Secure Code Insights

The recent cybersecurity Executive Order from the Biden Administration has certainly got the security industry talking, especially those who are looking to win over developers to the importance of applying secure coding best practices in their day-to-day work. For the first time, developers who are working on software in use by the federal government must have verified security skills, as well as adherence to new, evolved guidelines. 

This marks a positive change in the cyber defense status quo, and finally makes adequate upskilling of developers part of the conversation. While these policies are US government-centric, they offer a global opportunity for organizations to address and upgrade current security standards, everything from developers to security analysis of software supply chains. 

NIST recently sought public comment to inform their next updates to HIPAA legislation, among others, and this was an unmissable opportunity for us to pool our company expertise into positioning papers that can help inform a safer, and more effective, human-led approach to cybersecurity that will help organizations leverage their teams for greater outcomes. 

As an expert-driven organization, we are fortunate to have some of the most dedicated and accomplished cybersecurity professionals working with us, including Ph.D. candidate Pieter de Cremer, and Dr. Brian Chess, who is part of our Technical Advisory Board. The three of us put our heads together to formally submit positioning papers to NIST, calling out ways our approach to developer upskilling and preventative security at the software creation stage could positively impact cybersecurity standards going forward. 

A secure development pathway, paved for developers

Vulnerability scanning tools, monitoring and other forms of security automation are increasingly prevalent, and they feature in both the new Executive Order, as well as within NIST guidelines. They are an increasingly essential part of a modern security program, but history and the present show that scanning tools in particular certainly find vulnerabilities in software with ever-increasing efficiency, yet this alone has no effect on reducing them, or, indeed, improving security from the start. 

A cumbersome tech stack that is distracting and slows down the developer workflow is one of the fundamental reasons that developers disengage with security and view it in a negative light. However, if developers had a paved pathway for secure development, one that was customized to suit not just the technology, but also languages, frameworks, and project-specific development objectives, then embedding security into the development process from the beginning - with as little disruption to their productivity as possible - is an ideal that would result in significant reduction in common vulnerabilities over time. 

To read our NIST positioning paper in full, download it now:

Certification framework for secure development practices: The (current) missing link

To date, there is no formal certification to verifying secure coding skills and best practices. This has been an industry oversight for a long time, and it’s our position that this is essential for the future of improved cyber defense and secure development. 

We know there are many forms of security training targeting developers, but if the volume of large-scale data breaches, cyberattacks, and poor quality code out there is any indication, it’s not creating security-aware developers, and they are not being equipped with the knowledge to make a dent in a problem that is only getting worse. 

Developer upskilling requires tools and education that is day-job relevant, contextual, bite-sized (yet frequent), and allows them to build upon existing knowledge in the languages and frameworks they actually use. Generic training does not suffice, and this needs to be made abundantly clear in legislation and industry bodies such as NIST. 

The NICE Framework is more than suitable to build out comprehensive certification guidelines that actively use methodologies that work, and are of most interest and relevance to developers, and their work. Aligning with this recognized institutional framework helps to standardize practices that truly make a difference, and provides more concrete pathways for organizations to follow. 

To read our second NIST positioning paper in full, download it now:

The people factor in cybersecurity is often forgotten, and it’s time we worked towards human solutions for human problems such as recurrent common vulnerabilities. Decades-old bugs should no longer trip us up, but it will take the backing of global governments to change the status quo and provide measurable, positive impact. 
‍
Are you ready to certify your developers? You’ve come to the right place. Check out our Learning Platform today.

We recently sat down with Dimitri Vanderhaeghe, Software Engineer at Selligent Marketing Cloud, a highly integrated, AI-powered omnichannel marketing automation platform that enables ambitious B2C marketers to maximize every moment of interaction with today’s connected consumers.  For Selligent, a fast-paced B2C technology company scaling up and meeting the growing demands of their market is vital. Part of being able to meet these demands is an emphasis on cybersecurity and most crucially a developer-led, security skills program. 

Why is cybersecurity vital for scaling your business? 

