Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.

A significant uptick in software security will require a groundswell of support for security skill-building and, when it comes to developers, an emphasis on continuous learning around secure coding best practices. It is refreshing to witness a new chapter for the industry, in which global governments are leading by example and providing appropriate guidance to mitigate insidious, code-level vulnerabilities.

The Australian Women in Security Network (AWSN) has worked tirelessly to promote more women in cybersecurity roles in Australia. We, along with Commonwealth Bank (CBA), recently held a secure coding tournament for security-savvy developers and professionals to showcase their skills in a friendly, competitive environment.

This July 17 event was well-attended by incredible women representing multiple verticals, and it’s safe to say that their contributions will assist in shaping Australia as one of the most cyber-safe nations in the world by 2030.

Endorsement for a more secure future

We were fortunate to have Lt. Gen. Michelle McGuiness, Australia’s Cyber Security Coordinator, supporting the joint AWSN/CBA/SCW tournament event. Speaking directly to Australia’s Six Cyber Shields initiatives and endorsing Secure-by-Design principles, her words resonated with the room of dedicated cyber professionals committed to positive changes and higher standards of software design and execution:

‍

‍

“We want to enlist the whole country in tackling [cybersecurity] challenges, and that includes making sure we build a strong and diverse and, of course, inclusive, welcoming cyber workforce.

Our strategy is built around six cyber shields that help protect our businesses, our organizations, and our citizens. Perhaps most pertinent to today's event is our work under the strategy that focuses on secure by design and secure by default. We should have every confidence that we won't be exposed to unnecessary risks when we buy digital devices or software.

And, of course, industry has a great role to play in helping us foster, grow and support these pathways for the benefit of their company, the benefit of our economy … and the security of our nation … I commend Secure Code Warrior and CBA as well as … AWSN for their leadership in bringing together today's event.”

What happens when you code like a girl?

Something incredible has always stood out to me whenever we have large-scale tournament events like this one. Typically, they involve tens of thousands of developers, and as is the statistical case industry-wide, quite a small percentage of the participants are female.

However, a female participant often ends up on the winners’ podium and shares the prize pool. I believe this speaks volumes for the inclusion of women in traditionally male-dominated spaces. Not only do they belong, but they can excel and be an aspirational force within their teams.

The competition was fierce in this event, and our overall winners, Bella Howard and Shanelle Haire, clearly have a bright future at the forefront of developer-driven security practices. They said of their win:

“We are thrilled about the win! Working as a pair was instrumental to our success—we believe our diverse skills and experiences complemented each other perfectly.

We also want to acknowledge that everyone performed exceptionally well. We are truly honored to have won and thoroughly enjoyed the event. We look forward to seeing you at the next one!”

Let’s get to know them a little better:

‍

• How long have you been working on your secure coding skills?

We both pursued dual degrees in IT, where our secure coding skills began to take shape. Bella developed a keen interest in cybersecurity, and we both attended events and workshops to expand our knowledge of the security field.

Through our employment, we have had the opportunity to utilize Secure Code Warrior, which has been instrumental in our development. Bella's focus on secure coding practices enhances her knowledge as a Security Analyst, while Shanelle's role as a Software Engineer demands a secure mindset, making secure coding an essential part of her responsibilities.

• Do you have any tips for women in STEM who are starting their secure coding careers?

We can highly recommend participating in security communities and learning from those already in the field. Joining female-led communities is also a fantastic way to gain support from women who have been in your shoes and can offer valuable guidance and encouragement.

Attend events like the Secure Coding Tournament and other industry-related workshops to learn and network while having fun. Seek out mentors who can guide you through your career and provide valuable insights. Don't wait until you feel like you know everything before you start—hands-on experience is the best way to learn.

• What is one thing you would do to promote the importance of cybersecurity best practices?

