1. Validate input from all untrusted data sources. Proper input validation can eliminate the vast majority of software vulnerabilities. Be suspicious of most external data sources, including commandline arguments, network interfaces, environmental variables, and user controlled files.
  2. Compile code using the highest warning level available for your compiler and eliminate warnings by modifying the code \[[C MSC00-A|MSC00-A. Compile cleanly at high warning levels], [C+\+ MSC00-A|cplusplus:MSC00-A. Compile cleanly at high warning levels] \].
  3. Create a software architecture and design your software to implement and enforce security policies. For example, if your system requires different privileges at different times consider dividing the system into distinct intercommunicating subsystems, each with an appropriate privilege set.
  4. Keep the design as simple and small as possible. Complex designs increase the likelihood that errors will be made in their implementation, configuration, and use. Additionally, the effort required to achieve an appropriate level of assurance increases dramatically as security mechanisms become more complex.
  5. Base access decisions on permission rather than exclusion means that, by default, access is denied and the protection scheme identifies conditions under which access is permitted.
  6. Every processes should execute with the the least set of privileges necessary to complete the job. Any elevated permission
    should be held for a minimum time. This approach reduces the opportunities an attacker has to execute arbitrary code with elevated privileges.
  7. Sanitize all data passed to complex subsystems \[[C STR02-A| STR02-A. Sanitize data passed to complex subsystems]\] such as command shells, relational databases, or commercial-off-the-shelf (COTS) components.  Attackers may be able to invoke unused functionality in these components through the use of SQL, command, or other injection attacks.

References