, and software design are examined within the context of the organization's acquisition and development lifecycles to prepare the student for a deeper study of secure coding. This eLearning course contains two hours of video instruction that may be studied incrementally.Secure Coding in JavaSecure Coding in Java provides a detailed explanation of common programming errors in Java and describes how these errors can lead to code that is vulnerable to exploitation. The course concentrates on security issues intrinsic to the Java programming languages and associated libraries. The intent is for this course to be useful to anyone involved in developing secure Java programs regardless of the specific application.Instruction is accomplished through recorded lectures from SEI instructors. Course exercises allow the concepts taught to be applied in a virtual environment ‹ VM and exercise application files are supplied for download. This eLearning course contains (16) hours of video instruction of video, that may be studied incrementally, and four (4) optional exercises.This course is also offered as instructor-led training at customer sites.Secure Coding in Java ExaminationThe CERT Secure Coding in Java Professional Certificate concludes with an examination of the student's comprehension of the concepts presented in the preceding courses. The exam consists of 40 multiple choice questions. Students proceed through the exam at their convenience over 6 total hours. Students must achieve a passing score of 80%. Once answers are submitted, the exam will provide your score immediately and allow one opportunity to review and change responses to rescore, if necessary.Please note that successful completion of all program components are necessary to achieve the professional certificate....
RegisterSecure Coding in Java
Producing secure programs requires secure designs. However, even the best designs can lead to insecure programs if developers are unaware of the many security pitfalls inherent in Java programming. This four-day course provides a detailed explanation of common programming errors in Java and describes how these errors can lead to code that is vulnerable to exploitation. The course concentrates on security issues intrinsic to the Java programming languages and associated libraries. The intent is for this course to be useful to anyone involved in developing secure Java programs regardless of the specific application. Please note: you must bring a laptop computer equipped with the latest version of Adobe Reader and VMware Player. See the Prerequisites section for download information. The course assumes basic Java programming skills but does not assume an in-depth knowledge of software security. Material in this presentation was derived from the Addison-Wesley books The CERT Oracle Secure Coding Standard for Java and Java Coding Guidelines....
Register