It's crucial to emphasize that security is everyone's responsibility. For effective in-depth security, all individuals working across the technology stack, as well as all users of technology, need to be aware of and adhere to security best practices. By fostering a culture where security is seen as a collective responsibility, we can better protect our systems and data.‍

‍

We thank all participants and look forward to partnering with AWSN on future projects.

‍

Organizations understand that secure by design principles are only successfully implemented through developer driven security. After all, developers are the ones designing, building, and ultimately committing the code that powers an organization's software. Ensuring that these invaluable contributors have the knowledge and skills to implement secure code best practices is absolutely critical.  However, the challenge of implementing this often comes down to aligning developer secure code knowledge and skills with the programming languages they use when building software.

This challenge is further complicated by the sheer volume and mix of programming languages that are being used in an organization’s codebase, often completely unbeknownst to security teams. So how do CISOs, AppSec and Engineering leaders ensure that the code that is being produced and committed is backed by a developer’s secure code knowledge and skills in that commit’s specific programming language?
‍

Introducing SCW Trust Agent

Secure Code Warrior has launched SCW Trust Agent to answer this difficult question. SCW Trust Agent gives security leaders the visibility and control needed to scale developer driven security, empowering developers and teams to deliver code faster while maintaining and improving the security of what is committed.
‍

How Does SCW Trust Agent Work?

SCW Trust Agent connects to your code repository to assess the metadata of every code commit. It inspects the developer that made the commit, the programming languages in use, and the exact timestamp when the code was shipped. It then pairs this analysis alongside data and insights from SCW’s agile learning platform to determine if the developer has sufficient security knowledge in that specific programming language. Based on this information, it returns a rating on the health of that commit in accordance with your policy configuration. These policies are customizable and configurable by Admin users, who can set specific guidelines and requirements for commits that can have a higher or lower threshold of requirements based on that project or repository’s overall sensitivity.  
‍

Strengthening Your Security Posture

Having this visibility and customizable control not only gives an organization insight into overall commit health across all of its repositories, but also the tools it needs to strengthen its security posture, mitigating risk by taking a proactive approach. SCW Trust Agent looks to ensure that developers are knowledgeable and skilled in the security implications of the specific coding language they are using when going to make a commit. This assurance reduces the likelihood of inadvertently introducing a vulnerability into the code that could be exploited.
‍

Optimizing The Development Lifecycle

This proactive approach not only improves an organization’s overall security posture, but also can also drive new optimizations in the development lifecycle. By ensuring developers have secure code knowledge and skills in the language of their commit,  the number of introduced vulnerabilities that would later need to be identified and remediated are reduced. Remediation and rework tend to be large time drain for developers, often interrupting their workflow and impacting their velocity.  Reducing vulnerabilities through a proactive approach minimizes these remediation cycles keeping development teams focused on delivery of high value code and capabilities.
‍

Scaling Developer Driven Security

SCW Trust Agent gives organizations the tools they need to scale their developer driven security programs. CISOs and Appsec teams have the visibility and control they need to apply proper governance, meet and even exceed compliance standards with detailed insights into policy design, application and adherence. And developers are empowered to deliver secure code faster with secure code training that is specific to the languages they utilize in the code that they deliver.

SCW Trust Agent works with any Git-based source code management tool and connecting your code repository is easy with multiple connectivity options including on-premises, cloud based, and manual upload. To learn more visit www.scwtrustagent.com or contact us, we’d love to discuss how we can help your organization strengthen its security posture and scaling developer driven security.

‍

We are excited to continue the conversation on the newest enhancement to the SCW Platform- SCW Trust Score. This ground-breaking feature was officially launched in May and represents a pivotal advancement in our mission to empower developers and organizations with the tools they need to write secure code.

At its core, the SCW Trust Score offers invaluable insights into your organization's security posture and the efficacy of your secure coding practices. Let’s walk through the main advantages and benefits of SCW Trust Score.

