IAG Group is the name behind many of the leading insurance companies in the Asia-Pacific region, underwriting policies for millions of customers to the tune of approximately AUD $11.4 Billion in premiums per annum. Bianca Wirth is the Corporate Security Education & AwarenessManager for IAG Group. Highly attuned to the need for tight security awareness and practices within the development team, she set about creating a truly innovative, optimum environment in which the team could learn vital secure coding techniques.

ENTER: Game of Codes

The challenge

Developers are often stretched for time, with multiple deliverables and projects on the boil. However, keeping up-to-date with security best practice is of utmost importance to any organisation, let alone one with millions of sensitive customer data profiles to keep safe from hackers. Bianca and her team set clear objectives on the path to making their cybersecurity initiatives more robust. They determined that minimising the attack surface area inIAG-developed applications was the priority, and they would approach this through educating developers to identify and fix critical and high-risk vulnerabilities. Lengthy secure coding training courses certainly exist, but they can be laborious, tedious, and take key staff away from development projects with strict delivery timelines, which creates pressure across the business. The need to up skill the dev team quickly, with minimal impact to workload and operations, became apparent. And with developers across Australia andNew Zealand, each working on systems that weren’t necessarily the same, this was no small feat.

“This year, I made a change to our source code which removed an SQL injection vulnerability. For there cognition of this I give credit to Game of Codes. Even just keeping secure coding top of mind is helpful. The competition is a good way to push people to try their best… because let’s face it, security isn’t everyone’s most enjoyable topic, so this is a good way to get people involved.” R, IAG Developer

The implementation

Bianca strategised the rollout of a gamified training experience, working in conjunction with her team and Secure Code Warrior in the implementation of tournaments and training to promote the skills of their in-house developers. For this, it was essential to set up a sound communication strategy, as well as cater to the different motivations and personalities that staff have in adopting an all-new platform and using it to its full potential:

“We designed a communications plan, consisting of how we’re going to communicate to staff and key stakeholders the need-to-know points, key messages and what incentives we’re giving them to respond to as well. Most people really enjoy the gamified experience. It just depends on their personalities, their motivation and what drives them. So, that’s why we try to cater for a whole different range of motivations for people. For some, they love the prizes, for others the achievement aspect itself is enough of a factor,” she said

Bianca and IAG expertly showcased Secure Code Warrior’s gamified learning platform, transforming their tournament into a fun competition experience heralded as the ‘Game of Codes’, with staff placed into medieval-themed houses (complete with branded player merchandise) going head-to-head in a battle worthy of its HBO-produced namesake.

The tournament has even been taken to the international stage, with an upcoming Australia vs New Zealand match-up soon to launch. This gives IAG the chance to identify the leading security champions across both countries, as well as ensuring teams are up-skilling together.

The result

Game of Codes is, in effect, a specialised training program. Its roll-out as an interactive, fun tournament ensured that staff remained engaged in a variety of ways, but the core practicality of the exercise remained: to give developers the skills required to identify and thwart high-risk vulnerabilities in IAG-developed applications.

By ensuring that both developers and security teams are working with a security-first mindset, as well as being equipped to not just identify, but fix vulnerabilities from the beginning, IAG anticipates seeing a reduction in costly penetration testing exercises and strain on the team that carries them out.

In addition to this vital competency continuing to be developed, Game of Codes also aided in relationship building, injecting a sense of camaraderie and friendly competitiveness between involved teams, while also helping individuals feel more confident in their secure coding abilities when seeing them measured in a point-scoring tournament environment.

Bianca stated that the internal support for the program was immense, with a positive reception from the executive suite. This also led to an ambassador program, where individuals keen to promote the program and champion security within the organisation could get involved:

“It has been fantastic exposure for some developers and an excellent promotion of their skills. They’re getting benefit from that in their own jobs as well which is important to see.”

Far from being ‘just a game’, or simply a more pleasant way for department managers to burn through compliance training, Game of Codes offers a high-retention, engaging solution that turns security novices into security champions quickly, which is essential in minimising the risk of a large-scale breach.

And the ultimate advice, from Bianca herself:

“If you roll out any program and expect people to just use it, it's not going to work. You need to design a program around it where you initiate and motivate changed behaviour. What we built was essentially a developer change management program, focused on security.”