A strong security strategy has to be high on your company's agenda if you want to scale your business, otherwise you leave yourselves open to vulnerabilities. A cybersecurity attack takes place every 39 seconds, and the cost of an attack on your business can be financially detrimental and ruin your reputation. We only have to look to the Equifax hack in 2017 for a prime example as their CEO resigned and made it clear that the hack was the reason for doing so. 

However, cybersecurity has to become a shared responsibility in order to scale, in particular within your developer community as Dimitri explains:

"The most important reason to train engineers is scalability, because we have a big product that almost 60 engineers are working on. If they don't care about security, all the vulnerability scans come back to the security specialists."

How do you create a developer-led security culture?

Dimitri and the Selligent team seem to have cracked a developer-led security culture, but from our recent research only 15% of developers see security as everyone’s responsibility within their organization. So, how do you start left and create a developer-led security culture?

Dimitri attributes this to an increase in security awareness generated through Secure Code Warrior® 's learning platform to upskill their developers. Dimitri says that without the platform they would have struggled to create security awareness. As a result, security is at the forefront of the developers’ minds when producing code. 

Another key aspect to creating a developer-led security culture is to make training relevant. Our recent study also showed that 40% of developers say that training is not hands-on and 30% say it’s also not relevant Dimitri notes that the granularity and real-world nature of Secure Code Warrior® tournaments make all the difference. The fun and competitive nature of the platform also leads to more engaged and aware developers. 

As Dimitri points out, without awareness the burden of cybersecurity falls back to the security specialists, which simply is not scalable. The answer is to scale your business and products effectively to ensure you’re protected against software vulnerabilities by focusing on hyper-relevant contextual training of your developer community with a developer-led security skills program. 

‍
Secure Code Warrior can offer your organization just that. Interested in a demo? Book one below. 

‍

How’s this for a sobering statistic? 60% of SMBs go out of business within six months of a successful cyber attack*. Major corporations haemorrhage millions (or billions!) while brand reputations bleed out. As organizations increasingly embrace secure coding practices, a 'shift left' is taking place. With the rise of DevSecOps, secure code is becoming the focus right from the start of the SDLC. To investigate the real-world impacts of this trend, Secure Code Warrior with Evans Data Corp*** commissioned a recent study on developers’ attitudes towards secure coding, secure code practices, and security operations. 

Shifting Left – a shift on many levels  

As companies realize it costs 30 times more to fix vulnerabilities after the fact, preemptive measures have become the new gold standard*. But for such measures to be effective, everyone in the SDLC must be security-aware, especially developers. 

‍Shift One  – so, who’s responsible now? 

With the rise of DevSecOps, organizations are embracing secure coding practices. As a result, one of the first shifts our research highlighted is a shift in responsibility for code security towards operational levels. 

When we asked developers and development managers, "who should have ultimate responsibility for code security?", 46% said the project/team lead –  almost twice as many as those  who said the responsibility should remain with the application security team. 

This is a clear indication of a shift in security responsibility away from traditional application security teams towards development team leads.

Shift Two – The Changing Roles of Managers  

The pressure to implement secure code training is landing on managers from several directions. 

41% reveal that the organizational imperative for secure code training comes from senior leadership. Increasing demands for regulatory compliance are also a factor. 

Managers play critical roles in assisting with the transition from traditional development to DevSecOps and are emerging as crucial decision-makers for training and tooling purchase decisions.

‍Shift Three – Developers Stepping Up

However, we also see the pressure for change bubbling up from below; 24% of managers reveal that they implement secure coding practices due to suggestions and recommendations from their developers. This point highlights the increasingly important role of developers as contributors to their companies’ security programs. The shift to DevSecOps, with its newfound emphasis on preventative secure coding practices, shifts developers into the role of the 'first line of defense’.

Shift Four – Improved Team Dynamics  

While implementing secure code practices has a material impact on software quality, it also changes the way teams work for the better. 60% of developers surveyed believe that employing secure code practices has increased their communication with other developers – but the gains don’t stop there. 

