What should every programmer know about security? [closed]

Question

Principles to keep in mind if you want your applications to be secure:

• Never trust any input!
• Validate input from all untrusted sources - use whitelists not blacklists
• Plan for security from the start - it's not something you can bolt on at the end
• Keep it simple - complexity increases the likelihood of security holes
• Keep your attack surface to a minimum
• Make sure you fail securely
• Use defence in depth
• Adhere to the principle of least privilege
• Use threat modelling
• Compartmentalize - so your system is not all or nothing
• Hiding secrets is hard - and secrets hidden in code won't stay secret for long
• Don't write your own crypto
• Using crypto doesn't mean you're secure (attackers will look for a weaker link)
• Be aware of buffer overflows and how to protect against them

There are some excellent books and articles online about making your applications secure:

• Writing Secure Code 2nd Edition - I think every programmer should read this
• Building Secure Software: How to Avoid Security Problems the Right Way
• Secure Programming Cookbook
• Exploiting Software
• Security Engineering - an excellent read
• Secure Programming for Linux and Unix HOWTO

Train your developers on application security best pratices

Codebashing (paid)

Security Innovation(paid)

Security Compass (paid)

OWASP WebGoat (free)

Rule #1 of security for programmers: Don't roll your own

Unless you are yourself a security expert and/or cryptographer, always use a well-designed, well-tested, and mature security platform, framework, or library to do the work for you. These things have spent years being thought out, patched, updated, and examined by experts and hackers alike. You want to gain those advantages, not dismiss them by trying to reinvent the wheel.

Now, that's not to say you don't need to learn anything about security. You certainly need to know enough to understand what you're doing and make sure you're using the tools correctly. However, if you ever find yourself about to start writing your own cryptography algorithm, authentication system, input sanitizer, etc, stop, take a step back, and remember rule #1.

Every programmer should know how to write exploit code.

Without knowing how systems are exploited you are accidentally stopping vulnerabilities. Knowing how to patch code is absolutely meaningless unless you know how to test your patches. Security isn't just a bunch of thought experiments, you must be scientific and test your experiments.

Security is a process, not a product.

Many seem to forget about this obvious matter of fact.