• Secure Design Patterns Updated October 2009
  This newly updated technical report describes a set of secure design patterns, which are descriptions or templates describing a general solution to a security problem that can be applied in many different situations.
• As-if Infinitely Ranged Integer Model Published
  This paper presents a model for automating the elimination of integer overflow and truncation in C and C++ programming code.
• Robert Seacord on the CERT C Secure Coding Standard
  Robert C. Seacord and David Chisnall discuss the CERT C Secure Coding standard, developing C standards, and the future of the language and its offshoots.
• Evaluation of CERT Secure Coding Rules through Integration with Source Code Analysis Tools
  This report describes a study conducted by the CERT Secure Coding Initiative and JPCERT to evaluate the efficacy of the CERT Secure Coding Standards and source code analysis tools in improving the quality and security of commercial software projects.

Secure Coding standards web site
A collaborative site that provides rules and recommendations for secure coding practices in the C and C++ programming languages is now available at http://www.securecoding.cert.org. You are invited to review and comment on already codified practices or submit suggestions for new practices. If you have a comment or suggestion concerning the site, or would like to be more directly involved in the effort, send email to secure-coding at cert dot org.

Managed string library
A beta implementation of the managed string library specified by "Specifications for Managed Strings" is now available for download. The managed string library provides a more secure alternative to standard null-terminated byte strings in C. Managed string functions dynamically allocate memory as required, eliminating the possibility of buffer overflows, string truncation, and other common programming errors.

Integral Security
Integers represent a growing and underestimated source of vulnerabilities in C and C++ programs. CERT's Secure Coding Initiative has been working on a number of solutions for addressing the issue of integral security including the AIR integer paper and prototype, a secure integer library, and a paper on ranged integers.

• Software Assurance
• Standards and Guidelines
• Static Source Code Analysis Tools
• Secure Programming

• As-if Infinitely Ranged Integer Model
• Evaluation of CERT Secure Coding Rules through Integration with Source Code Analysis Tools
• Ranged Integers for the C Programming Language
• Specification for Managed Strings
• Secure Coding in C++/CLI
• Secure Coding in C and C++
• Software Vulnerabilities in Java
• rlogin(1): The Untold Story

• Implementing Secure Coding Standards in a System Acquisition (pdf)
• Mapping of CERT C Secure Coding Standard to Application Security and Development Checklist, version2, release 1.5 (pdf)
• Secure Coding Governance and Guidance (pdf)
• Secure Coding Plan (pdf)
• SOW paragraphs for Application of Secure Coding Methods (pdf)