ISO 27001 A.8.28: Secure coding

Define secure coding standards for each programming language and framework your team uses. Base them on OWASP Secure Coding Practices and language-specific guides (CERT standards for C/C++, Java, Python, etc.). The critical practices: Input validation - validate everything on the server side. Use allowlists, not blocklists. Check data type, length, range, and format. Reject invalid input outright rather than trying to clean it up. Output encoding - encode output based on context (HTML, URL, JavaScript) to prevent XSS. Use templating engines with auto-escaping turned on by default. Parameterised queries - use prepared statements for every database query. Never concatenate user input into SQL strings. This single practice eliminates SQL injection. Authentication and session management - use established frameworks, not custom implementations. Generate secure, random session identifiers. Enforce session timeouts and regenerate session IDs after login. Cryptography - use well-tested libraries, never roll your own. Follow your organisation's cryptographic standards. Never hard-code secrets or keys in source code. Error handling - catch all error conditions. Log enough detail for debugging but show generic messages to users. Never leak stack traces, database errors, or internal paths. Verification - integrate SAST tools into your workflow and CI/CD pipeline. Configure rules that match your coding standards. Require code reviews with a security focus. Use pre-commit hooks to catch common issues before they even reach the repository. Train your developers on secure coding. Make it language-specific and practical - exercises, code review examples, security challenges. Track completion and build competency over time.