Secure Code Insights

We’ve hit that time of the year. The time to reflect on everything that’s happened, what we thought would happen and didn’t, lessons learned and what we expect will shape the decisions, actions and outcomes over the next 12 months. 

Challenging economic dynamics, emerging cybersecurity threats, and society’s most accessible introduction to AI to date, shaped what was an interesting 2023 for DevSecOps. Even more curious – none of these elements are in the rearview mirror as we turn the page and head into 2024. They are front and center for organizations, their developer and cybersecurity teams, and government regulators. 

As priorities shift at a rapid pace, here are the top predictions Secure Code Warrior sees unfolding in the next 12 months: 

Organizations will place a premium on developer retention 

Developers deliver immense value to organizations and their customers. Now it’s on the organizations to demonstrate their value and appreciate what the developer can do for their bottom line. More investment will be made in retention strategies, programs and other efforts to ensure developers are more empowered to make their current employer their long-term career destination. Learning and development will be a huge differentiator for these enterprises. 

More asks of developers will put content and integrations at centerstage. 

The pressures placed on developers will not let up anytime soon, knowing organizations want more software, and continuous digital transformation to get into the hands of their customers sooner. For developers to stay sharp, anticipate emerging roadblocks in software development life cycles (SDLC) and have access to more resources to accelerate innovation - more learning content and third-party integrations will be of paramount importance. 

AI tooling is the new Stack Overflow 

The same way developers go to Stack Overflow or open source forums to seek help, developers will start turning to AI tools. However, this creates a false sense of security. Developers will use AI as a “help channel,” but organizations will realize that this approach is not enough. 

AI remediation is here to stay 

AI is not replacing the developer tomorrow, but the technology is becoming more embedded in the software development life cycle (SDLC), creating a more foolproof process to avoid introducing vulnerabilities, or to identify a compatible fix. We’re bound to see more experimentation throughout the year that will inevitably bring about a change in developer behavior, organizational investment, staffing re-allocation and new approaches to cybersecurity risk management. 

AI reliance + API explosive growth = regulatory measures

The number of companies fueling their businesses through the accelerated creation and enablement of APIs has significantly expanded the API threat vector. With the propensity of AI usage to exponentially increase the speed at which APIs are created and launched, greater governance for API security will need to be a focus – and new regulatory measures are sure to be introduced. 

More consequences for software vendors who don’t ship secure code 

CISA Director Jen Easterly has made it abundantly clear that software vendors should not be permitted to “pass the buck” when it comes to security within their products. While CISA’s powers only extend so far - helping to enforce Secure-by-Design practices to vendors that sell to federal agencies - The MOVEit incident earlier this year reaffirmed that large software vendors need to hit and exceed a new benchmark. There needs to be more accountability and more consequences to enforce for repeat offenders who ship insecure code.

2024’s OWASP Top 10 will show a renewed focus on design flaws 

Speaking of Secure-by-Design, In 2021, OWASP introduced the “Insecure Design” category, focusing on the shift towards architectural security issues and flaws. As we anticipate their upcoming Top 10 list (most likely in 2024), there will be greater, executive-level conversation around the difference between insecure design and insecure implementation, with an emphasis on teams developing a secure software development life cycle (SSDLC), including a complete threat modeling procedure that supports critical authentication and access control configuration. 

DevSecOps vendors will need to prove specific ROI to target different executive buyers 

In order to sell to multiple groups in a competitive sales cycle, vendors will need to tailor conversations to different areas of the business. Traditionally, security vendors primarily sell to CISOs or security leadership. In 2024, there will be a greater need for the ability to prove risk reduction in increasingly specific contexts for executives across L&D and DevOps/AppSec – in addition to Security/CISOs.

“Gatekeeping” will be the ticket to security maturity in software development 

CISOs remain under scrutiny to prove the business value of cybersecurity efforts, as well as the effectiveness of their program over time. Developers will increasingly need to prove they are security-aware before being given projects with sensitive repositories. CISOs who adopt a “gatekeeping” standard and prioritize secure coding from the start of the software creation process will better position their teams for security excellence. 