“After going through the training sessions on Game of Codes, I find I am more interested in security and thinking about security when creating automation tests.I am a senior tester in an agile team and these training sessions have motivated me to learn more about security testing and think of it as a possible specialisation.” A, IAG Senior Tester

FAST FACTS 

• In addition to gamified learning, IAG is also using Secure Code Warrior as a skill-testing tool in developer recruitment.
• They are in the process of rolling the program out to 100% of their development team, with 55% already active in the system.  
• They have developed a key set of internal metrics allowing them to measure the success of the program in minimising risk and reducing costs over time.
  ‍

Was, wann und warum sollten Sie Ihre Entwickler stärker einbeziehen.

‍

Background

Thales Group is a French multinational company that designs, develops, and manufactures electrical systems, as well as devices and equipment for the aerospace, defense, transportation, and security sectors. Viswanath S. Chirravuri, is the Software Security Technical Director at Thales. Viswanath, or Vis, started his career in security initially as a programmer. He is now a senior security leader at Thales, with more than 18 years of experience in the security industry, and holds more than 30 certifications, including CISSP, PMP, and GSE. He has educated over 3,000 software professionals in more than 18 countries. In addition, Vis won more than 10 SANS challenge coins in international cybersecurity tournaments (such as Netwars) and is an active member of the GIAC Advisory Board. We spoke with Vis to learn how he aligned people, processes, and technology to develop a successful secure code-learning program at Thales.

Situation

When Vis started at Thales, he coached business units to look at the source of vulnerabilities discovered via pen-testing as a possible solution to decrease the backlog of tech debt. The application security team used 7 different vendors they were working with to solidify their security posture - from IAST/ DAST tools to pen-testing tools. Vis wanted to understand the market trends and manage threats in a scalable manner to develop mitigation strategies through a strong integration between process and technology. This meant shifting from a purely tools-based approach to a strategy that had a strong learning component. He noticed that many of the developers didn’t have a security background or security skills. His initial approach was to provide classroom-based training for developers on topics like the OWASP Top 10, but he realized quickly that this was not going to scale with all the travel required to teach in person and the need to reach thousands of developers across the globe. Vis noted that:

“There is always going to be an imbalance in the ratio between security and development. Even if I had a 1:1 ratio of security to developers, I couldn’t keep them engaged all the time. Keeping our developers up to date on new attack vectors, best practices, new languages, and newly discovered vulnerabilities meant we needed to be able to promote self-learning by developers and have them be able to go at their own pace. If they need help, I could help them, but I realized that I couldn’t be the guy teaching them how to fix every vulnerability they find.”

Initially - there was pushback from development managers about the time investment developers would need to spend on secure code learning, recognizing that so many developers were starting from the ground up. Vis needed to manage the perception that a commitment to secure code learning might disrupt software release cycles or slow mission-critical sprints. He needed to find a way to properly motivate the organization to spend time on agile learning for secure code. Vis took a people-first attitude to address vulnerabilities at the source, “People often say that security is taking away time from development. For me, if you develop something and it’s insecure, it was a waste of time to begin with. You should always develop software to be secure and save yourself the time of having to fix the vulnerabilities that could have easily been avoided. We should all have the common goal of shipping reliable code.”

Action

Vis had two primary goals in mind: securing their software and raising security awareness in Thales’ developer teams. It was critical to implement a program that allowed developers to be independent and train at their own pace. Vis' strategy was to build a security community over time, working to link secure coding with corporate policies and developing a mandate for secure code learning in the organization. By encouraging a culture of community that connected developers, testers, architects, and engineers he saw a motivation multiplier effect. Security champions emerged that were passionate about security as a part of their day jobs helped spread awareness of secure coding practices across the organization. Vis evaluated more than a dozen security training vendors and became an SCW customer in 2019. For Thales, it was a huge benefit to have a vendor covering all the programming languages and frameworks in their environment instead of a piecemeal solution. Vis leaned on Secure Code Warrior’s huge volume of content to build training and self-paced learning for developers in the security program to access:

“The OWASP top 10 is not just simply just ten things you need to know. The depth and diversity of the vulnerabilities covered by OWASP combined with the sheer number of programming languages can be overwhelming - the wide range of challenges and coverage we have on these things was a key factor in choosing SCW. They are always adding new things. The depth, the diversity of topics, the up-to-date content, and the focus on secure code design principles really setSCW apart. With them, it’s not a one-time use training, instead, we gained the opportunity to build a continuous program.”