Half of all developers and managers surveyed agreed that secure coding practices led to more cooperation between developers and their leaders. 46% claimed more collaboration between developers and stakeholders. At the same time, 41% pointed to more cooperation between leaders and stakeholders.

DevSecOps brings teams, leaders, and stakeholders together in new ways, improving cooperation across different roles and stages of the software development life cycle. 

62% of managers surveyed claim that secure code practices help increase the velocity of code releases. This single fact combines with all these other shifts to highlight the clear benefits of moving to a DevOps approach. But, as stated earlier in this article, for such measures to be effective, everyone in the SDLC must be security-aware. This insight has critical implications for how organizations train their developers. Teams need to learn about recently identified vulnerabilities and learn in the specific language:frameworks in which they code. In short, they need to understand how to locate, identify and fix known vulnerabilities in code in the context they work in every day. Such training turns your teams from your first line of risk into your first line of defense.  

As champions of change in secure coding, Secure Code Warrior takes a human-led approach to help your organization' shift left' – and take your overall security approach from reactive to proactive.

If you’d like to know more about hands-on, highly engaging and proven secure code training that aligns the needs of managers, developers and the organization to achieve a DevSecOps future, book a demo now.

‍

*60 Percent Of Small Companies Close Within 6 Months Of Being Hacked.
‍https://cybersecurityventures.com/60-percent-of-small-companies-close-within-6-months-of-being-hacked/

**IBM Software Group; Minimizing Code Defects to Improve Software Quality and Lower Development Costs.
‍https://docplayer.net/11413245-Minimizing-code-defects-to-improve-software-quality-and-lower-development-costs.html

***Shifting from reaction to prevention: The changing face of application security 2021. Secure Code Warrior and Evans Data Corp.
https://scw.buzz/3169uzS

According to an IBM study, it is thirty times more expensive to fix vulnerabilities post-release compared to finding and fixing them initially. With that in mind, it’s not surprising that forward-looking CIOs are implementing secure coding practices. This means training and equipping developers to write code that is more secure from the beginning– making them their organization’s ‘first line of defense’. To measure the actual impacts of this trend, Secure Code Warrior teamed up with Evans Data Corp* and commissioned a recent study on developers’ attitudes towards secure coding, secure code practices, and security operations. This research reveals that implementing secure code practices is trans-formative for companies on several different fronts. Download your copy of the whitepaper here.

Secure Coding with more confidence and mindfulness

Without a doubt, implementing secure coding practices raises the security awareness of developers in ways that benefit their employers. Our study reveals that 55% of developers say that good training has increased their confidence in their coding techniques, and 53% said that good training has allowed them to be more careful when debugging and testing their own code. An equal 53% believe they have become more mindful of security when writing code.

What does this tell us? It tells us that with a little bit of upskilling, developers can transform into your first line of defense.

Smarter tool selection + increased release velocity

When we asked managers about the impacts of secure code training, their perspectives reflected their managerial responsibilities. 43% of managers agreed that secure code training has helped their organizations become more careful when debugging and testing their code. 47% revealed that good training has allowed them to be more selective with tooling choices that provide more security. But perhaps most importantly, 44% indicated that secure code training and techniques have helped save time and speed up software releases – a substantial advantage when speed to market is everything.

Enhanced productivity across the board

When we asked developers how secure coding has helped productivity, over half felt it had helped increase both coding and app design quality.  

63% said it reduces rework by preventing recurring vulnerabilities. 70% said it helped eliminate errors that lead to rework or patches. 56% claim that it has improved productivity in Debug and Testing. We can see the transformation underway at multiple stages of the software development life-cycle.

Team dynamics and code quality

Secure code practices also have an impact on team dynamics. While individually, developers learn to code more securely, their code does not exist within a vacuum. Their code is often contingent on the work of others and vice versa. Implementing secure coding practices causes developers to share and seek out secure coding knowledge, driving better communication amongst developers, developers and management, and the development team and their stakeholders.

• 60% of developers surveyed believe that employing secure code practices has increased their communication with other developers
• 45% say that contact with management has increased.