Reactive security will be seen as old school 

As the goal of increased cyber resilience continues to dominate cyber strategies across multiple verticals, those who rely on reaction and incident response as the only core tenets of their plan will find themselves in a place of unacceptable exposure and risk. “Shift left” needs to be more than a rapidly aging buzzword; code-level security should be prioritized, alongside upskilling and verifying the competence of the developers working on the software and critical digital infrastructure we take for granted. Now, more than ever, governments and enterprises alike must commit themselves to a preventative, high-awareness security program in which every member of staff is enabled to share responsibility.

As the leader in secure coding education and implementation, we’re excited for the year ahead and collaborating with our 600+ customers to get ahead of these evolving dynamics. What does your 2024 look like and how can Secure Code Warrior help?

Interested to learn more? Follow us on X and LinkedIn to stay up-to-date on all announcements.

The speed of innovation in cloud computing and AI is at an all time high. Global SASE leader Netskope helps organizations take advantage of it all while addressing evolving threats, new risks and technology shifts. However, these challenging dynamics have placed added pressures on the software development lifecycle.

Netskope’s Deputy CISO, James Robinson, has been at the forefront of finding ways to ensure his organization’s development team stays up to speed on new languages and technologies, but also keeps the team skilled on the ever-evolving security landscape. When he recognized that current training capabilities only addressed a handful of languages, it was obvious a better alternative was needed.

In working with Secure Code Warrior, they have built a program that makes security content visible and accessible to developers, so they won’t wander to unvetted solutions.The customizable content and myriad of hands-on learning activities from Secure Code Warrior has changed the game for Netskope, with a higher participation in SCW’s agile learning platform and the fact that these efforts no longer feel like they’re a check-the-box – but meaningful content and activations for the developer community.

What was their complete journey like and what have been the results thus far?

• Check out Netskope’s story in this brand-new case study you can read here
• Watch a joint webinar with Secure Code Warrior and Netskope on Going beyond compliance here 

No matter where you look, there is an ongoing fixation with AI technology in almost every vertical. Lauded by some as the answer to rapid-fire feature creation in software development, the gains in speed come with a price: the potential for severe security bugs making their way into codebases, thanks to a lack of contextual awareness from the tool itself, and low-level security skills from the developers relying on them to boost productivity and generate answers to challenging development scenarios. 

Large Language Model (LLM) technology represents a seismic shift in assistive tooling, and, when used safely, could indeed be the pair programming companion so many software engineers crave. However, it has been quickly established that unchecked use of AI development tools can have a detrimental impact, with one 2023 study from Stanford University revealing that reliance on AI assistants was likely to result in buggier, more insecure code overall, in addition to an uptick in confidence that the output is secure.

While it is valid to assume that the tools will continue to improve as the race to perfect LLM technology marches on, a swathe of recommendations - including a new Executive Order from the Biden Administration, as well as the Artificial Intelligence Act from the EU - renders their use a tricky path in any case. Developers can get a head start by honing their code-level security skills, awareness, and critical thinking around the output of AI tools, and, in turn, become a higher standard of engineer.

How do AI coding assistants introduce vulnerabilities? Play our NEW public mission and see for yourself!

‍

Example: Cross-site scripting (XSS) in ‘ChatterGPT’

Our new public mission reveals the familiar interface of a popular LLM, and utilizes a real code snippet generated in late November 2023. Users can interpret this snippet and investigate any potential security pitfalls if it were to be used for its intended purpose.

Based on the prompt, “Can you write a JavaScript function that changes the content of the p HTML element, where the content is passed via that function?” the AI assistant dutifully produces a code block, but all is not what it seems.

Have you played the challenge yet? If not, try now before reading further.

… okay, now that you’ve completed it, you will know that the code in question is vulnerable to cross-site scripting (XSS). 

XSS is made possible by manipulating the core functionality of web browsers. It can occur when untrusted input is rendered as output on a page, but misinterpreted as executable and safe code. An attacker can place a malicious snippet (HTML tags, JavaScript, etc.) within an input parameter, which -- when returned back to the browser -- is then executed instead of displayed as data.