• Visibility: Diverse skills and competencies emerge across teams through learning and education programs, which rely on various factors for success. Despite undergoing identical secure code programs, teams often yield a spectrum of expertise, encompassing top performers, average achievers, and those who need additional support. SCW Trust Score provides organizations with a data-driven measurement of the effectiveness of their security learning program by aggregating individual developer security posture as they use Secure Code Warrior. 
  
  
• Benchmarking Metrics: Organizations need a benchmark to define the bell curve of their developers' security standing and pinpoint areas to optimize to truly create a security-ready and high-performing and productive software team.  With the SCW Trust Score, organizations gain the ability to assess their security posture relative to industry benchmarks and best practices. By leveraging this comprehensive metric, stakeholders can identify areas of strength and opportunities for improvement with unparalleled precision.
  
  
• Data-Powered: SCW Trust Score harnesses the power of 20 million learning data points sourced from over 600 companies and 250,000 developers. By analyzing all learning activities completed on our platform, our algorithm generates a comprehensive score. This score considers factors such as the breadth and depth of learning activities, activity comprehension, recency of learning, job description, onboarding lifecycle, and total number of developers trained.
  
  

We are proud to have continued our conversations with customers and prospects recently at RSAC, where it earned considerable interest from customers, partners, and industry leaders alike.

We are pleased to announce that we will be hosting a webinar on June 12th, in which our Chief Technology Officer & Co-founder Matias Madou will provide a comprehensive overview of the SCW Trust Score and its practical applications in real-world scenarios. We look forward to seeing you there.

Finally, we extend our appreciation to each member of the customer and partner community who has contributed to the development and refinement of the SCW Trust Score. Together, we embark on a journey toward understanding what good security posture looks like across organizations

Developers face constant challenges to keep their skills sharp and stay ahead of the curve. With technology advancing at rapid pace and new tools and frameworks emerging regularly, the need for continuous learning has never been more critical. In this digital era, where information is readily available at our fingertips, developers can harness the power of learning content on demand to propel their careers forward and stay relevant in the competitive field of software development.

Learning content on demand offers developers several key benefits. On-demand resources offer unparalleled flexibility and convenience, allowing developers to learn at their own pace, and fit education around their busy schedules and personal preferences. Moreover, agile platforms often feature targeted learning paths tailored to individual goals and skill levels, maximizing learning efficiency and ensuring developers acquire the skills necessary for career advancement. Ultimately, on-demand learning fosters a culture of continuous skill development, empowering developers to remain agile and resilient in the face of technological change and ensuring their long-term success in the software development field.

‍

At Secure Code Warrior, we're committed to providing developers with the most comprehensive and robust content available. Our goal is not only to offer superior learning and development resources but also to deliver them at the right time with information that's relevant to developers' current needs. This commitment is embodied in our Explore tab, a content library within the SCW platform designed to address the challenge of scattered resources. Explore consolidates all training content into one centralized location, providing users with a comprehensive view of available content types effortlessly. Whether learners seek to master a new programming language or explore intricate concepts, Explore has them covered. Our meticulously curated content catalog caters to a wide range of interests and skill levels, ensuring there's something for everyone. With Explore, learners will discover a wealth of interactive tutorials, practical exercises, and real-world scenarios, all designed to enhance the learning experience and empower developers to excel.

‍

‍

Tech ecosystems today are characterized by constant innovation and disruption, so the need for agile learning platforms has become increasingly critical. Traditional methods of learning and skill development no longer suffice in keeping pace with the rapid advancements in technology and the dynamic demands of the industry. As a result, organizations are turning to agile learning platforms to provide developers with the tools and resources they need to adapt and thrive in this fast-paced environment where developer driven security is essential.

One of the primary reasons why agile learning platforms are essential is their ability to deliver timely and relevant learning content. Agile learning platforms leverage dynamic content delivery mechanisms, such as microlearning modules and just-in-time resources, to provide developers with the knowledge they need, precisely when they need it. Another revolves around their ability to offer flexibility and customization, allowing developers to tailor their learning experiences to suit their individual needs and preferences. Whether they prefer interactive tutorials, hands-on labs, or video content, developers can choose the format that best suits their learning style and schedule.

