Realigning your organization around secure coding – barriers, concerns, and active solutions
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done.
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoSecure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior builds a culture of security-driven developers by giving them the skills to code securely. Our flagship Agile Learning Platform delivers relevant skills-based pathways, hands-on missions, and contextual tools for developers to rapidly learn, build, and apply their skills to write secure code at speed.
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Click on the link below and download the PDF of this one pager.
DownloadSecure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demoSecure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior builds a culture of security-driven developers by giving them the skills to code securely. Our flagship Agile Learning Platform delivers relevant skills-based pathways, hands-on missions, and contextual tools for developers to rapidly learn, build, and apply their skills to write secure code at speed.
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
Table of contents
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.