Using AI coding assistants safely in software development

A recent survey of working development teams revealed that almost all of them - or 96% - have started using AI assistants in their workflow, with 80% even bypassing security policies to keep them in their toolkit. Further, more than half acknowledged that generative AI tools commonly create insecure code, yet this clearly did not slow down adoption.

With this new era of software development processes, discouraging or banning the use of these tools is unlikely to work. Instead, organizations must enable their development teams to utilize the efficiency and productivity gains without sacrificing security or code quality. This requires precision training on secure coding best practices, and providing them the opportunity to expand their critical thinking skills, ensuring they are acting with a security-first mindset, especially when assessing the potential threat of AI assistant code output. 

Further reading

For XSS in general, check out our comprehensive guide.

Want to learn more about how to write secure code and mitigate risk? Try out our XSS injection challenge for free.

If you’re interested in getting more free coding guidelines, check out Secure Code Coach to help you stay on top of secure coding best practices.

‍

In the ever-evolving landscape of cybersecurity, the role of developers in safeguarding digital assets has become increasingly pivotal. However, the challenge lies in educating developers who, inherently focused on problem-solving and efficiency, may not prioritize security. In this blog post, we explore three critical steps to structure a security education program that not only engages developers but also significantly reduces vulnerabilities—by a remarkable 53%. From fostering relationships to implementing a tiered approach, these strategies aim to empower developers with the knowledge and skills necessary for secure coding practices.

1. Build relationships and keep developers engaged 

Developers often lack initial security knowledge, but their primary focus lies in resolving code-related issues promptly. To spark their interest in security, it's crucial to emphasize the value of these topics and make them actionable. Implementing a program that allows developers to train independently and at their own pace across all programming languages in your technology stack is key. Establish strong relationships with developers and team leads to allocate realistic time for secure code education.

The critical first step is to  implement a program that allows developers to be independent and train at their own pace. This means it needs to cover all programming languages used in your technology stack. Take into consideration the learning needs of developers in a complex environment and think about how it will work alongside your existing security tooling to aid in vulnerability management.

2. Prioritize recurring vulnerabilities  

Using your scanning and pen-testing tools, keep a close eye on your critical and recurring vulnerabilities to guide you on which secure coding educational content will build the cornerstones of your program. Utilizing your existing tools and integrating these findings into your secure code program will be key. Consider also the following metrics to prioritize which vulnerabilities your developers need to be educated on: 

• Average vulnerability age 
• Number of vulnerabilities in the backlog
• Average resolution time, or mean time to remediate (MTTR)  
• Number of closed vulnerabilities vs. open vulnerabilities
• Number of issues per line of your proprietary written code (not third party)

Expectations around the outcome of the program should be set early on as well. Developers who participate in the program should be expected to attain a certain level of secure coding skills, which can be tracked by the number of vulnerabilities they resolve and are not re-introducing. 

3. Implement a tiered secure coding skill development program 

Once you have integrated developers’ participation in security with the analysis and testing process, it’s time to empower developers to be proactive about honing their secure coding skills by incentivizing them to continue with their secure coding education. This can be done by structuring your program into tiers, or “belts” to move developers into more complex areas of security. 

Here’s one example of how Thales structured their security education program: 

1. Awareness - raises the basic level of security awareness and establishes a baseline for the developers’ knowledge of the security topic 
2. Basic - teaches basic security skills like how to spot vulnerable code and understand common vulnerabilities 
3. Autonomous - uses vetted tactics to locate and remediate vulnerabilities with Secure Code Warrior’s guidance 
4. Expert - becomes a defined security champion and expert in all relevant areas important to the business

Promoting self-learning will also motivate your developers to keep them up to date on new attack vectors, best practices, new languages, and newly discovered vulnerabilities. Once everyone has reached a baseline of secure-coding competence, take advantage of a program that helps save time with just a couple of key learnings every month through relevant content, rather than an hour-long compliance-oriented annual training. The time saved through educating developers will manifest in the reduction of rework needed to fix vulnerabilities that shouldn’t have been introduced in the first place. 

Conclusion

In the dynamic realm of cybersecurity, where threats mutate as swiftly as technology advances, a proactive and well-structured security coding education program for developers  is a critical business safeguard. By building strong relationships with developers, prioritizing recurring vulnerabilities, and implementing tiered skills development, organizations can fortify their codebase against a potentially devastating breach. 