All-in-all, agile learning platforms play a crucial role in empowering developers to thrive in today's fast-paced and ever-changing tech landscape. By delivering timely, relevant, and personalized learning experiences, these platforms enable developers to acquire new skills, stay ahead of industry trends, and drive innovation within their organizations. At Secure Code Warrior, we have developers top of mind as we continuously enhance our platform. Understanding the pivotal role developers play in crafting secure software, we ensure that our enhancements not only address current challenges but also empower developers to build resilient code with confidence. Here are some of the developer-forward platform enhancements we've recently implemented to reinforce this dedication.

We believe we can be more effective at engaging your developers through modern communications channels like Microsoft Teams. Our integration with Microsoft Teams is our first step towards next gen user communications within the SCW platform. Invite them to new learning activities, and send them custom reminders on course learning activities. You can also use Teams as a channel of delivery for Nudges, where you can Nudge course participants to complete their course via Teams notification.

‍

Adding to our developer driven product innovation is our Explore tab. Whether users are seeking to enhance their skills or dive into new areas, Explore ensures a seamless and enriching developer experience by providing a comprehensive hub for self-paced training and knowledge expansion. With over 7,000 activities available in 64 languages, Explore empowers users to effortlessly discover, play, and replay learning activities tailored to their preferences. Click here to learn more about Explore and the importance of content on demand.

‍

Lastly, reports are crucial for keeping developer training effective and engaging. They not only track progress and ensure compliance with security standards, but also identify gaps where developers can improve. This insight allows for tailored training that strengthens security defenses and keeps learning relevant and targeted. Reports also help justify the investment in training by demonstrating its impact, ensuring ongoing support for security initiatives. Overall, reports are essential tools for enhancing both compliance and developer engagement, keeping everyone on track and engaged in their learning journey. Be on the lookout for some exciting news around SCW reporting coming soon!

‍

To learn even more about recently released functionality, check out our latest product talk webinar or reach out to us today!

‍

Financial services institutions have strong reasons to ensure that the software code they use is secure. An obvious motivation, of course, is the need to protect their data from a breach, which can be costly in terms of leaked PII, cleanup expenses, fines and restitution, and damage to an organization’s reputation. Another ongoing reason is the need to stay in compliance with an array of industry and government regulations.

Because they handle so much sensitive, personal and financial information, as well as people’s money, financial services are a highly regulated industry. Depending on the services they provide, companies must comply with a mix of rules and requirements.

The Payment Card Industry Data Security Standard (PCI DSS) is well-known for its rules on protecting cardholder data, for instance. Requirements in the Sarbanes-Oxely Act govern financial records management. Companies that operate internationally are familiar with the Digital Operational Resilience Act (DORA), which is a binding risk management framework, and the global standards for fund transfers established by the Society for Worldwide Interbank Financial Telecommunication, known as Swift.

And laws such as the California Consumer Privacy Act (CCPA) and the EU’s General Data Protection Regulation (GDPR) set requirements for protecting the privacy and personal information of customers. There are others, such as regulations set by the U.S. Office of the Comptroller of the Currency (OCC) and the European Central Bank (ECB).

If that’s not enough, the National Cybersecurity Strategy states among other things that software makers should be held responsible for ineffective software security. And the Cybersecurity and Infrastructure Security Agency (CISA), alongside 17 U.S. and international partners, has issued guidance on Secure-By-Design principles for software development. 

A common thread for financial services companies is that secure code is a critical element in helping to meet the goals of those regulations that can help make demonstrating compliance with them easier. And it underscores why developers need training and upskilling to ensure that security is applied to code at the start of the development process.

As an example of how that works, let’s look at the newest version of PCI DSS.

