[ISM] Output encoding and escaping:

[OWASP] Apply proper output encoding to neutralize untrusted data (SSS-02-20-01)

Ensure proper output encoding to prevent injection attacks by neutralizing untrusted data before rendering. For example, apply context-aware encoding (e.g., HTML encoding for web pages, SQL parameterization for databases, and escaping for command-line inputs) to prevent XSS, SQL injection, and command injection; Perform output encoding as close to the interpreter as possible to ensure untrusted data is properly sanitized before execution; Avoid persisting encoded data unless explicitly required, ensuring encoding is applied dynamically when rendering content; Continuously test and audit encoding mechanisms to detect and remediate injection vulnerabilities.

[SAMM] Automate security regression testing (SSS-02-20-01-01)

Organizations must integrate automated security regression tests within the development lifecycle to prevent previously identified vulnerabilities from resurfacing. Security tests should be incorporated into unit testing frameworks, ensuring that security-critical functionality—such as authentication, access control, input validation, encryption, and logging—is continuously verified during development. Security test cases should be designed to validate both positive and negative requirements, covering edge cases and common attack scenarios. Automated security tests must run dynamically at runtime, verifying that security mechanisms function as expected and that code changes do not introduce new risks. To enforce security standards, configure automated security tests as a prerequisite for code merges and build validation. Security functional tests should be written at the unit level, ensuring that key security controls within functions, methods, or classes operate correctly. For example, input validation tests should assert that all user-provided data is properly sanitized before being processed. By embedding automated security testing into CI/CD pipelines, organizations can establish continuous security verification, reducing the risk of security regressions and improving overall software resilience.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-20-01-01-01	Implement Output Encoding Close to the Interpreter	Ensure that output encoding is performed as close to the interpreter as possible, ensuring that data is properly encoded for the relevant output context (e.g., HTML, JSON, XML). This protects against injection attacks.	Development	Security Engineers, Software Developers
SSS-02-20-01-01-02	Render Output Safe for Immediate Use	Encode output before rendering it to prevent unsafe data from being injected into the application. This helps prevent common attacks like Cross-Site Scripting (XSS) or SQL injection.	Development	Security Engineers, Web Developers
SSS-02-20-01-01-03	Perform Contextual Output Encoding	Use contextual output encoding to prevent malicious content from being executed. This should be tailored for the output context (e.g., escaping HTML characters for HTML contexts).	Development	Security Engineers, Web Developers
SSS-02-20-01-01-04	Ensure Encoding is Done Dynamically at Runtime	Ensure output encoding is dynamically performed at runtime, especially when user-generated data is involved, to prevent injection vulnerabilities from being exploited.	Development	Security Engineers, Software Developers

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1241) OWASP Application Security Verification Standard OWASP SAMM: Software Assurance Maturity Model (V-RT-3-A)