Technical Dimension
Software Developer Behavior (SODB)
The SODB dimension establishes the behavioral standards for secure development, focusing on robust input validation, secure error handling, and the rigorous management of external software dependencies.
SODB1Secure Coding Practices
SODB1.1Safe input validation
- ✓SODB1.1.1Validates inputs against a defined set of allowed values (using whitelists)
- ✓SODB1.1.2Applies length restrictions on input fields to prevent buffer overflows and excessive data submission
- ✓SODB1.1.3Consistently uses trusted input validation libraries and frameworks rather than writing custom validation code
- ✓SODB1.1.4Ensures that all input is validated on the server side and not just the client side
- ✓SODB1.1.5Ensures that the application handles invalid or malicious input gracefully, without crashing or revealing sensitive system information
- ✓SODB1.1.6When integrating with external systems or third-party services, input data is validated to ensure it meets internal security requirements
- ✓SODB1.1.7Regularly reviews logs for patterns of invalid input attempts
- ✓SODB1.1.8Validates each step for multi-step or dependent inputs to ensure data integrity at every stage
SODB1.2Secure error handling
- ✓SODB1.2.1Ensures that error messages do not include detailed technical information that reveals internal logic or infrastructure details
- ✓SODB1.2.2Ensures that detailed error information logged internally for debugging purposes is stored in a secure, access-controlled environment
- ✓SODB1.2.3Implement checks to sanitize error logs to avoid capturing sensitive data
- ✓SODB1.2.4Uses a centralized error handling mechanism to ensure consistent behavior across the application when errors occur
- ✓SODB1.2.5Limits the amount of information provided in production error logs compared to development environments
- ✓SODB1.2.6Logs errors related to security events with detailed information and flags them for further investigation
SODB1.3Secure code reviews
- ✓SODB1.3.1Actively checks for common security vulnerabilities such as those listed in the OWASP Top 10
- ✓SODB1.3.2Ensures that the code adheres to proper business logic
- ✓SODB1.3.3Ensures that all inputs are properly validated and sanitized
- ✓SODB1.3.4Ensure that the code follows the principle of least privilege
- ✓SODB1.3.5Checks whether unnecessary or untrusted libraries are included in the project to minimize the attack surface
- ✓SODB1.3.6Ensures code simplicity to reduce the chances of introducing vulnerabilities due to complexity or unclear logic
- ✓SODB1.3.7Ensures that critical sections of code are well-documented and contain comments that explain the security considerations involved
- ✓SODB1.3.8Ensures that the code is reviewed against a predefined security checklist or framework
- ✓SODB1.3.9Engage multiple reviewers to review critical code sections to ensure no vulnerabilities are overlooked
SODB2Secure Management of Dependencies and Third-Party Libraries
SODB2.1Secure dependency updation
- ✓SODB2.1.1Routinely check for and apply updates to dependencies
- ✓SODB2.1.2Specifies dependency versions in configuration files to avoid unintended updates that might introduce vulnerabilities
- ✓SODB2.1.3Only downloads dependencies from reputable sources
- ✓SODB2.1.4Configures builds to fail or raise alerts when vulnerabilities are detected in dependencies
- ✓SODB2.1.5Checks the license of dependencies to ensure compliance with legal and organizational policies
- ✓SODB2.1.6Maintains documentation of all dependency updates
SODB2.2Secure maintenance of third-party libraries
- ✓SODB2.2.1Conducts routine scans of third-party libraries to ensure that libraries’ licenses have not changed
- ✓SODB2.2.2Maintain an up-to-date list of all third-party libraries used in the project, along with their versions and security status