Secure coding (and developer training) Is at the core of PCI DSS 4.0

PCI DSS 4.0, which became mandatory as of April 1, 2024, includes several substantial updates to PCI DSS 3.2.1—not least of which is an emphasis on the role developers play in ensuring secure software code.

PCI has long recognized the importance of secure software in the past. Version 2.0, which was released in 2017, included guidance for developers on ensuring secure transactions on mobile devices. The guidance in Version 4.0 now emphasizes applying security best practices to software development and includes some specific guidance on developer training. 

The requirements are often broadly stated, though companies may want to implement a more thorough approach.

For example, one requirement from Version 4.0 states that the “processes and mechanisms for developing and maintaining secure systems and software are defined and understood.” A good way to ensure that is true is for developers to receive precise training in the programming languages and frameworks they’re using in order to fill any knowledge gaps.

Another requirement states that developers working on bespoke and custom software must receive training at least once every 12 months, covering:

• Software security relevant to their job function and development languages.
• Secure software design and coding techniques. 
• How to use security testing tools—if they are being used—to detect vulnerabilities in software.

In reality, however, once a year isn’t frequent enough to address core security issues and break bad coding habits. Training should be continuous and measured, with a skills verification process to ensure it is being put to good use.

PCI DSS 4.0 includes more than a half-dozen other requirements that address areas such as preventing and mitigating various types of attacks, documenting third-party software components, identifying and managing vulnerabilities, and other security steps. In every case, organizations would be wise to thoroughly pursue those measures. Training on attack vectors should be frequent, rather than yearly. Third-party components, frequently a source of vulnerabilities, should be carefully inventoried through a Software Bill of Materials (SBOM) program. And organizations should be sure to have clearly defined roles for managing vulnerabilities.

The new version also gives organizations some flexibility in meeting its requirements, focusing on outcomes rather than checking boxes, while adding new requirements for authentication controls, password lengths, shared accounts and other factors. 

Compliance starts at the beginning of the SDLC

What these regulations have in common is that they attempt to set high standards for protecting data and transactions in the financial services industry. And, as in the case of the latest PCI DSS version, they are increasingly emphasizing the importance of secure code at the beginning of the software development lifecycle (SDLC). The National Cybersecurity Strategy and CISA’s Secure by Design principles also place responsibility for security with the makers of software—before it’s shipped—so that even companies that aren’t directly governed by financial services regulations need to comply.

Organizations need to bridge the gap that exists between DevOps teams (who are focused on speed of development) and AppSec teams (who are rushing to bring security into the process) by training developers to make security inherent to their approach. That requires a complex set of skills, however, that involves more than yearly training sessions or standard, stagnant educational programs can provide. Training should be continuous and agile, built to engage learners with active, real-world scenarios and delivered in small bursts that fit their work schedules.

Financial services companies need to ensure security to both protect against breaches and to stay compliant with increasingly stringent regulations. The costs of non-compliance can be as damaging as a breach in terms of the impact on a company’s reputation and monetary costs. IBM’s Cost of a Data Breach Report 2023, for example, found that organizations with a high level of non-compliance faced, on average, fines and other costs totaling $5.05 million—a half-million dollars more than the average cost of an actual data breach.

The continued growth of cloud-based environments and digital transactions has made the security of software in the financial services industry of paramount importance, something that regulations such as PCI DSS recognize. The best way to ensure secure software is through secure coding at the start of the SDLC. And the way to get there is by effectively training developers in secure coding practices. 

For a comprehensive overview of how secure coding can help ensure success, security, and profits for financial services companies, you can read the newly-released Secure Code Warrior e-book: The ultimate guide to security trends in financial services.

Check out the Secure Code Warrior blog pages for more insight about cybersecurity, the increasingly dangerous threat landscape, and to learn about how you can employ innovative technology and training to better protect your organization and your customers.