These sentiments are echoed by managers, albeit from a different perspective. 62% of managers surveyed claim that secure code practices require them to spend more time managing people and help increase the velocity of code releases.

For organizations that implement secure code practices, the increase in communication has a trans-formative impact on team dynamics, positively impacting code quality and speed to market.

Transforming from reactive to preventive

Finally, secure code impacts the way developers and dev managers apply security measures and their accompanying metrics.

Today, 81% of organizations still rely on reactive metrics such as defect counts and scanner metrics to determine security quality.

But these reactive activities are increasingly supplemented by or giving way to proactive or preventative metrics. 67% of organizations now measure developer awareness of OWASP Top 10 as a metric for security readiness. Other proactive metrics in increasing use include:

• Measuring developer competency around application security
• Use of pre-approved code
• Compliance with regulatory requirements.

90% of developers now pay attention to these preventative measures. But while awareness and implementation of secure coding practice are growing, there's still some way to go to realize its full potential.

Where to go from here?

As champions of change in secure coding, Secure Code Warrior takes a human-led approach to help you transform your developers into your first line of defense – and your overall security approach from reactive to proactive. Our proven learning platform delivers contextual, hands-on education in 52 language:framework-specific categories, with challenges that mimic those that developers face in the real world. We know from deep experience that developers prefer the learn-by-doing method to the struggle of theory-based static learning. If you’d like to see the trans-formative impact this can have on your teams and their ability to ship quality code with confidence, book a demo now.

‍

*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
1. IBM Software Group; Minimizing Code Defects to Improve Software Quality and Lower Development Cost - https://docplayer.net/11413245-Minimizing-code-defects-to-improve-software-quality-and-lower-development-costs.html

‍

New research explores the benefits of quality security training. 

What are the potential impacts of quality secure code training for your organization – and could it be a worthwhile investment? To find some answers, let's look at some insights from a recent study on developers' attitudes towards secure coding, secure code practices, and security operations, conducted by Secure Code Warrior with Evans Data Corp*. 
‍

When developers and their managers were asked how training has changed the way they code, each cohort responded slightly differently. These differences were in line with how they approach their work and their role within the software development life cycle. Overall though, the underlying theme is that the impact of quality secure code training is overwhelmingly positive. 

55% of developers revealed that good training has increased their confidence in their coding techniques, while 53% said that good training has allowed them to be more careful when debugging and testing their own code. 

Most importantly, 53% believe they have become more mindful of security while writing their code – leading to fewer vulnerabilities and less rework. 

Managers achieving faster software releases

While 43% of managers agree that secure code training has helped their organizations become more careful when debugging and testing their code, the top two changes reflect managerial responsibilities. 47% revealed that good training has allowed them to be more selective with tooling choices that provide more security. While 44% indicated that secure code training and techniques have helped save time and speed up software releases.

Secure coding’s influence on productivity

When it comes to increasing productivity, secure coding practices can have a powerful effect. Asked to identify how secure coding could help to improve productivity, more than 63% of developers revealed that writing secure/quality code reduces rework by preventing recurring vulnerabilities. 70% of developers say that quality training could eliminate errors that later cause reworks or patches. 

Secure coding’s impact on the development life cycle

As developers and their managers integrate secure coding practices into their development life cycles, the real-world impacts of their training can be measured. 

It seems improvements flow across the board, improving productivity right from the start of the SDLC. Over half of all developers surveyed claim that good training has improved productivity application design, coding, and debug & testing.

The debug & testing phase is the most impacted, with 56% of developers saying that they have become more productive with these activities. While better scanning and testing tools may have shortened this phase of development, secure coding practices promote the use and reuse of vetted code that is proven to have no code vulnerabilities, as well as a security-minded approach to designing applications. By “starting left” of the development life cycle with their approach to security, developers can save time during the debug phase.

Deployment, which is further downstream, is less impacted, though 44% of developers reveal that they have become more productive even in deployment. This is a result of the increased release velocity associated with secure coding practices.