The success of such a program is not merely measured in reduced vulnerabilities but in the cultivation of a security-first mindset among developers. As we navigate the complex terrain of digital security, empowering developers through education emerges as a potent strategy for transforming an organization into a resilient and secure digital ecosystem.

Secure Code Warrior is here to help you securely code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.

Empowering developers, enhancing productivity, and mitigating risk

What an amazing year in the ever-evolving landscape of cybersecurity! Secure Code Warrior is proud to continue our mission of equipping developers and organizations with the skills needed to combat ever-evolving security threats. In 2023, we worked with more than 600 enterprises, and in analyzing data from nearly 75,000 developers, our research shows that those who engage with Secure Code Warrior reduced vulnerabilities as much as 53%. This in turn leads to massive gains in productivity for developers, as well as supporting AppSec and security teams in hedging against risk and strengthening their organization’s security posture.

As we head towards 2024, we thought it would be helpful to walk you through some of the key product advancements, strategic partnerships, and company updates we have made this year. 

‍

Product innovations

We saw a banner year for secure code learning in our community of developers. Here are some of the highlights:

• We added 2 new languages to the platform - Terraform:GCP and Dart:Flutter- and shipped Coding Labs in 9 different languages and frameworks. 
• Secure Code Warrior hosted 820 Tournaments in 2023.
• On average, developers spent 2.3 minutes on Coding Labs, completing over 100,000 labs in 2023. That adds up to over 4,200 hours spent on Secure Code Warrior’s newest learning activity! 
• Finally, here’s a look at the top 10 industries our developers come from based on the number of active learners on the platform. 

In 2023, Secure Code Warrior introduced Coding Labs - our most advanced and interactive learning activity - designed to elevate developer security education. This addition provides real-time, contextual feedback and is currently available in 9+ languages and frameworks. Coding Labs acts as a personal trainer, facilitating faster learning and skill improvement, and making it quicker for developers to go from “learning” to “doing”. 

Secure Code Warrior continued to broaden its industry-leading library of content with the addition of two new programming languages - Dart:Flutter and TeraformGCP. Further enhancements include incorporating Guidelines into courses and the SCW Jira integration, offering developers deeper insights and in-depth remediation advice within their workflows. The introduction of Multi-company Tournaments helps foster friendly competition between developers from various companies and subsidiaries, ensuring a scalable secure coding culture. Additionally, the rollout of SCIM allows program owners and company admins to manage Secure Code Warrior licenses programmatically, ensuring accuracy and compliance at scale.

Curious to learn more about our latest product innovations? Contact your Customer Success Manager or visit our resource library for one of the many product deep dive webinars available. 

‍

‍

Strategic partnerships and integrations

A noteworthy collaboration emerged with Synopsys Developer Security Training, powered by Secure Code Warrior. This integration offers a closed-loop strategy to preempt security risks at the developer desktop, accelerating issue remediation across the software development life cycle (SDLC) and CI/CD pipelines. The partnership aims to establish a comprehensive approach to secure development, with quantifiable risk reductions.

Learn more about the partnership here. 

‍

Devlympics 2023

Devlympics, an annual global tournament hosted by Secure Code Warrior, witnessed over 1000 developers participating in 2023. The event garnered attention from security professionals worldwide, with overwhelmingly positive feedback:

• 94% enjoyed participating in the tournament.
• 90% expressed interest in joining next year's event.
• 62% rated the SCW platform 10/10, and 91% would recommend it to their peers.
• Over 85% would use the SCW platform if their organization had full-time access.

Read the full report here. Don’t want to miss out on next year’s Devlympics? Mark your calendar for October 15-16, 2024 and register your interest to be kept in the loop. 

‍

Hear from your peers

As we’ve partnered with our customers, Secure Code Warrior has become deeply embedded in their security ecosystem, and made a profound impact on their developer productivity and reduction of risk. We heard from several customers this year, and collected key learnings and insights from their subject matter experts to share with our colleagues in the broader Application Security community.  

