Monetary Authority of Singapore Technology Risk Management Guidelines 6.1: 6.1 Secure Coding, Source Code Review and Application Security Testing

To minimise bugs and vulnerabilities the FI should adopt standards on secure coding, source code review and application security testing, covering secure programming, input validation, output encoding, access controls, authentication, cryptographic practices and error and exception handling. Third-party and open-source code should be reviewed and tested under a policy before integration, and its updates and reported vulnerabilities tracked for timely remediation. Developers should be trained to apply the standards; a comprehensive application security validation strategy may combine static, dynamic and interactive testing (Annex A), with rules reviewed periodically; and all issues from code review and testing should be tracked, with major ones remediated before production.