Vis and his team structured four levels of the secure code learning program rollout, with different milestones for each engineering role:

Importantly, SCW became the source of truth for vulnerability fixes. Instead of relying on Google searches that might lead you to troubleshoot, Vis published both guidelines from the AppSec team and ones from SCW’s content library so that developers could reference a trusted and authentic source for vulnerability fixes in the code. According to Vis:

“Developers shouldn’t be free to decide how to fix a vulnerability and potentially introduce a new vulnerability in the process. We integrated SCW videos into our LMS via SCW’s SCORM integration to make sure developers were learning how to fix the vulnerability in the right way. This also gave us a way to ensure that developers delivering secure software were being recognized. We ask them to achieve a certain level of secure coding and we can track that through the vulnerabilities they resolve and are not re-introducing. That way, the hard work they’ve done is recognized and valued in the company.”

Results

Vis and his team publish a monthly secure code newsletter where they can recognize the top learner in the company. They use SCW to look at assessment scores, tournament participation, and challenges played to amplify that achievement. This motivates other developers to learn too. The KPIs he initially set focused on reducing the overall number of vulnerabilities over 2 years. After implementing SCW, he noted a decreasing trend line. These vulnerabilities are not re-introduced at the source code level. Vis puts it this way:

"The KPIs we present to our management reflect that well-informed selection we made. We are proud that we have secure code training that delivers business confidence to our customers. We are recognized for our comprehensive secure code training program and are respected by our customers and peers. It adds a lot of value to your company when you have a program like this.”

Key takeaways

Vis recognized that people, processes, and technology all have a role to play in any security initiative. By focusing on the security of the software, developer knowledge, and meeting compliance - it’s possible to put together an agile learning for a secure code program that reduces vulnerabilities in the source code over time. Vis offers these recommendations to professionals in his field looking to build security skills in developer teams.

Background

Envestnet, Inc. is a publicly-traded fintech company with $5.3 trillion in assets and more than 18.5M investor accounts. Envestnet’s mission is to empower advisors and financial service providers with innovative technology, solutions, and intelligence to make financial wellness a reality for everyone. Envestnet has established itself as one of the market leaders in wealth management technology with its flagship advisory platform that integrates the services and software used by financial advisors in wealth management across the globe.

Envestnet’s commitment to data management best practices include continuously monitoring its wealth management platform via ongoing risk-based compliance measures that can quickly identify and remediate any compliance issues or potential failures. Envestnet is leading the way in safeguarding customers’ data by embracing world-class security measures in the delivery of its services.

Learn how Derek Fisher, Head of Product Security at Envestnet and the author of “The Application Security Handbook”, worked with Secure Code Warrior to develop a holistic approach to reduce vulnerabilities through agile secure code enablement for his developer teams. Derek has been working in application security for over a decade, where he has seen numerous security successes and failures firsthand, and brings his singular expertise in developing a secure code learning environment for developers at Envestnet.

Situation

When Derek first came into his position in Application Security, he wanted to go above and beyond the OWASP top ten and basic compliance training. They had some Secure SDLC processes, but they were largely focused on finding vulnerabilities, not necessarily addressing them at the source.

According to Derek, “We’re all pretty well familiar with the annual compliance training that we’re all subjected to in any organization. It’s usually what I call ‘death by Powerpoint’, a bunch of slides and maybe an assessment at the end...  just really ineffective and time-consuming. We had training, but it was the usual compliance based with some specific-to-security training that was slide/audio recording based. We noticed that developers weren’t very engaged and learning from the materials, so we had to shift our strategy.”

This legacy strategy of simply training developers through passive, OWASP-focused compliance training was particularly painful for Derek and his team because
they couldn’t measure the training’s impact, so instead they found themselves increasingly spending more of their time on vulnerability management.



Derek recognized that it was important to look at the source of the vulnerabilities - insecure code being shipped into production by developers - and that just throwing more tools at it wasn’t going to be the solution.

Instead, Derek and his team shifted their focus in 2020to vulnerability mitigation, with the goal of writing more secure code from the start. Derek and his team adopted a "shift left" strategy to address and remediate vulnerabilities much earlier in the SDLC, when it costs significantly less to remediate.

But first, they needed to tackle historically low engagement from developers on existing App Sectraining. He wanted to avoid just implementing a “checkbox” mentality to his secure code learning strategy and provide a more effective, agile learning experience for secure code to developers at Envestnet.