A proven path to better training

There’s no doubt that quality secure code training delivers many benefits. The question is, how do you judge the quality of secure code training? 

To find the answer, we asked developers what they wanted. 75% of developers preferred structured on-the-job training. They prefer the learn-by-doing method to the drudgery of theory-based static learning. Developers are on the front lines of battle when it comes to stopping vulnerabilities.  As a result, they want training focused on practical applications – something most current training programs sorely lack.

As champions of change in secure coding, Secure Code Warrior takes a human-led approach to help you create a human-led defense. Our proven learning platform delivers contextual, hands-on training content across 50+ language:frameworks, with challenges that mimic those that developers face in the real world. All of which reduces cost and time to release by preventing vulnerabilities before they become tomorrow’s news.

If you’d like to see the potential impact on your teams and their ability to deliver secure code faster, book a demo now.

If there is such a thing as divine timing, then it must be said that the Biden Administration nailed it with their Executive Order (EO) announcement, addressing the US government’s plan to harden federal networks, as well as improve cybersecurity standards and best practices across the nation. This strategy follows two recent, devastating cyberattacks: the ongoing supply-chain breach from SolarWinds, in addition to the Colonial Pipeline gas infrastructure attack. 

While these events undoubtedly caused ripples throughout every level of government, this directive marks an exciting time for the future of cybersecurity. It seems we are finally getting serious about protecting our digital existence right from the top, and there is no better time to push for better standards and higher quality software than now. 

The EO touches on many aspects of functional cybersecurity, but for the first time, specifically outlines the impact of developers, and the need for them to have verified security skills and awareness. For years, we have shouted from the rooftops that this is the way forward to combat the common vulnerabilities that so often trip us up, and for government mandates to align with this approach is the path to widespread success in cyber defense.

How should organizations - and federal departments alike - respond to this order? Let’s unpack some main categories.

‘Tick-the-box’ is off the table. 

We’ve long pointed out the ineffectiveness of most types of cybersecurity training for developers. It’s often too generic, not delivered in a way that engages and inspires the desired result (read: more secure code), and is touched upon far too infrequently. Worse still, a lot of companies are content with “tick-the-box” training: an approach that delivers the bare minimum, “one and done” basics to fulfill an operational requirement and get a tick next to a developer’s name. These education strategies are what keeps every CISO on a knife edge, crossing their fingers and hoping their company won’t be the victim of the next zero-day breach. They simply do not work to reduce vulnerabilities and create higher-quality code. 

In section 4 of Biden’s mandate, the need for an organization to demonstrate that their developers display documented, verified security compliance is made clear:

‍

“The guidelines shall include criteria that can be used to evaluate software security, include criteria to evaluate the security practices of the developers and suppliers themselves, and identify innovative tools or methods to demonstrate conformance with secure practices.”

There’s a slight problem with that: no industry-standard certification specific to developers currently exists. To be able to benchmark the secure coding skill level of developers, and work with courses and assessments to improve those skills is fundamental, allowing companies to set goals and achieve compliance. When developers can show core competencies in a practical, hands-on environment, this can be assessed and certified in a meaningful, trustworthy way. It’s core to our offering at Secure Code Warrior, and we’ve worked hard to create a system that can be utilized for reliable certification that is customizable to their tech stack and organizational requirements. 

These skills are valuable, and they cannot be automated. Certification can transform developers into a security-aware force that can defend the codebase against insidious threats. 

‍

A focus on developer tooling (and tools in general).

In addition to guidelines around verifying secure coding practices, the EO does quite a deep dive into the automation and tooling side of security. 

There is simply too much code being produced for humans to handle alone from a security perspective, and automation - as part of an extensive tech stack - is a major part of every security program, as it should be. However, not all tools are created equal, and there is no “one tool to rule them all” that will pick up every vulnerability, in every programming language. A great security program takes a nuanced approach, especially when it comes to developer-targeted tools and services.

