We have discussed secure coding industry best practices, such as CERT, CWE, Android secure coding, OWASP Code Review, and the Apple secure coding guide. Based on those secure coding rules, we established secure coding baselines as part of the security policy and release criteria. To allow the team to be familiar with secure coding, a training portal was prepared. It was suggested that the secure coding knowledge portal should provide not only coding rules but also case studies.
To apply secure coding to developers' daily tasks, secure coding tools must be adopted. We evaluated secure coding tools, taking into account usability, budget, programming language support, detection rates, and scanning rule maintenance. To evaluate the detection rate of a scanning tool, we also introduced some vulnerable projects that can be used as testing projects.
Secure coding rules and...