• Workday: A remarkable reduction from 4662 security issues to zero in approximately 18 months.
• Thales: Achieved an overall reduction in vulnerabilities over two years, with no reintroduction at the source code level.
• Envestnet: Developers fixed 2.7 times more vulnerabilities than their peers, closing issues at a rate of 4.5 per developer.
• Netskope: Meet their compliance goals without traditional "check-the-box" training, with higher engagement rates in their secure coding program.
• Colgate-Palmolive:  Placed developers at the core of their secure code strategy, and embedded Secure Code Warrior seamlessly into their workflows using Okta.
• Sage: Built a best-in-class security champion community and reduced the mean time to fix vulnerabilities by 82%.

Hear directly from our customers about how they’ve built their secure code programs, fostered a security-first culture, and improved their security posture. 

‍

SCW’s Rapid Response to cybersecurity vulnerabilities

Secure Code Warrior’s Rapid Response program addresses current critical vulnerabilities plaguing our world, such as the MOVEit zero-day exploit, high-severity libcurl/curl vulnerabilities, and mvcRequestMatcher Spring. These incidents underscore the importance of proactive security measures and continuously educating engineering teams about recent vulnerabilities. Learn more about these critical vulnerabilities below, each comes with a free mission that you can play through hands-on.

• MOVEit Zero-day free mission
• libcurl/ curl vulnerability mission 
• mvcRequestMatcher Spring mission 

‍

Major funding and recognition

With office locations in Sydney and Melbourne Australia, Boston USA, Belgium, and Iceland - SCW is proud to host a community of developers that represent a wide variety of industries and regions. 

On July 13, 2023, Secure Code Warrior announced a groundbreaking achievement—the closure of its Series C funding round led by Paladin Capital Group, securing an impressive $50 million USD. This brings the total funding to over $100 million USD, underlining the confidence and support garnered since the company's inception.

‍

Join the growing community 

Secure Code Warrior's commitment to innovation, strategic partnerships, and customer success makes us proud to celebrate our successes as the leader in secure coding education and implementation. 

Interested to learn more? Follow us on X and LinkedIn to stay up-to-date on all announcements. 

That’s all for now, see you in 2024!

How agile learning with Secure Code Warrior reduces vulnerabilities

Security education needs to evolve 

One of the challenges facing security teams today is there is not enough time to integrate secure coding earlier in the development cycle. Security leaders also need to rethink the value developers are getting from the secure code learning experience, how to make the program more engaging and, most importantly, more impactful. The last thing you want is for your security education program to be seen as a hindrance to productivity. The goal of approaching developer security training should instead be built on engaging pathways, integrations with workflows, and a breadth of content that helps the concepts to stick, resulting in a reduction of the vulnerabilities being introduced. 

By integrating secure code learning with your developers’ workflow and reducing the burden on their time, developers can see a big boost in their ability to code more securely and be more productive. Secure Code Warrior has looked at data from over 75,000 developers using our platform and found that agile learning helps developers introduce 53% fewer vulnerabilities into the codebase. 

This requires a shift in approach so that developers get excited about the subject through more hands-on learning and integrations with their tools and environment to drive deeper engagement and moments of micro-learning with a big impact. 

According to Derek Fisher, a leader in application security, “We’re all pretty well familiar with the annual compliance training that we’re all subjected to in any organization. It’s usually what I call ‘death by Powerpoint’, a bunch of slides and maybe an assessment at the end...  just really ineffective and time-consuming. We had training, but it was the usual compliance based with some specific-to-security training that was slide/audio recording based. We noticed that developers weren’t very engaged and learning from the materials, so we had to shift our strategy.”

Integrate the learning experience with your developer workflows

Secure Code Warrior’s platform delivers just-in-time microburst content into the developer’s daily workflow. This integration with security tools is designed to eliminate context-switching and enable AppSec teams to build more prescriptive and engaging programs. 

With these devtool and security integrations, you can measure how your secure code learning program is working by tracking developers’ progress and measuring response times to tickets, as well as observing the reduction of vulnerabilities over time through IAST/ DAST/SAST tools. 

