Group 8 Research Essay
Benefits of Secure Coding in Programming
Logan Moore
Dillon Firman
Maverick Burchfield
Mathew Walden
CS304-002
Cynthia Jensen
04/03/2025
Table of Contents
1. Abstract.................................................................................................1
2. Why Are Secure Coding Practices Important?................................2
3. What Could Happen if You Don’t Use Secure Programming
Practices?................................................................................3
4. Common Points of Failure in Improperly Secured Programs..........4
5. Real-World Examples of These Failures and Their Results..............5
6. Brief History of Secure Coding Practice..........................................6
7. Introduction of Copyright and SEI.....................................................7
8. The Equifax Breach..........................................................................8
9. How Can We Practice Secure Coding?............................................9
a. General Rules..............................................................................9
b. Input Validation...........................................................................10
c. Access Control............................................................................11
d. Encryption...................................................................................12
10. Conclusion.......................................................................................13
11. References.......................................................................................14
List of Illustrations

Figure 1. OWASP Logo – Symbol of global software security standards

Figure 2. Equifax Data Breach – Referenced in the Equifax breach case study
Abstract
secure programming plays a vital part in software development. In this paper, the
importance of secure programming, the risks associated with not doing so, and the
particular vulnerabilities that occur in insecurely written software have been discussed.
Drawing lessons based on the past using the background of past events, industry
standards, and real-world data breaches such as Equifax and Yahoo, it emphasizes the
importance of proactive security. It talks about the chief secure programming practices
such as input scrubbing, access control, and encoding, all based on OWASP and SEI
standards. With increasing cyber-attacks, including secure programming right at the
start becomes a necessity in maintaining data security, system reliability and stability,
and customer confidence.
Why Are Secure Coding Practices Important?
Secure coding practices are essential to defending software from malicious attacks,
system vulnerabilities, and user unpredictability. In a world where interactions with software are
required for everyday life such as banking, shopping and entertainment, the integrity of the
systems we use is paramount. By implementing secure coding practices, developers can prevent
unauthorized access, protect sensitive data, and ensure the reliability of the software. Secure
coding practices may also be a requirement in your field if the data you are working with is
highly sensitive, such as healthcare records which are protected by HIPAA.
What Could Happen if You Don’t Use Secure Programming Practices?
Failing to follow secure coding practices can have pretty bad consequences including
financial loss, reputation loss and legal repercussions. One of the most common risks is data
breaches, where customer or company information is stolen where it could be released or sold.
Cybercriminals exploit vulnerabilities in poorly coded software to gain access to this protected
information. This can result in identity theft, financial fraud, and disruptions to businesses and
peoples lives. Poorly coded software can also allow criminals to gain access to other networks or
software through the use of worms or distributed denial-of-service attacks.
Common Points of Failure in Improperly Secured Programs
Several common vulnerabilities include:

SQL Injection: Attackers insert SQL queries into input fields to manipulate or extract
data from databases.

Cross-Site Scripting (XSS): Malicious scripts are injected into web applications to
execute actions in a user’s browser.

Buffer Overflow: Programs overwrite memory due to improper input handling, leading to
crashes or exploitation by attackers.

Insecure Authentication and Authorization: Weak or improperly implemented
authentication mechanisms can allow unauthorized users to access sensitive systems.

Improper Error Handling: Exposing system errors can give attackers information about
the workings of an application, which they can use to exploit it.

Lack of Data Encryption: Failure to encrypt data leaves it vulnerable to theft.
Real-World Examples of These Failures and Their Results

Equifax Data Breach: The Equifax hack resulted from an unpatched security vulnerability
in the Apache Struts web framework. This allowed attackers to steal personal information
of nearly 147 million individuals, leading to severe financial and reputational
consequences for the company.

Heartbleed Bug: A vulnerability in OpenSSL allowed attackers to extract data from
memory, including passwords and encryption keys. This affected millions of websites
and services.

Target Data Breach: Cybercriminals gained access to Target’s payment system by
exploiting weak security in a third-party vendor’s credentials. The breach resulted in the
exposure of 40 million credit and debit card details, costing Target hundreds of millions
in damages and settlements.

