Microsoft® Windows® 2000 Security Handbook

Software Security Explained

The concepts behind secure software are often simple but rarely considered by most programmers in the design and implementation of their programs.

The following are prime tenets in writing secure software:

• Give your software the least privileges it needs.

• Check all return codes religiously.

• Don't make assumptions about anything.

• Test and retest your code in as many environments as possible.

• Fail closed.

• Be paranoid.

Following these simple tenets could reduce most security-related bugs in software today.

You might be wondering how an attacker can break the security of your programs even though you did not follow those tenets. Security bugs are rarely obvious. Often, they do not show up during normal testing conditions. Attackers ...