Secure Coding

Tutorials and training on how to build secure applications using the latest in secure and defensive programming strategies.

In this session, we'll give a demonstration of using a centralized authentication service to secure many different microservices. The demo will be based on Project Keycloak, but it would apply as well to Stormpath, Ping.Indenty, or similar services.

Steven Pousty
Red Hat Developer Alumnus

What is Secure Coding?

Secure coding is a set of technologies and best practices for making software as secure and stable as possible. It encompasses everything from encryption, certificates, and federated identity to recommendations for moving sensitive data, accessing a file system, and managing memory. Although the security landscape is always changing, secure coding tries to make building secure software more of a science than an art. 

Free Best Practices Guide for Defensive Coding

Writing secure code should be top of mind, especially given the number of application security breaches that find their way into the news. A critical first step is learning important secure coding principles and how they can be applied so you can code with security in mind. The Fedora Project's Defensive Coding Guide provides guidelines for improving software security through secure coding. It covers common programming languages and libraries, and focuses on concrete recommendations.

  • The first part of the book contains useful tips for seven programming languages, such as C++, Java, or Go.
  • Part two is dedicated to secure coding principles from manipulating files to processes.
  • Part three offers tips for authentication, authorization, cryptographic protocols, hardware security modules, and smart cards.

Start Reading

The Latest on Secure Coding & Security

Vulnerability analysis for Golang applications with Red Hat CodeReady Dependency Analytics

Vulnerability analysis for Golang applications with Red Hat CodeReady Dependency Analytics

April 15, 2021

Red Hat CodeReady Dependency Analytics, powered by Snyk Intel Vulnerability database, helps developers find, identify, and fix security vulnerabilities in their code. In the latest 0.3.2 release, we focused on supporting vulnerability analysis for Golang application dependencies, providing easier access to vulnerability details uniquely known to Snyk, and other user experience improvements. Vulnerability analysis for […]

Securely connect Red Hat Integration Service Registry with Red Hat AMQ Streams

Securely connect Red Hat Integration Service Registry with Red Hat AMQ Streams

April 7, 2021

Red Hat Integration Service Registry is a datastore based on the Apicurio open source project. In my previous article, I showed you how to integrate Spring Boot with Service Registry. In this article, you’ll learn how to connect Service Registry to a secure Red Hat AMQ Streams cluster. Connecting Service Registry with AMQ Streams Service […]

Get started with clang-tidy in Red Hat Enterprise Linux

Get started with clang-tidy in Red Hat Enterprise Linux

April 6, 2021

Clang-tidy is a standalone linter tool for checking C and C++ source code files. It provides an additional set of compiler warnings—called checks—that go above and beyond what is typically included in a C or C++ compiler. Clang-tidy comes with a large set of built-in checks and a framework for writing your own checks, as […]

Improving security with Istio | DevNation Tech Talk

Improving security with Istio | DevNation Tech Talk

April 1, 2021

As we move toward cloud-native infrastructure and build our applications with microservices, we must fully face the drawbacks and challenges involved. One of the most important aspects is securing (through authentication and authorization) the services correctly. In this session, we’ll show how Istio can simplify your security model when adopting (micro) services architecture.

X.509 user certificate authentication with Red Hat's single sign-on technology

X.509 user certificate authentication with Red Hat's single sign-on technology

February 19, 2021

This article illustrates how to configure a browser authentication flow using X.509 user-signed certificates. Once you have set up authentication using X.509 user-signed certificates, your users will not be required to enter a username and password when authenticating against Red Hat’s single sign-on technology (SSO). Instead, they will present an X.509 certificate to the SSO […]

More articles on security

Latest Comments

Waiting for Disqus…