Yahoo Data Breaches: A series of security lapses exposed the personal data of
approximately 3 billion user accounts. Weak encryption and delayed security responses
worsened the impact, leading to a massive loss of trust in the company.
These examples demonstrate the consequences of failing to adhere to secure coding
practices. Implementing secure coding practices from the development stage can mitigate risks
and protect both users and organizations from cyber threats.
Brief History of Secure Coding Practice
Secure coding practices have evolved within computing, mirroring increasing complexity
and interconnectivity of computers. Security, in its early years, wasn't really thought of to be
frank. Technological innovation such as the growth of the internet. Early network building, as
embodied by ARPANET, which was a military idea that had communication and data exchange
as its top concern as opposed to security protocols. As explained by Gharbawi (n.d.), "The
revolution in computer networking began in the 1960s with creation of the ARPANET, a
network designed to link computers in research institutions and defense bases." But as society
transitioned from individual networks towards a world network, problems in the architecture
started to appear more often.
Introduction of Copyright and SEI
In the 1980s and 1990s if you had a personal computer, you could have illegally accessed
information and participate in malicious activity. It was also a period when copyright legislation
was created, intended to protect hardware and software against inappropriate usage. Measures
were insufficient to fix and protect, though. The game of cat and mouse between coders and
hackers put emphasis on the necessity of integrating security into the development process
urgently.
With that institutions like the Software Engineering Institute (SEI) were formed to help
spread awareness about secure coding practices for some of the more well-known languages now
as Java and C. The SEI acts as a repository of information dissemination about secure coding
practices. The SEI (n.d.a) advocates "Better Software Through Secure Coding". The active
security approach to solving problems before having a chance to become exploitable shifted their
plans from reacting to what the hackers do to trying to stop it before it even happens. The SEI
also asserts, “The SEI owns and retains all rights, title, and interest in and to the SEI Marks”
(SEI, n.d.b).
The Equifax Breach
The 2017 Equifax breach serves as a reminder that they should have followed secure
coding practices. The breach, in which personal data of approximately 143 million individuals
was stolen. The gained access due to a patch that was known in the Apache Struts framework.
The hackers gain access to personal data including addresses, SSN’s, and other personal data.
Nadeau (2017), in "Equifax says website vulnerability exposed 143 million U.S. consumers,"
states that The Equifax breach showed more than anything else how important it is for secure
coding practice to stop breaches before they happen. The breach is just one of many ways not to
follow secure coding practices. How it can lead to financial losses, loss of reputation, as well as
public distrust.
How Can We Practice Secure Coding?
Secure coding is an important part of program planning that is used to limit
vulnerabilities and maintain personal data safety and security. Secure coding uses a list of
general guidelines and applies certain mechanisms like input validation, access control, and
encryption to ensure data security.
General Rules
One of the essentials of secure coding is a strong defense employing multiple layers of
defense instead of just one strong layer. OWASP strongly advises this defense-in-depth approach
where multiple layers are used to protect a single point of failure impact. OWASP (Open Web
Application Security Project) is a prominent, international, not-for-profit organization with a
mission to increase security in software globally. OWASP shares useful resources, tools, and
advice with security specialists and software developers all over the world. OWASP is respected
by technical experts all over the world and is seen as one of the top authorities when it comes to
cybersecurity. Organizations all over the world use OWASP documents, such as OWASP Top
10 and cheat sheets, as guidelines when enforcing secure coding. OWASP strongly advises
starting to implement security during the software development lifecycle, explaining that
"security must be addressed early and continuously throughout the software development
process" (OWASP DevSecOps Guideline). By keeping code simple and removing any
unnecessary features, OWASP is able to optimize software by limiting any possible gaps in the
code caused by complexity, which can be easy to miss. OWASP-recommended techniques also
involve regular security testing, code reviews, and staying up-to-date with the latest security
vulnerabilities and techniques.
Input validation
Input validation involves ensuring that data input by users complies with the format given
by the developer. By simply adding input restrictions into one’s software they can greatly
decrease security breaches. SQL injection, cross-site scripting (XSS), and buffer overruns all can
be defeated by simply creating and securing validation on any input found in the site(OWASP
