Security' is Not a Dirty Word: How a Positive Approach Will Transform Your Security Program

Published Apr 17, 2019
by Jaap Karan Singh
cASE sTUDY

Security' is Not a Dirty Word: How a Positive Approach Will Transform Your Security Program

Published Apr 17, 2019
by Jaap Karan Singh
View Resource
View Resource

Originally published on the DevSecCon Blog.

Having been on both sides of the fence, I know all too well the tension that can arise between the development team and AppSec specialists when it comes to upholding security best practice.

It's tough; at the end of the day, a developer's chief priority is delivering software features. They must be beautiful, functional and help showcase the power of the application. With agile development practices typically in-play these days, these features must be completed to strict deadlines... and security is rarely high on the list of concerns with so much else at stake.

Security is seen as the domain of the AppSec team, who have the unenviable task of scanning code (or worse: reviewing it manually, line-by-line) and reporting to the development team that their code is insecure or indeed, entirely unusable. They're the sticks in the mud that pick apart their good work, halt innovation and generally create a headache for developers. At the end of the day, many security issues are quite a simple fix " perhaps just one line of code could reinforce a vulnerable back door in minutes.

But, here's the problem. With "security'so synonymous with a negative experience, developers simply aren't engaged with it as closely as they should be. Those one-line fixes aren't happening: after all, the AppSec guys continually come across the same issues. It must be quite maddening for them to still be pointing out SQL injection flaws, more than twenty years after we first discovered them (and their subsequent fix).

What we've done to date isn't working anywhere near as effectively as we'd hoped. We need to focus on repairing the bridge between developers and AppSec specialists, striving for a positive security culture in which developers are given the tools and training to make a real impact in the space.

Who knows? They might even fall in love with it as I did!

Positive security is the fastest and easiest way to improve application security

ity " and no, it's not some woo-woo about intangible outcomes. It is an absolutely vital ingredient in the secure coding recipe of success.

Developers hold the key to improving security from the very beginning of production, by writing secure code in the first place. By creating a positive security culture and getting developers excited about application security, common vulnerabilities can be wiped out before they ever make it to a scan or manual code review in AppSec land.

It's thirty times more expensive to fix vulnerabilities in code that is already committed, so finding training that plays to developer strengths, holds interest and actually works is a huge step in future cost reduction for identifying and fixing those recurring vulnerabilities.

Positive, developer focused initiatives foster the right security culture.

When everyone is on the same page with security best practice, a positive security culture is a happy, vital by-product.

Positive, scalable developer focused initiatives foster the right security culture. Engaging the problem-solving, creative minds of developers is essential to winning them over, as well as ensuring any new recruits can quickly come up-to-speed with the security expectations of the team. Get in touch for an overview of how the developer security relationship has evolved and ideas on rolling out a successful security awareness program in your own organizations.

View Resource
View Resource

Author

Jaap Karan Singh

Want more?

Dive into onto our latest secure coding insights on the blog.

Our extensive resource library aims to empower the human approach to secure coding upskilling.

View Blog
Want more?

Get the latest research on developer-driven security

Our extensive resource library is full of helpful resources from whitepapers to webinars to get you started with developer-driven secure coding. Explore it now.

Resource Hub

Security' is Not a Dirty Word: How a Positive Approach Will Transform Your Security Program

Published Apr 17, 2019
By Jaap Karan Singh

Originally published on the DevSecCon Blog.

Having been on both sides of the fence, I know all too well the tension that can arise between the development team and AppSec specialists when it comes to upholding security best practice.

It's tough; at the end of the day, a developer's chief priority is delivering software features. They must be beautiful, functional and help showcase the power of the application. With agile development practices typically in-play these days, these features must be completed to strict deadlines... and security is rarely high on the list of concerns with so much else at stake.

Security is seen as the domain of the AppSec team, who have the unenviable task of scanning code (or worse: reviewing it manually, line-by-line) and reporting to the development team that their code is insecure or indeed, entirely unusable. They're the sticks in the mud that pick apart their good work, halt innovation and generally create a headache for developers. At the end of the day, many security issues are quite a simple fix " perhaps just one line of code could reinforce a vulnerable back door in minutes.

But, here's the problem. With "security'so synonymous with a negative experience, developers simply aren't engaged with it as closely as they should be. Those one-line fixes aren't happening: after all, the AppSec guys continually come across the same issues. It must be quite maddening for them to still be pointing out SQL injection flaws, more than twenty years after we first discovered them (and their subsequent fix).

What we've done to date isn't working anywhere near as effectively as we'd hoped. We need to focus on repairing the bridge between developers and AppSec specialists, striving for a positive security culture in which developers are given the tools and training to make a real impact in the space.

Who knows? They might even fall in love with it as I did!

Positive security is the fastest and easiest way to improve application security

ity " and no, it's not some woo-woo about intangible outcomes. It is an absolutely vital ingredient in the secure coding recipe of success.

Developers hold the key to improving security from the very beginning of production, by writing secure code in the first place. By creating a positive security culture and getting developers excited about application security, common vulnerabilities can be wiped out before they ever make it to a scan or manual code review in AppSec land.

It's thirty times more expensive to fix vulnerabilities in code that is already committed, so finding training that plays to developer strengths, holds interest and actually works is a huge step in future cost reduction for identifying and fixing those recurring vulnerabilities.

Positive, developer focused initiatives foster the right security culture.

When everyone is on the same page with security best practice, a positive security culture is a happy, vital by-product.

Positive, scalable developer focused initiatives foster the right security culture. Engaging the problem-solving, creative minds of developers is essential to winning them over, as well as ensuring any new recruits can quickly come up-to-speed with the security expectations of the team. Get in touch for an overview of how the developer security relationship has evolved and ideas on rolling out a successful security awareness program in your own organizations.

We would like your permission to send you information on our products and/or related secure coding topics. We’ll always treat your personal details with the utmost care and will never sell them to other companies for marketing purposes.

To submit the form, please enable 'Analytics' cookies. Feel free to disable them again once you're done.