Section 3 of the EO outlines the expectations for vendors creating software that is eligible for use by the federal government, and instructive guidelines around the use of tools in the development process:

‍

“ (iii) employing automated tools, or comparable processes, to maintain trusted source code supply chains, thereby ensuring the integrity of the code;
(iv) employing automated tools, or comparable processes, that check for known and potential vulnerabilities and remediate them, which shall operate regularly, or at a minimum prior to product, version, or update release.”

Security tools in the developer tech stack are one of the ways to improve security best practices at speed, ensuring that releases have the best chance of meeting deadlines and not being held up by security bugs and other showstoppers. The thing is, however, that developers will still need contextual learning to make the best use of the most powerful tools. For them to understand what has been flagged, why it’s dangerous, and how to remediate it is crucial, and will lead to fewer mistakes for tools to identify in the first place. 

The best tools will integrate with a developer’s environment, assisting them in producing higher quality (and more secure) code, and ensure security stays front-of-mind. 

‍

Securing the supply chain.

One of my favorite parts of the EO is the comprehensive plans to secure the software supply chain. This isn’t surprising, given the SolarWinds event, but it’s an important highlight:

“The security of software used by the Federal Government is vital to the Federal Government’s ability to perform its critical functions. The development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors. There is a pressing need to implement more rigorous and predictable mechanisms for ensuring that products function securely, and as intended… the Federal Government must take action to rapidly improve the security and integrity of the software supply chain, with a priority on addressing critical software.”

This ruling will affect any software company looking to do business with the US government, but it should be applied as the standard everywhere. Lack of transparency from third-party vendors (not to mention developers making use of third-party components) over their security measures makes it incredibly difficult to assess, validate, and declare that cybersecurity best practices are being fulfilled. We must analyze the suppliers we use and the software they write. These actions may be seen as the “extra mile”, but they should be inherent to a gold standard of cybersecurity best practices.

Shipping secure code with confidence has been a pain point in our industry for a long time, but this is the perfect opportunity to evaluate current processes and lead the charge to hardened software and cloud infrastructure that is the envy of those left behind. Talk to us now and find out how you can leverage Courses, Assessments, and developer tools to certify your next team of security-aware developers.

‍

In our hyper-connected world, almost every organization shares a common Achilles heel.  A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done.  So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.

In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.

When we asked developers and managers about the most critical priorities in the software development process:

• 76% nominated application performance 
• 62% picked features and functionality
• And a little over 50% selected secure code
  

Today, as we can see, security is not a critical priority. 

But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most. 

But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices. 

Concerns and barriers around secure coding practices

The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team. 

The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.

Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities.  After all, if their team produces lousy code, the buck stops with the manager. 

The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices. 

45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources. 

Current secure code training approaches are not delivering – and managers realize a new approach is needed.   

Who’s responsible for secure code practices? 

By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree. 

However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground. 

Creating more security champions 

Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general. 

Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.

83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training.  These incentives range from formal recognition to greater responsibilities to higher pay. 

It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.  

But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency. 

So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need? 

Solutions to begin to address realignment

Developers don't want to sit around listening to lecturers  – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios. 

Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world. 

This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other. 

When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team. 

If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.

*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020

Insecure code costs companies millions – so what gets in the way of adopting secure coding practices? 

In a world that relies on software for just about everything, ensuring that code is secure is critical. Brand reputations and financial viability depend on it. That said, there are many concerns around secure coding – and many barriers to its full and effective adoption. More than ever before, a new way of working is required. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and their managers’ attitudes towards secure coding, secure code practices, and security operations (download whitepaper here).

‍Right now, organizations find it hard to implement secure code practices. Developers and managers alike find dealing with vulnerabilities and being accountable for code particularly concerning.

Clearly, there is a need for better training and a program that supports secure code practices. This need becomes evident when we ask developers and their managers about their concerns around secure coding. Our research* showed that both these groups share the same basic set of concerns. But due to their different roles, they differ on which of these concerns are most pressing.  

The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team. 

The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which once again echoes the need for a new approach to secure code training. 

Managers, on the other hand, take more of a top-down view. 