Input Validation Cheat Sheet). The developer can stop malicious input before an application runs
by checking data type, length, form, and content thoroughly. The OWASP Input Validation
Cheat Sheet emphasizes early validation, stating that, "Input Validation should occur as early as
possible in the data flow, and ideally as soon as the data is received from the user" (OWASP
Input Validation Cheat Sheet). Early action reduces the security risks by lessening weak points
for possible attackers before it’s too late. Common input validation types include data type
checking, checking against ranges, and sanitization (OWASP Input Validation Cheat Sheet).
Secure input validation blocks attack surfaces significantly, securing sensitive data as well as
software integrity.
Access Control
Access control is a security protocol that controls who or what is able to access resources
in a computing setting. It is important for protecting sensitive data and critical system functions
from unauthorized access. Organizations can ensure that only authorized users or processes can
perform specific actions by implementing secure access control measures. The OWASP Access
Control page defines it as "Access Control...is mediating access to resources on the basis of
identity and is generally policy-driven...It is the primary security service that concerns most
software, with most of the other security services supporting it" (OWASP Access Control).
Common techniques include role-based access control (RBAC) and attribute-based access
control (ABAC) (OWASP Access Control), which assign permissions based on user roles and
permissions. Using the principle of least privilege, which grants users only the necessary
permissions to perform their tasks, allows the company to minimize the risk of unauthorized
access. Properly implemented access control prevents data breaches, maintains data integrity,
and ensures compliance with OWASP requirements.
Encryption
Encryption converts data into an unreadable format, called ciphertext, which can only be
decrypted using a secret key. It is an important security measure that protects data while in
transit and at rest. In its "Testing for Weak Encryption" guide, OWASP emphasizes that "The
goal of cryptography is to provide confidentiality, integrity, and authenticity. Weak cryptography
can be broken, leading to the exposure of sensitive data" (OWASP Testing for Weak
Encryption). This points out that using strong encryption algorithms and proper key management
is crucial. Testing for weak encryption includes analyzing the code, key length, and encryption
mechanisms to find potential weaknesses. For example, using out-of-date or bad encryption keys
can weaken the protection placed on important information. Strong and up-to-date encryption
software and encryption keys protect data from breaches, even if the attacker gains access to the
encrypted data.
Conclusion
Secure coding practices are a foundational element of responsible software development.
As the internet continues to grow and systems become more complex, the need for built-in
security becomes more urgent. The devastating consequences of high-profile breaches like
Equifax and Yahoo highlight the risks of overlooking secure development protocols. Thankfully,
resources like OWASP and institutions like the SEI provide developers with tools, guidelines,
and support to write safer, more resilient code. By understanding vulnerabilities, embracing early
and consistent validation, enforcing access control, and leveraging strong encryption, developers
can build software that not only functions well but also stands firm against the threats of a
connected world.
Resources
CSO Online. (2020, March 18). What is OWASP and why it matters for AppSec.
https://www.csoonline.com/article/560221/what-is-owasp-and-why-it-matters-forappsec.html
CyberSaint. (2019, July 9). The Equifax aftermath: A lesson in due care.
https://www.cybersaint.io/blog/equifax-aftermath-due-care
Gharbawi, A. (n.d.). The history of computer networking.
https://sites.cs.ucsb.edu/~almeroth/classes/F04.176A/homework1_good_papers/AlaaGharbawi.html
Leyden, J., & Barker, P. (2025, April 1). The 18 biggest data breaches of the 21st century. CSO
Online. https://www.csoonline.com/article/567911/the-18-biggest-data-breaches-of-the21st-century.html
Nadeau, M. (2017, September 7). Equifax says website vulnerability exposed 143 million U.S.
consumers. CSO Online. https://www.csoonline.com/article/562865/equifax-sayswebsite-vulnerability-exposed-143-million-us-consumers.html
OWASP. (n.d.). Access control. https://owasp.org/www-community/Access_Control
OWASP. (n.d.). DevSecOps guideline. https://owasp.org/www-project-devsecopsguideline/latest/
OWASP. (n.d.). Input validation cheat sheet. OWASP Cheat Sheet Series.
https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
OWASP. (n.d.). Testing for weak encryption. https://owasp.org/www-project-web-securitytesting-guide/latest/4-Web_Application_Security_Testing/09Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption
Seacord, R. (2018). Top 10 secure coding practices. Carnegie Mellon University.
https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=534644
Software Engineering Institute. (n.d.-a). Legal. https://www.sei.cmu.edu/legal/
Software Engineering Institute. (n.d.-b). Secure development. https://insights.sei.cmu.edu/securedevelopment/