I have been asked by my IT department how a LabVIEW application is secure

Question

In general how does a standard LabVIEW application respond to these requirements:
The runtime environment shall not be susceptible to buffer overflows, SQL injection, LDAP and XPath injection, code injection or any other injection flaws. Malicious file execution and insecure direct object references shall be prevented at all times. 

Answer 1

I know certain ActiveX actions that are deemed "security risks" will now generate errors in the LabVIEW Run Time Engine unless the registry of the host computer has been specifically modified to allow such ActiveX calls.
I guess my point is, NI does take some steps to prevent some issues at the run-time level regardless of how your code is written, so if that is the level <they> are concerned about, I would reach out to my local NI Field engineer and/or NI Customer Support and ask for help in how to answer <them>.
As Sam_Sharp pointed out, there are several things that are difficult/impossible for the RunTimeEngine to protect against, in any language.  If the author of the code does stupid things or deliberately has maliscious intent, there are many things they can do that is outside the bounds of an RTE.   In LabVIEW, some of the 'holes' in other languages are hard (impossible??) to do.  For example, you as a coder, do not have access to creating and manipulating pointers, so you can't create code that intentionally overwrites other [edit: memory-]sectors in the host machine memory.  So that would also be a case of where the run-time-engine (and its memory manager) plugs (or significantly shores up) things and makes it "safer".
The main security threats I see coming from the LV RTE engine is that there is no way the RTE can protect against malicious file removals, file hashing, injecting bad commands and/or data into network(s) and databases etc., beyond the protection offered by the OS (file/folder permissions) and IT infrastructure (firewalls, database query protections etc.).
Not sure any of that helps you out or not.. A dialoge with NI seems required for you, perhaps bring together reps' from both parties (NI field engineer and your IT people) so that they can get a line of communication going.
QFang
CLD LabVIEW 7.1 to 2013