Here are three key ways Secure Code Warrior can integrate with your tools and workflows to help reduce vulnerabilities by up to 53% 

1. Streamline your approach 

Integrate Secure Code Warrior with your scan and pen-testing tools. This allows you to automatically correlate specific vulnerabilities and expose developers to trusted learning content needed for remediation. Secure Code Warrior has integrations with Synopsys, Snyk, Bugcrowd, Fortify, Contrast, and many more to help keep your program laser-focused. 

2. Improve productivity

Enable development teams to learn by doing through hands-on Challenges, Coding Labs, and Guidelines embedded in Jira, Gitlab, GitHub, and Azure Boards. Learning happens in minutes, not hours, without hampering developer productivity or disrupting their flow. 

2. Scale your program 

Reduce the admin burden for a security program with SCORM and SCIM capabilities built for the enterprise. Easily integrate Secure Code Warrior with your LMS, and manage user provisioning automatically. Enable SSO with the Okta integration. 

Reduce 53% of vulnerabilities earlier in the SDLC 

It’s possible to remediate vulnerabilities much earlier in the SDLC by shifting focus to writing more secure code from the start when it costs significantly less to fix them. By looking at the source of many vulnerabilities, namely, insecure code being shipped into production by developers, reducing the vulnerabilities introduced can help alleviate your tech debt and strengthen security. 

Meaningfully reducing vulnerabilities through developer education doesn't happen through boring, static training that disrupts the developers' flow. By embedding learning from the most flexible agile learning platform on the market with your tools, your existing investments in security and devtools become more valuable, potentially resulting in a substantial 53% reduction in vulnerabilities. 

Learn more tips from Secure Code Warrior 

In our next blog post, we’ll explore how you can build a highly engaging program that ties everything back to risk reduction, allowing you to focus on what the material impact is for a successful secure coding program.

Secure Code Warrior is here for your organization to help you securely code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.

Learn how hands-on security education can reduce vulnerabilities by 53% 

The challenge facing development teams today 

Developers are under enormous pressure to build faster and accelerate production cycles more than ever before. This leads to a higher volume of code being introduced into organizations, some coming from open-source, A.I., or other third parties. While these may help accelerate productivity, this also raises the risk of introducing insecure code into the code base.

Despite mounting pressure to deliver faster, a software development team reworks about 26% of its code prior to release. This means a developer can spend up to 13.5 hours a week on just technical debt. That’s over 700 hours a year spent on fixing past mistakes. The hours of lost productivity can slow down development cycles, and worse, introduce new risk into the code through shortcuts and third-party sources. This creates a challenge in balancing the pressure to release code quickly but also securely. 

According to Secure Code Warrior’s research, 67% of developers admit to shipping code with vulnerabilities, and with each new line of code written each day, more and more vulnerabilities are being introduced. There is a better way to approach this - embed security from the start. In this blog, we’ll explore how developers can be the first line of defense in securing code and reducing up to 53% of vulnerabilities in their code with agile learning. 

Stop vulnerabilities from even being introduced 

Secure Code Warrior works with over 600 different enterprises to help them secure their code. Our researchers looked at data from 30% of our user base - almost 75,000 developers - and noted that developers who learn and apply secure coding practices with Secure Code Warrior introduce 53% fewer vulnerabilities into their organization than their peers. When developers stop creating new vulnerabilities - this unlocks hours and hours of productivity gained. This time can be spent reducing the technical debt backlog, or even on shipping new, innovative solutions and features. The possibilities become endless when introducing vulnerabilities becomes a thing of the past and can result in a number of efficiency improvements to the software development lifecycle. 

How can developers benefit from agile learning?  

Secure Code Warrior has integrated agile principles into the design of our learning platform to encourage developers to learn secure coding by doing. This is done through breaking up what used to be long, boring security training into small microbursts of learning that is interactive and engaging. 

Secure Code Warrior is the only agile learning platform that combines multiple microburst learning formats so developers can learn, test, and apply their knowledge quickly, in the context of real work they are already doing - in the language of their choice.

With customizable programs, highly impactful hands-on learning activities, and developer tool-ready integrations, Secure Code Warrior is the most effective way to teach developers to identify and fix vulnerabilities at the start of the SDLC, and stop vulnerabilities from being introduced in the first place.

