CVE-2024-20659

Requiring documented development standards and tools can embed input-validation practices into the engineering process.

A.8.25 mandates security requirements, secure coding guidelines, checkpoints, testing (incl. code scans) and developer training in the SDLC, which reaches a slice of input validation defects but leaves the majority (incomplete enforcement, second-order inputs, parser differentials, post-validation canonicalization) unaddressed as in the SA-3 and A.8.28 anchors.

Mandating input controls that include integrity checks and input validation ensures that untrusted data is examined before use, blocking the root cause of many injection and malformed-data weaknesses.

Security-by-design principles explicitly call for data validation and sanitization at every layer, reducing the chance that malformed or malicious input will be processed without scrutiny.

Requiring language-specific secure coding standards, peer review, SAST and documented mitigation of common programming errors forces validation of all inputs before they are trusted.

Testing against a defined set of requirements and using code review plus vulnerability scanning forces validation of inputs and handling of unanticipated conditions, reducing the chance that malformed data will be accepted.