“Once I saw SCW and what it can do – I knew that amore hands-on, more interactive approach was right for us.  I wanted engineers and developers to walk away from that training with more hands-on knowledge of what the actual issues are.  We wanted to build that muscle memory of, ‘Here’s somethingI’ve seen before in training, I know how to approach this coding issue that I see.’ The Secure Code Warrior platform has allowed us to provide that type of environment in which engineers and developers can get in there and really understand what are the good secure coding practices, what bad ones look like, and how to resolve vulnerabilities quickly.”

Derek Fisher, Head of Product Security at Envestnet

Action

Derek was particularly keen to implement a belting strategy that rewarded secure code up skilling with certifications. The four-level program would focus on building a strong foundation of security awareness (levels 1 & 2) and then pave the way for developers to become security champions (levels 3 & 4). This solved the problem of not being able to measure how developers were retaining secure code concepts while ensuring that security-aware developers had a career path towards advancing their skills with more complex security challenges.

They tested it out in a small pilot and solicited feedback from developers that were involved. Feedback was highly positive. Derek noted,

"You don't always get positive feedback from those things - I can't stress that enough anytime you get positive feedback on training - that's unusual. That’s a good indicator that this is the right tool.”

Envestnet hosted its first tournament in the Spring of 2021 and noted more positive results from a developer engagement perspective. Derek then launched a series of courses integrated into their LMS for DB, Front End, API, andCloud developers. By the time Envestnet hosted its second tournament in the fall of 2021, the total number of developers participating had doubled.

According to Derek, Envestnet saw great traction with tournaments because,

"We all know that competition is a motivation. We all want to make sure our peers recognize how well we’re doing in certain things and it really motivates people to participate and do well in those tournaments. That and integration with our dev tools really showed us Secure Code Warrior's value.”

Derek and the team also worked to integrate Secure Code Warrior with Jira so that when certain vulnerabilities came up repeatedly, the developer could access immediate remediation advice right inside their Jira ticket, and without leaving that familiar environment. This gave developers valuable context as well as in-the-moment, on-demand education on how to address that vulnerability, right where it was needed, and at the point of impact. Derek’s team also worked with Secure Code Warrior to sponsor a Security Day event, which led to broader CEO support and reinforced the importance that engineering and security play in the success of Envestnet. With this type of executive and developer buy-in, Envestnet was able to expand its program to what it is today. Now, Envestnet has enrolled all their identified Security Champions in the program and 60% of the entire team has completed their Level 1 or 2 certification.

Results

One way Envestnet measured its success was to look at the teams that had gone through the SCW learning experience and measure if they were producing fewer vulnerabilities and/or fixing vulnerabilities faster. What they found was impressive:

• SCW-educated developers fixed 2.7x more vulnerabilities than their peers
• 100 SCW-educated developers fixed 450 vulnerabilities in a short span of time
• 1,200 SCW-educated developers enabled Envestnet to increase remediation by 120% in their respective queue
• In one year across two product lines, SCW-educated developers closed issues with vulnerabilities at a rate of 4.5 per developer, compared to their peers who only closed vulnerabilities at a rate of 1.82 per developer
• All Security Champions went through their certification program in 2022
• 60% and counting of Security Aware developers went through Levels 1 & 2


Key Takeaways

Derek offers this advice to those starting their secure code learning journey:

“Our job in security is to reduce risk in the organization.  That’s our True North and that’s what we are always striving for. A critical vulnerability may not be your highest risk or most impactful thing to your organization. It could be a couple of mediums, a low, and a high stitched together to create a chain that is far more impactful. The more vulnerabilities that stack up over time, the more risk you’re accruing. With Secure Code Warrior, you can stay ahead and take a proactive approach to mitigate that potential chain of vulnerabilities through agile secure code learning.”

• Don’t just focus on testing for vulnerabilities and reporting on them - this just ends up creating noise for your developers
• Instead, AppSec should be a partner to developers and make sure you have their buy-in before implementing a secure code learning strategy
• Rome was not built in a day. Your program will need to evolve as your risk profile changes, your company changes, and your technology and tools change
• The most effective long-term strategy is to raise the security IQ of the people around you to reduce the overall number of vulnerabilities that are created

TL;TR

About Colgate-Palmolive

Colgate-Palmolive Company is a marquis consumer products brand known and loved across households everywhere. Despite being more than two centuries old, they are an innovative growth company leveraging digital to reimagine a healthier future for people, their pets, and the planet.

