4.4 Summary

Even though security flaws made at the design stage may be more costly and difficult to fix after the software is written, it is at the implementation stage that the "last chance for safety" occurs. Clearly, there are a great many things that you must keep in mind when implementing your design. Coding a software design is a process that requires a great deal of caution and care, and there is no substitute for experience. And even the experts often get it wrong!

We all can learn from how things are done in other industries. In the aviation industry, practitioners make extensive use of checklists, in addition to training pilots on an ongoing basis on how to properly operate their aircraft. They also intensely analyze the mistakes of others; whenever an accident takes place, the Federal Aviation Administration (here in the U.S.?no doubt other countries have similar practices) distributes a causal analysis memo to all pilots, for mandatory reading. We all are well advised to learn from that model. Study all the information that you can find; pedantically use checklists at each step of the development process; test and retest every aspect of your software.

Never assume that you have stopped learning how to implement secure code. Oh, and if you must make mistakes in your software, at least be original!


  • What "do's and "don't's" can you add to our list? That is, what did we miss?

  • Which of our pointers do you think fall under the rubric of "common sense"? Perhaps more interestingly, which don't?

  • This chapter lists a couple of dozen concrete technical implementation tips that can strengthen program security. Consider now: if you have had formal training in software engineering, how many of these points were covered in your coursework? If you are self-trained, how many of them occurred to you as you were writing code? How many did you learn the hard way?