Why Secure Code Warrior

Secure Code Warrior gives your developers the skills to write secure code. Our learning platform is the most effective secure coding solution because it uses agile learning methods for developers to learn, apply, and retain software security principles. Over 600 enterprises trust Secure Code Warrior to implement agile security training programs for learning code with agile methodology, deliver secure software rapidly, and create a culture of developer-driven security. Ready to learn more? Request a demo.

Just a short time ago, the security and development communities were put on notice with an advisory from the curl Project’s lead developer, Daniel Stenberg, who dropped the unfortunate missive that a new version of curl - distributed October 11 - was released to address two high-impact security vulnerabilities, one of which he describes as "probably the worst curl security flaw in a long time."

A postmortem on Stenberg’s blog noted that affected versions of the curl library are susceptible to a Heap-based buffer overflow vulnerability, related to a legacy issue with the SOCKS5 proxy protocol in use since 2002.

With its usage as a command line tool dating all the way back to 1998, curl is widely regarded as a foundational pillar of the internet. With such a storied history and widespread use, it is a dependency that, if found to be vulnerable, could have ongoing implications for general cyber safety.

This incident shares similarities with the devastating Log4Shell attack in Log4j, another vulnerable dependency that is still being exploited almost two years later.
‍
>>> Test your knowledge right now with our curl Mission!‍

The vulnerability: Buffer Overflow

The exploit is detailed under CVE-2023-38545, and impacts curl versions 7.69.0 up to and including 8.3.0. The primary bug is a Heap-based Buffer Overflow vulnerability, with initial reports noting that successful exploitation could lead to a more devastating Remote Code Execution (RCE) attack. While this is a possible workflow for a threat actor, it is a rare use case rather than a given.

Perhaps the one saving grace to mitigate some of the risks is that the malicious communication must go through a SOCKS5 proxy, which is a relatively uncommon deployment.

Comparable to the curl exploit, let’s take a look at this Buffer Overflow explainer:

When curl is told to use a SOCKS5 proxy, it will pass on the hostname and have the proxy resolve it. However, if the hostname exceeds the 255 bytes limit, curl will resolve the hostname locally (as seen in the code snippet below: source).

In case there is a slow handshake between the client and proxy, it is possible that the long hostname is copied into the memory buffer instead of the (shorter) resolved address. The allocated memory portion only allows for a 255-byte value, so if it receives a value that exceeds this limit, the data will overflow the memory buffer’s boundaries.

>>> Try it out for yourself in this playable mission!

Buffer Overflow is a powerful attack vector, and one that can be prevalent in a lot of legacy programming languages. In this particular case, exploitation made way for a more serious and damaging attack in the form of RCE in some contexts, though this pathway remains uncommon and unlikely.

How can you mitigate Buffer Overflow risk?

At this stage, the highest priority remediation is to apply the patches to all vulnerable instances, with a reminder that the use of curl is so widespread, it may not necessarily be obvious or advertised that components of your system include the dependency in use. In that case, auditing and subsequent patching are required. 

In general, buffer overflow flaws can be mitigated by using a memory-safe language like Rust, however, as is the case with a sprawling project like curl, it isn’t practical to port to another language or rewrite on a whim. As Stenberg notes while discussing the potential to use and support more dependencies written in memory-safe languages - or the alternative of gradually replacing parts of curl piecemeal - “... development is… currently happening in a near glacial speed and shows with painful clarity the challenges involved. curl will remain written in C for the foreseeable future.” It is no small undertaking, and the security implications are immense.

Security mistakes can and will happen, and it’s not always possible to rely on scanners and tests to pick up every possible attack vector. Therefore, our greatest weapon in the fight against these bugs is a commitment to ongoing security awareness and skill-building.
‍

Want to learn more about how to write secure code and mitigate risk?

Try out our Heap Overflow challenge for free.

If you’re interested in getting more free coding guidelines, check out Secure Code Coach to help you stay on top of secure coding best practices.

Here at Secure Code Warrior, we’re constantly innovating to help equip developers and organizations with the right skills to tackle today’s ever-changing security challenges. We do this through our agile learning platform for secure coding that allows developers to learn how they want, with the most complete and reliable vulnerability content in the industry today.  