Situation

Colgate-Palmolive, just like nearly every other organization, is going through a digital transformation to better serve its customers, and this has led to a shift in how the organization approaches application security.

Alex Schuchman, CISO at Colgate-Palmolive, puts it this way:

“It is very important to us that we are protecting our customer’s data and therefore are able to build trust—not just in our products but in the digital interactions our customers have with us."

But for Alex, the challenge was to secure the root source of potential customer data breaches—the code itself.

“Working on the build side of applications was really helpful when I made the switch over to my role as CISO. I understand the pain of getting tickets back from AppSec or the frustration of missing deadlines because of re-work. As a result, my goal as CISO hasn't just been increasing security in the software development lifecycle, but also streamlining how it is implemented.”

Action

Colgate-Palmolive approached this challenge by breaking up its security training into smaller, bite-sized chunks. This made it more palatable for developers so they could fit it into their workflow, instead of the long, monolithic compliance training they were used to. By leveraging Secure Code Warrior’s agile, in-context approach to secure code learning, developers were able to understand vulnerabilities in the context of their real-life projects – leading to higher engagement and long-term retention of secure coding skills.

“I wanted to roll out these best practices while keeping the developers engaged,” says Alex. “We still have mandated critical parts of the program but keeping the training manageable and listening to developer feedback has helped the program be successful.”

Colgate-Palmolive implemented an Okta workflow that gates the GitHub repository, allowing only developers who've passed specific SCW assessments access for pull requests, as depicted in the diagram below.

Results

According to Alex, “We understood that to optimize for success we needed to have our developers on-board from the start. So we made sure the developers knew they would be a critical part of the success of the program. As a result, we found that there was a much better relationship between our security team and our developers, and it really felt like we were working together as a team on the program. We are continuing to expand and scale the security maturity program, building on the success we have already enjoyed.”

Key takeaways

1. Clearly define program goals and emphasize developer input and engagement. Developers are more likely to buy-in to a secure code learning program that is built into their workflow and integrated with the dev tools they use every day.
2. Using an SSO tool such as Okta to gate the code repository incentivizes the team.  Only developers with a passing score on specific SCW courses and assessment are permitted to make pull requests.  
3. Over time, build a security culture that promotes a strong working relationship between AppSec and Development teams.

‍

In einem kürzlich veröffentlichten Bericht von Aberdeen waren sich 8 von 9 Unternehmen keiner Compliance- oder Schwachstellenprobleme in ihrer Codebasis bewusst. Für das eine Unternehmen, das Probleme identifizierte, entsprach das, was es wusste, nur 9,5 Prozent der tatsächlichen Probleme, die schließlich bei einem Software-Audit aufgedeckt wurden. Dies stellt sowohl eine Vermeidungs- als auch eine Behebungslücke dar, wenn es um das Management von Sicherheits- und Compliance-Risiken geht.

Diese Lücke zu schließen ist wichtig, um Entwicklungsteams und ihren Führungskräften zu helfen, die Auswirkungen von Open-Source-Software auf die Fähigkeit eines Unternehmens, risikofreie Lösungen zu entwickeln und bereitzustellen, besser zu verstehen. Ein Teil der Lösung besteht darin, einen geschlossenen Prozess einzurichten, bei dem Entwickler über die Bedeutung von Sicherheit und Compliance sowie über die Risikominderung geschult werden. Außerdem müssen die richtigen Tools für die Erkennung und Behebung von Problemen eingerichtet werden.

Wenn Sie Entwickler, technischer Leiter oder Sicherheitsspezialist sind, hören Sie in diesem Webinar, wie unsere Experten Alex Rybak, Director of Product Management bei Revenera, und Matias Madou, CTO bei Secure Code Warrior, sprechen:

- Die Bedeutung der Implementierung einer kontinuierlichen Governance während des gesamten Softwareentwicklungszyklus.
- Warum eine Software-Stückliste (SBOM) der beste Freund eines technischen Leiters ist.
- Wie die Entwicklung vertrauenswürdiger Lösungen mit der Festlegung vereinbarter funktionsübergreifender Richtlinien zur Identifizierung und Behebung von Risiken beginnt.
- Es treten Branchenvorschriften in Kraft, die einen Strukturwandel zur Unterstützung des Compliance- und Sicherheitsmanagements erfordern.
- Die Rolle, die Unternehmen heute bei der Sicherung der Entwicklerausbildung spielen, und zwar durch Programme wie Mikrotraining für eine robustere Open-Source-Management-Initiative.