Reactive Versus Preventive Security: Prevention Is a Better Cure

Security teams struggle to keep up with the tidal wave of new innovations in today’s cloud-driven DevOps world, so it stands to reason that they are equally unable to keep pace with the myriad of ways attackers exploit the weaknesses that inevitably come with so much code constantly being generated. 

Yet despite the accelerating pace of significant security breaches—from the likes of the Equifax data breach and the SolarWinds supply chain attack to more incidents in recent years, such as the successful attacks on Change Healthcare, AT&T and others—many organizations continue to focus on a reactive approach to security. They put most of their security resources into finding and fixing vulnerabilities and responding to incidents as they occur. That approach may have been suitable in another time, but the rapid evolution of software, technology capabilities and IT infrastructure is too much for understaffed and overworked security teams to keep up.

To avoid being continually disadvantaged, they need to stop chasing security threats that move too fast for them or wait until the data-breach horse is out of the barn. Instead, they should get in front of the problem by taking a preventive, rather than reactive, approach. Improving the security of both legacy apps and new applications requires a Secure-by-Design approach—bolstered by effective developer training—to ensure security best practices are employed at the start of the software development lifecycle (SDLC) and that vulnerabilities are remediated before they go into production.

To date, this has proved to be much easier said than done. 

Secure Coders Are in Short Supply

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been trying to push prevention as a key policy with its Secure-by-Design initiative, which promotes secure coding along with other best practices—ranging from multi-factor authentication (MFA) to reducing classes of vulnerabilities—and encouraging organizations to take the Secure-by-Design Pledge. Other countries, including Australia, Canada, Germany and the U.K., have launched similar programs. Nevertheless, our research shows that precious few organizations have come on board so far.

If we combine all the developers on Secure Code Warrior’s Learning Platform with those of SCW’s competitors working in the Secure-by-Design vein, there are between 500,000 and 1 million developers who are taking this approach. By the most generous estimate, that’s around 3.5% of the total number of developers worldwide, projected to reach 28.7 million by the end of 2024. That’s a lot of developers producing more code than ever before, especially with generative artificial intelligence programs greatly accelerating the pace of development, and very few learning how to start with secure code. 

Software engineers generally are not taught cybersecurity because the traditional model has called for developers and security professionals to work as separate entities, with security teams addressing security issues after software has been created. But security professionals are woefully outnumbered in today’s environment. The most recent Building Security in Maturity Model report, BSIMM14, shows that there are, on average, 3.87 AppSec professionals for every 100 developers globally. Having fewer than four trained specialists trying to secure the output of 100 developers working at breakneck speed isn’t a recipe for secure code. 

The neglect of application security is similarly evident when comparing its market size to other security sectors. The components that make up a Secure-by-Design approach fall into the applications security market, which is expected to grow from $6.08 billion in 2023 to $17.51 billion by 2031. That looks like rapid growth, but it pales when compared with the money spent on network security, projected to increase from $23.57 billion in 2023 to $67.33 billion by 2032, or operational technology security, which is poised to grow from $18.03 billion in 2023 to $57.51 billion by 2031. 

Considering the growing importance of secure code and applications, that area is underfunded. In fact, if companies invest more in application security and a Secure-by-Design approach, they may be able to save in other security areas. 

There are a number of other factors that contribute to the view that preventive security is harder to implement, and therefore harder to sell to top executives. For one thing, companies that have been around a long time, such as those in the financial services sector, are saddled with old legacy systems, some of them dating to the middle of the last century when COBOL was the programming language of choice. 

The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures. 

Building a Culture of Prevention

The transition towards a preventive approach to security may be off to a slow start, but the push for adopting Secure-by-Design practices isn’t going away because the pressing need for it in today’s cyber threat environment isn’t going away either. The automobile industry would be raked across the coals if it decided to invest in more ambulances and EMTs rather than making cars safer, yet many organizations follow that model when it comes to cybersecurity.

Organizations need to adopt a preventive, proactive approach to reducing risk. They should build programs to upskill developers on writing secure code and correcting errors (such as those introduced by AI assistants or third-party code) early in the SDLC. These programs should include agile, interactive training programs that fit developers’ schedules and can be tailored to their work environments and the programming languages they use. Upskilling should involve hands-on training that addresses real-world problems.

Importantly, it needs to include a means to measure their progress to ensure they’ve made security best practices a vital part of their everyday routines. A tool such as SCW’s Trust Score uses benchmarks to gauge progress both internally and against industry standards while also identifying areas that need to be improved. 

A Secure-by-Design approach would be holistic, reflecting a security-first mindset within the organization, where security is a business priority. Response and recovery are essential parts of an organization’s overall security posture, certainly. But by focusing on prevention, enterprises can make great strides in reducing risk and perhaps avoiding the kind of major breaches that can threaten a business’s viability.

Learn more about how Secure Code Warrior can assist you in realizing a viable Secure-by-Design initiative today.