Compilers generate object (executable) files from source code files. There are several utilities, libraries and objects used by compilers:

Compiler Languages:

C/C++

COBOL85

FORTRAN

NMC/NMCPLUS

NMCOBOL

Pascal

PTAL

SCOBOL

SQL*

TACL*

TAL

Utilities:

AXCEL*

BINDER*

CROSSREF*

Objects:

System libraries

Common run-time libraries

User libraries

The programs and utilities marked with an asterisk (*) are not covered in this section. Please refer to the appropriate Gazette section.

Compilers and their related utilities are resources whose security varies depending on the Corporate Security Policy concerning compilation on secure systems. Many sites control compilations by enforcing that all compilation be performed on a development system. Application change control policy governs the method and security to update the secure application.

Some sites do not use certain languages, but all sites use at least one language compiler for the secure application. Language compilation controls are a fundamental method that companies can use to control their application.

RISK Compilers can be destructive because code can be inserted or deleted to circumvent previously implemented controls.

RISK Language compilers might be used to develop test or hacking programs to access sensitive data.

AP-ADVICE-COMPS-01 On secure systems, languages that are not in active use should be secured from use and other language compilers should be accessible only to necessary personnel.

On secure systems, only members of the group (if any) responsible for compiling programs on the secure system should have access to secure object files.

AP-ADVICE-COMPS-02 To protect applications from inadvertent or malicious changes...