‍

The cybersecurity industry was once again placed on high alert following the discovery of an insidious software supply chain compromise. The vulnerability, affecting the XZ Utils data compression library that ships with major Linux distributions, is logged under CVE-2024-3094 and boils down to a backdoor deliberately inserted by a once-trusted volunteer system maintainer. Allowing remote code execution (RCE) in some instances if successfully exploited, it represents a high-severity issue with the ability to cause serious damage in established software build processes.

Thankfully, another maintainer discovered this threat before the malicious code entered stable Linux releases, but it still poses an issue to those who have started running version 5.6.0. and 5.6.1. of XZ Utils as part of Fedora Rawhide, and organizations are urged to patch it as an emergency-level priority. If this discovery were not made in time, the risk profile would make it one of the most devastating supply chain attacks on record, perhaps even eclipsing SolarWinds.

The reliance on community volunteers to maintain critical systems is widely documented, yet rarely discussed until high-impact issues such as this incident bubble to the surface. While their tireless work is essential to the maintenance of open-source software, this highlights the need for serious emphasis on security skills and awareness at the developer level, not to mention heightened access controls around software repos.

What is the XZ Utils backdoor, and how is it mitigated?

On March 29, Red Hat published an urgent security alert to inform users of Fedora Linux 40 and Fedora Rawhide that the latest versions of the “XZ” compression tools and libraries contain malicious code that appears to be purpose-built to facilitate unauthorized third-party access.How this malicious code was injected will likely be the subject of intense study in the future, but it amounts to a sophisticated, patient, years-long social engineering exercise on the part of the threat actor, a pseudonymous attacker called “Jia Tan”. This individual spent countless hours gaining the trust of other maintainers, making legitimate contributions to the XZ Utils project and community for over two years, eventually earning “trusted maintainer” status after multiple sockpuppet accounts eroded confidence in volunteer project owner, Lasse Collin:

‍

‍

This unusual scenario is a prime example of a highly technical person still falling victim to tactics typically reserved for use against those who are less savvy, showing the need for precision, role-based security awareness training. It was only for the inquisitiveness and quick thinking of Microsoft software engineer and PostgreSQL maintainer, Andres Freund, that the backdoor was discovered and versions rolled back, thus stopping what could have been the most devastating supply chain attack in recent memory.

The backdoor itself is officially being tracked as a vulnerability of the highest possible severity in NIST’s registry. Initially thought to allow SSH authentication bypassing, further investigation revealed that it enabled unauthenticated remote code execution on vulnerable Linux systems, including Fedora Rawhide, Fedora 41, Kali Linux, openSUSE MicroOS, openSUSE Tumbleweed, and some versions of Debian.

Jia Tan appears to have gone to great lengths to obfuscate the malicious package, which, when triggered to construct itself during the build process, hampers authentication in SSHd via systemd. As Red Hat detailed, in the right circumstances, this interference could potentially allow an attacker to break SSHd authentication and gain remote unauthorized access to the entire system.

‍

Microsoft, among others, has published comprehensive guidance on scanning systems for instances of the exploit and mitigating its effect, and the immediate action recommended by CISA is that affected developers and users should downgrade XZ Utils to an uncompromised version, like XZ Utils 5.4.6 Stable.

Preventing this attack type is incredibly difficult - especially when utilizing open-source components in software - as there is precious little assurance and transparency over the security of the supply chain. We've already combatted accidental flaws in the software supply chain, but this risk has elevated to include security bugs deliberately planted with malice to compromise open-source security.

Most developers will not be able to stop an attack of this nature unless they have a strong sense of security awareness, healthy security knowledge, and a sprinkling of paranoia. It’s almost a case of requiring a threat actor mindset. However, a chief consideration should always center around source code repos that are controlled internally (i.e. not open-source). These should only be accessible to people who have verified, relevant security skills. AppSec professionals might consider a setup like branch-level security controls, only allowing security-skilled developers to commit changes to the final master branch.

