## 9 Security and Privacy Risk Controls
### Implementation and Verification of Security and Privacy Risk Controls  
In the development phase, the developer will implement and verify each of the selected controls. During the implementation, developers should consider secure coding practices. The developer will use organization defined secure coding practices if available;  
Figure 10: Selection and implementation process of security and privacy risk controls. otherwise the developer can follow the secure coding guidelines provided below. Finally, to verify whether controls have been implemented properly, code review and unit testing should be conducted. Secure coding guidelines:  
Validate input from all data sources. Compile code using the highest warning level and take necessary action to resolve the warnings. Use version control to track code changes. Sanitize the input to SQL statements. Use parameterized SQL statements. Do not use string concatenation or string replacement to build SQL statements. Use the latest version of compilers, which often include defences against coding errors; for example, GCC protects code from buffer overflows. Include proper error/exception handling. Check the return values of every function, especially security and privacy related functions. Encode HTML input field data. Do not store sensitive data in cookies. Use code review tools to find security and privacy issues early. Code Review: Code review is an effective technique to examine the source code to minimize coding errors and reduce the risk of introducing vulnerabilities during the implementation phase. Secure coding guidelines also need to be considered during the code review process. Code review can be performed manually and/or by using an automated tool. To conduct a manual code review, organizations need to assign an experienced person from the development team. To conduct a code review using an automated tool, an organization needs to select the tool based on the technology stack. There are various automated code review tools available such as: SonarQube, IBM Security AppScan, Code Dx or Veracode which support a wider range of technology stacks. Unit Testing: Unit testing is a testing method which helps to test an individual unit or component of an application. The goal of unit testing, from a security and privacy perspective, is to verify that each implemented control effectively mitigates its respective risk. Sample acceptance criteria for unit-tests are present in Table 11. The example below details the test to verify that the countermeasure for _\"Weak Authentication Scheme\"_ is properly implemented. Sample use case: User login with username and password  
Test objectives: Verify that the user authentication is aligned with business and security requirements  
If the code review or unit test identifies any control failures, then the developer needs to conduct the following steps in order:  
Review the reason for the failure and take necessary action based on the scenario presented in Section 9.3. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Id** & **Test Case** & **Expected Result** \\ \hline \multirow{2}{*}{Test01} & Testing for valid user with & \multirow{2}{*}{Successful authentication response} \\  & right password & \\ \hline \multirow{2}{*}{Test02} & Testing for valid user with & Authentication failed due to the \\  & wrong password & wrong password \\ \hline \multirow{2}{*}{Test03} & Testing for a nonexistent username & \multirow{2}{*}{\
\begin{tabular}{c} Authentication failed due to \\ invalid username \\ \end{tabular} } \\  & & \\ \hline \multirow{2}{*}{Test04} & Testing authentication with & Authentication failed due to empty \\  & blank passwords & password supplied \\ \hline \multirow{2}{*}{Test05} & Attempt to log in with an incorrect & \multirow{2}{*}{
\begin{tabular}{c} Account locked out due to maximum \\ try with the wrong password. \\ \end{tabular} } \\  & password four times & \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Sample acceptance criteria for unit testing.