ASD ISM 2041 Ensure use of memory-safe programming practices

Software developers should select programming languages that are designed to prevent memory errors, such as Java, Python, or Rust, when starting a new project.

These languages automatically manage memory, which can prevent many types of security vulnerabilities. Developers can research and choose a language that best fits the project requirements while enhancing security.

IT managers should organise training for their team on memory-safe programming practices.

This can include workshops or online courses that focus on understanding how memory errors occur and how to avoid them using safe coding techniques. Engaging a trainer with expertise in memory-safe code is a practical approach to ensure the team has the necessary skills.

Project leaders should establish coding standards that prioritise memory safety.

These standards should be integrated into the development process and include guidelines on using safe libraries and frameworks. Document these standards and ensure that all developers are familiar with and follow them.

Quality assurance teams should incorporate static analysis tools to check the code for memory safety issues before the software is released.

Tools like Clang or Coverity can be set up to automatically scan code and highlight potential problems. This step helps catch errors early in the development cycle.

Procurement officers should ensure that external software vendors adhere to memory-safe practices.

When evaluating software from other companies, include memory safety requirements in their evaluation criteria and ask vendors to provide evidence of their memory management practices.