Volunteer maintainers are heroes, but it (should) take a village to sustain secure software

To those outside the realm of software engineering, the notion that a spirited community of volunteers painstakingly maintains critical systems in their own time is a difficult concept to grasp, but this is the nature of open-source development, and it continues to be an area of critical risk for security professionals protecting the supply chain.

Open-source software is a vital part of virtually every enterprise’s digital ecosystem, and trusted maintainers (of which most are acting in good faith) are truly heroic in their selfless pursuit of technological progress and integrity, but it is farcical to keep them delivering in isolation. In these DevSecOps-centric times, security is a shared responsibility, and every developer must be armed with the knowledge and right-fit tooling to navigate the security issues they are likely to encounter in their workday. Security awareness and hands-on skills should be non-negotiable in the software development process, and it’s up to security leaders to influence change at the enterprise level. 
‍

‍Build a thriving security culture in your organization today with in-depth Courses from Secure Code Warrior.

Software developers have shown they are ready and willing to make use of generative artificial intelligence (AI) to write code, and they have generally seen some favorable results. But there are also plenty of signs that they could be playing a dangerous game.

According to a recent survey by GitHub, more than 90% of U.S. developers are using AI coding tools, citing advantages such as faster completion times, quick resolution of incidents, and a more collaborative environment, which is something they feel is important. Working with AI tools allows developers to hand off routine tasks, allowing them to work on more creative jobs that benefit their companies and, not incidentally, reduces the chances of on-the-job burnout.

However, studies have also shown that AI tools have a propensity to introduce flaws when writing code. A survey by Snyk found that although 75.8% of respondents said that AI code is more secure than human code, 56.4% admitted that AI sometimes introduces coding issues. Alarmingly, 80% of respondents said they bypass AI code security policies during development.

Since OpenAI's ChatGPT debuted in November 2022, the use of generative AI models has spread with lightning speed throughout the code development process in financial services, as it has in many other fields. The fast emergence of other models, such as GitHub Copilot, OpenAI Codex, and a growing list of others, suggests that we have only scratched the surface of what generative AI can do and the impact it can have. But for that impact to be positive, we need to ensure that the code it generates is secure.

Coding bugs can spread quickly

Whether created by human developers or AI models, code is going to contain some errors. With AI helping to accelerate code development to meet the ever-increasing demands in highly distributed, cloud-based computing environments, the chances of bad code propagating widely before it is caught could increase. 

AI models being trained to write code will ingest thousands of examples of code that perform various tasks, and then they can draw on those examples to create their own code. But if the samples that it’s working from contain flaws or vulnerabilities—whether they were originally created by a human or another AI—the model could transfer those flaws to a new environment. 

Considering research has shown that AI models aren’t capable of reliably recognizing flaws in the code it’s using, there is little built-in defense against the spread of flaws and vulnerabilities. AI will not only make mistakes in coding, but it will repeat its own mistakes and those of other sources until the vulnerability is identified somewhere down the line—perhaps in the form of a successful breach of a company using the software it created.

The real defense against the proliferation of coding flaws is for humans and AI models to work together. Human developers should oversee AI code writing and serve as a check against unsecure coding practices and vulnerable code. But for that to happen, developers must be thoroughly trained in the best practices of secure code writing so they can identify coding mistakes an AI might make and quickly correct them.

The challenges of AI code creation and remediation

The sudden explosion of large language models (LLMs) like ChatGPT has been something of a double-edged sword. On one side, companies and everyday users have seen tremendous productivity gains from using AI to handle time-consuming, onerous, or difficult chores. On the other side, there have been plenty of examples of what can go wrong when blindly trusting AI to handle the work.

AI models have made glaring mistakes, demonstrated bias and produced flat-out hallucinations. In many cases, the root of the problem was inadequate or irresponsible training data. Any AI model is only as good as the data it’s trained on, so it’s essential that training data be comprehensive and carefully vetted. Even then, however, some mistakes will be made.

