> Markdown version of [/videos/220-software-security-101-secure-coding-basics?t=6334](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics?t=6334). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Software Security 101: Secure Coding Basics

Are you sacrificing software security for faster release cycles? Discover how to prevent crippling technical debt by mastering foundational secure coding practices and architectural threat modeling.

- **Speakers:** Thomas Konrad
- **Event:** World Congress 2021
- **Published:** June 30, 2021
- **Duration:** 1:58:48
- **URL:** https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics

## Summary

Software security mimics structural engineering: bypassing structural safety requirements might provide initial velocity for releasing early code, but it invariably introduces technical debt that cripples sustained velocity over time. This foundational session outlines the difference between architectural project flaws—likened to the design oversight of the Tacoma Narrows Bridge—and implementation bugs, stressing the need to integrate security non-functional requirements actively from day one. While secure applications can be built in practically any programming language, leaning into strict type systems and memory safety drastically minimizes unanticipated runtime vulnerabilities while allowing Static Application Security Testing (SAST) tools to build highly accurate abstract syntax trees and avoid flagging false positives.

Delving into secure coding practices, engineers are encouraged to apply the "economy of mechanisms" by maintaining clean, auditable architectures and reliably deleting obsolete code. The presentation defines contextual output encoding as the strongest defensive measure against injection and cross-site scripting (XSS), reminding developers that while input validation helps lower the application's attack surface, it rarely mitigates specific vulnerabilities entirely. Additional implementation practices call for utilizing the principle of complete mediation to assert access controls on every single request and leveraging built-in framework systems for session token management rather than fabricating custom routines. When facing complex objectives like end-to-end encryption, structural complications like multi-device key recovery underscore the universal mantra to "never roll your own crypto."

True application hardening extends beyond code and requires a shift-left approach to the entire Software Development Lifecycle (SDLC). Integrating practices like architectural threat modeling and enforcing automated, build-failing dependency checks on untrusted foreign code dramatically reduces exposure prior to compiling payloads. Adopting structured frameworks such as the OWASP Software Assurance Maturity Model (SAMM) helps organizations benchmark their CI/CD maturity. Ultimately, automated scanners can only establish a scalable security baseline; bridging the remaining gap demands a deep understanding of application logic to mitigate business-specific, nuanced OWASP threats securely.

**Keywords:** OWASP software assurance maturity model, contextual output encoding, static application security testing, software technical debt, scalable security baseline, cross-site scripting prevention, strict typing advantages, memory safety mechanisms, complete mediation principle, input sanitization techniques, secure session management, automated dependency checks, API excessive data exposure, end-to-end encryption challenges, cryptographic key derivation, thread concurrency race conditions, SDLC threat modeling

## Chapters

1. **Understanding the importance of building secure software systems** (00:02) — Early integration of security practices reduces future costs and technical debt.
1. **Establishing core security terms and design principles** (07:40) — Understanding key concepts like technical debt, bugs versus flaws, and defense in depth establishes communication baselines.
1. **Evaluating programming languages by their security criteria** (22:14) — Programming attributes like memory safety, type strictness, and sandbox support heavily impact overall application robustness.
1. **Validating and encoding inputs to prevent injection attacks** (39:24) — Differentiating input validation from sanitization safely embeds untrusted data into target structures.
1. **Implementing strong cryptography, session management, and concurrency** (58:36) — Establishing non-guessable session identifiers and avoiding race conditions prevents severe logic exploits.
1. **Identifying and mitigating top software vulnerability classes** (75:30) — Navigating recognized vulnerability lists like OWASP Top 10 establishes targeted defensive strategies.
1. **Managing risks associated with generic third-party dependencies** (87:42) — Mitigating potential exploits introduced by external code requires automated dependency auditing inside deployment pipelines.
1. **Integrating security into the software development process** (92:48) — Shifting left using the OWASP Software Assurance Maturity Model discovers design flaws effectively early.
1. **Recommended training platforms for developing security mindsets** (99:21) — Exploring deliberately vulnerable applications and educational environments helps developers practice active hacking techniques.
1. **Answering audience questions on practical application security** (105:34) — Expert insights address discovering vulnerabilities, static analysis tool selection strategies, and memory management considerations.

## Related Moments

- [Making security a foundational feature in software development](https://www.wearedevelopers.com/videos/100358-always-on-the-right-track-with-rails-with-eileen-uchitelle-senior-system-engineer-at-github) (from "Always on the Right Track with Rails with Eileen Uchitelle, Senior System Engineer at GitHub")
- [Defining fundamental starting points for software application security](https://www.wearedevelopers.com/videos/357-climate-vs-weather-how-do-we-sustainably-make-software-more-secure) (from "Climate vs. Weather: How Do We Sustainably Make Software More Secure?")
- [Addressing developer adoption and future software security risks](https://www.wearedevelopers.com/videos/900-from-syntax-to-singularity-ai-s-impact-on-developer-roles) (from "From Syntax to Singularity: AI’s Impact on Developer Roles")
- [Introduction to secure development and OWASP SAMM](https://www.wearedevelopers.com/videos/351-maturity-assessment-for-technicians-or-how-i-learned-to-love-owasp-samm) (from "Maturity assessment for technicians or how I learned to love OWASP SAMM")
- [Identifying non-coding software vulnerabilities and organizational risks](https://www.wearedevelopers.com/videos/712-unleashing-the-power-of-developers-why-cybersecurity-is-the-missing-piece) (from "Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?")
- [Introduction to speaker and software security concepts](https://www.wearedevelopers.com/videos/1126-programming-secure-c-net-applications-dos-don-ts) (from "Programming secure C#/.NET Applications: Dos & Don'ts")

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Security Basics for Vibe Coders](https://www.wearedevelopers.com/magazine/598-security-basics-for-vibe-coders)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Software Engineer II, Security](https://www.wearedevelopers.com/jobs/ext/131510-software-engineer-ii-security) at **GitHub**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**