This past quarter, Secure Code Warrior has implemented new ways for company admins to expand tournaments to multiple brands and entities, in addition to managing their users through SCIM provisioning more simply. We are also thrilled to announce that new coding guidelines are available in Jira, as well as performance overview reporting and new program workflows available in preview. 

Let’s dive in to learn more!

Expanding the SCW platform’s breadth and depth 

Secure Code Warrior’s continued expansion into new content helps to keep our modules relevant, timely, and tailored to what you need to know in today’s cyber-security landscape. With industry-leading breadth and depth of over 60 languages, it’s easy to build and scale an agile learning program for developers in a large number of languages and frameworks. 

Now available: Coding Guidelines in Jira 

The addition of Guidelines to our Jira integration offers developers contextual learning that covers security mitigation. Guidelines are more in-depth than videos, focus on a specific language or framework, and offer code snippets to help developers solve an issue even faster. In addition to accessing videos and challenges, now developers can read coding guidelines directly in a Jira issue to access in-depth remediation advice.

Now available: New front-end developer content 

Front-end developers need secure code enablement, too! That’s why we have released additional front-end vulnerabilities in Missions and Walkthroughs. Front-end developers will also be able to access front-end specific Missions through Courses. 

These updates strive for comprehensive coverage of frontend-specific vulnerabilities - from common ones like DOM-based XSS, to less frequently encountered vulnerabilities such as CSS Injection.  Step-by-step Walkthroughs provide front-end developers with trusted guidance on how vulnerabilities are being exploited, while more advanced developers can also test their skills in front-end Missions in Tournaments. 

Exciting new ways to scale your culture of security 

Now available: Multi-company Tournaments 

‍

Multi-company Tournaments can be created to enable friendly competition between developers from multiple business entities, company subsidiaries, partners, and other companies. This ensures that a secure coding culture can scale across an entire organization and its multiple brands.  

Interested in participating in the ultimate Multi-company Tournament? Register for the 3rd annual Devlympics - SCW’s global tournament for Cybersecurity Awareness month! If you are already a customer, you can register through the platform. 

Simplifying the admin and developer experience

Now available: Course filtering 

The ability to apply additional filters on the Course Management page makes it much simpler for admins to filter down to the course they want to work on. Courses can be filtered by several attributes such as status, end date, and teams enrolled.

Now available: Manage your SCW licenses with SCIM 

Now program owners and company admins can programmatically manage developers at scale and enjoy the certainty of knowing that access controls are always up to date.

SCIM provisioning uses your identity provider to synchronize access to Secure Code Warrior. Automating these tasks ensure accuracy, security, and compliance to save both time and resources when provisioning users. Currently, SCW supports SCIM provisioning on the user level only and not yet for SCIM groups.

Available in preview: Program workflows

 Configuring a scalable and engaging secure code education program is now easier than ever with key usability improvements to the platform. Programs were created to provide more guidance for learners through the sequencing of courses and assessments into multi-level programs. Automated program workflows are now available to customers who have enabled preview in the platform. Program workflows ensure that developers know where to start, can navigate to what is next, and move easily through different levels in a secure code learning program. It also enables company admins to spend less time setting up, managing their program, and nudging developers to complete their next learning activity. 

Need some tips about how to kickstart secure code learning at your organization? Read our handbook about how to structure your program to meet your security goals. 

Reporting and program insights

Available in preview: Performance Overview 

As a company admin, the need to monitor activity across your organization is crucial to understanding developer participation and measuring the success of your secure code learning program. We’ve built an enhanced reporting interface that ensures company admins are gleaning the most actionable insights from their reports.

Performance Overview provides insight into developer course and assessment completion, along with the average accuracy over time. The report also generates an insightful industry benchmark to see how your program compares to your industry’s average assessment score for your selected assessment. 

This simple, and yet powerful report marks the beginning of Secure Code Warrior’s set of insights and metrics that are planned for 2024. 

Interested in trying out Secure Code Warrior but don’t have an account yet? Book a demo to learn more today. 

That’s a wrap on this quarter’s new capabilities! Follow Secure Code Warrior on LinkedIn and X (formerly Twitter) to get updates about the latest releases and improvements.

‍

‍