The use of AI for coding faces many of the same hurdles. Code generated by AI has been shown to contain a range of flaws, such as vulnerabilities to cross-site scripting and code injection, as well as attacks specific to AI and machine learning (ML), such as prompt injection. AI models also operate in a black box because their processes aren’t transparent, which prevents a security or development team from seeing how an AI reaches its conclusions. As a result, the model can repeat the same mistakes over and over. The same shortcomings that can affect code writing also carry over to using AI for code remediation and meeting compliance requirements. 

The potential for flaws being created or repeated by AI models has grown to the point that LLMs now have their own Open Web Application Security Project (OWASP) list of top ten vulnerabilities.

Developers and AI can work together to create secure code

Concerns about the potential flaws in AI-generated code might give some organizations pause, albeit briefly, about moving ahead with the technology. But the potential benefits are too great to ignore, especially as AI developers continue to innovate and improve their models. The financial services industry, for one, is unlikely to put the genie back in the bottle. Banks and financial services companies are technology-driven already, and they operate in a field where they’re always looking for a competitive advantage. 

The key is to implement AI models in a way that minimizes risk. And that means having developers who are security-aware and thoroughly trained in secure coding best practices—so they can write secure code themselves and closely monitor the code AI models produce. By having AI engines and human developers working together in a tight partnership, with developers having the final say, firms can reap the benefits of improved productivity and efficiency while also improving security, limiting risk and ensuring compliance. 

For a comprehensive overview of how secure coding can help ensure success, security, and profits for financial services companies, you can read the newly-released Secure Code Warrior guide: The ultimate guide to security trends in financial services.

‍

‍

Check out the Secure Code Warrior blog pages for more insight about cybersecurity, the increasingly dangerous threat landscape, and to learn about how you can employ innovative technology and training to better protect your organization and your customers.

‍

Recently I had the privilege of hosting a webinar where our very own CTO Matias Madou and with Mednd.io’s Sharon Kochevsky addressing Taking charge of vulnerability alerts. During the session they explored both the challenges and the solutions in handling security vulnerability alerts. In case you missed the webinar, here are a few key takeaways from their conversation. Of course, the webinar is also now on-demand here to get the full details. 

Impact of AI on security

Matias incorporated the analogy of self-driving cars to explain the current state of AI creating secure software. While self-driving cars can technically drive themselves they still face problems while on the road. For instance, he referenced one situation where self-driving cars encountered a problem on the road never encountered before and would ghost break as a result. Problems will come, and it’s the human technicians that need to resolve. Similarly, if developers blindly follow AI, errors in code and vulnerabilities could come into play.  

For AI to produce better output, Matias stressed the need for regularity and numerous good code examples to train developers on the AI models. While AI presently works well on generic frameworks, it falls short with real-world applications that operate on millions of code lines.

He further explained that seasoned developers could reap the benefits of generative AI for accelerated coding, but those not trained might pose a threat as they could reproduce and paste faulty codes at rapid pace. 

Shifting towards proactiveness

One topic that led the discussion was the shift towards proactive actions. Rather than keeping tabs on security issues, Sharon Kochevsky advocates for enterprises and AppSec programs to  take a more proactive approach with actual code fixes versus a reactive approach focused on security reporting. In line with Matias, he underscores the need to surpass purely administrative practices and focus on consequential outcomes. The panel also discussed primary areas of creating reports along with utilizing security products incorporated with real-time dashboards and issue tracking. 

Bridging the gap 

Sharon and Matias also identified a crucial problem that should get addressed: the disconnection between developers and security managers. Organizations and enterprises are now adding security champions to help bridge the gap. These are security pros located within the engineering team, and help promote proactive security measures.

Needless to say, we just scratched the surface on this topic and the conversation extends beyond these webinars; continuous discussion and engagement are crucial in our ever-evolving industry. If you would like to learn more or replay the session, it is now available on-demand.

‍