General Guidelines for Network Programs

Follow these guidelines to enhance the security of network programs:
  • Perform a reverse lookup on an IP address to obtain the fully qualified domain name, and then use that domain name look up the IP address. Ensure that both IP addresses are identical.

  • Protect a service against Denial of Service (DoS) attacks by pausing the processing of requests if it becomes overloaded.

  • Set timeouts on read and write requests over the network.

  • Check the content, bounds, value, and type of data received over the network, and reject any data that doesn't conform to what the program expects.

  • Use certificates or preshared keys to authenticate the local and remote ends of the network connection.

  • Use encryption technology such as TLS or SSL to secure data sent over the network connection.

  • Wherever possible, use existing networking protocols and technologies whose security characteristics are widely understood.

  • Log any information about successful and unsuccessful connection attempts, data reception, and transmission errors, and changes to the service state.