As team managers and leaders, their number one concern is being accountable for code. If a team produces lousy code, the buck stops with its manager. 

Code that replicates previous vulnerabilities comes in second. The fact that the learning process is challenging comes in third. As current secure code training approaches are not delivering, managers realize that a new approach is needed.   ‍

Barriers to adopting secure coding practices

When we asked managers about the barriers to adopting secure coding practices in their organizations, two things stand out loud and clear: communication and training. 

45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% bemoan the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources. 

There are process and HR-related barriers to adopting secure code practices successfully throughout organizations. 

But you can still make progress despite such intractable issues. The lack of secure coding skills among new hires and inadequate training and resources are easier to address. 

Developers are on the front lines of battle when it comes to stopping vulnerabilities. But are they receiving the support, tools, and training to hold up their part of the security deal?

Based on their concerns, the short answer is 'no'. 

The truth is, the right training shouldn't feel like a lecture. 

As champions of change in secure coding, Secure Code Warrior takes a human-led approach that actively engages developers to learn and build their secure coding skills. Our proven Learning Platform provides development and security teams with contextual and hyper-relevant learning within their preferred workflow. It empowers them not just to find vulnerabilities but to prevent them from occurring in the first place.

This kind of hands-on training is an upskilling opportunity – a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.

If you'd like to learn more – and see the potential impact on your teams' ability to 'start left' and ship secure code faster without compromising security, book a demo now.

‍*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020

Right now, only 15% of developers agree that secure code practices should be everyone’s responsibility. In a world of increasing security threats, that simply isn’t good enough. Something has to be done. One key to creating a healthy AppSec culture is understanding the key influences (and influencers!) at play. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.

When it comes to the vital adoption of secure coding practices, certain roles have a growing influence and voice, which can help to compel others to learn and adopt best practice. 

The first of these is the development manager, cajoling AppSec-averse developers towards a secure coding mindset. Development managers are aware that they and their teams need to increase and improve their secure coding skill sets. 42% of surveyed managers bemoan the lack of secure coding skills among new hires. 

The second is the ‘security champion’. While most developers still see security as someone else's responsibility, there is a small but growing cohort that embraces secure coding and champions it to their fellow coders. 25% of developers surveyed agree that there are go-to people leading the change to secure coding.

While these champions may only be a developer or senior developer, they can have an outsize impact on moving an organization towards a proactive security posture.

But first, let’s have a look at the role of the development manager in this context. 

83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training.  

• 67%  offer developers the potential for greater responsibility as recognition for learning secure coding practices. 
• 47% say that they offer the potential for higher pay. 

Many managers put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.

It's clear that at the organizational level, development managers are critical drivers of the adoption of secure coding practices – and instrumental to spotting security champions in the ranks of their developers.  

Identifying security champions 

One of the keys to improving developer engagement in secure code training and awareness programs is identifying security advocates or champions within the ranks of their current developer cohort. 

Some development managers do this already – 55% of those surveyed say they recognize developers who perform well at special events. 

As champions of change in secure coding, Secure Code Warrior understands the power of special events and competitions to bring out the best in an organization’s developer base. This is why we have made Tournaments a central plank of our Learning Platform. 

Raise security awareness and ownership‍

With a range of challenges, time limits, leaderboards, and prizes, tournaments generate a buzz that makes secure coding cool and promotes security awareness and ownership. 

When it comes to measuring the effect of secure code training, 65% of surveyed development managers say that regular skills assessments drive their organizational focus on secure coding. Tournaments can be used to measure coders’ security skills in an active but safe environment and quickly establish a baseline for future skills development. This gamified training delivers contextual, hands-on experiences in relevant programming languages and frameworks, with challenges that mimic those developers face in the real world.

Throughout the tournament, developers earn points and watch as they climb to the top of the leaderboard. Watching the leaderboard helps management spot potential security champions within their development team.

‍
If you'd like to know more about building secure code skills and awareness with gamified training that engages developers and identifies security champions, book a demo now.

‍

*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020